ProtonVPN vs Mullvad VPN

Proton's Terms say its services are operated by Proton AG, a Swiss company in Geneva, under supervision of the non-profit Proton Foundation, based in Switzerland. This is a provider statement, not an independent assessment of applicable law or surveillance exposure.

Mullvad says its legal entity, Mullvad VPN AB, is based in Sweden and outlines its view of laws relevant to the service. This is the provider's account, not an independent legal conclusion or an alliance-based score.

Proton's public no-logs audit summary, updated June 16, 2026, describes five consecutive annual Securitum audits through 2026 and quotes a conclusion about the examined Proton VPN server infrastructure. The linked 2026 report was not reviewed for this record, so this summary records Proton's account rather than an independent assessment of the full report.

Cure53 conducted a comprehensive security audit of Mullvad VPN in 2020, confirming their no-logs policy and infrastructure security.

Proton's feature page names WireGuard and OpenVPN and describes Stealth as a custom obfuscation protocol based on WireGuard tunneled over TLS. This page does not provide a complete protocol-by-platform matrix or substantiate IKEv2 support.

Mullvad VPN supports WireGuard and OpenVPN protocols with secure defaults and strong encryption.

Proton's feature page says its VPN protocols use open-source encryption standards such as AES-256 and ChaCha20 at their strongest settings. It does not specify the ChaCha20-Poly1305 mapping or a protocol-specific cipher suite in this passage.

WG ChaCha20-Poly1305; OVPN AES-256-GCM; strong handshakes.

Proton's feature page says DNS leak protection is provided and that a kill switch is included in all its apps. It does not establish IPv6 leak-test results or platform-by-platform behavior.

Always-on kill-switch/lockdown; DNS guidance; IPv6/WebRTC mitigations.

Mixed model; special Secure Core (CH/IS/SE) uses hardened, Proton-controlled servers.

Extensive colocation/hardened fleet (not 100% owned globally).

Proton's feature page says its servers are bare metal and use full-disk encryption. That passage does not state that servers are RAM-only or establish the absence of persistent storage.

Network-wide RAM-only completed Sep 20, 2023.

Proton's ownership support page says Proton Foundation is Proton AG's primary shareholder and that employees own most of the remaining shares. It does not say the Foundation owns a majority of all shares.

Company details public (Mullvad VPN AB, Sweden); frequent policy/audit comms.

Open-source apps, recurring external audits; privacy-mission stance.

No affiliates/paid reviews policy.

Proton’s program page accepts reports by email, lists web, desktop, mobile, and server issue categories, and says awards are assessed case by case. It publishes standard reward ranges; actual payouts may vary. No VPN-only eligibility rule was identified.

Public security contact & disclosure; no cash bounty program.

The linked TechRadar article was not retrieved in the current source batch. Its audit and SOC 2 references therefore do not support an incident-response maturity conclusion in this record.

Police visit handled transparently; follow-up protocol request published.

The linked TechRadar and Tom's Guide reviews were not retrieved in the current source batch, so the cited peak throughput and performance summary are not independently verified here.

Mullvad VPN provides good speed performance with WireGuard protocol, though speeds may vary by server location.

Proton's feature page lists apps for Windows, macOS, Linux, Android, Android TV, Apple TV, iOS/iPadOS, and Chromebook, plus Chrome and Firefox extensions. This platform list does not assess router configuration or feature parity across clients.

Native apps: Windows/macOS/Linux GUI/iOS/Android; 5 devices.

Proton's streaming guide lists supported services including Netflix, Prime Video, Disney+, and BBC iPlayer, and says streaming is available on paid plans. This is a provider statement and guide, not an independent reliability or pass-rate test.

Mullvad VPN does not actively support streaming unblocking and focuses on privacy rather than geo-unblocking.

Proton's dedicated support article advertises 24/7 Live Chat for paid plans, while its general features page says paid-plan Live Chat is available most hours. Actual availability was not tested; these pages do not establish free-plan chat access.

Mullvad VPN provides email support and comprehensive documentation, though live chat is not available.

ProtonVPN offers competitive pricing with 30-day money-back guarantee and free tier available.

Mullvad lists a flat EUR5 monthly price. Its refund help, updated 26 August 2026, offers a 14-day guarantee for eligible payment methods; cash and cryptocurrency are excluded, while App Store and voucher refunds are handled through the relevant seller.

Proton's payment article lists cards, PayPal, Apple Pay, Google Pay, Bitcoin, cash, and bank transfer. It notes that Bitcoin requires an existing account and that some methods vary by platform or are handled through account credits.

Anonymous account numbers; cash by mail, Monero, BTC, cards, bank wire, Swish.

Non-profit backing; repeated independent audits.

Civil-liberties advocacy (e.g., Stop Chat Control) and privacy-first ops.

Proton's feature page describes NetShield as DNS filtering that blocks ads, trackers, and malicious scripts. This page does not establish plan eligibility or independently measured blocking efficacy.

Encrypted DNS filters for ads/trackers/malware (DNS-level).

Proton’s feature page lists Secure Core, Tor over VPN, port forwarding, split tunneling on specified platforms, and custom connection profiles.

Multihop, split tunneling, custom DNS, SOCKS5, API keys, Android TV.

Proton's feature page describes alternative routing through third-party networks when access to Proton servers is blocked and says Stealth is designed to defeat many forms of advanced censorship. It does not establish a universal DPI bypass or a measured success rate.

WG-over-TCP, Bridge, DAITA traffic camo; effective in many restricted environments.

All apps open-source; regular audits.

Apps & many tools open-source (GitHub).

The reviewed Proton feature page does not state a post-quantum rollout or compatible platforms. This page alone cannot establish that Proton has not launched PQC tunnels.

Mullvad VPN has enabled quantum-resistant WireGuard tunnels by default on all desktop platforms as of January 2025. The implementation uses Classic McEliece and ML-KEM algorithms for post-quantum secure key encapsulation mechanisms.

The linked Proton VPN plans article does not describe a consumer dedicated-IP offering. Its silence does not establish that one is unavailable, and business-service options were not reviewed here.

Not offered (shared IP model).

Proton's Secure Core page describes a multi-server VPN route. It does not assess whether Proton participates in decentralized VPN networks.

Centralized (not a dVPN).

The reviewed Proton feature page does not describe AI- or machine-learning-based VPN threat detection. Its silence does not establish that no such feature exists.

No AI endpoint scanning features.

Proton's feature page lists Linux among its open-source apps and names Linux among the platforms with split tunneling. This does not establish a command-line interface or feature parity with other clients.

First-class Linux GUI; parity documented.

The linked Proton audit article discusses open-source apps and external security audits but does not provide a client-telemetry inventory or tracker measurement. Open-source availability alone does not establish minimal telemetry.

Apps avoid trackers; policy emphasizes minimal data.