# Virtual cards privacy ratings

Virtual and masked payment cards.

| Name | Grade | Jurisdiction | Description |
| --- | --- | --- | --- |
| [IronVest](https://privacyratings.com/virtual-cards/ironvest/) | D (47/100) | United States (Five Eyes) | Privacy service formerly called Abine Blur that provides masked virtual payment cards, masked email addresses and masked phone numbers, along with password management. |
| [MySudo](https://privacyratings.com/virtual-cards/mysudo/) | F (34/100) | United States (Five Eyes) | App for creating separate personas called Sudos, each with its own phone number, email address, virtual payment cards and encrypted messaging. Virtual cards require identity verification. |
| [Privacy.com](https://privacyratings.com/virtual-cards/privacy-com/) | F (19/100) | United States (Five Eyes) | US service by Lithic that issues virtual Visa and Mastercard cards locked to single merchants or spending limits, hiding the real card number from merchants. Sign-up requires name, date of birth and a government ID number. |
| [Revolut](https://privacyratings.com/virtual-cards/revolut/) | F (13/100) | United Kingdom (Five Eyes) | Financial app offering accounts, payment cards, transfers and investing, including disposable and merchant-specific virtual cards. Accounts require identity verification. |

## Criteria

- **Open source** (weight 3): Is all the source code needed to run the product public?
- **No trackers or telemetry** (weight 3): Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
- **No ads or data sales** (weight 2): Is the product funded without advertising, ad targeting or selling user data?
- **Independent audit** (weight 2): Has an independent security or privacy audit been published within the last three years?
- **Transparency report** (weight 2): Does the provider regularly publish how many government and legal requests it receives and how it responds?
- **Tells users about requests** (weight 1): Does the provider promise to tell users about requests for their data, unless a court forbids it?
- **TLS configuration** (weight 2, automated): Does the website pass the Qualys SSL Labs test with a grade of A or better?
- **Security headers** (weight 1, automated): Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
- **Modern web standards** (weight 1, automated): Does the website score 90% or higher on the Internet.nl website test?

Source: https://privacyratings.com/virtual-cards/