Field Notes

entity

AzireVPN

StatusStableReviewdue UpdatedStands on7 sourcesSupportsnotes

AzireVPN is a Swedish VPN provider founded in Stockholm in 2012 and operated by Netbouncer AB (559089-4175). It built its reputation on infrastructure-level privacy guarantees: self-owned diskless servers booted into RAM, a kernel module that blinds its own operators to user traffic, and an early bet on WireGuard. Since November 2024 it is part of Malwarebytes, a US cybersecurity company, which makes it a useful case study in what ownership change does and does not alter about a privacy provider’s guarantees.

Technical model

AzireVPN’s distinguishing choice is physical ownership. It buys, configures, seals, and colocates every server it runs rather than renting capacity, arguing that rented or virtualized infrastructure leaves part of the trust chain in a third party’s hands. The servers contain no hard drives: they boot over the network via PXE into RAM, so no permanent storage exists on the machine. USB, VGA, and serial ports are sealed or disabled.

Blind Operator is the software complement. In 2017 AzireVPN hired WireGuard’s creator, Jason Donenfeld, to write an open-source Linux kernel module that zeroes out the endpoint and allowed-IPs fields of WireGuard peers, blocks packet-capture sockets and debugging interfaces, and cannot be unloaded once loaded. The point is not merely that AzireVPN promises not to look; the module removes the ordinary administrator’s ability to look, which the company frames as a defense against compelled realtime surveillance: it cannot be ordered to do something it does not know how to do. Blind Operator 2.0 (2023) went further, disabling SSH and console access on production servers entirely.

The service has been WireGuard-only since March 2025, when OpenVPN support ended. It runs first-party DNS, supports port forwarding since 2023, allows P2P on all servers, and permits five simultaneous connections. The network is small by commercial VPN standards — roughly 80 servers in about 26 countries — because expanding means shipping owned hardware to data centers the company judges trustworthy. There is no multi-hop.

Assurance

AzireVPN publishes transparency reports and a monthly Warrant canary, and its signup historically required no email address.

Its first full independent audit arrived only after the acquisition. X41 D-Sec audited the infrastructure between December 2025 and January 2026, covering AzireVPN and Malwarebytes Privacy VPN, which share the same server software and hardware. The white-box engagement combined a source-code audit with a physical penetration test on a production server shipped to X41’s lab in Germany. X41 observed no evidence of user activity logging and confirmed that production server images discard logs and ship with SSH, consoles, and local access disabled — the Blind Operator design verified from the inside.

The audit was not a clean bill of health. X41 found 14 vulnerabilities, two critical:

  • an unverified Debian image in the build supply chain (CVSS 9.4), where a compromised download host could yield a fully compromised server image;
  • an unverified boot chain (CVSS 9.3), because PXE boot files were not cryptographically verified.

The physical hardening also proved incomplete: with brief physical access, X41 recovered the BIOS password and dumped system memory via DMA, concluding that an attacker with data-center access could fully compromise a server. A further finding showed the production payment endpoint lacked access controls present in the reviewed source, a code-versus-deployment discrepancy. AzireVPN reported most findings fixed with the boot-chain issue still in remediation at publication.

The Malwarebytes acquisition

On 7 November 2024, Malwarebytes announced the acquisition for undisclosed terms, stating it would integrate AzireVPN’s technology and Blind Operator intellectual property into its products while keeping the AzireVPN brand and its no-logs, owned-and-diskless-server practices. AzireVPN’s own announcement promised unchanged standards and faster location expansion. Malwarebytes Privacy VPN — which had run on Mullvad’s server network since October 2019 — now shares AzireVPN’s infrastructure, which is why the X41 audit covered both services at once.

Two changes followed that users noticed. Cryptocurrency payments, previously central to AzireVPN’s pseudonymous-signup proposition, were discontinued with no plans to restore them. And the ultimate parent is now a US-incorporated company: Netbouncer AB remains the Swedish operating entity subject to Swedish and EU law, but ownership-chain analysis now has to account for US legal exposure at the parent level. The operating entity, the engineering, and the servers did not move; the accountability chain did.

The acquisition fits a consolidation pattern in which small privacy-focused VPN providers are absorbed by larger security vendors — OVPN was acquired by Pango the same year — leaving founder-owned Mullvad and IVPN as the remaining independent Swedish and privacy-first comparison points.

Limitations and open points

  • The network is small, so long-distance performance and streaming unblocking are inconsistent, and traffic-blending cover is thinner than on large networks.
  • One third-party review reported DNS leaks in its own testing and kill-switch coverage limited to Android; these predate or sit beside the current apps and have not been independently confirmed.
  • Sweden is a Fourteen Eyes participant, though Swedish law imposes no mandatory data retention on VPN providers; the post-2024 jurisdictional question is the US parent rather than Sweden itself.
  • Whether the technical culture survives long-term product integration is exactly the kind of claim that needs repeated verification, which is what Privacy claim assurance exists to test.

Relevance to the vault

AzireVPN is the clearest worked example in the vault of the assurance ladder for privacy claims: marketing promise, then architecture that makes the promise costly to break, then commissioned third-party verification with published scope and findings. It is also the counterexample on ownership: Swedish and EU privacy suppliers treats origin claims as per-SKU evidence, and AzireVPN shows why “Swedish VPN” needs a qualifier once the ultimate parent sits in another jurisdiction.

Built on 7 sources (7 external).

Working out connections…