Proton VPN vs Mullvad in 2026: Two VPNs That Publish Their Audits, One Honest Pick for Each Job

Logging and audits: what each one keeps, and who checked

Start with the claim every VPN makes and almost none can prove.

Mullvad's no-logging policy — last updated 17 June 2026 on its own site — is unusually blunt: “We log nothing whatsoever that can be connected to a numbered account's activity.” It then spells out what that covers: no logging of traffic, of DNS requests, of connections (“including when one is made, when it disconnects, for how long, or any kind of timestamp”), of IP addresses, or of user bandwidth. The account itself is minimal by design: “A Mullvad account has two properties: the account number and the time remaining on that account.” There is no username, no password and no email address, because Mullvad never asks for one.

That design got a real-world test on 18 April 2023 when, in Mullvad's own account published two days later, “at least six police officers from the National Operations Department (NOA) of the Swedish Police visited the Mullvad VPN office in Gothenburg with a search warrant.” The outcome, in Mullvad's words: “They left without taking anything and without any customer information.” Not because Mullvad talked them out of it, but because “such customer data did not exist.”

Proton's proof runs through auditors rather than police. Its no-logs policy has now had five consecutive annual audits by Securitum, a European security auditing company, covering 2022 to 2026, and Proton publishes the full report rather than a summary. The 2026 report concludes that the technical evidence “did not indicate that the examined Proton VPN server infrastructure logs users' browsing activity, DNS queries, destination services, network traffic contents or user-identifiable connection metadata” (Proton's audit page, updated 16 June 2026). Proton was also, by its own account, “the first VPN provider to open source our apps on all platforms (Windows, macOS, Android, and iOS)”, which means the client code is inspectable as well as the server claims.

Mullvad's audit trail is broader than one policy. Cure53's fourth infrastructure audit, published 27 June 2024, found one low-severity and one medium-severity issue, both since fixed, and called the overall security posture “very positive”. X41 D-Sec audited the account, payment, device-provisioning and WireGuard key-distribution systems in a report Mullvad published on 21 January 2026, finding five issues — two low, three medium — of which, in the report's words, “none of the reported issues give an attacker the ability to access user data.” Assured audited the web app in October 2025 and found nothing above low severity.

The honest read: on logging, Proton VPN vs Mullvad is a draw between two providers that are genuinely ahead of the field. If you want the full mechanics of how to judge any provider's claim, see what a no-logs policy actually means.

Jurisdiction and ownership: Switzerland vs Sweden

Where a VPN company is incorporated decides which government can compel it, so both companies are open about it — and here they genuinely differ.

Proton VPN is run by Proton AG, which Proton's about page describes as “a Swiss corporation whose primary shareholder is the non-profit Proton Foundation based in Geneva, Switzerland.” Switzerland is outside the EU and outside the Five, Nine and Fourteen Eyes intelligence-sharing arrangements, which is the structural point Proton builds its pitch on. The foundation ownership is worth a second look too: it arguably makes a quiet sale to a private-equity buyer — the fate of several other VPN brands — harder to pull off.

Mullvad is a Swedish company with its office in Gothenburg, which puts it inside the EU. Mullvad's answer to that is not a friendlier flag but an architecture that holds nothing worth compelling: no identity, no logs, and an account that is a number plus a balance. The 2023 warrant is the evidence that this works in practice, and it is a stronger argument than most jurisdictions can make for themselves.

So which matters more, a favourable legal home or a data-free design? The answer that survives contact with reality is that jurisdiction only protects you when it is paired with an audited no-logs policy — a provider with nothing to hand over is safe wherever it is registered, and a provider that keeps logs is unsafe in Switzerland too. Both companies pass that combined test, which is why this section, like the last, does not produce a winner. Treat Switzerland as a small structural bonus for Proton, treat the raid as a small practical bonus for Mullvad, and move on to the parts of the comparison that will actually decide your purchase.

Price, devices, payment and refunds

This is where the two companies stop resembling each other.

Mullvad charges one price — “€5 per month” on its pricing page — whether you buy one month, one year or, as the page cheerfully offers, one decade. There is no discount for committing longer, there is no introductory rate that triples at renewal, and because you buy time rather than a subscription, nothing silently renews unless you choose a recurring payment yourself. The page lists cash (in EUR, USD, GBP, SEK, NOK, CHF, CAD, AUD and NZD), Bitcoin, Bitcoin Cash and Monero, bank wire, cards, PayPal and a set of European bank-transfer methods; cryptocurrency payments are “discounted at 10% due to lower fees and less administration.” An account covers “up to 5 devices”, and there is a “14-day money back guarantee (except for cash payments due to anti-money laundering regulations)” — which is the one honest catch: post cash and you have decided.

Proton prices the ordinary way: a monthly rate that drops on a one- or two-year term, plus regional currency differences, so we print no figure — open Proton's own pricing page and read the renewal price, not the headline. VPN Plus covers “10 devices at a time”; Proton Unlimited adds Proton Mail, Calendar, Drive, Pass and Docs on top of the same VPN. Both paid plans carry a 30-day money-back guarantee. And Proton has something Mullvad does not: a free tier — one device, servers in ten countries you do not get to choose, described by Proton as “unlimited and free forever” with “no data or speed limits”, although the pricing page rates its speed as “medium” against the paid plan's “highest”. Whether that free tier is enough for you is a whole question of its own, answered in Proton VPN free vs paid.

What to check before you pay either of them:

• The per-month cost at the term you would actually buy. Mullvad is flat; Proton's headline is a multi-year rate, so compare like with like.
• How many devices you really run. Five covers a phone, a laptop, a tablet and a spare; a household on one account wants Proton's ten.
• Whether you need to be invisible to the payment system too. Only Mullvad takes cash by post, and only Mullvad issues an account with no email attached.
• The refund window and its exceptions. Fourteen days versus thirty, and none at all on cash. Our guide to what a money-back guarantee actually covers has the questions to ask.

On price alone Mullvad wins on transparency and Proton wins on flexibility; over a two-year term the actual difference depends entirely on the deal Proton quotes you that day.

Features: multihop, Secure Core, NetShield, Tor, DAITA, protocols and the streaming question

Both providers offer double-hop routing, but they mean different things by it.

Proton's version is Secure Core, which its support page describes as a feature that improves privacy “by mitigating some of the risks from a compromised VPN server.” Traffic enters through a Proton-controlled server in Iceland, Switzerland or Sweden before exiting elsewhere, and Proton stresses the physical side: the servers are “wholly owned and provisioned by us”, the Swedish ones sit “in an underground data center”, the Icelandic ones “on a former military base”, and they connect over IP addresses Proton owns through its own Local Internet Registry. Secure Core is “available on all paid Proton VPN plans”.

Mullvad's multihop is more of a tool than a product: enable it in the app under Advanced, VPN settings, WireGuard settings, then pick an entry and an exit location yourself. Mullvad's own help page warns that “generally, Multihop will make your connection slower over distance”, which is true of Secure Core as well and which neither company should be blamed for — two hops are two hops.

Then come the extras that only one side has. Proton's NetShield blocks ads, trackers and malware at the DNS level — “the DNS server will check these domains against databases of domains known to host malware, ads, or trackers” — with three levels of strictness, and it is “included in VPN Plus and all other paid Proton VPN plans”. Proton's Tor over VPN servers, marked with an onion icon and a -TOR suffix, let you reach .onion sites in an ordinary browser; Proton itself warns this is “very slow compared to using a regular VPN server”. If you are weighing Tor against a VPN at all, VPN vs proxy vs Tor is the place to start.

Mullvad's answer is DAITA — “Defense Against AI-guided Traffic Analysis” — which uses “constant packet sizes, random background traffic and data pattern distortion” to blunt attempts to work out what you are doing from the shape of your encrypted traffic. It is a genuinely different threat model from ad-blocking, aimed at a capable adversary rather than an adtech one, and Mullvad is candid about its limits: “For now, DAITA is only available on select servers in Amsterdam, London, Los Angeles and New York.” Mullvad also ships the Mullvad Browser, built “together with the Tor Project” to give all of its users similar fingerprints, and it is “open-source and free of charge, whether or not you are a Mullvad VPN user”.

Protocols are a clear split. Mullvad announced on 8 November 2024 that it would remove OpenVPN “from both client- and server-side” on 15 January 2026 to “focus entirely on the WireGuard protocol”, and that date has passed: Mullvad is WireGuard only. If your router or an older device speaks only OpenVPN, that is decisive. Proton's protocol page still lists WireGuard, OpenVPN, IKEv2, its own Stealth protocol for networks that block VPNs, and a Smart Protocol default, with availability varying by platform; Stealth is on Proton's free plan too. The background on what each protocol trades off is in VPN protocols explained.

Two more practical facts. Mullvad removed port forwarding in 2023 — announced 29 May, fully withdrawn on 1 July — citing abuse of the feature, which matters to a minority of torrent users; the best VPN for torrenting explains who actually needs it. And on streaming, neither provider is the tool for the job: Proton lists streaming as a paid-only feature and our own Proton VPN review rates it as less consistent than the big streaming names, while our Mullvad review calls streaming its honest limitation. If unblocking a catalogue is the main reason you want a VPN, read the best VPN for streaming instead of either of these.

The verdict: which one to buy

Proton VPN vs Mullvad comes down to a single question: are you buying a VPN, or are you buying anonymity from the VPN itself?

Choose Mullvad if the second answer is yours. No email, an account number instead of an identity, cash by post, one flat price with no games at renewal, a 2023 police search that found nothing, and a feature set — DAITA, the Tor-derived browser, multihop — built for people whose threat model includes traffic analysis rather than pop-up ads. Accept five devices, no OpenVPN, no port forwarding, a 14-day refund that does not apply to cash, and streaming that may or may not work on a given evening.

Choose Proton VPN if you want a privacy-first VPN that also behaves like a modern consumer service: ten devices, Secure Core through hardware Proton physically owns, NetShield, Tor over VPN, Stealth for hostile networks, a 30-day refund, the option to bundle mail, storage and a password manager, and a free tier that is the most credible one available. Accept a subscription that renews at a price you must check yourself, and an account that, foundation-backed or not, knows your email address.

The counter-argument to all of this is that for most people the difference will never show. Both keep nothing, both were checked by outsiders, and either will do everything a VPN can honestly do for a commuter on café Wi-Fi. If that is you, the cheaper one on the day is the right one, and only one of them lets you work that out without a calculator. Still undecided between these two and the rest of the field? Best VPN 2026 puts both alongside the alternatives, and our VPN matcher narrows it to one in three questions. If Proton's mix is the one that fits, check Proton VPN's current plans and refund terms on its own site before you buy, and read the renewal price twice.

Frequently Asked Questions