Mullvad VPN DIGITAL

Enterprise Technology Stack & Vendor Relationships

• Mullvad VPN is operated by Mullvad VPN AB, a Swedish subsidiary of Amagicom AB, and its public materials identify founders Fredrik Strömberg and Daniel Berntsson as the 100% owners who remain actively involved ^{1, 2}.

• A Swedish company-record listing gives Mullvad VPN AB organisation number 559238-4001 and a registration date of 24 January 2020 ³.

• Mullvad’s published partnerships list names Malwarebytes, Mozilla, Tailscale, and Obscura VPN as users of its VPN-server network, alongside specified Amazon national storefronts and European activation-code resellers ⁴.

• The published partner list does not name Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, Claroty, Palo Alto Networks, or another identified Israeli-origin enterprise-security vendor ⁴.

• DataPacket describes Mullvad as a client for dedicated-server infrastructure, stating that Mullvad operated 145 DataPacket servers across 38 locations and had pre-ordered four additional locations when the undated case study was published ⁵.

• DataPacket characterises this as purpose-configured international VPN-server infrastructure, including management servers for IPMI access and 10-Gbps links ⁵.

• No public evidence identified in the reviewed company materials, partner disclosures, and targeted vendor checks of a direct Mullvad licensing, integration, managed-security, systems-integrator, outsourcing, or subscription relationship with the named Israeli-origin enterprise-security vendors ^{1, 4}.

Surveillance, Biometrics & Retail Technology

• No public evidence identified in the reviewed corporate, UN, civil-society, and targeted web materials that Mullvad uses Israeli-origin facial recognition, biometrics, behavioural analytics, predictive policing, sentiment analysis, social-media monitoring, or workforce-surveillance products ^{1, 6, 7}.

• No public evidence identified that such surveillance or biometric products reach Mullvad indirectly through a named managed-security provider, platform provider, or systems integrator ^{4, 5}.

• No public evidence identified that Mullvad technology has been publicly documented as deployed for Israeli military, intelligence, law-enforcement surveillance, target-generation, or weapons effects ^{1, 4}.

• No public evidence identified of retail-technology, consumer-profiling, or physical-security deployments by Mullvad in Israel or the occupied Palestinian territory ^{1, 4}.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

• Mullvad states that its public server list is complete and can be filtered by country, city, provider, ownership, and server type ^{8, 9}.

• The initial unfiltered page extract omitted later country entries. A direct review of the official Israel-filtered server list on 9 September 2026 identifies three rented DataPacket servers in Tel Aviv: il-tlv-wg-101, il-tlv-wg-102, and il-tlv-wg-103, each listed at 10 Gbps ¹⁰. This confirms a current consumer-VPN infrastructure presence; no public evidence identified that these relays serve an Israeli military, intelligence, surveillance, or government contract ^{10, 9}.

• Mullvad states that its listed VPN servers are physical servers that it either owns or rents as dedicated servers, that it does not use virtual servers or virtual locations, and that displayed locations correspond to physical locations ⁹.

• A third-party network-observation page identifies IP address 169.150.227.222 as il-tlv-wg-103.relays.mullvad.net, locates it in Israel, and reports a reverse resolution to a datapacket.com hostname ¹¹.

• The third-party observation supports a discrete Israeli Mullvad relay or exit point supplied through DataPacket, but it does not establish Mullvad ownership of an Israeli data centre, customer-account storage in Israel, an Israeli corporate operation, or the duration of any relevant arrangement ^{5, 11}.

• Mullvad states that it does not store VPN activity logs, that its central validation mechanism uses temporary memory, and that server monitoring records aggregate connection and system-health metrics ¹².

• Mullvad’s privacy policy states that payment, support, and problem-report personal data are processed only within the EU/EEA and that no third-country transfer is made ¹³.

• Mullvad’s privacy policy does not identify Israel as a personal-data processing location ¹³.

• No public evidence identified of Mullvad participation in Project Nimbus, another Israeli government-cloud programme, or a contract to provide data-residency, sovereignty, or resilience services to Israeli state or military institutions ^{1, 2, 8, 13}.

Defence, Intelligence & Security Sector Technology Relationships

• No public evidence identified in the reviewed company materials, partner disclosures, UN materials, and targeted checks of a Mullvad, Amagicom, DataPacket-on-Mullvad’s-behalf, founder, or director contract with the Israeli Ministry of Defense, IDF, intelligence agencies, police, or another Israeli security body ^{1, 4, 5, 6}.

• No public evidence identified of Mullvad developing, licensing, selling, or maintaining offensive-cyber tools, exploit capabilities, or digital weapons for Israeli state actors ^{1, 4}.

• No public evidence identified of Mullvad’s use or deployment of Israeli-origin offensive cyber, AI/ML, behavioural analytics, or autonomous systems ^{1, 4}.

• No public evidence identified of a public foreign-military-sales, procurement, or security-sector disclosure naming Mullvad as a supplier to an Israeli state body ^{1, 4}.

AI, Algorithmic & Autonomous Systems

• No public evidence identified in the reviewed sources of Mullvad providing AI/ML, computer vision, autonomous decision-support, surveillance-derived training data, or civilian-population data to Israeli state, military, or security bodies ^{1, 4}.

• No public evidence identified of Mullvad supplying purpose-built autonomous targeting, target-generation, fire-control, or kill-chain software ^{1, 4}.

• Mullvad’s described service is VPN infrastructure, including dedicated physical servers and a no-activity-logging policy, rather than a publicly described AI or autonomous-systems offering ^{9, 12}.

Technology Ecosystem & R&D Footprint

• Mullvad gives its public address as Box 53049, 400 14 Gothenburg, Sweden, while its corporate materials identify Mullvad VPN AB as part of the Amagicom AB group ^{1, 2}.

• Amagicom AB is listed with organisation number 556783-9807 in a Swedish company-record listing ¹⁴.

• Tillitis AB identifies Amagicom AB as its parent and states that its TKey security-token work began as a research project at Mullvad VPN ¹⁵.

• Tillitis lists Ekelundsgatan 4, 411 18 Göteborg, Sweden as its address and names Fredrik Strömberg among its team ¹⁵.

• Glasklar Teknik AB describes itself as a sister company of Mullvad VPN AB and Tillitis AB, lists organisation number 559394-2906, names Fredrik Strömberg among its team, and states that it has an official Gothenburg address with headquarters in Stockholm ¹⁶.

• Swedish company-register data available through Allabolag identifies Erik Daniel Berntsson as a board member of Mullvad VPN AB and identifies Amagicom AB as its parent ³.

• The reviewed sources identify Strömberg and Berntsson as founders and owners, but they do not reliably establish a complete current board roster, chair, or CEO through a primary company-register extract ^{1, 3}.

• A founder-signed 2021 ownership statement said that Strömberg and Berntsson were then the sole shareholders, each holding 50%, that the business had grown organically without outside investment, and that they did not intend to sell ¹⁷.

• The 2021 statement is not independent registry verification of present equal share allocations ¹⁷.

• Daniel Berntsson’s personal biography states that he and Strömberg started Mullvad in response to Swedish mass-surveillance legislation and states that neither he nor companies he has run have filed patents, the latter being a personal statement rather than patent-office verification ¹⁸.

• No public evidence identified in the reviewed sources of an Israeli Mullvad or Amagicom R&D centre, engineering office, accelerator, acquisition, startup or VC investment, research-institution collaboration, patent collaboration, or licensing agreement ^{1, 15, 16}.

• No public evidence identified in the targeted founder and principal checks of disclosed investments, board roles, or family-office vehicles of Strömberg or Berntsson in Israeli surveillance, cyber, AI, SIGINT, or military-technology companies ¹.

Civil Society Scrutiny & Regulatory History

• The supplied deterministic full-text pre-scan found no mention of Mullvad in the UN Special Rapporteur’s 2025 report From economy of occupation to economy of genocide, a document-scoped finding rather than a general absence determination ⁶.

• The supplied deterministic full-text pre-scan found no mention of Mullvad in the 2023 OHCHR report on Israeli settlements or the OHCHR’s 2025 update to its settlement-business database, which are likewise document-scoped findings ^{7, 19}.

• No public evidence identified in the reviewed sources of an organised boycott, divestment, sanctions, export-control, regulatory, court, or parliamentary proceeding concerning Mullvad technology provision to Israeli state entities or operations in occupied territory ^{1, 4, 6, 19}.

• The current public server list cannot assess historical server deployment because the research shard did not obtain archived server lists ^{8, 9}.

• The third-party Israeli-relay observation does not establish traffic volume, customer-data retention, legal-access conditions, a current contractual term, or whether the relay remained active after the observation ¹¹.