Mullvad vs IVPN

These are the two services in this directory that will sell you a subscription without learning your name, your email address or anything else. Both issue a number instead of an account. Both accept cash through the post. Both publish their source code, and both argue in public that a VPN is a narrower tool than the industry pretends. A reader who has narrowed the field to these two has already made most of the decision.

What the audits actually covered

Mullvad scores 4 for privacy against IVPN's 3, and both are marked as checked but not recently. They arrive at that mark by the same route: an audit record that reads as current and an examination of the servers that does not. Mullvad has four external reviews published between October 2025 and June 2026, covering the Android app, a WireGuard implementation and the payment backend. None of them examined the VPN servers, and no firm has ever verified the no-logs claim.

IVPN's pattern is the same shape. Cure53 has assessed it every year since 2019 and published the reports, but the engagement inside the last two years covered the mail and DNS side products. The gateways were last examined in February 2023, and the no-logs claim only ever in March 2019 — a format the company has since said it will not commission again.

The difference is what stands in for an audit. Mullvad has something no report can manufacture: Swedish police searched its servers under warrant in 2023 and left with nothing. IVPN has open source under GPLv3 on every client, which is checkable by anyone who wants to read it and by nobody who does not.

Where the jurisdictions land

Sweden is a Fourteen Eyes member, which is the one criticism four audits cannot answer, and Mullvad does not pretend otherwise.

Gibraltar looks like the better answer and is not obviously one. It signed nothing — the intelligence arrangements are between sovereign states and Gibraltar is not one. But the United Kingdom has told the United States Department of Justice that Gibraltar has no investigatory powers legislation and no intelligence services of its own, and that British signals intelligence conducted there runs under British law. That is why IVPN is recorded here as sitting inside the Five Eyes arrangement, against the industry's usual description of it.

Which should you choose?

Choose Mullvad if the flat price matters and five devices is enough. Five euros a month is the rate at one month and at ten years, there is no renewal to be caught by, and the 2023 police search is the strongest single piece of evidence any service in this directory can point at.

Choose IVPN if you want the code rather than the promise, or if you want multi-hop routing included on the cheapest plan rather than as an upgrade. IVPN scores 3 for value against Mullvad's 4, and the reason is the entry tier: two devices on Standard is a number you have to plan around, where Mullvad's five mostly is not.

If neither the anonymity nor the open source is what brought you here, Proton VPN is worth a look before either: it has a free tier with no data cap and sits outside both intelligence groupings.