"IVPN vs Mullvad VPN: an honest, no-affiliate comparison for Australians"

IVPN vs Mullvad VPN: an honest, no-affiliate comparison for Australians

IVPN and Mullvad are the two providers almost every privacy-focused reviewer recommends, and that's partly because they can't be bought: neither runs an affiliate program, so every "IVPN vs Mullvad" table you've read has zero revenue motive behind it – including this one. Below is how they actually differ: architecture, audits, infrastructure, WireGuard implementation, jurisdiction, payment options, and Australian-specific realities like server coverage and metadata retention. Prices are quoted in AUD where possible; note we sell hardware, not VPN subscriptions, so we have nothing to push either way.

This is not legal advice.

Why neither provider runs an affiliate program

Start with disclosure, because the VPN affiliate economy is genuinely rotten. IVPN closed its affiliate program in 2016, citing the standard industry abuses: fake coupon-code sites that intercept shoppers at checkout, and paid rankings in "best VPN" lists that reward commission rates, not quality. IVPN's FAQ states plainly that it has no affiliate program, no tracking scripts, and no surveillance advertising.

Mullvad's position is equally explicit: "we do not have affiliates, and do not pay for influencers – we don't even pay for links back to our website." Mullvad does buy advertising (outdoor, Google, app stores, and non-microtargeted YouTube), which it discloses openly, but it never pays for reviews.

The practical consequence for you: any comparison that ranks either provider first is at least arguing rather than selling. The honest conclusion is that both are legitimate and the choice comes down to specifics – which is what the rest of this article is.

Privacy architecture: numbered accounts and what's actually collected

Both providers sign you up with a randomly generated account number and no email address. Mullvad's no-logging policy documents that an account consists of exactly two data points: the account number and the time remaining. That's it. IVPN works the same way and goes a step further with Unlinked Access: its add-on services (private DNS, Mailx email protection, Portmaster) authorise access via HSM-derived tokens so they never receive your IVPN account ID at all, preventing cross-service linkage.

On the network side, both operate documented no-logging policies and back them with independent audits:

The strongest real-world evidence for Mullvad is not a report but a raid: on 18 April 2023, Swedish police executed a search warrant at Mullvad's Gothenburg office intending to seize customer data – and left with nothing, because there was nothing to seize. No IVPN customer data has been seized in a raid that we know of, but its architecture is designed the same way.

One honest caveat on IVPN's side: it has disclosed a security incident on its Bitcoin payment server. Both firms disclose incidents; that's a point in favour of the category, not against either.

Infrastructure: who owns the boxes

A circulating claim holds that Mullvad rides on "RamenNodes" infrastructure. That's wrong – RamenNodes is a hosting provider used by community projects like Riseup and Calyx VPN, not Mullvad. Mullvad publishes a complete live server list (545 servers online at time of writing) with hostname, datacentre provider, and owned vs rented status per box. It operates a mix of owned physical servers and rented dedicated hardware, and since September 2023 the entire network is RAM-only – no disks exist to seize, so a reboot wipes everything.

IVPN's model is simpler to describe: it owns none of its servers. All 89 gateways across 58 locations are bare-metal rented machines from 17 datacentre partners (live status page) – physical machines, no virtual locations, but third-party landlords throughout. Mullvad's owned-plus-RAM-only model is the stronger of the two against physical seizure and tampering; IVPN's counter-argument is that its fleet is audited annually regardless of who hosts it.

WireGuard implementation differences

Both are WireGuard-first, and both ship quantum-resistant WireGuard by default: a post-quantum key encapsulation generates the WireGuard pre-shared key, defending the tunnel against harvest-now-decrypt-later collection. Mullvad made quantum-resistant tunnels the desktop default in January 2025 and supports them across iOS and Android too. Both apps generate and rotate keys client-side rather than provisioning static server configs.

The real differences:

• Protocol menu. Mullvad has removed OpenVPN entirely as of January 2026 – WireGuard only. IVPN runs WireGuard and OpenVPN on every server, which matters if you're stuck behind a device or network where only OpenVPN works.
• Censorship resistance. IVPN offers V2Ray obfuscation (VMess over QUIC/TCP) on all platforms plus obfs4 for OpenVPN on desktop. Mullvad counters with DAITA, a defence against traffic analysis that shapes traffic patterns (only in the Mullvad app, not on all servers). IVPN's multi-hop (entry+exit in different jurisdictions) is the more mature tool against a hostile local network; DAITA is the more interesting tool against metadata correlation outside the tunnel.
• Features. IVPN includes multi-hop, AntiTracker DNS blocking, a SOCKS5 proxy, and private DNS resolvers. Mullvad keeps the feature set deliberately small and explicitly declines port forwarding (as does IVPN).

Mullvad Browser

Mullvad does one thing IVPN doesn't: Mullvad Browser, developed with the Tor Project and released April 2023. It's a Firefox fork with Tor Browser's anti-fingerprinting patches, minus the Tor network – designed to be paired with a trustworthy VPN. It's free, open source, and requires no Mullvad account. This matters more than it sounds: VPN or not, your browser fingerprint is what actually identifies you, and a VPN provider shipping the right browser (not just "our VPN extension") shows a coherent privacy philosophy. IVPN's equivalent contribution is Portmaster integration on its top tier.

Jurisdiction: Sweden vs Gibraltar (not Panama)

Correcting a common error: Mullvad is not Panamanian – that's NordVPN. Mullvad VPN AB and its parent Amagicom AB are incorporated in Sweden, 100% owned by founders Fredrik Strömberg and Daniel Berntsson. Sweden is a 14-Eyes country, which is the honest knock against it; the April 2023 raid is the counter-evidence that the architecture holds under pressure. IVPN is incorporated in Gibraltar as IVPN Limited (formerly Privatus), publishes legal process guidelines for Gibraltar authorities, and states it complies with GDPR. Gibraltar is outside the EU and outside the Five/Nine/Eyes intelligence-sharing groupings. If jurisdiction on paper is your priority, Gibraltar edges Sweden; if demonstrated resilience to a police raid is your priority, Mullvad's record is the one to point at. Neither is perfect – but both are far better than the US- or Panama-incorporated VPNs with affiliates and email signups.

Neither provider is subject to Australia's TOLA Act or the Telecommunications Act Part 5-1A metadata retention regime – your Australian ISP still sees (and retains, for at least two years) the fact that you connect to an offshore VPN; the tunnel content is encrypted. A VPN hides which sites you visit from your ISP; it doesn't make the connection invisible.

Payment: cash, Monero, and crypto discounts

Both accept anonymous payment; Mullvad's menu is broader:

For Australians, Mullvad's cash-by-post accepting AUD is the more practical fully-anonymous path; IVPN's cash route is clunkier (longer plans only). Note that paying by card or PayPal constructs exactly the payment-to-account link both providers' privacy policies warn about.

Pricing in AUD

Mullvad charges a flat €5/month forever – one month, one year, or a decade, same rate – which its pricing page equates to A$8.16/month, with a 10% discount for crypto payments (→ ~A$7.34/month) and a 14-day money-back guarantee. No sales, ever; the price hasn't moved since 2009.

IVPN prices in USD across three tiers: Standard ($6/month, $60/year, $140/3yr – roughly A$9.10, A$7.60 and A$6.40/month respectively at ~A$1.52/USD), Plus (adds private DNS and email protection, $10/month), and Pro Suite (10 devices, Portmaster Pro, $15/month; $100/year ≈ A$15.20/month). A one-week $2 trial exists, which Mullvad lacks, and there's a 30-day refund window.

Rough parity at the entry tier. Mullvad is the better value if you want the VPN alone; IVPN's Plus/Pro tiers buy a broader privacy stack (DNS, email protection, Portmaster) at real money.

The Australia-specific wrinkle: server coverage

Here's the finding most comparisons miss. Checking Mullvad's live relay API while researching this piece, Mullvad currently has zero WireGuard servers in Australia – the Adelaide and Sydney relays shown historically are offline/removed, leaving Australians routing to Singapore, Tokyo, or LA, with the latency penalty that implies. IVPN, by contrast, operates Sydney gateways among its 58 locations, so you can stay in-country (useful for speed and for services that behave better with an AU exit IP). This flips a conventional assumption – check both live server lists before you pay, because Mullvad has changed this before.

Which fits which user

• Maximum anonymity on a budget, cash or Monero, minimal features: Mullvad. A$8.16/month flat, RAM-only partly-owned fleet, raid-proven, and the strongest payment-privacy path for Australians.
• Multi-hop, OpenVPN fallback, obfuscation for hostile networks, local AU servers, an integrated privacy stack (DNS, email, Portmaster): IVPN. Slightly more money, more capability, Gibraltar jurisdiction.
• Wants a browser from the same people: Mullvad, via Mullvad Browser (free regardless of subscription).
• Neither is for you if you need port forwarding, guaranteed streaming access, or a free plan – both explicitly refuse all three, and that refusal is part of why they're trustworthy.

We don't sell either service – StealthOz sells the hardware you test and harden with. If your threat model is Australian ISP metadata retention or border device searches, read what telcos actually keep and how ABF device searches work alongside this piece – a VPN is one layer of that picture, not the whole one.

← All posts