INDEX / DIRECTORY / MULLVAD VPN

Mullvad VPN

Cybersecurity & VPN 41 CITED SOURCES UPDATED 2026-09-09 METHOD V6.5
BDS-1000 Score 157 /1000 E Tier E - Limited
Military ↗ 0.00 Digital ↗ 1.31 Economic ↗ 0.32 Political ↗ 1.77

OpenIntel is reader-funded - no sponsors, no institutional money. Support OpenIntel →

Key Findings

  • Digital: Three rented Tel Aviv VPN relays route communications through Israel. The assessment applies the rubric’s in-transit data-exposure principle; no actual state access, surveillance deployment or stored customer records in Israel were established.1, 2, 3, 4
  • Economic: The Tel Aviv relays establish a limited rented infrastructure presence, while reviewed disclosures do not establish Israeli revenue, local incorporation, tax payments, data-centre ownership, or a government end user.1, 5
  • Political: The public server selector presents Israel/Tel Aviv as an ordinary service location. The assessment treats that communication as limited business-as-usual normalization under the rubric, without inferring active advocacy or a state partnership.1
  • Not found: No public evidence identified of Israeli military or security contracts, settlement operations, Project Nimbus participation, Israeli entity-level ownership, or Israel/Palestine-related lobbying, donations, or state partnerships.6, 7, 8

Target Profile

FieldDetail
Company NameMullvad VPN, operated by Mullvad VPN AB
JurisdictionSweden9
HeadquartersBox 53049, 400 14 Gothenburg, Sweden9
SectorPrivacy and communications software; consumer VPN and browser services.10, 11
OwnershipPrivate. Mullvad states that Mullvad VPN AB is a subsidiary of Amagicom AB and that both are 100% owned by founders Fredrik Strömberg and Daniel Berntsson; a 2021 founder statement said each then held 50%, but this is not independent confirmation of current equal allocations.9, 12
Key Executives / GovernanceFounders/owners Fredrik Strömberg and Daniel Berntsson; Swedish company-record material identifies Erik Daniel Berntsson as a board member of Mullvad VPN AB. An online Mullvad publication identifies Jan Jonsson as CEO, but the reviewed record does not independently establish that role as current.9, 13, 14
Israeli-Nexus SummaryThree official-listing, rented DataPacket VPN relays in Tel Aviv establish a limited current infrastructure presence; no public evidence identified of Israeli state, military, settlement, or security-sector business.1, 6

Key Facts:

Executive Summary

Mullvad is a Swedish privacy-and-communications company whose VPN service is operated by Mullvad VPN AB, a subsidiary of Amagicom AB. The company identifies Fredrik Strömberg and Daniel Berntsson as its founders and owners. Its public product material describes a service that routes internet traffic through encrypted VPN tunnels, alongside browser and privacy offerings.9, 15, 11

The principal documented Israel nexus is narrow: on 9 September 2026, Mullvad’s official Israel-filtered server list identified three rented DataPacket relays in Tel Aviv - il-tlv-wg-101, il-tlv-wg-102, and il-tlv-wg-103 - each listed at 10 Gbps. Mullvad says its displayed server locations are physical locations and it does not use virtual locations. This supports a current consumer-VPN infrastructure presence in Israel, but not an Israeli corporate office, data-centre ownership, Israeli customer-data storage, Israeli tax residence, or a particular customer relationship.1, 2

The audits found no public evidence of a contract, procurement award, framework agreement, or other verified relationship involving Mullvad, Amagicom, the founders, or DataPacket on Mullvad’s behalf with the Israeli Ministry of Defense, IDF, intelligence agencies, police, prison service, Border Police, or another Israeli security body. They likewise found no public evidence of Project Nimbus participation, Israeli-origin enterprise-security integrations, offensive cyber or targeting products, settlement operations, Israeli subsidiaries, Israeli resellers, or Israeli government-cloud services.6, 7, 8, 16

Mullvad’s public-facing politics are privacy-focused rather than Israel/Palestine-focused. Reviewed materials discuss free communication, censorship circumvention, activists in oppressive regimes, and opposition to surveillance legislation, while not addressing Israel, Palestine, Gaza, the West Bank, or the wider conflict. Document-scoped searches also found no Mullvad mention in specified UN and OHCHR materials; those findings do not establish real-world or database-wide absence.10, 11, 17, 18

On the fixed, human-vetted V6.5 assessment, the limited Israeli relay presence drives the non-zero Digital, Economic, and Political domain values, while the absence of verified military, settlement, state-contract, or direct security nexus yields a Military score of zero. The resulting BRS is 157, Tier E (Minimal/No Complicity).

Timeline of Relevant Events

DateEvent
Summer 2008A founder-authored ownership statement says the founders began building the organisation.12
March 2009Mullvad dates the launch of its VPN service to March 2009.9
24 January 2020A Swedish company-record listing gives Mullvad VPN AB registration date as 24 January 2020.13
3 February 2020Mullvad announced that VPN operations would move from Amagicom to newly created Mullvad VPN AB, effective 1 March 2020.19
16 September 2021Founder-authored statement said Strömberg and Berntsson were the sole shareholders, each holding 50%, and that the business had grown without outside investment.12
29 October 2025Mullvad’s reviewed reseller roster listed specified Amazon storefronts and resellers in Sweden, Germany, Austria, and the Netherlands; it did not list an Israel-based reseller or distributor.20
August 2026A third-party network observation recorded il-tlv-wg-103.relays.mullvad.net in Tel Aviv, with reverse DNS associated with DataPacket/CDN77.21
9 September 2026Mullvad’s official Israel-filtered server interface identified three rented DataPacket relays in Tel Aviv.1

Corporate Overview

Mullvad states that Mullvad VPN AB is the operating company for its VPN service and a subsidiary of Amagicom AB. The company says no other company is directly involved in operating the Mullvad VPN service, and that neither the companies nor the founders hold ownership or economic stakes in other VPN services.9, 11

The available record describes a Swedish founder-owned structure. Mullvad identifies Strömberg and Berntsson as active owners; a 2021 founder statement described equal 50% ownership at that time, without outside investment or a public listing. That historical statement should not be treated as independently verified present beneficial-ownership data.9, 12

Commercial registry-mirror material describes a broader Amagicom group that includes Mullvad VPN AB, Tillitis AB, Glasklar Teknik AB, Karlstad Internet Privacy Lab AB, and Eisenia AB. A September 2025 Amagicom Group presentation names several of those entities. The present group composition, the legal status of each relationship, ownership percentages, and their roles in Mullvad’s VPN operations were not independently confirmed through certified registry extracts or consolidated accounts.22, 23

No public evidence identified of an Israeli parent, subsidiary, office, franchisee, R&D centre, state ownership interest, Israeli board appointee, settlement-based entity, or entity-level state partnership. The limited documented Israeli presence consists of rented relay infrastructure in Tel Aviv.1, 8

Domain Summaries

Military: Military

Mechanism of Involvement

No public evidence identified of direct defence contracting or procurement involving Mullvad VPN AB, Amagicom AB, Strömberg, or Berntsson and the Israeli Ministry of Defense, IDF, Israel Prison Service, Border Police, or another Israeli security body.6

Mullvad’s documented product is encrypted VPN traffic routing and related privacy software. The reviewed material supports classification as general privacy and communications software, not software designed for weapons effects, targeting decisions, munitions integration, or tactical operations.15, 11

No public evidence identified of military-specific product variants, Israeli military end-user certificates, export-licence decisions, defence-prime supply relationships, military logistics or base services, weapons-system supply, or Israeli security-force-specific hosting or reseller arrangements.6, 16

Counter-Arguments and Evidence Limits

The strongest defence is the civilian character of Mullvad’s documented product and the absence of a verified military customer or contract. The presence of a Tel Aviv VPN relay is not evidence of military supply: the cited material identifies neither a military end user nor a security relationship.1, 21

A user-submitted 2024 issue asserting that Mullvad had servers in Israel did not identify an operator, customer, contract, end user, or state-security relationship and therefore does not establish military or settlement supply.24 The audits’ negative findings are bounded research findings, not proof that no relationship exists anywhere.

Named Entities and Evidence Map

Digital: Digital

Mechanism of Involvement

Mullvad’s official Israel-filtered server list identifies three rented DataPacket servers in Tel Aviv. The company says its server list is complete and can be filtered by country, city, provider, ownership, and server type; it also states that locations correspond to physical servers rather than virtual locations.1, 2

This establishes a current, discrete consumer-VPN relay presence in Israel. DataPacket’s case study describes Mullvad as a client for dedicated-server infrastructure and describes purpose-configured international VPN-server infrastructure, including management servers and 10-Gbps links.27

The adjudicated digital finding applies the rubric’s Data-Exposure / Sovereignty Principle to Mullvad’s routing of user communications through the listed physical Israeli relays. This is an assessment of in-transit exposure, which the rubric treats separately from a named state contract. It is not evidence that Israeli authorities accessed the traffic, that Mullvad provided surveillance services, or that customer accounts were stored in Israel. The confirmed three-relay footprint limits magnitude; direct deployment supports operator proximity.1, 2, 15, 3, 4

No public evidence identified of a direct Mullvad relationship with identified Israeli-origin enterprise-security vendors, use of Israeli biometric or surveillance products, deployment for Israeli military or intelligence surveillance, Project Nimbus participation, Israeli government-cloud provision, offensive cyber capabilities, AI/ML services, autonomous targeting, or other digital-weapons functionality.7, 8, 16

Counter-Arguments and Evidence Limits

The strongest defence is that the available evidence identifies ordinary VPN relay infrastructure rather than a state or security deployment. Mullvad says it does not store VPN activity logs; its central validation mechanism uses temporary memory, and monitoring records aggregate connection and system-health metrics. Its privacy policy says payment, support, and problem-report personal data are processed only in the EU/EEA and does not identify Israel as a personal-data processing location.3, 4

The third-party relay observation does not establish traffic volume, customer-data retention, legal-access conditions, relay duration, Israeli data-centre ownership, or the terms of the underlying hosting relationship. Current server lists also cannot determine historical deployment because archived lists were not obtained.21, 2

Named Entities and Evidence Map

Economic: Economic

Mechanism of Involvement

The three rented Tel Aviv relays are the established economic nexus: they indicate a limited infrastructure arrangement in Israel. The reviewed disclosures do not establish the amount of rental expenditure, Israeli revenue, local incorporation, Israeli tax payments, data-centre ownership, or an Israeli government or military end user.1, 5

Mullvad’s disclosed sales channels list Amazon marketplaces and named resellers in Sweden, Germany, Austria, and the Netherlands. The reviewed roster does not list an Israel-based reseller or distributor.20 No public evidence identified of Israeli physical-product sourcing, Israeli import arrangements, Israeli regulatory registrations, tax status, portfolio investments, acquisitions, Israeli R&D facilities, or Israeli sovereign/fund exposure.8, 16

Counter-Arguments and Evidence Limits

Mullvad is a Swedish-operated service whose disclosures place the operating company, parent, and named founders in a Swedish corporate structure.9, 12 The company’s available financial figures from registry-derived data - 2024 turnover of SEK 314.810 million and 44 employees - were not corroborated by an annual report in the research scope and should not be used to infer the scale of any Israeli economic exposure.28

The absence findings do not substitute for audited accounts, transfer-pricing disclosures, tax filings, or a complete intercompany structure. The evidence cannot trace profits or quantify any Israeli economic contribution.28, 22

Named Entities and Evidence Map

Political: Political

Mechanism of Involvement

Mullvad publicly describes its purpose in terms of free communication, privacy, encrypted communications, and censorship circumvention. The reviewed material does not address Israel, Palestine, Gaza, the West Bank, or the conflict.10, 11

The Tel Aviv relays establish infrastructure in Israel but do not establish political endorsement, a state partnership, settlement activity, or a public-sector deployment.1 No public evidence identified of Israel/Palestine-related corporate lobbying, anti-BDS advocacy, donations, sponsorships, free-service credits, IDF or settlement support, crisis logistics, public relations initiatives, or official company statements.8, 16

The separately adjudicated political act is the customer-facing server selector: Mullvad publicly presents Israel/Tel Aviv as an ordinary selectable location without occupation context. Under this assessment’s rubric, that communication fits the lower edge of Business-as-Usual normalization. The recurring technical listing has limited visibility and no documented institutional advocacy, supporting a lower political magnitude. This interpretation does not convert the server rental into evidence of an explicit endorsement or state partnership.1

Counter-Arguments and Evidence Limits

The strongest defence is that Mullvad’s documented advocacy is directed at Swedish surveillance law and broad privacy concerns, not support for an Israeli governmental or military programme. Berntsson’s account of advocacy against Swedish surveillance legislation is a personal first-person statement rather than a corporate charter or statutory filing.29

No public evidence identified of legal proceedings, regulatory action, organised boycott campaigns, or a documented company response tied to Israel/Palestine. A document-scoped scan found no Mullvad mention in specified UN and OHCHR reports; this does not establish absence for affiliates, principals, other databases, or the world beyond those documents.17, 18

Named Entities and Evidence Map

BDS-1000 Score

Method: V6.5.

DomainIMPV-Domain Score
Military0.000.000.000.00
Digital6.101.509.001.31
Economic1.501.508.000.32
Political3.104.009.001.77

Political is the V_MAX at 1.77 because the public service-location listing supports the rubric’s limited Business-as-Usual normalization finding. Digital 1.31 reflects in-transit data-routing exposure; Economic 0.32 reflects the limited direct rental of three servers, without treating rented capacity as an owned operational footprint. Military remains zero because no qualifying physical military/security supply was identified. These are distinct rubric assessments of the documented routing, rental and public communication, not findings of actual state data access or active political advocacy.1, 2, 3, 4

Methodology Note

Footnotes

  1. https://mullvad.net/en/servers?country=il ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10 ↩11 ↩12 ↩13 ↩14 ↩15 ↩16 ↩17

  2. https://mullvad.net/en/help/server-list ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7

  3. https://mullvad.net/en/help/no-logging-data-policy ↩ ↩2 ↩3 ↩4

  4. https://mullvad.net/en/help/privacy-policy ↩ ↩2 ↩3 ↩4 ↩5

  5. https://mullvad.net/en/help/server-list ↩ ↩2

  6. https://mullvad.net/en/policies ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7

  7. https://mullvad.net/en/help/partnerships-and-resellers ↩ ↩2 ↩3 ↩4

  8. https://docs.un.org/en/A/HRC/59/23 ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7

  9. https://mullvad.net/en/about ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10 ↩11 ↩12 ↩13

  10. https://mullvad.net/en/about ↩ ↩2 ↩3

  11. https://mullvad.net/en/vpn/trustworthy-vpn ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  12. https://mullvad.net/en/blog/2021/9/16/ownership-and-future-mullvad-vpn ↩ ↩2 ↩3 ↩4 ↩5

  13. https://www.allabolag.se/foretag/mullvad-vpn-ab/g%C3%B6teborg/konsulter/2KHK741I5YF3I ↩ ↩2 ↩3

  14. https://mullvad.net/pdfs/Total_surveillance.pdf ↩ ↩2

  15. https://github.com/mullvad/mullvadvpn-app/blob/main/docs/security.md ↩ ↩2 ↩3

  16. https://docs.un.org/en/A/HRC/60/19 ↩ ↩2 ↩3 ↩4 ↩5

  17. https://docs.un.org/en/A/HRC/59/23 ↩ ↩2 ↩3 ↩4

  18. https://www.ohchr.org/en/press-releases/2025/09/un-human-rights-office-updates-database-businesses-involved-israeli ↩ ↩2 ↩3

  19. https://mullvad.net/en/blog/2020/2/3/doing-corporate-shuffle ↩

  20. https://mullvad.net/en/help/partnerships-and-resellers ↩ ↩2 ↩3 ↩4

  21. https://www.netify.ai/resources/ips/169.150.227.222 ↩ ↩2 ↩3

  22. https://www.hitta.se/f%C3%B6retagsinformation/amagicom%2Bab/5567839807 ↩ ↩2 ↩3

  23. https://transparency.dev/pdfs/summit2025/hardware.pdf ↩

  24. https://github.com/tailscale/tailscale/issues/11902 ↩

  25. https://www.sibat.mod.gov.il/Industries/directory/Pages/default.aspx ↩

  26. https://www.sibat.mod.gov.il/Industries/directory/Documents/Sibatdir-HLS-en2018-19.pdf ↩

  27. https://www.datapacket.com/case-study/mullvad-vpn ↩ ↩2

  28. https://www.allabolag.se/s%C3%B6k-p%C3%A5-f%C3%B6retagsnamn?q=vpn ↩ ↩2

  29. https://dberntsson.info/about/ ↩ ↩2