Compare Mullvad and Proton VPN on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: ExpressVPN, Private Internet Access
Sweden· VPN Services
Needs review
Shortlist when you need a Swedish founder-owned privacy VPN with numbered accounts, GPL clients, RAM-only relays, and a dense public audit trail. Skip when you need dedicated IPs, remote port forwarding, or productized enterprise SSO/ISO packaging—consider Proton VPN for suite/free-tier onboarding or AirVPN for inbound ports.
Switzerland· VPN Services
Needs review
Shortlist Proton VPN when you want a Swiss Proton AG VPN with open-source clients, publicly linked Securitum no-logs infrastructure audits, Secure Core/Stealth, a real free tier, and optional Business SSO/SCIM inside the Proton suite. Skip when you need anonymous numbered accounts without email (prefer Mullvad) or first-class remote port forwarding/DDNS (prefer AirVPN).
Highlighted rows differ between the two products.
| Feature | Mullvad | Proton VPN |
|---|---|---|
| Country of origin | Sweden | Switzerland |
| Category | VPN Services | VPN Services |
| Open source | Yes | Yes |
| Self-hosted | No | No |
| Headquarters | Sweden | Switzerland |
| Legal entity | Mullvad VPN AB (reg. no. 559238-4001); parent Amagicom AB | Proton AG (Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva); EU rep Proton Europe sàrl (Luxembourg) |
| Governing law | Swedish / EU law (GDPR); see Swedish legislation help page | Switzerland (vendor privacy/legal framework) |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Medium |
| Hosting / residency | Multi-region VPN exits (EU and outside EU, including USA) on owned and rented colo (public provider list: e.g. M247, DataPacket, xtom, Zenlayer, Blix). RAM-only VPN OS. Account/payment personal data claimed stored only in EU/EEA. Payment subprocessors include Stripe and PayPal (US-group) plus SEB for bank/Swish when those methods are used; support email self-hosted by Mullvad since 2024. | VPN/account infrastructure: Proton-owned/controlled servers; account data stated in CH/DE/NO; Secure Core owned in CH/IS/SE; global VPN exits with full-disk encryption. Support/payments processors include US-group Zendesk, Stripe, Chargebee, PayPal (and HubSpot for sales forms) per privacy policy—not the VPN tunnel path. |
| Summary | Swedish privacy VPN with numbered accounts (no email), GPL-3 clients, RAM-only relays, and repeated third-party security audits—built for anonymity over enterprise packaging. | Swiss Proton AG VPN with open-source clients, Securitum-audited no-logs infrastructure, Secure Core/Stealth, free unlimited-data tier, and Business SSO/SCIM packaging. |
| Tags |
| At a glance | Mullvad | Proton VPN |
|---|---|---|
| HQ / entity | Gothenburg, Sweden — Mullvad VPN AB (parent Amagicom AB) | Proton AG, Plan-les-Ouates (Geneva), Switzerland |
| Ownership | 100% founders Fredrik Stromberg and Daniel Berntsson | Not listed |
| Protocols | WireGuard (primary), OpenVPN; bridges/obfuscation | WireGuard, OpenVPN, IKEv2, Stealth |
| Clients | GPL-3 apps (Win/macOS/Linux/Android/iOS); WireGuard configs + CLI | Not listed |
| Sessions | Five simultaneous connections; shared exits only | Not listed |
| Commercial model | Prepaid access; no free tier; cash/crypto/card/PayPal (see site) | Not listed |
| Infrastructure | RAM-only VPN relays; multi-region colo (owned + rented) | Not listed |
| Independent audits | Multiple public app/infra audits (Cure53, ROS, Assured, X41, …) | Not listed |
| B2B packaging | Self-serve consumer ToS; no productized enterprise pack found | Not listed |
| Governance | Not listed | Primary shareholder: non-profit Proton Foundation (vendor claim) |
| Network (vendor) | Not listed | 20,000+ servers, 140+ countries (re-check live) |
| Free tier | Not listed | 1 device, unlimited data, limited countries, no ads |
| Paid consumer devices | Not listed | Up to 10 simultaneous (typical Plus packaging) |
| Open source | Not listed | Official clients yes; not a self-host server product |
| Business | Not listed | SSO, SCIM, dedicated IPs/gateways, DPA published |
| Key capabilities | Mullvad | Proton VPN |
|---|---|---|
| EU-operated (Sweden) | Yes | Not listed |
| Numbered accounts | Yes | Not listed |
| GPL-3 clients | Yes | Not listed |
| WireGuard + multihop | Yes | Not listed |
| Public security audits | Yes | Not listed |
| RAM-only relays | Yes | Not listed |
| Swiss-operated (Proton AG) | Not listed | Yes |
| Open-source clients | Not listed | Yes |
| Securitum no-logs audits | Not listed | Yes |
| Secure Core double-hop | Not listed | Yes |
| Free unlimited-data tier | Not listed | Yes |
| Business SSO / SCIM | Not listed | Yes |
Numbered accounts (no email required)
Signup generates a random account number with prepaid time remaining—no username, password, or email by default. Multiple people can share a number; recovery without the number is intentionally hard. Best when identity linkage is a risk; use cash or self-hosted crypto payments if you also want to avoid card/PayPal trails.
WireGuard-first apps with multihop and obfuscation
Official clients for Windows, macOS, Linux, Android, and iOS use WireGuard with multihop, quantum-resistant tunnel options, DAITA traffic-analysis resistance, and bridge/obfuscation modes (Shadowsocks, UDP-over-TCP, QUIC, LWO on selected servers) for censored networks. Kill switch and tunnel DNS are on by default. Up to five simultaneous connections per account.
GPL-3 open-source clients
Desktop and mobile client code is published under GPL-3 (github.com/mullvad/mullvadvpn-app) with public audit reports in-repo. WireGuard config export and a CLI support non-GUI deployments. iOS App Store distribution uses Apple's EULA rather than GPL for the shipped binary.
RAM-only relays and public audit trail
VPN infrastructure completed migration to diskless/RAM-only operation so reboots discard volatile state. Multiple independent infrastructure and app assessments (Cure53, Radically Open Security, Assured, X41, and others) publish findings; Cure53's work explicitly looked for privacy-impacting flaws on sample relays.
DAITA and quantum-resistant tunnels
DAITA (Defense Against AI-guided Traffic Analysis) adds padding/cover traffic patterns against modern traffic-analysis models. Quantum-resistant WireGuard tunnel modes are available across platforms and were rolled out as defaults on supported clients—useful for long-lived confidentiality threat models, at some performance cost.
Audited no-logs on Proton-owned VPN infrastructure
Strict no-logs policy for VPN session activity (no traffic content, destination, or session metadata that identifies a user to a server, per published Securitum infrastructure reviews). Account data lives on Proton-controlled servers in Switzerland, Germany, or Norway; Secure Core machines are Proton-owned in CH/IS/SE. Suits privacy officers who need public audit PDFs, not NDA-only claims.
Secure Core double-hop via CH, IS, or SE
Paid Secure Core routes traffic through hardened Proton-owned entry servers in Switzerland, Iceland, or Sweden before the exit country—extra hop against network-level attacks if an exit were compromised. Adds latency; best for high-threat models, not every streaming session.
Stealth protocol and free-tier censorship tools
Stealth obfuscates the tunnel (TLS-over-TCP style) to reduce DPI/VPN-block detection and is available on Free as well as paid apps. Free plan: one device, unlimited data, no ads, limited country set, kill switch; paid unlocks multi-device, streaming profiles, Secure Core, and full NetShield packaging.
Open-source clients across major platforms
Official apps for Windows, macOS, Linux, Android, iOS, and browser extensions are open source on GitHub (ProtonVPN org) with third-party app security reviews published over time. Server-side VPN stack is not a public full OSS product—inspect clients and audit reports, not the entire backend.
NetShield DNS filtering and multi-protocol stack
NetShield is Proton's DNS-based blocker for ads, trackers, and malware domains (feature depth varies by plan). Protocols include WireGuard, OpenVPN, IKEv2, and Stealth; kill switch and leak protections are first-class client features for untrusted Wi-Fi.
Business org controls: SSO, SCIM, dedicated IPs
Proton VPN for Business adds organization admin, private gateways, dedicated servers/IPs, enforced 2FA, SSO, and SCIM provisioning (docs cover Okta/Google examples). Fits SMB remote access and policy control—not a numbered-account anonymity product.
| Assurance & compliance | Mullvad | Proton VPN |
|---|---|---|
| Independent security / no-logs audit | Verified Public Cure53 infrastructure reports (e.g. 2021, 2024) and other third-party app/infra audits; Cure53 stated no PII on assessed systems and no anonymity compromise found in 2024 sample. April 2023 Swedish police search reported no customer data seized. | Verified Multi-year Securitum infrastructure no-logs audits published with downloadable reports (see no-logs audit blog). Client app security reviews also published over time. |
| ISO 27001 | Not found | Vendor claimed Proton announces ISO 27001 (May 2024) and links a certificate from the Trust Center; re-validate scope/certificate for your ISMS. |
| SOC 2 / SOC 3 | Not found | Vendor claimed Trust Center and company blog assert SOC 2 Type II; obtain the report under your vendor process if required. |
| GDPR / EU data protection | Vendor claimed Swedish EU entity; privacy policy addresses GDPR rights and states personal data stored/processed only in EU/EEA. | Vendor claimed Swiss operator claims GDPR alignment; EU representative in Luxembourg; Swiss FADP also applies. |
| US CLOUD Act exposure (indicative) | Partial EU entity, founder-owned, no known US parent. Partial residual exposure: Stripe and PayPal as payment processors (US-group) when those methods are chosen; multi-region exits include US colo. Not legal advice. | Partial No known US parent (Proton AG / Foundation). VPN designed no-logs on Proton paths. US-group processors for support/payments (Zendesk, Stripe, Chargebee, PayPal; HubSpot sales) raise indicative exposure for account identity data. Not legal advice. |
| Data processing agreement (B2B) | Not found Consumer privacy policy and ToS published; no productized enterprise DPA flow found on primary pages. | Vendor claimed Public DPA published at proton.me/legal/dpa; confirm countersignature/process for your business SKU. |
| EU AI Act | Not applicable VPN connectivity product; not an AI system under typical procurement framing (DAITA is a traffic-defense feature, not a general-purpose AI product). | Not applicable VPN connectivity product; separate Lumo AI offering is out of scope for this VPN entry. |
| Considerations & known limitations | Mullvad | Proton VPN |
|---|---|---|
| Consumer packaging, not enterprise control plane | Medium Self-serve numbered accounts without productized SSO/MDM org admin, ISO/SOC claims, or click-through DPA. Procurement that requires those artifacts needs offline negotiation or another vendor. | Not listed |
| US payment processors when card/PayPal used | Medium Stripe and PayPal process identity-bearing payment data outside the pure numbered-account model. Cash or self-hosted crypto reduces that trail; card/PayPal does not. | Not listed |
| Multi-region exit nodes including non-EU | Medium Traffic can leave the tunnel outside the EU depending on server choice. Strict residency policies need operational EU-only exit controls, not HQ branding alone. | Not listed |
| No new port forwarding; no dedicated IP | Low Remote port forwarding was disabled for new ports in 2023; dedicated IPs are not offered by design. Choose AirVPN or self-hosted WireGuard if inbound reachability is required. | Not listed |
| Weak recovery without the account number | Low No email-based reset by default. Losing the number can mean losing access; treat it as a secret in team runbooks. | Not listed |
| US CLOUD Act residual path (indicative) | Low No known US parent. Residual exposure mainly via US payment SaaS and optional US exits—not ownership. Not a guarantee against other LE cooperation. | Not listed |
| US SaaS for support and payments | Not listed | Medium Privacy policy lists Zendesk, Stripe, Chargebee, PayPal (and HubSpot for sales) as processors. This is not VPN traffic logging, but billing/support identity can leave the Swiss-only path—map to your transfer assessment. |
| Global exit nodes outside EU/CH | Not listed | Medium Large multi-country network means traffic can exit outside the EU depending on server choice. Strict residency policies need operational controls (allowed countries, Secure Core preferences), not HQ alone. |
| Free tier capacity and country limits | Not listed | Low Free is one device and a limited country pool; shared free capacity can mean slower peaks. Not a full substitute for paid multi-device org rollout. |
| Account identity vs numbered anonymity | Not listed | Low Standard Proton account (email or external address options) is not the same threat model as cash/number-only VPN accounts. Cash/Bitcoin payment options exist for paid plans but account recovery fields may still apply. |
| ISO/SOC scope verification | Not listed | Low ISO 27001 and SOC 2 Type II are vendor-asserted on Trust Center; procurement should confirm certificate/attestation scope covers the VPN services in use. |
When: You need inbound remote port forwarding or Dynamic DNS
Consider: AirVPN
Mullvad disabled new port forwards in 2023; AirVPN remains port-forward oriented.
When: You want a free tier plus mail/drive in one European privacy suite
Consider: Proton VPN
Proton is account-based with a broader product suite; Mullvad optimizes for minimal identity.
When: You need maximum consumer server footprint and streaming-oriented features
Consider: NordVPN or Surfshark
Trade a denser feature catalog for weaker accountless/audit differentiation vs Mullvad.
When: You need enterprise zero-trust mesh or org-wide device VPN with SSO
Consider: Self-hosted WireGuard, Tailscale, or NetBird
Different product class than consumer privacy VPN.
When: You need maximum account anonymity (no email identity)
Consider: Mullvad
Numbered accounts and cash/crypto-friendly privacy posture; less suite/Business packaging.
When: You need remote port forwarding and Dynamic DNS as core features
Consider: AirVPN
Technical inbound reachability; different product emphasis than Proton Free/Plus.
When: You want a large consumer network with different brand/jurisdiction tradeoffs
Consider: NordVPN or catalog peers such as CyberGhost
Re-check ownership, audit publication model, and streaming for your regions.
When: You need enterprise zero-trust mesh rather than a privacy VPN
Consider: Tailscale, NetBird, or self-hosted WireGuard
Different product class from consumer/privacy VPN.