The best VPN for privacy is Mullvad, unless you need it free

Mullvad vs Proton VPN vs IVPN

Which of the three to pay

You will pay €5 and you don't want an email on the account

Mullvad. The warrant is the strongest single record of the three, the signup collects the least, and the price doesn't jump. You are trusting a Swedish company, and Sweden has already shown it will serve the warrant.

You need a free VPN for privacy, or you want the servers themselves checked for logs every year

Proton VPN. The free plan uses the same no-logs claim as the paid one. You give Proton an email address, and the cheap monthly number on the pricing page is not what the plan costs after the offer ends.

You want a smaller company, owned by a named person, outside Sweden and Switzerland

IVPN. No email, cash and Monero, Gibraltar, the same owner since 2009. You are relying on the policy and on security audits, not on a recent examination of whether the VPN servers log. IVPN says that plainly.

None of the three is anonymous. Privacy Guides' own line is "Don't rely on a 'no log' policy," and a policy is the weakest of the documents below. How those documents are weighed against each other is the same order used for every tool on this site, set out on the methodology page: a court or police record, then an audit of a named part of the product, then published code, then the company's own promise.

A warrant, a no-logs audit, and an app audit

A no-logs policy is a sentence on a website. It becomes evidence only when something else happens to it.

The strongest thing that can happen is a forced disclosure: police, a court, or a prosecutor asks for the logs and there is a public account of what was handed over. Mullvad has one visit, in person, in 2023. Proton has a stack of Swiss orders and a year-by-year count of how many it could not answer. IVPN has neither in anything it has published. A visit proves the past. It does not promise what a future order, written to make the company start logging one account, would collect from that day on.

Next is a no-logs audit: someone who doesn't work there examines the machines that carry user traffic and says whether those machines are writing down browsing, DNS, or which account was connected. Proton's Securitum reports are this. Mullvad's January 2026 X41 report is not. It reviewed the account system. IVPN's published Cure53 work since 2019 is security testing of apps and web infrastructure, plus one no-logs audit in March 2019 that the company has chosen not to repeat.

An app audit is the third thing, and the one marketing departments prefer, because every serious provider has one. It can find a bug that leaks traffic from your laptop. It cannot see a log line on a server the auditor was never shown. When a ranking page says "independently audited" and stops, it is usually this third document, or a no-logs review the reader is not given a link to.

There are also two places a seizure can happen, and they answer different questions. An office search asks what the company keeps about customers: account records, payment records, support mail. A server seizure asks what that machine stored about traffic. Mullvad said on 20 September 2023 that its VPN servers no longer use disks at all, so a powered-off machine has nothing left to image. RAM doesn't stop a server from logging while it is running, if it was built to. Diskless is a control on leftovers, not a substitute for the question of whether anyone is writing logs in the first place.

The country in the app is a third confusion. The court that can order the company is the country where the company is incorporated. The country that can wheel a server out of a rack is the country where that machine sits. A "virtual location" is neither: the IP looks like one country and the computer is in another. Mullvad says it doesn't offer those. IVPN says the same. Proton's list is long enough that the difference matters, and it's in the Proton section.

Mullvad, and the warrant that found an empty office

On 18 April 2023 at least six officers from the Swedish police's National Operations Department came to Mullvad VPN AB in Gothenburg with a search warrant. They wanted computers holding customer data. Mullvad's account of the visit, published two days later, is that staff showed them the service doesn't keep that data, the prosecutor was consulted, and the officers left without seizing anything and without customer information. Mullvad says that if hardware had been taken it still wouldn't have held customer information, and that this was the first warrant at the office in over 14 years of operating the VPN.

The account design is why there was nothing of the usual kind to take. Signup asks for no username, no password and no email. The site generates a numbered account. The only two properties Mullvad says an account has are that number and the time remaining on it. Anyone can generate one. The number can be used by someone other than the person who created it.

Lose the number and the account is gone. Mullvad's terms say the number is the only proof that you have the right to use the service or claim a refund, and they tell you to write it down. There is no email to recover it with. That is the cost of the design, not a footnote.

What the policy says is not logged, tied to an account, is traffic, DNS requests, connections (including when one starts, ends, or how long it lasted), IP addresses, and bandwidth. The awkward exception is the five-connection cap. Each VPN server asks a central service whether the account has time left and whether it is already at five connections. Mullvad says that check lives in temporary memory and is not written to disk, and that it cannot tell you how many connections the account had five minutes ago. The website keeps Nginx access lines for up to five minutes, in a format it says contains no IP addresses, then deletes them and retains only aggregate counts of requests and response codes. Server health metrics (CPU, total bandwidth, total current connections) are collected as sums, not as a record of you.

The X41 review is real and narrower than "Mullvad is audited" sounds. In October 2025 X41 D-Sec read the source of the API and the backend services that handle payments, customer devices and WireGuard key distribution. The public report, dated 20 January 2026, describes five vulnerabilities, none of them critical or high, and says the VPN relays hold a list of allowed WireGuard keys without knowing which account a key belongs to. Read it as an audit of the account and payment machinery, not as a walk through the live servers looking for log files. Mullvad's diskless post says the server estate was audited in the RAM-only configuration in 2022 and 2023. Those reports are not the January 2026 document.

Every VPN server, Mullvad says, runs from RAM, is either owned by Mullvad or a dedicated machine it rents, and is physically in the city the list claims. No virtual locations, no shared virtual servers. Privacy Guides' country count for Mullvad was 49, last checked 28 October 2025. Port forwarding, which some peer-to-peer setups want, was removed in May 2023. Ordinary browsing doesn't use it.

The price is €5 a month whether you buy a month or a year, and Mullvad says that number has not changed since the service launched in 2009. There are no holiday sales. The refund is 14 days, and cash is excluded, which Mullvad attributes to anti-money-laundering rules. One account can be used on up to five devices. Direct purchases are €5; the App Store and resellers can charge something else. Paying inside an Apple or Google account ties the purchase to that store identity even though the VPN account is still a number. If the point of Mullvad is that the VPN company doesn't know your name, pay another way.

Cash in the post is accepted in EUR, USD, GBP, SEK, NOK, CHF, CAD, AUD and NZD, along with Bitcoin, Bitcoin Cash, Monero, vouchers and Swish. Card, SEPA, PayPal and in-app purchases are accepted too. Mullvad's logging policy says bank wire, PayPal, Swish and Stripe cause those payment companies to process your personal data. Cash or Monero is how you avoid handing a name to the payment rail. The VPN account being anonymous doesn't make a Visa transaction anonymous.

There is no free plan, and Mullvad's reason is the usual honest one: a free VPN is paid for by ads, by data, or by a paid tier subsidising it, and Mullvad doesn't want any of those. Proton, below, is the case of the third.

Proton VPN, the free plan, and the audit that enters the server room

Proton VPN is the pick when Mullvad's terms don't fit: you won't pay, or you specifically want a firm to sit with the servers each year and look for logs. It is a worse pick if the goal is that nobody, including the VPN company, has an email address for you.

Creating the account means entering a non-Proton email address. Proton says that address becomes your username and the recovery address if you lose the password. Privacy Guides lists cash among the ways to pay, alongside cards, PayPal and Bitcoin. Cash doesn't remove the email. The account and the payment are different records.

The audit is the part Proton has that Mullvad's public 2026 report doesn't. Securitum has examined the VPN infrastructure every year since 2022, and the 2026 round was the fifth. Proton says the auditors spend several days on site, reading VPN and server configuration, operating procedures and talking to staff. The questions, as Proton lists them, include whether production servers log activity, DNS, traffic contents or destinations, whether any log ties a user to a server, whether that is true for every region and every subscription tier, and whether a logging switch can be flipped without a second person and an alert. The 2026 report's conclusion, in the auditors' sentence Proton publishes:

The technical evidence reviewed during the engagement did not indicate that the examined Proton VPN server infrastructure logs users' browsing activity, DNS queries, destination services, network traffic contents or user-identifiable connection metadata. Securitum also did not identify persistent records that would allow Proton to associate a specific user with activity performed through a reviewed VPN server.

"The examined" and "a reviewed VPN server" are doing work in that sentence. It is not a claim about every machine Proton will ever rack. It is a claim about what those auditors saw that year. The reports are public, which is more than a press release that says "passed."

Swiss prosecutors have run the same test the auditors did: name the user behind a server and a time. Proton's transparency report says the only binding VPN requests are ones Swiss authorities approve, and that foreign police cannot be answered directly. The orders it describes are all the same request: who was on a given server at a given time, from a server IP and a timestamp. The yearly totals it publishes:

• 2020: 37 orders, 37 denied
• 2021: 121 orders, 121 denied
• 2022: 80 orders, 80 denied
• 2023: 60 orders, 60 denied
• 2024: 53 orders, 53 denied
• 2025: 59 orders, 59 denied

Those six years are 410 orders, and the report marks every one denied. A 2019 request is described separately: a foreign country's demand was approved by the Swiss courts, and Proton says it still had no customer IP to give. The audit announcement rounds the same history as "over 400 legal cases." Proton also says Swiss law does not require it to keep VPN activity logs. That is the law as Proton states it now. It is not a promise that a Swiss court can't order the company to start keeping something about one account from the day of the order. The worked example is not the VPN. It is Proton Mail: in 2021 a Swiss order compelled Proton to log an account in a French investigation, which the privacy tools page covers with Proton's own write-up. No stored mail was decrypted, because Proton couldn't. Logging that starts tomorrow is a different problem from logs that were never there.

Proton VPN is a service of Proton AG, in Plan-les-Ouates, Geneva. Proton says the primary shareholder is the Proton Foundation, a Swiss nonprofit set up so the company has to act in the community's interest, and that employees own most of the shares the foundation doesn't. The rest, Proton says, sit with FONGIT, another Swiss nonprofit, and with Proton users. Innosuisse and the European Commission are funders Proton says hold no shares and no control. The company was founded in 2014 by people who had met at CERN. Ownership of that kind is a reason the product is less likely to be sold to an advertising group. It is not itself a no-logs finding.

The free plan is a real plan, with a short list of constraints Proton prints. Proton says the free VPN has no data cap, no ads, and no speed limit it imposes on purpose. The same company's setup guide says free accounts reach servers in ten countries, which it names: the Netherlands, Japan, Romania, Poland, Norway, Switzerland, Singapore, Mexico, Canada and the United States, and only one device at a time. You don't choose the country. The pricing table marks free speed as "Medium" and paid speed as "Highest," which sits awkwardly next to "no artificial speed limit": Proton's own free-plan page says those free servers are simply busier. The no-logs questions Proton says Securitum asks include whether the policy is the same on every subscription tier, so the free plan is not, on Proton's account, a logging tier.

Paid pricing is several numbers at once. On 22 October 2026 one line of the pricing page billed a two-year term at $191.76 and then $119.88 every twelve months, while the comparison table showed VPN Plus at $3.49 a month. Those cannot all be the renewal price. Mullvad's €5 is dull on purpose. Proton's page is an offer. Paid plans come with 30 days to ask for the money back. Read the renewal before you take the monthly figure in the table.

Two limits that don't show up in the audit quote. Privacy Guides says Proton's kill switch on macOS does not block traffic when you disconnect on purpose, including when you switch servers, and that Intel Macs can crash with the kill switch on. It is still useful for an unexpected drop. It is not "nothing leaves the machine unless the VPN is up." The same page says the Android app hides telemetry under a menu called "Help us fight censorship," while other platforms put it under "Usage statistics." Turn it off if you don't want to send it. The setting being buried is a mark against the app, not against the no-logs report.

Country lists need the same kind of reading. Paid Proton plans advertise servers in 140+ countries and, on that pricing page, 20,000+ servers. Privacy Guides' count on 28 October 2025 was 127 countries, of which at least 71 were virtual locations (the IP says one country, the machine is in another), with 12 more locations offering both a physical server and a virtual one. The marketing number has moved since that count. A virtual location is still not the country the machine is in: a virtual Japan server is not a server in Japan, and a seizure or a local order lands where the hardware is. Privacy Guides also notes Proton runs its own servers and datacenters in Switzerland, Iceland and Sweden, which is a physical claim of a different sort. For hiding your IP from a website, a virtual location still changes the address the site sees. For privacy, where the box is matters more than the flag.

IVPN says the quiet part about no-logs audits

On 19 June 2026 IVPN's founder, Nick Pestell, wrote that the company's last and only no-logs audit was Cure53's, in March 2019, and that IVPN will not commission that kind of audit again. The reason is worth having in his terms: any provider can collect the day after the auditors leave, and IVPN has watched other VPNs wave the stamp as marketing. That is the right scepticism. It also means you cannot treat IVPN's no-logs claim the way you can treat Proton's 2026 report. The claim stands on the policy, on the age of the company, and on the fact that signup stores so little.

IVPN says it collects no personal data at signup, not even an email, and that it takes cash, Monero and Bitcoin. Pestell is founder, CEO and the sole owner of IVPN Limited. On 10 August 2023 the operating company changed its name from Privatus Limited to IVPN Limited. IVPN says ownership, the Gibraltar jurisdiction, the registered address and the registration number did not change. The address it printed then is 5 Secretary's Lane, GX11 1AA, Gibraltar. The team page describes ten people in six countries. IVPN says the service has run under that same ownership since 2009, that the business is paid subscriptions only, that it doesn't pay for reviews, and that it closed its affiliate programme so it wouldn't appear on top-ten lists.

The audits it does commission are security audits, and the scope lines matter. The sixth, published 11 April 2024, was eight days of Cure53 work in March 2024 against the customer website, its API, and the related web servers. Cure53 had the code and a test environment. IVPN says nobody from Cure53 was given access to production servers. The report found two low-severity vulnerabilities and two informational issues, all of which IVPN says were fixed. Cure53's published praise in that post is about the website's security posture. It is not a finding that VPN gateways keep no logs. IVPN's homepage says eight audits since 2019. The June 2026 post scheduled the eighth, again with Cure53, for two weeks in July 2026, covering the cryptography and privacy model and four named services (generator, token and preauth, verifier, distributor), plus Unlinked Access, the piece that lets other IVPN products authorise you without receiving your VPN account ID. That post announces a booking. It does not include findings.

Servers: 41 countries, dedicated bare metal, no virtual locations, run by IVPN rather than on someone else's cloud. Privacy Guides' count matches, last checked 28 October 2025, and it records that IVPN removed port forwarding in June 2023. Apps are open source. Privacy Guides dates that to February 2020. There is no free trial on Privacy Guides' account of the product, which matches a homepage that says the money comes from subscriptions. Multi-hop, a second server in another country before the traffic exits, is on the feature list. It raises the number of machines that see a piece of the path. It doesn't change what IVPN, as the operator of both, is in a position to know.

Choose IVPN when the thing you want is a named owner, a jurisdiction that isn't Sweden or Switzerland, and an account with no email on it, and when you have read the 2019 sentence and still want the service. Choose it because of a fresh no-logs audit and you have misread the company.

NordVPN's no-logs page can't agree with itself

Search for a private VPN and the first screen is usually NordVPN. One "best VPN for privacy" page picks NordVPN for most people and Proton for anyone whose situation is riskier. A logless roundup ranks NordVPN, then Surfshark, then ExpressVPN, and only then Mullvad. WIRED's 2026 gallery, which is a speed-and-features review rather than a logging review, makes Proton the overall pick and NordVPN the upgrade. Those articles are answering "which VPN should I buy." This comparison is about what a provider can be forced to show. Surfshark and ExpressVPN are named because they lead those lists. They are not in the table: the unsponsored short list is Privacy Guides' three, and the pages that put Surfshark or ExpressVPN first are selling a plan. ExpressVPN's change of owner is already in the ownership section of the privacy tools page, with ExpressVPN's own announcement.

NordVPN deserves the longer look, because it does have an audit history, and because its own no-logs page is the cleanest example of how that history gets told. The page says NordVPN is based in Panama, and that Panama has no data-retention law that would force a VPN provider to keep logs. It says you start by creating a Nord Account, and that cryptocurrency is a way to pay. An account plus a coin payment is not Mullvad's number. The payment may avoid a card. The account is still an account.

Then the page gives three counts of its own audits.

A company can have passed a series of assurance reviews and still publish a page that doesn't know whether the series has five entries or six. The article also doesn't link the reports. Proton's equivalent page exists to hand you the PDF. Until those Nord documents are readable without taking Nord's summary on faith, "audited" on that page is a claim about reviews, not a review. Passing one, if you later read it, would still be evidence about the systems in scope on that date. It would not turn a Nord Account into a numbered account, and it would not move the company out of the product category those roundups are selling: speed, streaming, a long prepaid term.

Nord's page also offers Double VPN and "Onion over VPN" as extra privacy. A second hop inside one company's network is not Tor. Tor is three relays run by different operators, and the browser is part of the protection. Who can see you with Tor, with a VPN, and with both stacked, is the Tor vs VPN comparison, including the cases where adding a VPN makes the setup worse.

What you still show the VPN, the website, and your ISP

A VPN encrypts the path from your device to the VPN server. Your internet provider stops seeing the sites and starts seeing a connection to the VPN company. The VPN company is then the one in a position to see them. That trade is the logging question. A provider with nothing behind the policy has been given the view your ISP used to have, and you still don't know what it keeps.

IVPN publishes a list of jobs a VPN does not do, and anonymity is the first item on it. Also on the list: stopping Google or Facebook collecting data on you, hiding a phone's GPS location, protecting passwords, and saving you from a breach at a service you log into. What IVPN says a VPN does do is narrower and right: the ISP no longer sees the domains (HTTPS already hides the page, not the name of the site), DNS can be hidden from the ISP, a public Wi-Fi network has a harder time sitting in the middle, and the website sees the VPN's address instead of yours.

The leaks that survive a careful VPN are mostly at the ends. Sign in to a site under your name and the site knows who you are, whatever address you arrived from. Pay by card and the payment company knows who paid. Use an ordinary browser and the site can still recognise the browser. The browser half of that problem is the privacy tools page, which separates Mullvad Browser, Brave and Tor Browser. If the job is that no single party can connect your name to the site, the tool is Tor, not a one-company tunnel. How to get Tor Browser and check the download is the practical version. The privacy tools page is the wider stack this VPN sits in: passwords and email still matter more than which of these three you pick, if those two are still your real name on every site.