Sourced comparison
Mullvad vs Proton VPN: audits, owners and leak fixes
Mullvad and Proton VPN side by side: who runs each, what independent auditors checked, and how each app handled the TunnelVision and TunnelCrack leaks. Every cell links its source. Last checked 26 Oct 2026.
Where Mullvad and Proton VPN differ
- Who runs them. Mullvad is run by Mullvad VPN AB in Sweden, part of Amagicom AB; Proton VPN by Proton AG in Switzerland, part of Proton Foundation.
- Audits. Mullvad lists 15 since 2020, the latest by Leviathan Security on 1 Jun 2026; Proton VPN lists 6 since 2020, the latest by Ruben Santamarta on 1 Dec 2025.
- Incidents. Mullvad has 1 on record, Proton VPN has 0.
- TunnelVision. On macOS, Mullvad says not affected and Proton VPN says mitigated; on Linux, Mullvad says not affected and Proton VPN says affected; on iOS, Mullvad says affected and Proton VPN says mitigated.
- TunnelCrack LocalNet. On Windows, macOS, Linux and Android, Mullvad says not affected and Proton VPN says nothing on it; on iOS, Mullvad says mitigated and Proton VPN says nothing on it.
- TunnelCrack ServerIP. On Windows, macOS, Linux, Android and iOS, Mullvad says not affected and Proton VPN says nothing on it.
The same on both: RAM-only servers: both state it on their own pages; open-source apps: both state it on their own pages; transparency: both publish a report or canary.
At a glance
| Mullvad | Proton VPN | |
|---|---|---|
| Company and country | Mullvad VPN AB, Sweden SourceRead 18 Oct 2026 | Proton AG, Switzerland SourceRead 18 Oct 2026 |
| Part of | Amagicom AB SourceRead 18 Oct 2026 | Proton Foundation SourceRead 18 Oct 2026 |
| Independent audits | 15 since 2020, 14 with a public report | 6 since 2020, 6 with a public report |
| Most recent audit | 1 Jun 2026, Leviathan Security: Apps SourceRead 18 Oct 2026 | 1 Dec 2025, Ruben Santamarta: Apps SourceRead 18 Oct 2026 |
| RAM-only servers | All VPN servers run from RAM without disks since September 2023. SourceRead 19 Oct 2026 | Proton VPN says it does not use RAM-only servers and runs hard disks with full-disk encryption, which it argues gives the same protection. SourceRead 26 Oct 2026 |
| Open-source apps | Desktop and mobile client source is public on GitHub (GPL-3.0). SourceRead 19 Oct 2026 | Proton says all Proton VPN apps are open source. SourceRead 19 Oct 2026 |
| Transparency report or canary | No regular report or canary. Mullvad disclosed a police search in April 2023; officers left without customer data. SourceRead 18 Oct 2026 | Swiss court orders; Proton says it denied all of them. No canary, because of Swiss notification law. SourceRead 18 Oct 2026 |
| Incidents on record | 18 Apr 2023, No-logs tested by police or court: Swedish police came to Mullvad's office with a search warrant for customer data and left without seizing anything. SourceRead 19 Oct 2026 | No statement on record |
| Newest app versions | Windows, macOS, Linux 2026.5 (11 Sep 2026) SourceRead 18 Oct 2026 Android 2026.12 (30 Sep 2026) SourceRead 18 Oct 2026 iOS 2026.5 (8 Sep 2026) SourceRead 18 Oct 2026 | Windows 5.1.8 (22 Sep 2026) SourceRead 18 Oct 2026 Android 5.20.74.0 (14 Oct 2026) SourceRead 18 Oct 2026 |
Known VPN leak attacks
Each provider’s own statement for each app. “Not stated” means the provider published nothing on it.
| Attack | Mullvad | Proton VPN |
|---|---|---|
| TunnelVisionA rogue DHCP server pushes routes (option 121) that pull traffic out of the tunnel while the VPN still shows connected. | Not affected Windows, macOS, Linux, Android SourceRead 18 Oct 2026 Affected iOS SourceRead 18 Oct 2026 | Not affected Windows, Android SourceRead 18 Oct 2026 Mitigated macOS, iOS SourceRead 18 Oct 2026 Affected Linux SourceRead 18 Oct 2026 |
| TunnelCrack LocalNetA rogue Wi-Fi network assigns itself public addresses the VPN treats as local, so traffic to them skips the tunnel. | Not affected Windows, macOS, Linux, Android SourceRead 18 Oct 2026 Mitigated iOS SourceRead 18 Oct 2026 | No statement on record |
| TunnelCrack ServerIPA spoofed DNS answer for the VPN server makes the client route chosen traffic outside the tunnel. | Not affected Windows, macOS, Linux, Android, iOS SourceRead 18 Oct 2026 | No statement on record |
Audits on record
Mullvad
| Date | Auditor | Type | What was checked | Findings | Source |
|---|---|---|---|---|---|
| 1 Jun 2026 | Leviathan Security | Apps | Android app 2026.2 against the App Defense Alliance MASA profile; black-box, no code review. | Not published | Report SourceRead 18 Oct 2026 |
| 6 Mar 2026 | Assured | Protocol | GotaTun 0.2.0, Mullvad's WireGuard implementation; DAITA, the CLI and external dependencies excluded. | 2 low | Report SourceRead 18 Oct 2026 |
| 21 Jan 2026 | X41 D-Sec | Backend and payments | White-box review of the account and payment API and backend; some findings redacted. | 3 medium, 2 low | Report SourceRead 18 Oct 2026 |
| 23 Oct 2025 | Assured | Backend and payments | Penetration test of the customer web app. | 1 low | Report SourceRead 18 Oct 2026 |
| 19 May 2025 | Assured | Apps | The installer and downloader (VPN loader): protocol and source code. | Not published | Report SourceRead 18 Oct 2026 |
| 27 Mar 2025 | NCC Group | Apps | Android app 2024.9 against the MASA profile; black-box, no code reviewed. | Not published | Report SourceRead 18 Oct 2026 |
| 11 Dec 2024 | X41 D-Sec | Apps | Penetration test and source review of the VPN app on all platforms, October to November 2024. | 3 high, 2 medium, 1 low | Report SourceRead 18 Oct 2026 |
| 27 Jun 2024 | Cure53 | Servers and infrastructure | One OpenVPN and one WireGuard staging server plus the Ansible code, with a privacy focus. | 1 medium, 1 low | Report SourceRead 18 Oct 2026 |
| 9 Aug 2023 | Radically Open Security | Servers and infrastructure | Two RAM-only VPN servers, including a check for logging; binaries and hardware excluded. | Not published | SourceRead 18 Oct 2026Report not public |
| 17 Feb 2023 | Assured | Backend and payments | Account and payment API, tested in November 2022. | None reported | Report SourceRead 18 Oct 2026 |
| 21 Oct 2022 | Atredis Partners | Apps | Penetration test and source audit of the apps on five platforms. | Not published | Report SourceRead 18 Oct 2026 |
| 14 Sep 2022 | Assured | Servers and infrastructure | Self-hosted authoritative DNS servers, before they went into production. | None reported | Report SourceRead 18 Oct 2026 |
| 22 Jun 2022 | Assured | No-logs | Two WireGuard and one OpenVPN server, freshly installed: configuration and any customer logging. | Not published | Report SourceRead 18 Oct 2026 |
| 20 Jan 2021 | Cure53 | Servers and infrastructure | First infrastructure audit, December 2020; six issues from informational to high, no breakdown given. | Not published | Report SourceRead 18 Oct 2026 |
| 25 Jun 2020 | Cure53 | Apps | Desktop 2020.4, Android and iOS apps; the worst finding was rated medium. | Not published | Report SourceRead 18 Oct 2026 |
Proton VPN
| Date | Auditor | Type | What was checked | Findings | Source |
|---|---|---|---|---|---|
| 1 Dec 2025 | Ruben Santamarta | Apps | Security audits of the apps by an independent researcher; the date is when Proton's article was updated. | Not published | SourceRead 18 Oct 2026 |
| 19 Sep 2025 | Securitum | No-logs | On-site no-logs audit in Zurich, August to September 2025. | Not published | Report SourceRead 18 Oct 2026 |
| 12 Jul 2024 | Securitum | No-logs | On-site no-logs audit in Geneva, July 2024. | Not published | Report SourceRead 18 Oct 2026 |
| 1 May 2023 | Securitum | No-logs | On-site no-logs audit in Zurich, April to May 2023. | Not published | Report SourceRead 18 Oct 2026 |
| 22 Apr 2022 | Securitum | No-logs | First no-logs audit. | Not published | SourceRead 18 Oct 2026 |
| 21 Jan 2020 | SEC Consult | Apps | Source code reviews of the Windows, macOS, iOS and Android apps, one report per app; the report linked is the Android one. | Not published | SourceRead 26 Oct 2026 |
Check it on your own connection
Records say what Mullvad and Proton VPN state. A test shows what your own connection does today: run the Mullvad leak test with that app connected, or the Proton VPN leak test with the other; each checks your IP, DNS, WebRTC and IPv6.
How this page is kept
- Mullvad’s column is read from mullvad.net and github.com; Proton VPN’s from protonvpn.com, github.com and proton.me. Auditors’ published reports count as well. Each cell links its source and the date it was read.
- “No statement on record” under Mullvad or Proton VPN means our sources hold none for that provider. It is not a finding that Mullvad or Proton VPN lacks the feature; check its own pages.
- This page does not rank Mullvad against Proton VPN. Which row matters depends on what you need the VPN for.
- A script re-reads every Mullvad and Proton VPN source weekly; when one changes, a person checks it before the Mullvad or Proton VPN row changes. These records also feed every published VPN audit, who owns which VPN and leak issues by provider.
The data on this page as JSON: facts.json (CC BY 4.0) · All open data · Changes and Atom feed