Vicinus

The audit covered every public-facing component of Mullvad’s online presence, including the website, the Tor-only Onion service, the rsync setup, and the internal content management system (CMS). Each of these elements was examined for common attack vectors, misconfigurations, or any signs of hidden data collection.

I believe checking the “internal content management system (CMS)” is what they are using to say there were no logs.

They linked a more detailed report in the article, but I didn’t look at it. It may contain something different than my takeaway from the article.

I think it’s because the price would be different in different regions.

I think it would be nice if they added an example region though: “50% off (ex. USA: $10 - > $5)”.

Edit: added quotes.