There was an audit of the VPN servers earlier this year:

https://mullvad.net/en/blog/fourth-infrastructure-audit-comp...