Sourced comparison
Mullvad vs IVPN: audits, owners and leak fixes
Mullvad and IVPN side by side: who runs each, what independent auditors checked, and how each app handled the TunnelVision and TunnelCrack leaks. Every cell links its source. Last checked 26 Oct 2026.
Where Mullvad and IVPN differ
- Who runs them. Mullvad is run by Mullvad VPN AB in Sweden, part of Amagicom AB; IVPN by IVPN Limited in Gibraltar.
- Audits. Mullvad lists 15 since 2020, the latest by Leviathan Security on 1 Jun 2026; IVPN lists 2 since 2023, the latest by Cure53 on 11 Apr 2024.
- TunnelVision. On Windows, macOS and Linux, Mullvad says not affected and IVPN says mitigated.
- TunnelCrack LocalNet. On Windows, macOS, Linux and Android, Mullvad says not affected and IVPN says fixed.
- TunnelCrack ServerIP. On Android, Mullvad says not affected and IVPN says fixed.
The same on both: RAM-only servers: both state it on their own pages; open-source apps: both state it on their own pages; transparency: both publish a report or canary.
At a glance
| Mullvad | IVPN | |
|---|---|---|
| Company and country | Mullvad VPN AB, Sweden SourceRead 18 Oct 2026 | IVPN Limited, Gibraltar SourceRead 18 Oct 2026 |
| Part of | Amagicom AB SourceRead 18 Oct 2026 | No parent named on its pages SourceRead 18 Oct 2026 |
| Independent audits | 15 since 2020, 14 with a public report | 2 since 2023, 2 with a public report |
| Most recent audit | 1 Jun 2026, Leviathan Security: Apps SourceRead 18 Oct 2026 | 11 Apr 2024, Cure53: Backend and payments SourceRead 18 Oct 2026 |
| RAM-only servers | All VPN servers run from RAM without disks since September 2023. SourceRead 19 Oct 2026 | IVPN says its servers use LUKS full-disk encryption and only a small number of pilot gateways run RAM-only, with the rollout still in progress. SourceRead 26 Oct 2026 |
| Open-source apps | Desktop and mobile client source is public on GitHub (GPL-3.0). SourceRead 19 Oct 2026 | IVPN's desktop, iOS and Android apps are public on GitHub. SourceRead 19 Oct 2026 |
| Transparency report or canary | No regular report or canary. Mullvad disclosed a police search in April 2023; officers left without customer data. SourceRead 18 Oct 2026 | A PGP-signed canary: no warrants, searches, seizures or backdoor requests to date. SourceRead 18 Oct 2026 |
| Incidents on record | 18 Apr 2023, No-logs tested by police or court: Swedish police came to Mullvad's office with a search warrant for customer data and left without seizing anything. SourceRead 19 Oct 2026 | Aug 2026, Server compromised: Attackers exploited a BTCPay Server flaw on IVPN's self-hosted Bitcoin payment server and moved out IVPN's operating funds. SourceRead 19 Oct 2026 |
| Newest app versions | Windows, macOS, Linux 2026.5 (11 Sep 2026) SourceRead 18 Oct 2026 Android 2026.12 (30 Sep 2026) SourceRead 18 Oct 2026 iOS 2026.5 (8 Sep 2026) SourceRead 18 Oct 2026 | Windows, Linux 3.15.15 (3 Sep 2026) SourceRead 18 Oct 2026 macOS 3.16.1 (8 Oct 2026) SourceRead 18 Oct 2026 Android 2.13.1 (24 Jun 2026) SourceRead 18 Oct 2026 iOS 2.14.2 (11 Jun 2026) SourceRead 18 Oct 2026 |
Known VPN leak attacks
Each provider’s own statement for each app. “Not stated” means the provider published nothing on it.
| Attack | Mullvad | IVPN |
|---|---|---|
| TunnelVisionA rogue DHCP server pushes routes (option 121) that pull traffic out of the tunnel while the VPN still shows connected. | Not affected Windows, macOS, Linux, Android SourceRead 18 Oct 2026 Affected iOS SourceRead 18 Oct 2026 | Not affected Android SourceRead 18 Oct 2026 Mitigated Windows, macOS, Linux, Router SourceRead 18 Oct 2026 Affected iOS SourceRead 18 Oct 2026 |
| TunnelCrack LocalNetA rogue Wi-Fi network assigns itself public addresses the VPN treats as local, so traffic to them skips the tunnel. | Not affected Windows, macOS, Linux, Android SourceRead 18 Oct 2026 Mitigated iOS SourceRead 18 Oct 2026 | Fixed Windows, macOS, Linux, Android SourceRead 18 Oct 2026 Mitigated iOS SourceRead 18 Oct 2026 |
| TunnelCrack ServerIPA spoofed DNS answer for the VPN server makes the client route chosen traffic outside the tunnel. | Not affected Windows, macOS, Linux, Android, iOS SourceRead 18 Oct 2026 | Not affected Windows, macOS, Linux, iOS SourceRead 18 Oct 2026 Fixed Android SourceRead 18 Oct 2026 |
Audits on record
Mullvad
| Date | Auditor | Type | What was checked | Findings | Source |
|---|---|---|---|---|---|
| 1 Jun 2026 | Leviathan Security | Apps | Android app 2026.2 against the App Defense Alliance MASA profile; black-box, no code review. | Not published | Report SourceRead 18 Oct 2026 |
| 6 Mar 2026 | Assured | Protocol | GotaTun 0.2.0, Mullvad's WireGuard implementation; DAITA, the CLI and external dependencies excluded. | 2 low | Report SourceRead 18 Oct 2026 |
| 21 Jan 2026 | X41 D-Sec | Backend and payments | White-box review of the account and payment API and backend; some findings redacted. | 3 medium, 2 low | Report SourceRead 18 Oct 2026 |
| 23 Oct 2025 | Assured | Backend and payments | Penetration test of the customer web app. | 1 low | Report SourceRead 18 Oct 2026 |
| 19 May 2025 | Assured | Apps | The installer and downloader (VPN loader): protocol and source code. | Not published | Report SourceRead 18 Oct 2026 |
| 27 Mar 2025 | NCC Group | Apps | Android app 2024.9 against the MASA profile; black-box, no code reviewed. | Not published | Report SourceRead 18 Oct 2026 |
| 11 Dec 2024 | X41 D-Sec | Apps | Penetration test and source review of the VPN app on all platforms, October to November 2024. | 3 high, 2 medium, 1 low | Report SourceRead 18 Oct 2026 |
| 27 Jun 2024 | Cure53 | Servers and infrastructure | One OpenVPN and one WireGuard staging server plus the Ansible code, with a privacy focus. | 1 medium, 1 low | Report SourceRead 18 Oct 2026 |
| 9 Aug 2023 | Radically Open Security | Servers and infrastructure | Two RAM-only VPN servers, including a check for logging; binaries and hardware excluded. | Not published | SourceRead 18 Oct 2026Report not public |
| 17 Feb 2023 | Assured | Backend and payments | Account and payment API, tested in November 2022. | None reported | Report SourceRead 18 Oct 2026 |
| 21 Oct 2022 | Atredis Partners | Apps | Penetration test and source audit of the apps on five platforms. | Not published | Report SourceRead 18 Oct 2026 |
| 14 Sep 2022 | Assured | Servers and infrastructure | Self-hosted authoritative DNS servers, before they went into production. | None reported | Report SourceRead 18 Oct 2026 |
| 22 Jun 2022 | Assured | No-logs | Two WireGuard and one OpenVPN server, freshly installed: configuration and any customer logging. | Not published | Report SourceRead 18 Oct 2026 |
| 20 Jan 2021 | Cure53 | Servers and infrastructure | First infrastructure audit, December 2020; six issues from informational to high, no breakdown given. | Not published | Report SourceRead 18 Oct 2026 |
| 25 Jun 2020 | Cure53 | Apps | Desktop 2020.4, Android and iOS apps; the worst finding was rated medium. | Not published | Report SourceRead 18 Oct 2026 |
IVPN
| Date | Auditor | Type | What was checked | Findings | Source |
|---|---|---|---|---|---|
| 11 Apr 2024 | Cure53 | Backend and payments | Customer website, API, web servers and web infrastructure, in a test environment without production access. | 2 low, 2 info | Report SourceRead 18 Oct 2026 |
| 15 Mar 2023 | Cure53 | Servers and infrastructure | Operating system and setup of the upgraded VPN gateway servers, in a test environment without production access. | 1 medium, 6 low, 1 info | Report SourceRead 18 Oct 2026 |
Check it on your own connection
Records say what Mullvad and IVPN state. A test shows what your own connection does today: run the Mullvad leak test with that app connected, or the IVPN leak test with the other; each checks your IP, DNS, WebRTC and IPv6.
How this page is kept
- Mullvad’s column is read from mullvad.net and github.com; IVPN’s from ivpn.net, raw.githubusercontent.com and github.com. Auditors’ published reports count as well. Each cell links its source and the date it was read.
- “No statement on record” under Mullvad or IVPN means our sources hold none for that provider. It is not a finding that Mullvad or IVPN lacks the feature; check its own pages.
- This page does not rank Mullvad against IVPN. Which row matters depends on what you need the VPN for.
- A script re-reads every Mullvad and IVPN source weekly; when one changes, a person checks it before the Mullvad or IVPN row changes. These records also feed every published VPN audit, who owns which VPN and leak issues by provider.
The data on this page as JSON: facts.json (CC BY 4.0) · All open data · Changes and Atom feed