# NymVPN privacy rating

VPN from Nym Technologies SA in Switzerland that runs on a decentralized network of independent nodes. It offers a fast two-hop WireGuard mode and an anonymous mode routed through the Nym mixnet.

## Summary

NymVPN scores 77 out of 100 (grade B) on the VPN providers criteria. It meets 7 of 12 criteria: open source, no ads or data sales, independent audit, TLS configuration, anonymous payment, open-source apps and modern protocols. It partly meets no trackers or telemetry, transparency report, security headers and audited no-logs policy. It does not meet tells users about requests. It is based in Switzerland: Not in the Five, Nine or Fourteen Eyes; GDPR-style data protection law. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.

- Website: https://nym.com
- Source code: https://github.com/nymtech/nym-vpn-client
- License: GPL-3.0
- Jurisdiction: Switzerland. Not in the Five, Nine or Fourteen Eyes. GDPR-style data protection law.
- Platforms: Windows, macOS, Linux, Android, iOS
- Home page trackers: none found
- Category: [VPN providers](https://privacyratings.com/vpns/)
- Also rated: [Nym](https://privacyratings.com/anonymity-networks/nym/) (Anonymity networks)
- Grade: B (77/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | The apps and the Nym network node software are open source under GPL-3.0. | https://github.com/nymtech/nym-vpn-client/blob/develop/LICENSE |
| No trackers or telemetry | Partial | App error reports via Sentry and usage statistics are off by default. The website uses self-hosted Matomo analytics. | https://nym.com/vpn-privacy-statement |
| No ads or data sales | Yes | Funded by paid subscriptions. The privacy statement rules out selling data to advertisers. | https://nym.com/pricing |
| Independent audit | Yes | Full Cure53 report on the apps, VPN, infrastructure and cryptography is public. | https://cure53.de/audit-report_nym.pdf |
| Transparency report | Partial | The privacy statement says requests will be challenged and made public. No request counts are published. | https://nym.com/vpn-privacy-statement |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=nym.com&hideResults=on |
| Security headers | Partial | Grade B (75/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=nym.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| Audited no-logs policy | Partial | The privacy statement describes a no-logs design with anonymous credentials. The Cure53 audit is a security audit, not a no-logs assessment. | https://nym.com/vpn-privacy-statement |
| Anonymous payment | Yes | Cash, Monero and Zcash are accepted, and no email is needed with these payment methods. | https://nym.com/vpn-privacy-statement |
| Open-source apps | Yes | Apps for Windows, macOS, Linux, Android and iOS are open source. | https://github.com/nymtech/nym-vpn-client |
| Modern protocols | Yes | The fast mode uses WireGuard across two hops. | https://nym.com/blog/building-decentralized-wireguard-vpn |

Source: https://privacyratings.com/vpns/nymvpn/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/vpns/nymvpn.md