Redesign larger pages (#2078)

Signed-off-by: Daniel Gray <dngray@privacyguides.org>

config/mkdocs.common.yml

@@ -80,6 +80,7 @@ plugins:
       - api.privacyguides.net/*
   optimize:
     enabled: !ENV [NETLIFY, false]
+  typeset: {}
 
 markdown_extensions:
   admonition: {}

config/mkdocs.en.yml

@@ -43,19 +43,19 @@ theme:
       accent: deep purple
       toggle:
         icon: material/brightness-auto
-        name: "Switch to light mode"
+        name: "Switch to dark mode"
     - media: "(prefers-color-scheme: dark)"
       scheme: slate
       accent: amber
       toggle:
         icon: material/brightness-2
-        name: "Switch to system theme"
+        name: "Switch to light mode"
     - media: "(prefers-color-scheme: light)"
       scheme: default
       accent: deep purple
       toggle:
         icon: material/brightness-5
-        name: "Switch to dark mode"
+        name: "Switch to system theme"
 
 plugins:
   social:
@@ -92,6 +92,7 @@ nav:
     - Advanced Topics:
       - 'advanced/dns-overview.md'
       - 'advanced/tor-overview.md'
+      - 'advanced/payments.md'
       - 'advanced/communication-network-types.md'
     - kb-archive.md
   - Recommendations:
@@ -108,10 +109,12 @@ nav:
       - 'cloud.md'
       - 'dns.md'
       - 'email.md'
+      - 'financial-services.md'
       - 'search-engines.md'
       - 'vpn.md'
     - Software:
       - 'calendar.md'
+      - 'cryptocurrency.md'
       - 'data-redaction.md'
       - 'email-clients.md'
       - 'encryption.md'

config/mkdocs.fr.yml

@@ -43,19 +43,19 @@ theme:
       accent: deep purple
       toggle:
         icon: material/brightness-auto
-        name: "Basculer en mode clair"
+        name: "Basculer en mode sombre"
     - media: "(prefers-color-scheme: dark)"
       scheme: slate
       accent: amber
       toggle:
         icon: material/brightness-2
-        name: "Basculer vers le thème du système"
+        name: "Basculer en mode clair"
     - media: "(prefers-color-scheme: light)"
       scheme: default
       accent: deep purple
       toggle:
         icon: material/brightness-5
-        name: "Basculer en mode sombre"
+        name: "Basculer vers le thème du système"
 
 plugins:
   social:
@@ -92,6 +92,7 @@ nav:
     - "Sujets avancés":
       - 'advanced/dns-overview.md'
       - 'advanced/tor-overview.md'
+      - 'advanced/payments.md'
       - 'advanced/communication-network-types.md'
     - kb-archive.md
   - Recommandations:
@@ -108,10 +109,12 @@ nav:
       - 'cloud.md'
       - 'dns.md'
       - 'email.md'
+      - 'financial-services.md'
       - 'search-engines.md'
       - 'vpn.md'
     - "Logiciels":
       - 'calendar.md'
+      - 'cryptocurrency.md'
       - 'data-redaction.md'
       - 'email-clients.md'
       - 'encryption.md'

config/mkdocs.he.yml

@@ -47,19 +47,19 @@ theme:
       accent: deep purple
       toggle:
         icon: material/brightness-auto
-        name: "עבור למצב בהיר"
+        name: "עבור למצב כהה"
     - media: "(prefers-color-scheme: dark)"
       scheme: slate
       accent: amber
       toggle:
         icon: material/brightness-2
-        name: "עבור לערכת הנושא של המערכת"
+        name: "עבור למצב בהיר"
     - media: "(prefers-color-scheme: light)"
       scheme: default
       accent: deep purple
       toggle:
         icon: material/brightness-5
-        name: "עבור למצב כהה"
+        name: "עבור לערכת הנושא של המערכת"
 
 plugins:
   social:
@@ -96,6 +96,7 @@ nav:
     - "נושאים מתקדמים":
       - 'advanced/dns-overview.md'
       - 'advanced/tor-overview.md'
+      - 'advanced/payments.md'
       - 'advanced/communication-network-types.md'
     - kb-archive.md
   - "המלצות":
@@ -112,10 +113,12 @@ nav:
       - 'cloud.md'
       - 'dns.md'
       - 'email.md'
+      - 'financial-services.md'
       - 'search-engines.md'
       - 'vpn.md'
     - "תוכנה":
       - 'calendar.md'
+      - 'cryptocurrency.md'
       - 'data-redaction.md'
       - 'email-clients.md'
       - 'encryption.md'

config/mkdocs.nl.yml

@@ -43,19 +43,19 @@ theme:
       accent: deep purple
       toggle:
         icon: material/brightness-auto
-        name: "Verander naar licht thema"
+        name: "Verander naar donker thema"
     - media: "(prefers-color-scheme: dark)"
       scheme: slate
       accent: amber
       toggle:
         icon: material/brightness-2
-        name: "Verander naar systeem thema"
+        name: "Verander naar licht thema"
     - media: "(prefers-color-scheme: light)"
       scheme: default
       accent: deep purple
       toggle:
         icon: material/brightness-5
-        name: "Verander naar donker thema"
+        name: "Verander naar systeem thema"
 
 plugins:
   social:
@@ -92,6 +92,7 @@ nav:
     - Gevorderde onderwerpen:
       - 'advanced/dns-overview.md'
       - 'advanced/tor-overview.md'
+      - 'advanced/payments.md'
       - 'advanced/communication-network-types.md'
     - kb-archive.md
   - Recommendaties:
@@ -108,10 +109,12 @@ nav:
       - 'cloud.md'
       - 'dns.md'
       - 'email.md'
+      - 'financial-services.md'
       - 'search-engines.md'
       - 'vpn.md'
     - Software:
       - 'calendar.md'
+      - 'cryptocurrency.md'
       - 'data-redaction.md'
       - 'email-clients.md'
       - 'encryption.md'

docs/advanced/payments.md

@@ -0,0 +1,83 @@
+---
+title: Private Payments
+icon: material/hand-coin
+---
+There's a reason data about your buying habits is considered the holy grail of ad targeting: your purchases can leak a veritable treasure trove of data about you. Unfortunately, the current financial system is anti-privacy by design, enabling banks, other companies, and governments to easily trace transactions. Nevertheless, you have plenty of options when it comes to making payments privately.
+
+## Cash
+
+For centuries, **cash** has functioned as the primary form of private payment. Cash has excellent privacy properties in most cases, is widely accepted in most countries, and is **fungible**, meaning it is non-unique and completely interchangable.
+
+Cash payment laws vary by country. In the United States, special disclosure is required for cash payments over $10,000 to the IRS on [Form 8300](https://www.irs.gov/businesses/small-businesses-self-employed/form-8300-and-reporting-cash-payments-of-over-10000). The receiving business is required to ID verify the payee’s name, address, occupation, date of birth, and Social Security Number or other TIN (with some exceptions). Lower limits without ID such as $3,000 or less exist for exchanges and money transmission. Cash also contains serial numbers. These are almost never tracked by merchants, but they can be used by law enforcement in targeted investigations.
+
+Despite this, it’s typically the best option.
+
+## Prepaid Cards & Gift Cards
+
+It’s relatively simple to purchase gift cards and prepaid cards at most grocery stores and convenience stores with cash. Gift cards usually don’t have a fee, though prepaid cards often do, so pay close attention to these fees and expiry dates. Some stores may ask to see your ID at checkout to reduce fraud.
+
+Gift cards usually have limits of up to $200 per card, but some offer limits of up to $2,000 per card. Prepaid cards (eg: from Visa or Mastercard) usually have limits of up to $1,000 per card.
+
+Gift cards have the downside of being subject to merchant policies, which can have terrible terms and restrictions. For example, some merchants don’t accept payment in gift cards exclusively, or they may cancel the value of the card if they consider you to be a high-risk user. Once you have merchant credit, the merchant has a strong degree of control over this credit.
+
+Prepaid cards don’t allow cash withdrawals from ATMs or “peer-to-peer” payments in Venmo and similar apps.
+
+Cash remains the best option for in-person purchases for most people. Gift cards can be useful for the savings they bring. Prepaid cards can be useful for places that don’t accept cash. Gift cards and prepaid cards are easier to use online than cash, and they are easier to acquire with cryptocurrencies than cash.
+
+### Online Marketplaces
+
+If you have [cryptocurrency](../cryptocurrency.md), you can purchase gift cards with an online gift card marketplace. Some of these services offer ID verification options for higher limits, but they also allow accounts with just an email address. Basic limits start at $5,000-10,000 a day for basic accounts, and significantly higher limits for ID verified accounts (if offered).
+
+When buying gift cards online, there is usually a slight discount. Prepaid cards are usually sold online at face value or with a fee. If you buy prepaid cards and gift cards with cryptocurrencies, you should strongly prefer to pay with Monero which provides strong privacy, more on this below. Paying for a gift card with a traceable payment method negates the benefits a gift card can provide when purchased with cash or Monero.
+
+- [Online Gift Card Marketplaces :material-arrow-right-drop-circle:](../financial-services.md#gift-card-marketplaces)
+
+## Virtual Cards
+
+Another way to protect your information from merchants online is to use virtual, single-use cards which mask your actual banking or billing information. This is primarily useful for protecting you from merchant data breaches, less sophisticated tracking or purchase correlation by marketing agencies, and online data theft. They do **not** assist you in making a purchase completely anonymously, nor do they hide any information from the banking institution themselves. Regular financial institutions which offer virtual cards are subject to "Know Your Customer" (KYC) laws, meaning they may require your ID or other identifying information.
+
+- [Recommended Payment Masking Services :material-arrow-right-drop-circle:](../financial-services.md#payment-masking-services)
+
+These tend to be good options for recurring/subscription payments online, while prepaid gift cards are preferred for one-time transactions.
+
+## Cryptocurrency
+
+Cryptocurrencies are a digital form of currency designed to work without central authorities such as a government or bank. While *some* cryptocurrency projects can allow you to make private transactions online, many use a public blockchain which does not provide any transaction privacy. Cryptocurrencies also tend to be very volatile assets, meaning their value can change rapidly and significantly at any time. As such, we generally don't recommend using cryptocurrency as a long-term store of value. If you decide to use cryptocurrency online, make sure you have a full understanding of its privacy aspects beforehand, and only invest amounts which would not be disastrous to lose.
+
+!!! danger
+
+    The vast majority of cryptocurrencies operate on a **public** blockchain, meaning that every transaction is public knowledge. This includes even most well-known cryptocurrencies like Bitcoin and Ethereum. Transactions with these cryptocurrencies should not be considered private and will not protect your anonymity.
+
+    Additionally, many if not most cryptocurrencies are scams. Make transactions carefully with only projects you trust.
+
+### Privacy Coins
+
+There are a number of cryptocurrency projects which purport to provide privacy by making transactions anonymous. We recommend using one which provides transaction anonymity **by default** to avoid operational errors.
+
+- [Recommended Cryptocurrency :material-arrow-right-drop-circle:](../cryptocurrency.md#coins)
+
+Privacy coins have been subject to increasing scrutiny by government agencies. In 2020, [the IRS published a $625,000 bounty](https://www.forbes.com/sites/kellyphillipserb/2020/09/14/irs-will-pay-up-to-625000-if-you-can-crack-monero-other-privacy-coins/?sh=2e9808a085cc) for tools which can break Bitcoin Lightning Network and/or Monero's transaction privacy. They ultimately [paid two companies](https://sam.gov/opp/5ab94eae1a8d422e88945b64181c6018/view) (Chainalysis and Integra Fec) a combined $1.25 million for tools which purport to do so (it is unknown which cryptocurrency network these tools target). Due to the secrecy surrounding tools like these, ==none of these methods of tracing cryptocurrencies have been independently confirmed.== It is quite likely that tools which assist targeted investigations into private coin transactions exist, and that privacy coins only succeed in thwarting mass surveillance.
+
+### Other Coins (Bitcoin, Ethereum, etc.)
+
+The vast majority of cryptocurrency projects use a public blockchain, meaning that all transactions are both easily traceable and permanent. As such, we strongly discourage the use of most cryptocurrency for privacy-related reasons.
+
+Anonymous transactions on a public blockchain are *theoretically* possible, and the Bitcoin wiki [gives one example of a "completely anonymous" transaction](https://en.bitcoin.it/wiki/Privacy#Example_-_A_perfectly_private_donation). However, doing so requires a complicated setup involving Tor and "solo-mining" a block to generate completely independent cryptocurrency, a practice which has not been practical for nearly any enthusiast for many years.
+
+==Your best option is to avoid these cryptocurrencies entirely and stick with one which provides privacy by default.== Attempting to use other cryptocurrency is outside the scope of this site and strongly discouraged.
+
+### Wallet Custody
+
+With cryptocurrency there are two forms of wallets: custodial wallets and noncustodial wallets. Custodial wallets are operated by centralized companies/exchanges, where the private key for your wallet is held by that company, and you can access them anywhere typically with a regular username and password. Noncustodial wallets are wallets where you control and manage the private keys to access it. Assuming you keep your wallet's private keys secured and backed up, noncustodial wallets provide greater security and censorship-resistance over custodial wallets, because your cryptocurrency can't be stolen or frozen by a company with custody over your private keys. Key custody is especially important when it comes to privacy coins: Custodial wallets grant the operating company the ability to view your transactions, negating the privacy benefits of those cryptocurrencies.
+
+### Acquisition
+
+Acquiring [cryptocurrencies](../cryptocurrency.md) like Monero privately can be difficult. P2P marketplaces like [LocalMonero](https://localmonero.co/), a platform which facilitates trades between people, are one option that can be used. If using an exchange which requires KYC is an acceptable risk for you as long as subsequent transactions can't be traced, a much easier option is to purchase Monero on an exchange like [Kraken](https://kraken.com/), or purchase Bitcoin/Litecoin from a KYC exchange which can then be swapped for Monero. Then, you can withdraw the purchased Monero to your own noncustodial wallet to use privately from that point forward.
+
+If you go this route, make sure to purchase Monero at different times and in different amounts than where you will spend it. If you purchase $5000 of Monero at an exchange and make a $5000 purchase in Monero an hour later, those actions could potentially be correlated by an outside observer regardless of which path the Monero took. Staggering purchases and purchasing larger amounts of Monero in advance to later spend on multiple smaller transactions can avoid this pitfall.
+
+## Additional Considerations
+
+When you're making a payment in-person with cash, make sure to keep your in-person privacy in mind. Security cameras are ubiquitous. Consider wearing non-distinct clothing and a face mask (such as a surgical mask or N95). Don’t sign up for rewards programs or provide any other information about yourself.
+
+When purchasing online, ideally you should do so over [Tor](tor-overview.md). However, many merchants don’t allow purchases with Tor. You can consider using a [recommended VPN](../vpn.md) (paid for with cash, gift card, or Monero), or making the purchase from a coffee shop or library with free Wi-Fi. If you are ordering a physical item that needs to be delivered, you will need to provide a delivery address. You should consider using a PO box, private mailbox, or work address.

docs/android.md

@@ -13,8 +13,9 @@ The **Android Open Source Project** is an open-source mobile operating system le
 
 These are the Android operating systems, devices, and apps we recommend to maximize your mobile device's security and privacy. To learn more about Android:
 
-- [General Android Overview :material-arrow-right-drop-circle:](os/android-overview.md)
-- [Why we recommend GrapheneOS over CalyxOS :material-arrow-right-drop-circle:](https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos/)
+[General Android Overview :material-arrow-right-drop-circle:](os/android-overview.md){ .md-button }
+
+[Why we recommend GrapheneOS over CalyxOS :material-arrow-right-drop-circle:](https://blog.privacyguides.org/2022/04/21/grapheneos-or-calyxos/){ .md-button }
 
 ## AOSP Derivatives
 

docs/cryptocurrency.md

@@ -0,0 +1,53 @@
+---
+title: Cryptocurrency
+icon: material/bank-circle
+---
+
+Making payments online is one of the biggest challenges to privacy. These cryptocurrencies provide transaction privacy by default (something which is **not** guaranteed by the majority of cryptocurrencies), provided you have a strong understanding of how to make private payments effectively. We strongly encourage you first read our payments overview article before making any purchases:
+
+[Making Private Payments :material-arrow-right-drop-circle:](advanced/payments.md){ .md-button }
+
+!!! danger
+
+    Many if not most cryptocurrency projects are scams. Make transactions carefully with only projects you trust.
+
+## Monero
+
+!!! recommendation
+
+    ![Monero logo](assets/img/cryptocurrency/monero.svg){ align=right }
+
+    **Monero** uses a blockchain with privacy-enhancing technologies that obfuscate transactions to achieve anonymity. Every Monero transaction hides the transaction amount, sending and receiving addresses, and source of funds without any hoops to jump through, making it an ideal choice for cryptocurrency novices.
+
+    [:octicons-home-16: Homepage](https://www.getmonero.org/){ .md-button .md-button--primary }
+    [:octicons-info-16:](https://www.getmonero.org/resources/user-guides/){ .card-link title=Documentation}
+    [:octicons-code-16:](https://github.com/monero-project/monero){ .card-link title="Source Code" }
+    [:octicons-heart-16:](https://www.getmonero.org/get-started/contributing/){ .card-link title=Contribute }
+
+With Monero, outside observers cannot decipher addresses trading Monero, transaction amounts, address balances, or transaction histories.
+
+For optimal privacy, make sure to use a noncustodial wallet where the view key stays on the device. This means that only you will have the ability to spend your funds and see incoming and outgoing transactions. If you use a custodial wallet, the provider can see **everything** you do; if you use a “lightweight” wallet where the provider retains your private view key, the provider can see almost everything you do. Some noncustodial wallets include:
+
+- [Official Monero client](https://getmonero.org/downloads) (Desktop)
+- [Cake Wallet](https://cakewallet.com/) (iOS, Android)
+    - Cake Wallet supports multiple cryptocurrencies. A Monero-only version of Cake Wallet is available at [Monero.com](https://monero.com/).
+- [Feather Wallet](https://featherwallet.org/) (Desktop)
+- [Monerujo](https://www.monerujo.io/) (Android)
+
+For maximum privacy (even with a noncustodial wallet), you should run your own Monero node. Using another person’s node will expose some information to them, such as the IP address that you connect to it from, the timestamps that you sync your wallet, and the transactions that you send from your wallet (though no other details about those transactions). Alternatively, you can connect to someone else’s Monero node over Tor or i2p.
+
+In August 2021, CipherTrace [announced](https://finance.yahoo.com/news/ciphertrace-announces-enhanced-monero-tracing-160000275.html) enhanced Monero tracing capabilities for government agencies. Public postings show that the US Department of the Treasury's Financial Crimes Enforcement Network [licensed](https://sam.gov/opp/d12cbe9afbb94ca68006d0f006d355ac/view) CipherTrace's "Monero Module" in late 2022.
+
+Monero transaction graph privacy is limited by its relatively small ring signatures, especially against targeted attacks. Monero's privacy features have also been [called into question](https://web.archive.org/web/20180331203053/https://www.wired.com/story/monero-privacy/) by some security researchers, and a number of severe vulnerabilities have been found and patched in the past, so the claims made by organizations like CipherTrace are not out of the question. While it's unlikely that Monero mass surveillance tools exist like they do for Bitcoin and others, it's certain that tracing tools assist with targeted investigations.
+
+Ultimately, Monero is the strongest contender for a privacy-friendly cryptocurrency, but its privacy claims have **not** been definitively proven one way or the other. More time and research is needed to assess whether Monero is resilient enough to attacks to always provide adequate privacy.
+
+## Criteria
+
+**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
+
+!!! example "This section is new"
+
+    We are working on establishing defined criteria for every section of our site, and this may be subject to change. If you have any questions about our criteria, please [ask on our forum](https://discuss.privacyguides.net/latest) and don't assume we didn't consider something when making our recommendations if it is not listed here. There are many factors considered and discussed when we recommend a project, and documenting every single one is a work-in-progress.
+
+- Cryptocurrency must provide private/untraceable transactions by default.

docs/dns.md

@@ -3,11 +3,9 @@ title: "DNS Resolvers"
 icon: material/dns
 ---
 
-!!! question "Should I use encrypted DNS?"
+Encrypted DNS with third-party servers should only be used to get around basic [DNS blocking](https://en.wikipedia.org/wiki/DNS_blocking) when you can be sure there won't be any consequences. Encrypted DNS will not help you hide any of your browsing activity.
 
-    Encrypted DNS with third-party servers should only be used to get around basic [DNS blocking](https://en.wikipedia.org/wiki/DNS_blocking) when you can be sure there won't be any consequences. Encrypted DNS will not help you hide any of your browsing activity.
-
-    [Learn more about DNS](advanced/dns-overview.md){ .md-button }
+[Learn more about DNS :material-arrow-right-drop-circle:](advanced/dns-overview.md){ .md-button }
 
 ## Recommended Providers
 

docs/email.md

@@ -8,9 +8,21 @@ Email is practically a necessity for using any online service, however we do not
 
 For everything else, we recommend a variety of email providers based on sustainable business models and built-in security and privacy features.
 
+- [OpenPGP-Compatible Email Providers :material-arrow-right-drop-circle:](#openpgp-compatible-services)
+- [Other Encrypted Providers :material-arrow-right-drop-circle:](#more-providers)
+- [Email Aliasing Services :material-arrow-right-drop-circle:](#email-aliasing-services)
+- [Self-Hosted Options :material-arrow-right-drop-circle:](#self-hosting-email)
+
 ## OpenPGP Compatible Services
 
-These providers natively support OpenPGP encryption/decryption, allowing for provider-agnostic E2EE emails. For example, a Proton Mail user could send an E2EE message to a Mailbox.org user, or you could receive OpenPGP-encrypted notifications from internet services which support it.
+These providers natively support OpenPGP encryption/decryption and the Web Key Directory (WKD) standard, allowing for provider-agnostic E2EE emails. For example, a Proton Mail user could send an E2EE message to a Mailbox.org user, or you could receive OpenPGP-encrypted notifications from internet services which support it.
+
+<div class="grid cards" markdown>
+
+- ![Proton Mail logo](assets/img/email/protonmail.svg){ .twemoji } [Proton Mail](email.md#proton-mail)
+- ![Mailbox.org logo](assets/img/email/mailboxorg.svg){ .twemoji } [Mailbox.org](email.md#mailboxorg)
+
+</div>
 
 !!! warning
 
@@ -48,41 +60,41 @@ If you have the Proton Unlimited, Business, or Visionary Plan, you also get [Sim
 
 Proton Mail has internal crash reports that they **do not** share with third parties. This can be disabled in: **Settings** > **Go to Settings** > **Account** > **Security and privacy** > **Send crash reports**.
 
-??? success "Custom Domains and Aliases"
+#### :material-check:{ .pg-green } Custom Domains and Aliases
 
-    Paid Proton Mail subscribers can use their own domain with the service or a [catch-all](https://proton.me/support/catch-all) address. Proton Mail also supports [subaddressing](https://proton.me/support/creating-aliases), which is useful for people who don't want to purchase a domain.
+Paid Proton Mail subscribers can use their own domain with the service or a [catch-all](https://proton.me/support/catch-all) address. Proton Mail also supports [subaddressing](https://proton.me/support/creating-aliases), which is useful for people who don't want to purchase a domain.
 
-??? success "Private Payment Methods"
+#### :material-check:{ .pg-green } Private Payment Methods
 
-    Proton Mail [accepts](https://proton.me/support/payment-options) Bitcoin and cash by mail in addition to standard credit/debit card and PayPal payments.
+Proton Mail [accepts](https://proton.me/support/payment-options) Bitcoin and cash by mail in addition to standard credit/debit card and PayPal payments.
 
-??? success "Account Security"
+#### :material-check:{ .pg-green } Account Security
 
-    Proton Mail supports TOTP [two factor authentication](https://proton.me/support/two-factor-authentication-2fa) only. The use of a U2F security key is not yet supported. Proton Mail is planning to implement U2F upon completion of their [Single Sign On (SSO)](https://reddit.com/comments/cheoy6/comment/feh2lw0/) code.
+Proton Mail supports TOTP [two factor authentication](https://proton.me/support/two-factor-authentication-2fa) only. The use of a U2F security key is not yet supported. Proton Mail is planning to implement U2F upon completion of their [Single Sign On (SSO)](https://reddit.com/comments/cheoy6/comment/feh2lw0/) code.
 
-??? success "Data Security"
+#### :material-check:{ .pg-green } Data Security
 
-    Proton Mail has [zero-access encryption](https://proton.me/blog/zero-access-encryption) at rest for your emails and [calendars](https://proton.me/news/protoncalendar-security-model). Data secured with zero-access encryption is only accessible by you.
+Proton Mail has [zero-access encryption](https://proton.me/blog/zero-access-encryption) at rest for your emails and [calendars](https://proton.me/news/protoncalendar-security-model). Data secured with zero-access encryption is only accessible by you.
 
-    Certain information stored in [Proton Contacts](https://proton.me/support/proton-contacts), such as display names and email addresses, are not secured with zero-access encryption. Contact fields that support zero-access encryption, such as phone numbers, are indicated with a padlock icon.
+Certain information stored in [Proton Contacts](https://proton.me/support/proton-contacts), such as display names and email addresses, are not secured with zero-access encryption. Contact fields that support zero-access encryption, such as phone numbers, are indicated with a padlock icon.
 
-??? success "Email Encryption"
+#### :material-check:{ .pg-green } Email Encryption
 
-    Proton Mail has [integrated OpenPGP encryption](https://proton.me/support/how-to-use-pgp) in their webmail. Emails to other Proton Mail accounts are encrypted automatically, and encryption to non-Proton Mail addresses with an OpenPGP key can be enabled easily in your account settings. They also allow you to [encrypt messages to non-Proton Mail addresses](https://proton.me/support/password-protected-emails) without the need for them to sign up for a Proton Mail account or use software like OpenPGP.
+Proton Mail has [integrated OpenPGP encryption](https://proton.me/support/how-to-use-pgp) in their webmail. Emails to other Proton Mail accounts are encrypted automatically, and encryption to non-Proton Mail addresses with an OpenPGP key can be enabled easily in your account settings. They also allow you to [encrypt messages to non-Proton Mail addresses](https://proton.me/support/password-protected-emails) without the need for them to sign up for a Proton Mail account or use software like OpenPGP.
 
-    Proton Mail also supports the discovery of public keys via HTTP from their [Web Key Directory (WKD)](https://wiki.gnupg.org/WKD). This allows people who don't use Proton Mail to find the OpenPGP keys of Proton Mail accounts easily, for cross-provider E2EE.
+Proton Mail also supports the discovery of public keys via HTTP from their [Web Key Directory (WKD)](https://wiki.gnupg.org/WKD). This allows people who don't use Proton Mail to find the OpenPGP keys of Proton Mail accounts easily, for cross-provider E2EE.
 
-??? warning "Digital Legacy"
+#### :material-alert-outline:{ .pg-orange } Digital Legacy
 
-    Proton Mail doesn't offer a digital legacy feature.
+Proton Mail doesn't offer a digital legacy feature.
 
-??? info "Account Termination"
+#### :material-information-outline:{ .pg-blue } Account Termination
 
-    If you have a paid account and your [bill is unpaid](https://proton.me/support/delinquency) after 14 days, you won't be able to access your data. After 30 days, your account will become delinquent and won't receive incoming mail. You will continue to be billed during this period.
+If you have a paid account and your [bill is unpaid](https://proton.me/support/delinquency) after 14 days, you won't be able to access your data. After 30 days, your account will become delinquent and won't receive incoming mail. You will continue to be billed during this period.
 
-??? info "Additional Functionality"
+#### :material-information-outline:{ .pg-blue } Additional Functionality
 
-    Proton Mail offers an "Unlimited" account for €9.99/Month, which also enables access to Proton VPN in addition to providing multiple accounts, domains, aliases, and 500GB of storage.
+Proton Mail offers an "Unlimited" account for €9.99/Month, which also enables access to Proton VPN in addition to providing multiple accounts, domains, aliases, and 500GB of storage.
 
 ### Mailbox.org
 
@@ -100,43 +112,54 @@ Proton Mail has internal crash reports that they **do not** share with third par
 
         - [:octicons-browser-16: Web](https://login.mailbox.org)
 
-??? success "Custom Domains and Aliases"
+#### :material-check:{ .pg-green } Custom Domains and Aliases
 
-    Mailbox.org lets you use your own domain, and they support [catch-all](https://kb.mailbox.org/display/MBOKBEN/Using+catch-all+alias+with+own+domain) addresses. Mailbox.org also supports [subaddressing](https://kb.mailbox.org/display/BMBOKBEN/What+is+an+alias+and+how+do+I+use+it), which is useful if you don't want to purchase a domain.
+Mailbox.org lets you use your own domain, and they support [catch-all](https://kb.mailbox.org/display/MBOKBEN/Using+catch-all+alias+with+own+domain) addresses. Mailbox.org also supports [subaddressing](https://kb.mailbox.org/display/BMBOKBEN/What+is+an+alias+and+how+do+I+use+it), which is useful if you don't want to purchase a domain.
 
-??? info "Private Payment Methods"
+#### :material-information-outline:{ .pg-blue } Private Payment Methods
 
-    Mailbox.org doesn't accept Bitcoin or any other cryptocurrencies as a result of their payment processor BitPay suspending operations in Germany. However, they do accept Cash by mail, cash payment to bank account, bank transfer, credit card, PayPal and couple of German-specific processors: paydirekt and Sofortüberweisung.
+Mailbox.org doesn't accept Bitcoin or any other cryptocurrencies as a result of their payment processor BitPay suspending operations in Germany. However, they do accept Cash by mail, cash payment to bank account, bank transfer, credit card, PayPal and couple of German-specific processors: paydirekt and Sofortüberweisung.
 
-??? success "Account Security"
+#### :material-check:{ .pg-green } Account Security
 
-    Mailbox.org supports [two factor authentication](https://kb.mailbox.org/display/MBOKBEN/How+to+use+two-factor+authentication+-+2FA) for their webmail only. You can use either TOTP or a [Yubikey](https://en.wikipedia.org/wiki/YubiKey) via the [Yubicloud](https://www.yubico.com/products/services-software/yubicloud). Web standards such as [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn) are not yet supported.
+Mailbox.org supports [two factor authentication](https://kb.mailbox.org/display/MBOKBEN/How+to+use+two-factor+authentication+-+2FA) for their webmail only. You can use either TOTP or a [Yubikey](https://en.wikipedia.org/wiki/YubiKey) via the [Yubicloud](https://www.yubico.com/products/services-software/yubicloud). Web standards such as [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn) are not yet supported.
 
-??? info "Data Security"
+#### :material-information-outline:{ .pg-blue } Data Security
 
-    Mailbox.org allows for encryption of incoming mail using their [encrypted mailbox](https://kb.mailbox.org/display/MBOKBEN/The+Encrypted+Mailbox). New messages that you receive will then be immediately encrypted with your public key.
+Mailbox.org allows for encryption of incoming mail using their [encrypted mailbox](https://kb.mailbox.org/display/MBOKBEN/The+Encrypted+Mailbox). New messages that you receive will then be immediately encrypted with your public key.
 
-    However, [Open-Exchange](https://en.wikipedia.org/wiki/Open-Xchange), the software platform used by Mailbox.org, [does not support](https://kb.mailbox.org/display/BMBOKBEN/Encryption+of+calendar+and+address+book) the encryption of your address book and calendar. A [standalone option](calendar.md) may be more appropriate for that information.
+However, [Open-Exchange](https://en.wikipedia.org/wiki/Open-Xchange), the software platform used by Mailbox.org, [does not support](https://kb.mailbox.org/display/BMBOKBEN/Encryption+of+calendar+and+address+book) the encryption of your address book and calendar. A [standalone option](calendar.md) may be more appropriate for that information.
 
-??? success "Email Encryption"
+#### :material-check:{ .pg-green } Email Encryption
 
-    Mailbox.org has [integrated encryption](https://kb.mailbox.org/display/MBOKBEN/Send+encrypted+e-mails+with+Guard) in their webmail, which simplifies sending messages to people with public OpenPGP keys. They also allow [remote recipients to decrypt an email](https://kb.mailbox.org/display/MBOKBEN/My+recipient+does+not+use+PGP) on Mailbox.org's servers. This feature is useful when the remote recipient does not have OpenPGP and cannot decrypt a copy of the email in their own mailbox.
+Mailbox.org has [integrated encryption](https://kb.mailbox.org/display/MBOKBEN/Send+encrypted+e-mails+with+Guard) in their webmail, which simplifies sending messages to people with public OpenPGP keys. They also allow [remote recipients to decrypt an email](https://kb.mailbox.org/display/MBOKBEN/My+recipient+does+not+use+PGP) on Mailbox.org's servers. This feature is useful when the remote recipient does not have OpenPGP and cannot decrypt a copy of the email in their own mailbox.
 
-    Mailbox.org also supports the discovery of public keys via HTTP from their [Web Key Directory (WKD)](https://wiki.gnupg.org/WKD). This allows people outside of Mailbox.org to find the OpenPGP keys of Mailbox.org accounts easily, for cross-provider E2EE.
+Mailbox.org also supports the discovery of public keys via HTTP from their [Web Key Directory (WKD)](https://wiki.gnupg.org/WKD). This allows people outside of Mailbox.org to find the OpenPGP keys of Mailbox.org accounts easily, for cross-provider E2EE.
 
-??? success "Digital Legacy"
+#### :material-check:{ .pg-green } Digital Legacy
 
-    Mailbox.org has a digital legacy feature for all plans. You can choose whether you want any of your data to be passed to heirs providing that they apply and provide your testament. Alternatively, you can nominate a person by name and address.
+Mailbox.org has a digital legacy feature for all plans. You can choose whether you want any of your data to be passed to heirs providing that they apply and provide your testament. Alternatively, you can nominate a person by name and address.
 
-??? info "Account Termination"
+#### :material-information-outline:{ .pg-blue } Account Termination
 
-    Your account will be set to a restricted user account when your contract ends, after [30 days it will be irrevocably deleted](https://kb.mailbox.org/en/private/payment-article/what-happens-at-the-end-of-my-contract).
+Your account will be set to a restricted user account when your contract ends, after [30 days it will be irrevocably deleted](https://kb.mailbox.org/en/private/payment-article/what-happens-at-the-end-of-my-contract).
 
-??? info "Additional Functionality"
+#### :material-information-outline:{ .pg-blue } Additional Functionality
 
-    You can access your Mailbox.org account via IMAP/SMTP using their [.onion service](https://kb.mailbox.org/display/MBOKBEN/The+Tor+exit+node+of+mailbox.org). However, their webmail interface cannot be accessed via their .onion service and you may experience TLS certificate errors.
+You can access your Mailbox.org account via IMAP/SMTP using their [.onion service](https://kb.mailbox.org/display/MBOKBEN/The+Tor+exit+node+of+mailbox.org). However, their webmail interface cannot be accessed via their .onion service and you may experience TLS certificate errors.
 
-    All accounts come with limited cloud storage that [can be encrypted](https://kb.mailbox.org/display/MBOKBEN/Encrypt+files+on+your+Drive). Mailbox.org also offers the alias [@secure.mailbox.org](https://kb.mailbox.org/display/MBOKBEN/Ensuring+E-Mails+are+Sent+Securely), which enforces the TLS encryption on the connection between mail servers, otherwise the message will not be sent at all. Mailbox.org also supports [Exchange ActiveSync](https://en.wikipedia.org/wiki/Exchange_ActiveSync) in addition to standard access protocols like IMAP and POP3.
+All accounts come with limited cloud storage that [can be encrypted](https://kb.mailbox.org/display/MBOKBEN/Encrypt+files+on+your+Drive). Mailbox.org also offers the alias [@secure.mailbox.org](https://kb.mailbox.org/display/MBOKBEN/Ensuring+E-Mails+are+Sent+Securely), which enforces the TLS encryption on the connection between mail servers, otherwise the message will not be sent at all. Mailbox.org also supports [Exchange ActiveSync](https://en.wikipedia.org/wiki/Exchange_ActiveSync) in addition to standard access protocols like IMAP and POP3.
+
+## More Providers
+
+These providers store your emails with zero-knowledge encryption, making them great options for keeping your stored emails secure. However, they don't support interoperable encryption standards for E2EE communications between providers.
+
+<div class="grid cards" markdown>
+
+- ![StartMail logo](assets/img/email/startmail.svg#only-light){ .twemoji }![StartMail logo](assets/img/email/startmail-dark.svg#only-dark){ .twemoji } [StartMail](email.md#startmail)
+- ![Tutanota logo](assets/img/email/tutanota.svg){ .twemoji } [Tutanota](email.md#tutanota)
+
+</div>
 
 ### StartMail
 
@@ -155,43 +178,39 @@ Proton Mail has internal crash reports that they **do not** share with third par
 
         - [:octicons-browser-16: Web](https://mail.startmail.com/login)
 
-??? success "Custom Domains and Aliases"
+#### :material-check:{ .pg-green } Custom Domains and Aliases
 
-    Personal accounts can use [Custom or Quick](https://support.startmail.com/hc/en-us/articles/360007297457-Aliases) aliases. [Custom domains](https://support.startmail.com/hc/en-us/articles/4403911432209-Setup-a-custom-domain) are also available.
+Personal accounts can use [Custom or Quick](https://support.startmail.com/hc/en-us/articles/360007297457-Aliases) aliases. [Custom domains](https://support.startmail.com/hc/en-us/articles/4403911432209-Setup-a-custom-domain) are also available.
 
-??? warning "Private Payment Methods"
+#### :material-alert-outline:{ .pg-orange } Private Payment Methods
 
-    StartMail accepts Visa, MasterCard, American Express and Paypal. StartMail also has other [payment options](https://support.startmail.com/hc/en-us/articles/360006620637-Payment-methods) such as Bitcoin (currently only for Personal accounts) and SEPA Direct Debit for accounts older than a year.
+StartMail accepts Visa, MasterCard, American Express and Paypal. StartMail also has other [payment options](https://support.startmail.com/hc/en-us/articles/360006620637-Payment-methods) such as Bitcoin (currently only for Personal accounts) and SEPA Direct Debit for accounts older than a year.
 
-??? success "Account Security"
+#### :material-check:{ .pg-green } Account Security
 
-    StartMail supports TOTP two factor authentication [for webmail only](https://support.startmail.com/hc/en-us/articles/360006682158-Two-factor-authentication-2FA). They do not allow U2F security key authentication.
+StartMail supports TOTP two factor authentication [for webmail only](https://support.startmail.com/hc/en-us/articles/360006682158-Two-factor-authentication-2FA). They do not allow U2F security key authentication.
 
-??? info "Data Security"
+#### :material-information-outline:{ .pg-blue } Data Security
 
-    StartMail has [zero access encryption at rest](https://www.startmail.com/en/whitepaper/#_Toc458527835), using their "user vault" system. When you log in, the vault is opened, and the email is then moved to the vault out of the queue where it is decrypted by the corresponding private key.
+StartMail has [zero access encryption at rest](https://www.startmail.com/en/whitepaper/#_Toc458527835), using their "user vault" system. When you log in, the vault is opened, and the email is then moved to the vault out of the queue where it is decrypted by the corresponding private key.
 
-    StartMail supports importing [contacts](https://support.startmail.com/hc/en-us/articles/360006495557-Import-contacts) however, they are only accessible in the webmail and not through protocols such as [CalDAV](https://en.wikipedia.org/wiki/CalDAV). Contacts are also not stored using zero knowledge encryption.
+StartMail supports importing [contacts](https://support.startmail.com/hc/en-us/articles/360006495557-Import-contacts) however, they are only accessible in the webmail and not through protocols such as [CalDAV](https://en.wikipedia.org/wiki/CalDAV). Contacts are also not stored using zero knowledge encryption.
 
-??? success "Email Encryption"
+#### :material-check:{ .pg-green } Email Encryption
 
-    StartMail has [integrated encryption](https://support.startmail.com/hc/en-us/sections/360001889078-Encryption) in their webmail, which simplifies sending encrypted messages with public OpenPGP keys.
+StartMail has [integrated encryption](https://support.startmail.com/hc/en-us/sections/360001889078-Encryption) in their webmail, which simplifies sending encrypted messages with public OpenPGP keys. However, they do not support the Web Key Directory standard, making the discovery of a Startmail mailbox's public key more challenging for other email providers or clients.
 
-??? warning "Digital Legacy"
+#### :material-alert-outline:{ .pg-orange } Digital Legacy
 
-    StartMail does not offer a digital legacy feature.
+StartMail does not offer a digital legacy feature.
 
-??? info "Account Termination"
+#### :material-information-outline:{ .pg-blue } Account Termination
 
-    On account expiration, StartMail will permanently delete your account after [6 months in 3 phases](https://support.startmail.com/hc/en-us/articles/360006794398-Account-expiration).
+On account expiration, StartMail will permanently delete your account after [6 months in 3 phases](https://support.startmail.com/hc/en-us/articles/360006794398-Account-expiration).
 
-??? info "Additional Functionality"
+#### :material-information-outline:{ .pg-blue } Additional Functionality
 
-    StartMail allows for proxying of images within emails. If you allow the remote image to be loaded, the sender won't know what your IP address is.
-
-## More Providers
-
-These providers store your emails with zero-knowledge encryption, making them great options for keeping your stored emails secure. However, they don't support interoperable encryption standards for E2EE communications between providers.
+StartMail allows for proxying of images within emails. If you allow the remote image to be loaded, the sender won't know what your IP address is.
 
 ### Tutanota
 
@@ -219,44 +238,51 @@ These providers store your emails with zero-knowledge encryption, making them gr
 
 Tutanota doesn't support the [IMAP protocol](https://tutanota.com/faq/#imap) or the use of third-party [email clients](email-clients.md), and you also won't be able to add [external email accounts](https://github.com/tutao/tutanota/issues/544#issuecomment-670473647) to the Tutanota app. Neither [Email import](https://github.com/tutao/tutanota/issues/630) or [subfolders](https://github.com/tutao/tutanota/issues/927) are currently supported, though this is [due to be changed](https://tutanota.com/blog/posts/kickoff-import). Emails can be exported [individually or by bulk selection](https://tutanota.com/howto#generalMail) per folder, which may be inconvenient if you have many folders.
 
-??? success "Custom Domains and Aliases"
+#### :material-check:{ .pg-green } Custom Domains and Aliases
 
-    Paid Tutanota accounts can use up to 5 [aliases](https://tutanota.com/faq#alias) and [custom domains](https://tutanota.com/faq#custom-domain). Tutanota doesn't allow for [subaddressing (plus addresses)](https://tutanota.com/faq#plus), but you can use a [catch-all](https://tutanota.com/howto#settings-global) with a custom domain.
+Paid Tutanota accounts can use up to 5 [aliases](https://tutanota.com/faq#alias) and [custom domains](https://tutanota.com/faq#custom-domain). Tutanota doesn't allow for [subaddressing (plus addresses)](https://tutanota.com/faq#plus), but you can use a [catch-all](https://tutanota.com/howto#settings-global) with a custom domain.
 
-??? warning "Private Payment Methods"
+#### :material-alert-outline:{ .pg-orange } Private Payment Methods
 
-    Tutanota only directly accepts credit cards and PayPal, however Bitcoin and Monero can be used to purchase gift cards via their [partnership](https://tutanota.com/faq/#cryptocurrency) with Proxystore.
+Tutanota only directly accepts credit cards and PayPal, however Bitcoin and Monero can be used to purchase gift cards via their [partnership](https://tutanota.com/faq/#cryptocurrency) with Proxystore.
 
-??? success "Account Security"
+#### :material-check:{ .pg-green } Account Security
 
-    Tutanota supports [two factor authentication](https://tutanota.com/faq#2fa) with either TOTP or U2F.
+Tutanota supports [two factor authentication](https://tutanota.com/faq#2fa) with either TOTP or U2F.
 
-??? success "Data Security"
+#### :material-check:{ .pg-green } Data Security
 
-    Tutanota has [zero access encryption at rest](https://tutanota.com/faq#what-encrypted) for your emails, [address book contacts](https://tutanota.com/faq#encrypted-address-book), and [calendars](https://tutanota.com/faq#calendar). This means the messages and other data stored in your account are only readable by you.
+Tutanota has [zero access encryption at rest](https://tutanota.com/faq#what-encrypted) for your emails, [address book contacts](https://tutanota.com/faq#encrypted-address-book), and [calendars](https://tutanota.com/faq#calendar). This means the messages and other data stored in your account are only readable by you.
 
-??? warning "Email Encryption"
+#### :material-alert-outline:{ .pg-orange } Email Encryption
 
-    Tutanota [does not use OpenPGP](https://www.tutanota.com/faq/#pgp). Tutanota accounts can only receive encrypted emails from non-Tutanota email accounts when sent via a [temporary Tutanota mailbox](https://www.tutanota.com/howto/#encrypted-email-external).
+Tutanota [does not use OpenPGP](https://www.tutanota.com/faq/#pgp). Tutanota accounts can only receive encrypted emails from non-Tutanota email accounts when sent via a [temporary Tutanota mailbox](https://www.tutanota.com/howto/#encrypted-email-external).
 
-??? warning "Digital Legacy"
+#### :material-alert-outline:{ .pg-orange } Digital Legacy
 
-    Tutanota doesn't offer a digital legacy feature.
+Tutanota doesn't offer a digital legacy feature.
 
-??? info "Account Termination"
+#### :material-information-outline:{ .pg-blue } Account Termination
 
-    Tutanota will [delete inactive free accounts](https://tutanota.com/faq#inactive-accounts) after six months. You can reuse a deactivated free account if you pay.
+Tutanota will [delete inactive free accounts](https://tutanota.com/faq#inactive-accounts) after six months. You can reuse a deactivated free account if you pay.
 
-??? info "Additional Functionality"
+#### :material-information-outline:{ .pg-blue } Additional Functionality
 
-    Tutanota offers the business version of [Tutanota to non-profit organizations](https://tutanota.com/blog/posts/secure-email-for-non-profit) for free or with a heavy discount.
+Tutanota offers the business version of [Tutanota to non-profit organizations](https://tutanota.com/blog/posts/secure-email-for-non-profit) for free or with a heavy discount.
 
-    Tutanota also has a business feature called [Secure Connect](https://tutanota.com/secure-connect/). This ensures customer contact to the business uses E2EE. The feature costs €240/y.
+Tutanota also has a business feature called [Secure Connect](https://tutanota.com/secure-connect/). This ensures customer contact to the business uses E2EE. The feature costs €240/y.
 
 ## Email Aliasing Services
 
 An email aliasing service allows you to easily generate a new email address for every website you register for. The email aliases you generate are then forwarded to an email address of your choosing, hiding both your "main" email address and the identity of your email provider. True email aliasing is better than plus addressing commonly used and supported by many providers, which allows you to create aliases like yourname+[anythinghere]@example.com, because websites, advertisers, and tracking networks can trivially remove anything after the + sign to know your true email address.
 
+<div class="grid cards" markdown>
+
+- ![AnonAddy logo](assets/img/email/anonaddy.svg#only-light){ .twemoji }![AnonAddy logo](assets/img/email/anonaddy-dark.svg#only-dark){ .twemoji } [AnonAddy](email.md#anonaddy)
+- ![SimpleLogin logo](assets/img/email/simplelogin.svg){ .twemoji } [SimpleLogin](email.md#simplelogin)
+
+</div>
+
 Email aliasing can act as a safeguard in case your email provider ever ceases operation. In that scenario, you can easily re-route your aliases to a new email address. In turn, however, you are placing trust in the aliasing service to continue functioning.
 
 Using a dedicated email aliasing service also has a number of benefits over a catch-all alias on a custom domain:
@@ -413,7 +439,7 @@ We prefer our recommended providers to collect as little data as possible.
 
 **Best Case:**
 
-- Accepts Bitcoin, cash, and other forms of cryptocurrency and/or anonymous payment options (gift cards, etc.)
+- Accepts [anonymous payment options](advanced/payments.md) ([cryptocurrency](cryptocurrency.md), cash, gift cards, etc.)
 
 ### Security
 
@@ -430,7 +456,7 @@ Email servers deal with a lot of very sensitive data. We expect that providers w
 - Valid [DANE](https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities) records.
 - Valid [SPF](https://en.wikipedia.org/wiki/Sender_Policy_Framework) and [DKIM](https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail) records.
 - Have a proper [DMARC](https://en.wikipedia.org/wiki/DMARC) record and policy or use [ARC](https://en.wikipedia.org/wiki/Authenticated_Received_Chain) for authentication. If DMARC authentication is being used, the policy must be set to `reject` or `quarantine`.
-- A server suite preference of TLS 1.2 or later and a plan for [Deprecating TLSv1.0 and TLSv1.1](https://datatracker.ietf.org/doc/draft-ietf-tls-oldversions-deprecate/).
+- A server suite preference of TLS 1.2 or later and a plan for [RFC8996](https://datatracker.ietf.org/doc/rfc8996/).
 - [SMTPS](https://en.wikipedia.org/wiki/SMTPS) submission, assuming SMTP is used.
 - Website security standards such as:
     - [HTTP Strict Transport Security](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security)
@@ -445,7 +471,7 @@ Email servers deal with a lot of very sensitive data. We expect that providers w
 - Bug-bounty programs and/or a coordinated vulnerability-disclosure process.
 - Website security standards such as:
     - [Content Security Policy (CSP)](https://en.wikipedia.org/wiki/Content_Security_Policy)
-    - [Expect-CT](https://datatracker.ietf.org/doc/draft-ietf-httpbis-expect-ct)
+    - [RFC9163 Expect-CT](https://datatracker.ietf.org/doc/rfc9163/)
 
 ### Trust
 

docs/financial-services.md

@@ -0,0 +1,92 @@
+---
+title: Financial Services
+icon: material/bank
+---
+
+Making payments online is one of the biggest challenges to privacy. These services can assist you in protecting your privacy from merchants and other trackers, provided you have a strong understanding of how to make private payments effectively. We strongly encourage you first read our payments overview article before making any purchases:
+
+[Making Private Payments :material-arrow-right-drop-circle:](advanced/payments.md){ .md-button }
+
+## Payment Masking Services
+
+There are a number of services which provide "virtual debit cards" which you can use with online merchants without revealing your actual banking or billing information in most cases. It's important to note that these financial services are **not** anonymous and are subject to "Know Your Customer" (KYC) laws and may require your ID or other identifying information. These services are primarily useful for protecting you from merchant data breaches, less sophisticated tracking or purchase correlation by marketing agencies, and online data theft; and **not** for making a purchase completely anonymously.
+
+!!! tip "Check your current bank"
+
+    Many banks and credit card providers offer native virtual card functionality. If you use one which provides this option already, you should use it over the following recommendations in most cases. That way you are not trusting multiple parties with your personal information.
+
+### Privacy.com (US, Free)
+
+!!! recommendation
+
+    ![Privacy.com logo](assets/img/financial-services/privacy_com.svg#only-light){ align=right }
+    ![Privacy.com logo](assets/img/financial-services/privacy_com-dark.svg#only-dark){ align=right }
+
+    **Privacy.com**'s free plan allows you to create up to 12 virtual cards per month, set spend limits on those cards, and shut off cards instantly.
+
+    [:octicons-home-16: Homepage](https://privacy.com){ .md-button .md-button--primary }
+    [:octicons-eye-16:](https://privacy.com/privacy-policy){ .card-link title="Privacy Policy" }
+    [:octicons-info-16:](https://support.privacy.com/hc/en-us){ .card-link title=Documentation}
+
+### MySudo (US, Paid)
+
+!!! recommendation
+
+    ![MySudo logo](assets/img/financial-services/mysudo.svg#only-light){ align=right }
+    ![MySudo logo](assets/img/financial-services/mysudo-dark.svg#only-dark){ align=right }
+
+    **MySudo** provides up to 9 virtual cards depending on the plan you purchase. Their paid plans additionally include functionality which may be useful for making purchases privately, such as virtual phone numbers and email addresses, although we typically recommend other [email aliasing providers](email.md) for extensive email aliasing use.
+
+    [:octicons-home-16: Homepage](https://mysudo.com/){ .md-button .md-button--primary }
+    [:octicons-eye-16:](https://anonyome.com/privacy-policy/){ .card-link title="Privacy Policy" }
+    [:octicons-info-16:](https://support.mysudo.com/hc/en-us){ .card-link title=Documentation}
+
+### Criteria
+
+**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
+
+!!! example "This section is new"
+
+    We are working on establishing defined criteria for every section of our site, and this may be subject to change. If you have any questions about our criteria, please [ask on our forum](https://discuss.privacyguides.net/latest) and don't assume we didn't consider something when making our recommendations if it is not listed here. There are many factors considered and discussed when we recommend a project, and documenting every single one is a work-in-progress.
+
+- Allows the creation of multiple cards which function as a shield between the merchant and your personal finances.
+- Cards must not require you to provide accurate billing address information to the merchant.
+
+## Gift Card Marketplaces
+
+These services allow you to purchase gift cards for a variety of merchants online with [cryptocurrency](cryptocurrency.md). Some of these services offer ID verification options for higher limits, but they also allow accounts with just an email address. Basic limits typically start at $5,000-10,000 a day for basic accounts, and significantly higher limits for ID verified accounts (if offered).
+
+### Cake Pay
+
+!!! recommendation
+
+    ![CakePay logo](assets/img/financial-services/cakepay.svg){ align=right }
+
+    **Cake Pay** allows you to purchase gift cards and related products with Monero. Purchases for USA merchants are available in the Cake Wallet mobile app, while the Cake Pay web app includes a broad selection of global merchants.
+
+    [:octicons-home-16: Homepage](https://cakepay.com/){ .md-button .md-button--primary }
+    [:octicons-eye-16:](https://ionia.docsend.com/view/jhjvdn7qq7k3ukwt){ .card-link title="Privacy Policy" }
+    [:octicons-info-16:](https://guides.cakewallet.com/){ .card-link title=Documentation}
+
+### CoinCards
+
+!!! recommendation
+
+    ![CakePay logo](assets/img/financial-services/coincards.svg){ align=right }
+
+    **CoinCards** (available in the US, Canada, and UK) allows you to purchase gift cards for a large variety of merchants.
+
+    [:octicons-home-16: Homepage](https://coincards.com/){ .md-button .md-button--primary }
+    [:octicons-eye-16:](https://coincards.com/privacy-policy/){ .card-link title="Privacy Policy" }
+    [:octicons-info-16:](https://coincards.com/frequently-asked-questions/){ .card-link title=Documentation}
+
+### Criteria
+
+**Please note we are not affiliated with any of the projects we recommend.** In addition to [our standard criteria](about/criteria.md), we have developed a clear set of requirements to allow us to provide objective recommendations. We suggest you familiarize yourself with this list before choosing to use a project, and conduct your own research to ensure it's the right choice for you.
+
+!!! example "This section is new"
+
+    We are working on establishing defined criteria for every section of our site, and this may be subject to change. If you have any questions about our criteria, please [ask on our forum](https://discuss.privacyguides.net/latest) and don't assume we didn't consider something when making our recommendations if it is not listed here. There are many factors considered and discussed when we recommend a project, and documenting every single one is a work-in-progress.
+
+- Accepts payment in [a recommended cryptocurrency](cryptocurrency.md).
+- No ID requirement.

docs/tools.md

@@ -84,7 +84,7 @@ For more details about each project, why they were chosen, and additional tips o
 
 <div class="grid cards" markdown>
 
-- ![Aurora Store logo](/assets/img/android/aurora-store.webp){ .twemoji } [Aurora Store (Google Play Client)](android.md#aurora-store)
+- ![Aurora Store logo](assets/img/android/aurora-store.webp){ .twemoji } [Aurora Store (Google Play Client)](android.md#aurora-store)
 - ![Shelter logo](assets/img/android/mini/shelter.svg){ .twemoji } [Shelter (Work Profiles)](android.md#shelter)
 - ![Auditor logo](assets/img/android/auditor.svg#only-light){ .twemoji }![GrapheneOS logo](assets/img/android/auditor-dark.svg#only-dark){ .twemoji } [Auditor (Supported Devices)](android.md#auditor)
 - ![Secure Camera logo](assets/img/android/secure_camera.svg#only-light){ .twemoji }![Secure Camera logo](assets/img/android/secure_camera-dark.svg#only-dark){ .twemoji } [Secure Camera](android.md#secure-camera)
@@ -199,6 +199,29 @@ We [recommend](dns.md#recommended-providers) a number of encrypted DNS servers b
 
 [Learn more :material-arrow-right-drop-circle:](email.md#self-hosting-email)
 
+### Financial Services
+
+#### Payment Masking Services
+
+<div class="grid cards" markdown>
+
+- ![Privacy.com logo](assets/img/financial-services/privacy_com.svg#only-light){ .twemoji }![Privacy.com logo](assets/img/financial-services/privacy_com-dark.svg#only-dark){ .twemoji } [Privacy.com](financial-services.md#privacycom-us-free)
+- ![MySudo logo](assets/img/financial-services/mysudo.svg#only-light){ .twemoji }![MySudo logo](assets/img/financial-services/mysudo-dark.svg#only-dark){ .twemoji } [MySudo](financial-services.md#mysudo-us-paid)
+</div>
+
+[Learn more :material-arrow-right-drop-circle:](financial-services.md#payment-masking-services)
+
+#### Online Gift Card Marketplaces
+
+<div class="grid cards" markdown>
+
+- ![Cake Pay logo](assets/img/financial-services/cakepay.svg){ .twemoji } [Cake Pay](financial-services.md#cake-pay)
+- ![CoinCards logo](assets/img/financial-services/coincards.svg){ .twemoji } [CoinCards](financial-services.md#coincards)
+
+</div>
+
+[Learn more :material-arrow-right-drop-circle:](financial-services.md#gift-card-marketplaces)
+
 ### Search Engines
 
 <div class="grid cards" markdown>
@@ -226,9 +249,9 @@ We [recommend](dns.md#recommended-providers) a number of encrypted DNS servers b
 
 <div class="grid cards" markdown>
 
-- ![Proton VPN logo](assets/img/vpn/protonvpn.svg){ .twemoji } [Proton VPN](vpn.md#proton-vpn)
 - ![IVPN logo](assets/img/vpn/mini/ivpn.svg){ .twemoji } [IVPN](vpn.md#ivpn)
 - ![Mullvad logo](assets/img/vpn/mullvad.svg){ .twemoji } [Mullvad](vpn.md#mullvad)
+- ![Proton VPN logo](assets/img/vpn/protonvpn.svg){ .twemoji } [Proton VPN](vpn.md#proton-vpn)
 
 </div>
 
@@ -247,6 +270,16 @@ We [recommend](dns.md#recommended-providers) a number of encrypted DNS servers b
 
 [Learn more :material-arrow-right-drop-circle:](calendar.md)
 
+### Cryptocurrency
+
+<div class="grid cards" markdown>
+
+- ![Monero logo](assets/img/cryptocurrency/monero.svg){ .twemoji }[Monero](cryptocurrency.md#monero)
+
+</div>
+
+[Learn more :material-arrow-right-drop-circle:](cryptocurrency.md)
+
 ### Data and Metadata Redaction
 
 <div class="grid cards" markdown>

docs/tor.md

@@ -15,13 +15,7 @@ The **Tor** network is a group of volunteer-operated servers that allows you to
 
 Tor works by routing your internet traffic through those volunteer-operated servers, instead of making a direct connection to the site you're trying to visit. This obfuscates where the traffic is coming from, and no server in the connection path is able to see the full path of where the traffic is coming from and going to, meaning even the servers you are using to connect cannot break your anonymity.
 
-<figure markdown>
-  ![Tor path](assets/img/how-tor-works/tor-path.svg#only-light)
-  ![Tor path](assets/img/how-tor-works/tor-path-dark.svg#only-dark)
-  <figcaption>Tor circuit pathway - Nodes in the path can only see the servers they are directly connected to, for example the "Entry" node shown can see your IP address, and the address of the "Middle" node, but has no way to see which website you are visiting.</figcaption>
-</figure>
-
-- [More information about how Tor works :material-arrow-right-drop-circle:](advanced/tor-overview.md)
+[Detailed Tor Overview :material-arrow-right-drop-circle:](advanced/tor-overview.md){ .md-button }
 
 ## Connecting to Tor
 

docs/vpn.md

@@ -3,9 +3,17 @@ title: "VPN Services"
 icon: material/vpn
 ---
 
-Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
+If you're looking for additional **privacy** from your ISP, on a public Wi-Fi network, or while torrenting files, a VPN may be the solution for you as long as you understand the risks involved. We think these providers are a cut above the rest:
 
-??? danger "VPNs do not provide anonymity"
+<div class="grid cards" markdown>
+
+- ![IVPN logo](assets/img/vpn/mini/ivpn.svg){ .twemoji } [IVPN](#ivpn)
+- ![Mullvad logo](assets/img/vpn/mullvad.svg){ .twemoji } [Mullvad](#mullvad)
+- ![Proton VPN logo](assets/img/vpn/protonvpn.svg){ .twemoji } [Proton VPN](#proton-vpn)
+
+</div>
+
+!!! danger "VPNs do not provide anonymity"
 
     Using a VPN will **not** keep your browsing habits anonymous, nor will it add additional security to non-secure (HTTP) traffic.
 
@@ -15,80 +23,11 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
 
     [Download Tor](https://www.torproject.org/){ .md-button .md-button--primary } [Tor Myths & FAQ](advanced/tor-overview.md){ .md-button }
 
-??? question "When are VPNs useful?"
-
-    If you're looking for additional **privacy** from your ISP, on a public Wi-Fi network, or while torrenting files, a VPN may be the solution for you as long as you understand the risks involved.
-
-    [More Info](basics/vpn-overview.md){ .md-button }
+[Detailed VPN Overview :material-arrow-right-drop-circle:](basics/vpn-overview.md){ .md-button }
 
 ## Recommended Providers
 
-!!! abstract "Criteria"
-
-    Our recommended providers use encryption, accept Monero, support WireGuard & OpenVPN, and have a no logging policy. Read our [full list of criteria](#our-criteria) for more information.
-
-### Proton VPN
-
-!!! recommendation annotate
-
-    ![Proton VPN logo](assets/img/vpn/protonvpn.svg){ align=right }
-
-    **Proton VPN** is a strong contender in the VPN space, and they have been in operation since 2016. Proton AG is based in Switzerland and offers a limited free tier, as well as a more featured premium option.
-
-    [:octicons-home-16: Homepage](https://protonvpn.com/){ .md-button .md-button--primary }
-    [:octicons-eye-16:](https://protonvpn.com/privacy-policy){ .card-link title="Privacy Policy" }
-    [:octicons-info-16:](https://protonvpn.com/support/){ .card-link title=Documentation}
-    [:octicons-code-16:](https://github.com/ProtonVPN){ .card-link title="Source Code" }
-
-    ??? downloads
-
-        - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=ch.protonvpn.android)
-        - [:simple-appstore: App Store](https://apps.apple.com/app/apple-store/id1437005085)
-        - [:simple-github: GitHub](https://github.com/ProtonVPN/android-app/releases)
-        - [:simple-windows11: Windows](https://protonvpn.com/download-windows)
-        - [:simple-linux: Linux](https://protonvpn.com/support/linux-vpn-setup/)
-
-??? success annotate "67 Countries"
-
-    Proton VPN has [servers in 67 countries](https://protonvpn.com/vpn-servers) (1). Picking a VPN provider with a server nearest to you will reduce latency of the network traffic you send. This is because of a shorter route (fewer hops) to the destination.
-
-    We also think it's better for the security of the VPN provider's private keys if they use [dedicated servers](https://en.wikipedia.org/wiki/Dedicated_hosting_service), instead of cheaper shared solutions (with other customers) such as [virtual private servers](https://en.wikipedia.org/wiki/Virtual_private_server).
-
-1. Last checked: 2022-09-16
-
-??? success "Independently Audited"
-
-    As of January 2020, Proton VPN has undergone an independent audit by SEC Consult. SEC Consult found some medium and low risk vulnerabilities in Proton VPN's Windows, Android, and iOS applications, all of which were "properly fixed" by Proton VPN before the reports were published. None of the issues identified would have provided an attacker remote access to your device or traffic. You can view individual reports for each platform at [protonvpn.com](https://protonvpn.com/blog/open-source/). In April 2022 Proton VPN underwent [another audit](https://protonvpn.com/blog/no-logs-audit/) and the report was [produced by Securitum](https://protonvpn.com/blog/wp-content/uploads/2022/04/securitum-protonvpn-nologs-20220330.pdf). A [letter of attestation](https://proton.me/blog/security-audit-all-proton-apps) was provided for Proton VPN's apps on 9th November 2021 by [Securitum](https://research.securitum.com).
-
-??? success "Open-Source Clients"
-
-    Proton VPN provides the source code for their desktop and mobile clients in their [GitHub organization](https://github.com/ProtonVPN).
-
-??? success "Accepts Cash"
-
-    Proton VPN, in addition to accepting credit/debit cards and PayPal, accepts Bitcoin, and **cash/local currency** as anonymous forms of payment.
-
-??? success "WireGuard Support"
-
-    Proton VPN mostly supports the WireGuard® protocol. [WireGuard](https://www.wireguard.com) is a newer protocol that uses state-of-the-art [cryptography](https://www.wireguard.com/protocol/). Additionally, WireGuard aims to be simpler and more performant.
-
-    Proton VPN [recommends](https://protonvpn.com/blog/wireguard/) the use of WireGuard with their service. On Proton VPN's Windows, macOS, iOS, Android, ChromeOS, and Android TV apps, WireGuard is the default protocol; however, [support](https://protonvpn.com/support/how-to-change-vpn-protocols/) for the protocol is not present in their Linux app.
-
-??? warning "Remote Port Forwarding"
-
-    Proton VPN currently only supports remote [port forwarding](https://protonvpn.com/support/port-forwarding/) on Windows, which may impact some applications. Especially Peer-to-peer applications like Torrent clients.
-
-??? success "Mobile Clients"
-
-    In addition to providing standard OpenVPN configuration files, Proton VPN has mobile clients for [App Store](https://apps.apple.com/us/app/protonvpn-fast-secure-vpn/id1437005085), [Google Play](https://play.google.com/store/apps/details?id=ch.protonvpn.android&hl=en_US), and [GitHub](https://github.com/ProtonVPN/android-app/releases) allowing for easy connections to their servers.
-
-??? info "Additional Functionality"
-
-    Proton VPN clients support two factor authentication on all platforms except Linux at the moment. Proton VPN has their own servers and datacenters in Switzerland, Iceland and Sweden. They offer adblocking and known malware domains blocking with their DNS service. Additionally, Proton VPN also offers "Tor" servers allowing you to easily connect to onion sites, but we still strongly recommend using [the official Tor Browser](https://www.torproject.org/) for this purpose.
-
-!!! danger "Killswitch feature is broken on Intel-based Macs"
-
-    System crashes [may occur](https://protonvpn.com/support/macos-t2-chip-kill-switch/) on Intel-based Macs when using the VPN killswitch. If you require this feature, and you are using a Mac with Intel chipset, you should consider using another VPN service.
+Our recommended providers use encryption, accept Monero, support WireGuard & OpenVPN, and have a no logging policy. Read our [full list of criteria](#criteria) for more information.
 
 ### IVPN
 
@@ -111,43 +50,44 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
         - [:simple-apple: macOS](https://www.ivpn.net/apps-macos/)
         - [:simple-linux: Linux](https://www.ivpn.net/apps-linux/)
 
-??? success annotate "35 Countries"
+#### :material-check:{ .pg-green } 35 Countries
 
-    IVPN has [servers in 35 countries](https://www.ivpn.net/server-locations) (1). Picking a VPN provider with a server nearest to you will reduce latency of the network traffic you send. This is because of a shorter route (fewer hops) to the destination.
-
-    We also think it's better for the security of the VPN provider's private keys if they use [dedicated servers](https://en.wikipedia.org/wiki/Dedicated_hosting_service), instead of cheaper shared solutions (with other customers) such as [virtual private servers](https://en.wikipedia.org/wiki/Virtual_private_server).
+IVPN has [servers in 35 countries](https://www.ivpn.net/server-locations).(1) Picking a VPN provider with a server nearest to you will reduce latency of the network traffic you send. This is because of a shorter route (fewer hops) to the destination.
+{ .annotate }
 
 1. Last checked: 2022-09-16
 
-??? success "Independently Audited"
+We also think it's better for the security of the VPN provider's private keys if they use [dedicated servers](https://en.wikipedia.org/wiki/Dedicated_hosting_service), instead of cheaper shared solutions (with other customers) such as [virtual private servers](https://en.wikipedia.org/wiki/Virtual_private_server).
 
-    IVPN has undergone a [no-logging audit from Cure53](https://cure53.de/audit-report_ivpn.pdf) which concluded in agreement with IVPN's no-logging claim. IVPN has also completed a [comprehensive pentest report Cure53](https://cure53.de/summary-report_ivpn_2019.pdf) in January 2020. IVPN has also said they plan to have [annual reports](https://www.ivpn.net/blog/independent-security-audit-concluded) in the future. A further review was conducted [in April 2022](https://www.ivpn.net/blog/ivpn-apps-security-audit-2022-concluded/) and was produced by Cure53 [on their website](https://cure53.de/pentest-report_IVPN_2022.pdf).
+#### :material-check:{ .pg-green } Independently Audited
 
-??? success "Open-Source Clients"
+IVPN has undergone a [no-logging audit from Cure53](https://cure53.de/audit-report_ivpn.pdf) which concluded in agreement with IVPN's no-logging claim. IVPN has also completed a [comprehensive pentest report Cure53](https://cure53.de/summary-report_ivpn_2019.pdf) in January 2020. IVPN has also said they plan to have [annual reports](https://www.ivpn.net/blog/independent-security-audit-concluded) in the future. A further review was conducted [in April 2022](https://www.ivpn.net/blog/ivpn-apps-security-audit-2022-concluded/) and was produced by Cure53 [on their website](https://cure53.de/pentest-report_IVPN_2022.pdf).
 
-    As of February 2020 [IVPN applications are now open-source](https://www.ivpn.net/blog/ivpn-applications-are-now-open-source). Source code can be obtained from their [GitHub organization](https://github.com/ivpn).
+#### :material-check:{ .pg-green } Open-Source Clients
 
-??? success "Accepts Cash and Monero"
+As of February 2020 [IVPN applications are now open-source](https://www.ivpn.net/blog/ivpn-applications-are-now-open-source). Source code can be obtained from their [GitHub organization](https://github.com/ivpn).
 
-    In addition to accepting credit/debit cards and PayPal, IVPN accepts Bitcoin, **Monero** and **cash/local currency** (on annual plans) as anonymous forms of payment.
+#### :material-check:{ .pg-green } Accepts Cash and Monero
 
-??? success "WireGuard Support"
+In addition to accepting credit/debit cards and PayPal, IVPN accepts Bitcoin, **Monero** and **cash/local currency** (on annual plans) as anonymous forms of payment.
 
-    IVPN supports the WireGuard® protocol. [WireGuard](https://www.wireguard.com) is a newer protocol that uses state-of-the-art [cryptography](https://www.wireguard.com/protocol/). Additionally, WireGuard aims to be simpler and more performant.
+#### :material-check:{ .pg-green } WireGuard Support
 
-    IVPN [recommends](https://www.ivpn.net/wireguard/) the use of WireGuard with their service and, as such, the protocol is the default on all of IVPN's apps. IVPN also offers a WireGuard configuration generator for use with the official WireGuard [apps](https://www.wireguard.com/install/).
+IVPN supports the WireGuard® protocol. [WireGuard](https://www.wireguard.com) is a newer protocol that uses state-of-the-art [cryptography](https://www.wireguard.com/protocol/). Additionally, WireGuard aims to be simpler and more performant.
 
-??? success "Remote Port Forwarding"
+IVPN [recommends](https://www.ivpn.net/wireguard/) the use of WireGuard with their service and, as such, the protocol is the default on all of IVPN's apps. IVPN also offers a WireGuard configuration generator for use with the official WireGuard [apps](https://www.wireguard.com/install/).
 
-    Remote [port forwarding](https://en.wikipedia.org/wiki/Port_forwarding) is possible with a Pro plan. Port forwarding [can be activated](https://www.ivpn.net/knowledgebase/81/How-do-I-activate-port-forwarding.html) via the client area. Port forwarding is only available on IVPN when using WireGuard or OpenVPN protocols and is [disabled on US servers](https://www.ivpn.net/knowledgebase/116/Port-forwarding-is-not-working-why.html).
+#### :material-check:{ .pg-green } Remote Port Forwarding
 
-??? success "Mobile Clients"
+Remote [port forwarding](https://en.wikipedia.org/wiki/Port_forwarding) is possible with a Pro plan. Port forwarding [can be activated](https://www.ivpn.net/knowledgebase/81/How-do-I-activate-port-forwarding.html) via the client area. Port forwarding is only available on IVPN when using WireGuard or OpenVPN protocols and is [disabled on US servers](https://www.ivpn.net/knowledgebase/116/Port-forwarding-is-not-working-why.html).
 
-    In addition to providing standard OpenVPN configuration files, IVPN has mobile clients for [App Store](https://apps.apple.com/us/app/ivpn-serious-privacy-protection/id1193122683), [Google Play](https://play.google.com/store/apps/details?id=net.ivpn.client), and [GitHub](https://github.com/ivpn/android-app/releases) allowing for easy connections to their servers.
+#### :material-check:{ .pg-green } Mobile Clients
 
-??? info "Additional Functionality"
+In addition to providing standard OpenVPN configuration files, IVPN has mobile clients for [App Store](https://apps.apple.com/us/app/ivpn-serious-privacy-protection/id1193122683), [Google Play](https://play.google.com/store/apps/details?id=net.ivpn.client), and [GitHub](https://github.com/ivpn/android-app/releases) allowing for easy connections to their servers.
 
-    IVPN clients support two factor authentication (Mullvad's clients do not). IVPN also provides "[AntiTracker](https://www.ivpn.net/antitracker)" functionality, which blocks advertising networks and trackers from the network level.
+#### :material-information-outline:{ .pg-blue } Additional Functionality
+
+IVPN clients support two factor authentication (Mullvad's clients do not). IVPN also provides "[AntiTracker](https://www.ivpn.net/antitracker)" functionality, which blocks advertising networks and trackers from the network level.
 
 ### Mullvad
 
@@ -172,55 +112,120 @@ Find a no-logging VPN operator who isn’t out to sell or read your web traffic.
         - [:simple-apple: macOS](https://mullvad.net/en/download/macos/)
         - [:simple-linux: Linux](https://mullvad.net/en/download/linux/)
 
-??? success annotate "41 Countries"
+#### :material-check:{ .pg-green } 41 Countries
 
-    Mullvad has [servers in 41 countries](https://mullvad.net/servers/) (1). Picking a VPN provider with a server nearest to you will reduce latency of the network traffic you send. This is because of a shorter route (fewer hops) to the destination.
-
-    We also think it's better for the security of the VPN provider's private keys if they use [dedicated servers](https://en.wikipedia.org/wiki/Dedicated_hosting_service), instead of cheaper shared solutions (with other customers) such as [virtual private servers](https://en.wikipedia.org/wiki/Virtual_private_server).
+Mullvad has [servers in 41 countries](https://mullvad.net/servers/).(1) Picking a VPN provider with a server nearest to you will reduce latency of the network traffic you send. This is because of a shorter route (fewer hops) to the destination.
+{ .annotate }
 
 1. Last checked: 2023-01-19
 
-??? success "Independently Audited"
+We also think it's better for the security of the VPN provider's private keys if they use [dedicated servers](https://en.wikipedia.org/wiki/Dedicated_hosting_service), instead of cheaper shared solutions (with other customers) such as [virtual private servers](https://en.wikipedia.org/wiki/Virtual_private_server).
 
-    Mullvad's VPN clients have been audited by Cure53 and Assured AB in a pentest report [published at cure53.de](https://cure53.de/pentest-report_mullvad_v2.pdf). The security researchers concluded:
+#### :material-check:{ .pg-green } Independently Audited
 
-    > Cure53 and Assured AB are happy with the results of the audit and the software leaves an overall positive impression. With security dedication of the in-house team at the Mullvad VPN compound, the testers have no doubts about the project being on the right track from a security standpoint.
+Mullvad's VPN clients have been audited by Cure53 and Assured AB in a pentest report [published at cure53.de](https://cure53.de/pentest-report_mullvad_v2.pdf). The security researchers concluded:
 
-    In 2020 a second audit [was announced](https://mullvad.net/blog/2020/6/25/results-available-audit-mullvad-app/) and the [final audit report](https://cure53.de/pentest-report_mullvad_2020_v2.pdf) was made available on Cure53's website:
+> Cure53 and Assured AB are happy with the results of the audit and the software leaves an overall positive impression. With security dedication of the in-house team at the Mullvad VPN compound, the testers have no doubts about the project being on the right track from a security standpoint.
 
-    > The results of this May-June 2020 project targeting the Mullvad complex are quite positive. [...] The overall application ecosystem used by Mullvad leaves a sound and structured impression. The overall structure of the application makes it easy to roll out patches and fixes in a structured manner. More than anything, the findings spotted by Cure53 showcase the importance of constantly auditing and re-assessing the current leak vectors, in order to always ensure privacy of the end-users. With that being said, Mullvad does a great job protecting the end-user from common PII leaks and privacy related risks.
+In 2020 a second audit [was announced](https://mullvad.net/blog/2020/6/25/results-available-audit-mullvad-app/) and the [final audit report](https://cure53.de/pentest-report_mullvad_2020_v2.pdf) was made available on Cure53's website:
 
-    In 2021 an infrastructure audit [was announced](https://mullvad.net/en/blog/2021/1/20/no-pii-or-privacy-leaks-found-cure53s-infrastructure-audit/) and the [final audit report](https://cure53.de/pentest-report_mullvad_2021_v1.pdf) was made available on Cure53's website. Another report was commissioned [in June 2022](https://mullvad.net/en/blog/2022/6/22/vpn-server-audit-found-no-information-leakage-or-logging-of-customer-data/) and is available on [Assured's website](https://www.assured.se/publications/Assured_Mullvad_relay_server_audit_report_2022.pdf).
+> The results of this May-June 2020 project targeting the Mullvad complex are quite positive. [...] The overall application ecosystem used by Mullvad leaves a sound and structured impression. The overall structure of the application makes it easy to roll out patches and fixes in a structured manner. More than anything, the findings spotted by Cure53 showcase the importance of constantly auditing and re-assessing the current leak vectors, in order to always ensure privacy of the end-users. With that being said, Mullvad does a great job protecting the end-user from common PII leaks and privacy related risks.
 
-??? success "Open-Source Clients"
+In 2021 an infrastructure audit [was announced](https://mullvad.net/en/blog/2021/1/20/no-pii-or-privacy-leaks-found-cure53s-infrastructure-audit/) and the [final audit report](https://cure53.de/pentest-report_mullvad_2021_v1.pdf) was made available on Cure53's website. Another report was commissioned [in June 2022](https://mullvad.net/en/blog/2022/6/22/vpn-server-audit-found-no-information-leakage-or-logging-of-customer-data/) and is available on [Assured's website](https://www.assured.se/publications/Assured_Mullvad_relay_server_audit_report_2022.pdf).
 
-    Mullvad provides the source code for their desktop and mobile clients in their [GitHub organization](https://github.com/mullvad/mullvadvpn-app).
+#### :material-check:{ .pg-green } Open-Source Clients
 
-??? success "Accepts Cash and Monero"
+Mullvad provides the source code for their desktop and mobile clients in their [GitHub organization](https://github.com/mullvad/mullvadvpn-app).
 
-    Mullvad, in addition to accepting credit/debit cards and PayPal, accepts Bitcoin, Bitcoin Cash, **Monero** and **cash/local currency** as anonymous forms of payment. They also accept Swish and bank wire transfers.
+#### :material-check:{ .pg-green } Accepts Cash and Monero
 
-??? success "WireGuard Support"
+Mullvad, in addition to accepting credit/debit cards and PayPal, accepts Bitcoin, Bitcoin Cash, **Monero** and **cash/local currency** as anonymous forms of payment. They also accept Swish and bank wire transfers.
 
-    Mullvad supports the WireGuard® protocol. [WireGuard](https://www.wireguard.com) is a newer protocol that uses state-of-the-art [cryptography](https://www.wireguard.com/protocol/). Additionally, WireGuard aims to be simpler and more performant.
+#### :material-check:{ .pg-green } WireGuard Support
 
-    Mullvad [recommends](https://mullvad.net/en/help/why-wireguard/) the use of WireGuard with their service. It is the default or only protocol on Mullvad's Android, iOS, macOS, and Linux apps, but on Windows you have to [manually enable](https://mullvad.net/en/help/how-turn-wireguard-mullvad-app/) WireGuard. Mullvad also offers a WireGuard configuration generator for use with the official WireGuard [apps](https://www.wireguard.com/install/).
+Mullvad supports the WireGuard® protocol. [WireGuard](https://www.wireguard.com) is a newer protocol that uses state-of-the-art [cryptography](https://www.wireguard.com/protocol/). Additionally, WireGuard aims to be simpler and more performant.
 
-??? success "IPv6 Support"
+Mullvad [recommends](https://mullvad.net/en/help/why-wireguard/) the use of WireGuard with their service. It is the default or only protocol on Mullvad's Android, iOS, macOS, and Linux apps, but on Windows you have to [manually enable](https://mullvad.net/en/help/how-turn-wireguard-mullvad-app/) WireGuard. Mullvad also offers a WireGuard configuration generator for use with the official WireGuard [apps](https://www.wireguard.com/install/).
 
-    Mullvad supports the future of networking [IPv6](https://en.wikipedia.org/wiki/IPv6). Their network allows you to [access services hosted on IPv6](https://mullvad.net/en/blog/2014/9/15/ipv6-support/) as opposed to other providers who block IPv6 connections.
+#### :material-check:{ .pg-green } IPv6 Support
 
-??? success "Remote Port Forwarding"
+Mullvad supports the future of networking [IPv6](https://en.wikipedia.org/wiki/IPv6). Their network allows you to [access services hosted on IPv6](https://mullvad.net/en/blog/2014/9/15/ipv6-support/) as opposed to other providers who block IPv6 connections.
 
-    Remote [port forwarding](https://en.wikipedia.org/wiki/Port_forwarding) is allowed for people who make one-time payments, but not allowed for accounts with a recurring/subscription-based payment method. This is to prevent Mullvad from being able to identify you based on your port usage and stored subscription information. See [Port forwarding with Mullvad VPN](https://mullvad.net/help/port-forwarding-and-mullvad/) for more information.
+#### :material-check:{ .pg-green } Remote Port Forwarding
 
-??? success "Mobile Clients"
+Remote [port forwarding](https://en.wikipedia.org/wiki/Port_forwarding) is allowed for people who make one-time payments, but not allowed for accounts with a recurring/subscription-based payment method. This is to prevent Mullvad from being able to identify you based on your port usage and stored subscription information. See [Port forwarding with Mullvad VPN](https://mullvad.net/help/port-forwarding-and-mullvad/) for more information.
 
-    Mullvad has published [App Store](https://apps.apple.com/app/mullvad-vpn/id1488466513) and [Google Play](https://play.google.com/store/apps/details?id=net.mullvad.mullvadvpn) clients, both supporting an easy-to-use interface as opposed to requiring you to manually configure your WireGuard connection. The Android client is also available on [GitHub](https://github.com/mullvad/mullvadvpn-app/releases).
+#### :material-check:{ .pg-green } Mobile Clients
 
-??? info "Additional Functionality"
+Mullvad has published [App Store](https://apps.apple.com/app/mullvad-vpn/id1488466513) and [Google Play](https://play.google.com/store/apps/details?id=net.mullvad.mullvadvpn) clients, both supporting an easy-to-use interface as opposed to requiring you to manually configure your WireGuard connection. The Android client is also available on [GitHub](https://github.com/mullvad/mullvadvpn-app/releases).
 
-    Mullvad is very transparent about which nodes they [own or rent](https://mullvad.net/en/servers/). They use [ShadowSocks](https://shadowsocks.org/) in their ShadowSocks + OpenVPN configuration, making them more resistant against firewalls with [Deep Packet Inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection) trying to block VPNs. Supposedly, [China has to use a different method to block ShadowSocks servers](https://github.com/net4people/bbs/issues/22). Mullvad's website is also accessible via Tor at [o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiad.onion](http://o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiad.onion).
+#### :material-information-outline:{ .pg-blue } Additional Functionality
+
+Mullvad is very transparent about which nodes they [own or rent](https://mullvad.net/en/servers/). They use [ShadowSocks](https://shadowsocks.org/) in their ShadowSocks + OpenVPN configuration, making them more resistant against firewalls with [Deep Packet Inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection) trying to block VPNs. Supposedly, [China has to use a different method to block ShadowSocks servers](https://github.com/net4people/bbs/issues/22). Mullvad's website is also accessible via Tor at [o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiad.onion](http://o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiad.onion).
+
+### Proton VPN
+
+!!! recommendation annotate
+
+    ![Proton VPN logo](assets/img/vpn/protonvpn.svg){ align=right }
+
+    **Proton VPN** is a strong contender in the VPN space, and they have been in operation since 2016. Proton AG is based in Switzerland and offers a limited free tier, as well as a more featured premium option.
+
+    [:octicons-home-16: Homepage](https://protonvpn.com/){ .md-button .md-button--primary }
+    [:octicons-eye-16:](https://protonvpn.com/privacy-policy){ .card-link title="Privacy Policy" }
+    [:octicons-info-16:](https://protonvpn.com/support/){ .card-link title=Documentation}
+    [:octicons-code-16:](https://github.com/ProtonVPN){ .card-link title="Source Code" }
+
+    ??? downloads
+
+        - [:simple-googleplay: Google Play](https://play.google.com/store/apps/details?id=ch.protonvpn.android)
+        - [:simple-appstore: App Store](https://apps.apple.com/app/apple-store/id1437005085)
+        - [:simple-github: GitHub](https://github.com/ProtonVPN/android-app/releases)
+        - [:simple-windows11: Windows](https://protonvpn.com/download-windows)
+        - [:simple-linux: Linux](https://protonvpn.com/support/linux-vpn-setup/)
+
+#### :material-check:{ .pg-green } 67 Countries
+
+Proton VPN has [servers in 67 countries](https://protonvpn.com/vpn-servers).(1) Picking a VPN provider with a server nearest to you will reduce latency of the network traffic you send. This is because of a shorter route (fewer hops) to the destination.
+{ .annotate }
+
+1. Last checked: 2022-09-16
+
+We also think it's better for the security of the VPN provider's private keys if they use [dedicated servers](https://en.wikipedia.org/wiki/Dedicated_hosting_service), instead of cheaper shared solutions (with other customers) such as [virtual private servers](https://en.wikipedia.org/wiki/Virtual_private_server).
+
+#### :material-check:{ .pg-green } Independently Audited
+
+As of January 2020, Proton VPN has undergone an independent audit by SEC Consult. SEC Consult found some medium and low risk vulnerabilities in Proton VPN's Windows, Android, and iOS applications, all of which were "properly fixed" by Proton VPN before the reports were published. None of the issues identified would have provided an attacker remote access to your device or traffic. You can view individual reports for each platform at [protonvpn.com](https://protonvpn.com/blog/open-source/). In April 2022 Proton VPN underwent [another audit](https://protonvpn.com/blog/no-logs-audit/) and the report was [produced by Securitum](https://protonvpn.com/blog/wp-content/uploads/2022/04/securitum-protonvpn-nologs-20220330.pdf). A [letter of attestation](https://proton.me/blog/security-audit-all-proton-apps) was provided for Proton VPN's apps on 9th November 2021 by [Securitum](https://research.securitum.com).
+
+#### :material-check:{ .pg-green } Open-Source Clients
+
+Proton VPN provides the source code for their desktop and mobile clients in their [GitHub organization](https://github.com/ProtonVPN).
+
+#### :material-check:{ .pg-green } Accepts Cash
+
+Proton VPN, in addition to accepting credit/debit cards and PayPal, accepts Bitcoin, and **cash/local currency** as anonymous forms of payment.
+
+#### :material-check:{ .pg-green } WireGuard Support
+
+Proton VPN mostly supports the WireGuard® protocol. [WireGuard](https://www.wireguard.com) is a newer protocol that uses state-of-the-art [cryptography](https://www.wireguard.com/protocol/). Additionally, WireGuard aims to be simpler and more performant.
+
+Proton VPN [recommends](https://protonvpn.com/blog/wireguard/) the use of WireGuard with their service. On Proton VPN's Windows, macOS, iOS, Android, ChromeOS, and Android TV apps, WireGuard is the default protocol; however, [support](https://protonvpn.com/support/how-to-change-vpn-protocols/) for the protocol is not present in their Linux app.
+
+#### :material-alert-outline:{ .pg-orange } Remote Port Forwarding
+
+Proton VPN currently only supports remote [port forwarding](https://protonvpn.com/support/port-forwarding/) on Windows, which may impact some applications. Especially Peer-to-peer applications like Torrent clients.
+
+#### :material-check:{ .pg-green } Mobile Clients
+
+In addition to providing standard OpenVPN configuration files, Proton VPN has mobile clients for [App Store](https://apps.apple.com/us/app/protonvpn-fast-secure-vpn/id1437005085), [Google Play](https://play.google.com/store/apps/details?id=ch.protonvpn.android&hl=en_US), and [GitHub](https://github.com/ProtonVPN/android-app/releases) allowing for easy connections to their servers.
+
+#### :material-information-outline:{ .pg-blue } Additional Functionality
+
+Proton VPN clients support two factor authentication on all platforms except Linux at the moment. Proton VPN has their own servers and datacenters in Switzerland, Iceland and Sweden. They offer adblocking and known malware domains blocking with their DNS service. Additionally, Proton VPN also offers "Tor" servers allowing you to easily connect to onion sites, but we still strongly recommend using [the official Tor Browser](https://www.torproject.org/) for this purpose.
+
+#### :material-alert-outline:{ .pg-orange } Killswitch feature is broken on Intel-based Macs
+
+System crashes [may occur](https://protonvpn.com/support/macos-t2-chip-kill-switch/) on Intel-based Macs when using the VPN killswitch. If you require this feature, and you are using a Mac with Intel chipset, you should consider using another VPN service.
 
 ## Criteria
 
@@ -255,13 +260,13 @@ We prefer our recommended providers to collect as little data as possible. Not c
 
 **Minimum to Qualify:**
 
-- Monero or cash payment option.
+- [Anonymous cryptocurrency](cryptocurrency.md) **or** cash payment option.
 - No personal information required to register: Only username, password, and email at most.
 
 **Best Case:**
 
-- Accepts Monero, cash, and other forms of anonymous payment options (gift cards, etc.)
-- No personal information accepted (autogenerated username, no email required, etc.)
+- Accepts multiple [anonymous payment options](advanced/payments.md).
+- No personal information accepted (autogenerated username, no email required, etc.).
 
 ### Security
 

theme/assets/img/cryptocurrency/monero.svg

@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="128" height="128" version="1.1" viewBox="0 0 33.867 33.867" xmlns="http://www.w3.org/2000/svg"><defs><clipPath id="_clip1"><rect width="3756.1" height="3756.5"/></clipPath></defs><g transform="matrix(.0090155 0 0 .0090155 16.933 16.933)"><g transform="translate(-1878,-1878.2)"><clipPath><rect width="3756.1" height="3756.5"/></clipPath><g clip-path="url(#_clip1)"><g transform="translate(-371.96,-371.75)"><path d="m4128 2249.8c0 1037.2-840.74 1878-1878 1878s-1878-840.86-1878-1878 840.76-1878.1 1878-1878.1 1878 840.79 1878 1878.1z" fill="#fff"/><path d="m2250 371.75c-1036.9 0-1879.1 842.06-1877.8 1878 0.26 207.26 33.31 406.63 95.34 593.12h561.88v-1579.9l1220.6 1220.6 1220.5-1220.6v1579.9h562c62.12-186.48 95-385.85 95.37-593.12 1.77-1037-840.89-1877.8-1877.9-1877.8v-0.25z" fill="#f26822"/><path d="m1969.3 2764.2-532.67-532.7v994.14h-407.25l-384.29 0.07c329.63 540.8 925.35 902.56 1604.9 902.56s1275.3-361.84 1605-902.64h-791.75v-994.13l-813.31 813.31-280.62-280.61h-0.02z" fill="#4d4d4d"/></g></g></g></g></svg>

theme/assets/img/financial-services/coincards.svg

@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="384" height="128" version="1.1" viewBox="0 0 101.6 33.867" xmlns="http://www.w3.org/2000/svg"><g transform="matrix(1.1073 0 0 1.1073 14.838 -20.88)"><g id="Layer_2_1_"><path class="st1" d="m32.7 23.9c-0.2-1-1.3-1.7-2.3-1.4l-22.7 5.4c-1 0.2-1.7 1.3-1.4 2.3l3.1 12.9c0.2 1 1.3 1.7 2.3 1.4l22.7-5.4c1-0.2 1.7-1.3 1.4-2.3z" fill="#ef8022"/></g><g fill="#ffc214"><path class="st2" d="m9.7 47.4c0.6 0.9 1.8 1.1 2.7 0.5l6.7-4.6-7.4 1.8c-1.3 0.3-2.6-0.5-2.9-1.8l-2.8-11.8-3.3 2.3c-0.9 0.6-1.1 1.8-0.5 2.7z"/><path class="st2" d="m14.2 25.8 11.7-2.8-1.3-2c-0.6-0.9-1.8-1.1-2.7-0.5z"/></g><g fill="#f9f185"><path class="st3" d="m12.6 48.3c-0.2 0.2-0.5 0.3-0.7 0.3l0.8 0.5c0.9 0.6 2.1 0.4 2.7-0.5l3.1-4.4z"/><path class="st3" d="m2.3 37.5-1 1.4c-0.6 0.9-0.4 2.1 0.5 2.7l6.3 4.4z"/><path class="st3" d="m12.9 26.1 7.2-5-2.7-1.9c-0.9-0.6-2.1-0.4-2.7 0.5l-5 7.2z"/></g><path class="st2" d="m11.9 42.8c-0.7 0-1.4-0.5-1.7-1.1l-1.5-3.2 1.1 4.6c0.2 0.6 0.7 1.1 1.4 1.1h0.3l17-4.1-16.2 2.7h-0.4z" fill="#ffc214"/><path class="st0" d="m16 35.5s-1.1 1.2-2.5 1.2c-1.7 0-2.6-1.4-2.6-2.8 0-1.3 0.9-2.7 2.6-2.7 1.3 0 2.3 1 2.3 1l1.1-1.7s-0.6-0.7-1.9-1.1v-1.2h-1.1v1h-0.5-0.1v-1h-1.1v1.1c-2.2 0.5-3.7 2.4-3.7 4.7 0 2.4 1.5 4.2 3.7 4.7v1.2h1.1v-1h0.1 0.5v1.1h1.1v-1.3c1.4-0.4 2.1-1.3 2.1-1.3z" fill="#fff"/><g fill="#fff"><path class="st0" d="m21 31.7c2.1 0 3.8 1.4 3.8 3.6 0 2.1-1.7 3.5-3.8 3.5s-3.8-1.4-3.8-3.5 1.7-3.6 3.8-3.6zm0 5.2c0.8 0 1.5-0.6 1.5-1.6s-0.7-1.7-1.5-1.7-1.5 0.6-1.5 1.7c0 1 0.7 1.6 1.5 1.6z"/><rect class="st0" x="25.3" y="31.9" width="2.3" height="6.7"/><rect class="st0" x="25.3" y="29.3" width="2.2" height="1.8"/><path class="st0" d="m28.5 31.9h2.2v0.6 0.4c0.3-0.5 1-1.2 2.1-1.2 1.4 0 2.4 0.6 2.4 2.5v4.4h-2.3v-4c0-0.6-0.2-0.9-0.7-0.9-0.7 0-1.1 0.4-1.3 1-0.1 0.3-0.1 0.6-0.1 0.9v3h-2.3v-6.7z"/></g><g fill="#ef8022"><path class="st1" d="m39.3 31.9c1.7 0 2.5 1 2.5 1l-0.6 0.9s-0.7-0.8-1.8-0.8c-1.3 0-2.3 1-2.3 2.4 0 1.3 1 2.4 2.3 2.4 1.2 0 2-0.9 2-0.9l0.5 0.9s-0.9 1.1-2.6 1.1c-2.1 0-3.5-1.5-3.5-3.5-0.1-2 1.4-3.5 3.5-3.5z"/><path class="st1" d="m46.1 34.5h0.3v-0.1c0-1.1-0.6-1.5-1.5-1.5-1 0-1.8 0.6-1.8 0.6l-0.5-0.9s1-0.8 2.5-0.8c1.7 0 2.6 0.9 2.6 2.6v4.2h-1.2v-0.6-0.5s-0.5 1.3-2.1 1.3c-1.1 0-2.3-0.7-2.3-2 0-2.2 2.9-2.3 4-2.3zm-1.4 3.3c1.1 0 1.8-1.1 1.8-2.1v-0.2h-0.3c-1 0-2.7 0.1-2.7 1.3-0.1 0.5 0.3 1 1.2 1z"/><path class="st1" d="m48.5 32h1.2v1.2 0.5c0.3-1 1.1-1.7 2.1-1.7h0.3v1.3h-0.4c-0.8 0-1.6 0.6-1.9 1.6-0.1 0.4-0.2 0.8-0.2 1.2v2.7h-1.3v-6.8z"/><path class="st1" d="m55.3 31.9c1.5 0 2 1 2 1v-0.4-3.1h1.3v9.2h-1.2v-0.6-0.4s-0.5 1.2-2.2 1.2c-1.8 0-2.9-1.4-2.9-3.5s1.3-3.4 3-3.4zm0.2 5.8c1 0 1.9-0.7 1.9-2.4 0-1.2-0.6-2.4-1.9-2.4-1 0-1.9 0.9-1.9 2.4s0.8 2.4 1.9 2.4z"/><path class="st1" d="m59.7 36.9s0.7 0.8 1.9 0.8c0.5 0 1.1-0.3 1.1-0.8 0-1.2-3.4-1-3.4-3.1 0-1.2 1.1-1.9 2.4-1.9 1.5 0 2.1 0.7 2.1 0.7l-0.5 1s-0.6-0.6-1.6-0.6c-0.5 0-1.1 0.2-1.1 0.8 0 1.2 3.4 0.9 3.4 3.1 0 1.1-0.9 1.9-2.4 1.9-1.6 0-2.5-1-2.5-1z"/></g></g></svg>

theme/assets/img/financial-services/mysudo.svg

@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="384" height="128" version="1.1" viewBox="0 0 101.6 33.867" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><defs><linearGradient id="SVGID_1_" x1="15.528" x2="240.08" y1="27.875" y2="220.72" gradientUnits="userSpaceOnUse"><stop stop-color="#4875F5" offset=".04971"/><stop stop-color="#4B71F4" offset=".1762"/><stop stop-color="#6250EC" offset=".3227"/><stop stop-color="#7238E7" offset=".4579"/><stop stop-color="#782FE5" offset=".5413"/><stop stop-color="#7B2BE4" offset=".6671"/></linearGradient><clipPath id="SVGID_00000008148322744188545190000011776514215319350975_"><use xlink:href="#SVGID_00000000189638345710748290000006527516765547016108_"/></clipPath><clipPath id="SVGID_00000008107224416624678500000006806855999860403361_"><use xlink:href="#SVGID_00000151503631089680849560000015413622321429831852_"/></clipPath><path id="SVGID_00000000189638345710748290000006527516765547016108_" d="m174.3 123.5c-0.1-7.1 5.3-13 12-13.1s12.4 5.7 12.4 12.8c0.1 7.1-5.4 12.9-12.1 13-6.6 0.1-12.2-5.6-12.3-12.7zm-6.9 0.1c0.2 11.2 8.8 20 19.4 19.8 10.7-0.1 19.1-9.2 18.9-20.4s-8.8-20.1-19.5-20c-10.6 0.3-18.9 9.4-18.8 20.6zm-33.5 13.2-0.3-25.6 6.1-0.1c6.9-0.1 12.1 5.3 12.2 12.6s-4.9 12.9-11.8 13zm-6.8 5.9c0 0.6 0.4 1.1 1 1.1l12.6-0.2c10.3-0.1 18.6-9 18.5-19.9-0.1-10.8-8.7-19.4-19-19.3l-12.6 0.2c-0.5 0-1 0.5-0.9 1.1zm-42.9-13.2c0.1 8.5 6.7 15.3 15 15.2 8.4-0.1 14.8-7.1 14.7-15.6l-0.3-23.3c0-0.6-0.5-1.1-1-1.1l-5.1 0.1c-0.6 0-1 0.5-1 1.1l0.3 23c0.1 4.7-3 8.5-7.7 8.6-4.6 0.1-7.8-3.6-7.9-8.4l-0.3-22.9c0-0.6-0.4-1.1-1-1.1l-5.1 0.1c-0.5 0-1 0.5-1 1.1zm-34 11.5c1.1 1 5.1 4.3 11.8 4.2 7.5-0.1 12.2-5.5 12.1-11.3-0.1-7.2-6.1-10.4-11.3-12.5-4.3-1.8-6.3-3.6-6.4-6.2 0-1.8 1.6-3.9 4.6-4 2.9 0 7 2.7 7.5 3 0.6 0.4 1.4 0 1.9-0.7l2-3.2c0.4-0.6 0.2-1.5-0.3-1.8-1.1-0.8-5.3-3.7-10.7-3.6-8.5 0.1-11.9 5.9-11.9 10.9 0.1 6.6 5.2 9.9 10.2 12 4.5 1.8 6.8 3.8 6.9 6.6 0 2.4-2 4.3-4.8 4.4-3.5 0-7.8-3.2-8.1-3.4-0.5-0.4-1.4-0.4-1.8 0.4l-1.9 3.5c-0.6 0.9-0.3 1.2 0.2 1.7z"/><path id="SVGID_00000151503631089680849560000015413622321429831852_" d="m185.1 157.8c-3.6 6-8.2 11.4-13.5 16.1-28.3 24.5-70.9 21.4-95.3-7-1.1-1.3-2.2-2.7-3.2-4.1-1.4-1.8-1-4.5 0.9-5.8 1.8-1.4 4.4-1 5.8 0.9 0.9 1.2 1.9 2.4 2.9 3.6 21.4 25 58.8 27.7 83.6 6.2 4.7-4.1 8.7-8.8 11.9-14.1 1.2-2 3.7-2.6 5.7-1.4 1.8 1 2.4 3.6 1.2 5.6zm-0.9-68.9c-3.8-5.9-8.5-11.2-14-15.7-28.9-23.8-71.5-19.5-95.1 9.6-1.1 1.4-2.1 2.8-3.1 4.2-1.3 1.9-0.8 4.5 1 5.8 1.9 1.3 4.5 0.9 5.8-1 0.9-1.3 1.8-2.5 2.8-3.7 20.7-25.5 58-29.3 83.4-8.5 4.8 4 8.9 8.6 12.3 13.8 1.2 1.9 3.8 2.5 5.7 1.2 1.9-1.2 2.4-3.8 1.2-5.7z"/></defs><g transform="matrix(.12495 0 0 .12495 -1.9367 1.4266)"><path class="st0" d="m214.5 236.2h-173.8c-13.9 0-25.2-11.3-25.2-25.2v-173.8c0-13.9 11.3-25.2 25.2-25.2h173.8c13.9 0 25.2 11.3 25.2 25.2v173.8c-0.1 13.9-11.3 25.2-25.2 25.2z" fill="url(#SVGID_1_)"/><use clip-rule="evenodd" fill="#ffffff" fill-rule="evenodd" xlink:href="#SVGID_00000000189638345710748290000006527516765547016108_"/><clipPath><use xlink:href="#SVGID_00000000189638345710748290000006527516765547016108_"/></clipPath><g clip-path="url(#SVGID_00000008148322744188545190000011776514215319350975_)"><rect class="st2" transform="matrix(.9999 -.013626 .013626 .9999 -1.6792 1.7502)" x="44" y="98.6" width="167.1" height="51.1" fill="#fff"/></g><use fill="#ffffff" xlink:href="#SVGID_00000151503631089680849560000015413622321429831852_"/><clipPath><use xlink:href="#SVGID_00000151503631089680849560000015413622321429831852_"/></clipPath><g clip-path="url(#SVGID_00000008107224416624678500000006806855999860403361_)"><rect class="st2" transform="matrix(.9999 -.013626 .013626 .9999 -1.679 1.7628)" x="66.4" y="52.5" width="124.3" height="143.2" fill="#fff"/></g><path d="m356.8 166.6c-5.4-15.3-17.9-52.5-23.2-69.8h-0.4v69.8h-19.2v-97.2h29.2s21 62.8 23.9 72.3c2.8-9.6 23-72.3 23-72.3h29v97.2h-19.1v-69.8h-0.4c-5.6 17.4-19.2 58-23.3 69.8z"/><path d="m446 194.4 10-27.2-25.7-66.7h20.1s12.4 35.8 15.1 44.6h0.3c2.8-8.7 15-44.6 15-44.6h18.9l-35 93.9z"/><path d="m552.3 108.6c23 3.9 33.6 11.9 33.6 29.4 0 18.7-16.5 30.5-39.2 30.5-24.6 0-39.4-13.9-40.3-29.6l20.8-3.3c1 9.3 7.2 16.1 19.4 16.1 9.9 0 17.9-3.7 17.9-12.6 0-7.2-5.3-10.7-20.4-13.1-20.3-3.2-35.7-9.9-35.7-29.4 0-19.4 15.7-29.2 37.2-29.2 20.1 0 35.3 9.6 38.6 26.7l-21.1 4.6c-1.5-8.9-7.8-14.4-18.1-14.4-10.4 0-15.6 4.2-15.6 10.7 0.3 8.3 7.1 10.9 22.9 13.6z"/><path d="m662.4 166.6h-19.3v-9.7c-3.3 6.2-9.7 11.7-20.3 11.7-12.6 0-22.9-7.5-22.9-22.5v-45.5h20v39.6c0 9 4.6 12.1 10 12.1 6.2 0 12.5-5.4 12.5-17.6v-34h20z"/><path d="m726 108.8v-39.4h20v97.2h-19.3v-9.6c-3.5 6-10.3 11.5-21.7 11.5-16.2 0-29-13.3-29-35 0-21.5 13.2-35 30-35 9.3 0.1 16.4 4.4 20 10.3zm0.2 22.8c0-12.1-7.5-17.6-14.9-17.6-9.2 0-14.9 8.5-14.9 19.6 0 11.2 5.4 19.6 14.2 19.6 7.6 0 15.6-5.4 15.6-17.5z"/><path d="m828.6 133.6c0 21.7-13.9 35-34.6 35-20.6 0-34.4-13.3-34.4-35s13.9-35 34.4-35c20.8 0 34.6 13.3 34.6 35zm-20.2 0c0-11.2-4.3-20-14.3-20-9.9 0-14.2 8.7-14.2 20s4.3 20 14.2 20c10 0 14.3-8.8 14.3-20z"/></g></svg>

theme/assets/img/financial-services/privacy_com-dark.svg

@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="384" height="128" version="1.1" viewBox="0 0 101.6 33.867" xmlns="http://www.w3.org/2000/svg"><defs><clipPath id="clip0_281_2112"><rect width="96" height="24" fill="#fff"/></clipPath></defs><g transform="matrix(1.0583 0 0 1.0583 1.6e-6 4.2333)" clip-path="url(#clip0_281_2112)"><rect width="96" height="24"/><path d="m96 0v24h-96v-24zm-24.243 5.76c-0.8248 0-1.6151 0.12887-2.3712 0.38661-0.756 0.25773-1.4404 0.63861-2.0533 1.1426-0.6128 0.50402-1.1054 1.177-1.4777 2.0189-0.3722 0.84193-0.5584 1.7898-0.5584 2.8437 0 1.008 0.1862 1.9129 0.5584 2.7148 0.3723 0.8018 0.8706 1.4433 1.4949 1.9244s1.3145 0.8477 2.0705 1.0997 1.5464 0.378 2.3712 0.378c1.26 0 2.4227-0.2577 3.488-0.7732v-2.5258c-0.7331 0.6644-1.7641 0.9966-3.0928 0.9966-0.5384 0-1.0568-0.0774-1.555-0.232-0.4983-0.1546-0.9508-0.3809-1.3575-0.6787-0.4066-0.2978-0.7302-0.6959-0.9708-1.1942-0.2405-0.4983-0.3608-1.0682-0.3608-1.7096 0-1.3517 0.4152-2.3741 1.2457-3.0671s1.83-1.0395 2.9984-1.0395c1.1913 0 2.1936 0.31501 3.0069 0.94503v-2.4571c-1.031-0.51548-2.1764-0.77321-3.4365-0.77321zm-58.821 0.24055h-4.5362v12.028h2.5774v-3.9519h1.9588c3.4594 0 5.189-1.346 5.189-4.0379s-1.7296-4.0378-5.189-4.0378zm13.062 0h-4.9485v12.028h2.5773v-4.2096h1.8901l3.2475 4.2096h2.9725l-3.5911-4.5361c1.7526-0.5613 2.6289-1.7526 2.6289-3.574 0-0.73312-0.1346-1.3631-0.4038-1.8901s-0.6414-0.93358-1.1168-1.22c-0.4754-0.28638-0.9794-0.49256-1.5121-0.61857-0.5326-0.126-1.114-0.18901-1.744-0.18901zm10.965 0h-2.5774v12.028h2.5774zm5.6223 0h-2.7836l4.6736 12.028h2.6461l4.6908-12.028h-2.7835l-3.2303 9.0036zm16.729 0h-2.7835l-4.9142 12.028h2.6633l0.8935-2.2509h5.4983l0.8763 2.2509h2.6633zm20.702 0h-2.9038l4.708 7.7664v4.2612h2.5601v-4.2612l4.6909-7.7664h-2.9039l-3.0756 5.3952zm-22.093 2.3884c0.0573 0.30929 0.1432 0.62429 0.2578 0.94503l1.6839 4.3128h-3.8833l1.6667-4.3128c0.1146-0.27492 0.2062-0.58992 0.2749-0.94503zm-44.866-0.12028c1.6266 0 2.4399 0.58993 2.4399 1.7698 0 1.1799-0.8133 1.7698-2.4399 1.7698h-2.079v-3.5396zm13.062 0c0.5956 0 1.0825 0.13746 1.4605 0.41238s0.567 0.70448 0.567 1.2887c0 0.57271-0.1919 0.99941-0.5756 1.2801-0.3837 0.2806-0.8677 0.421-1.4519 0.421h-2.4915v-3.4022z" clip-rule="evenodd" fill="#fff" fill-rule="evenodd"/></g></svg>

theme/assets/img/financial-services/privacy_com.svg

@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="384" height="128" version="1.1" viewBox="0 0 101.6 33.867" xmlns="http://www.w3.org/2000/svg"><path d="m101.6 4.28v25.308h-101.6v-25.31h101.6zm-25.657 6.0733c-0.87347 0-1.7102 0.13667-2.5103 0.40898a6.9003 6.9003 0 0 0-2.1731 1.2037c-0.64913 0.53232-1.1698 1.242-1.5635 2.1296-0.39517 0.88902-0.59126 1.8867-0.59126 2.9985 0 1.0622 0.19748 2.0179 0.59266 2.8632 0.39254 0.84528 0.92001 1.5214 1.5804 2.0292 0.66181 0.50772 1.3914 0.89346 2.1915 1.16 0.80008 0.26308 1.6368 0.39804 2.5103 0.39804 1.3335 0 2.564-0.26992 3.6915-0.81556v-2.663c-0.77613 0.70008-1.8669 1.0499-3.2738 1.0499-0.57011 0-1.1191-0.082-1.6454-0.24258a4.8458 4.8458 0 0 1-1.4365-0.71579 3.3105 3.3105 0 0 1-1.0274-1.2601 4.0838 4.0838 0 0 1-0.38239-1.802c0-1.4254 0.43894-2.5034 1.3179-3.2342 0.87914-0.73083 1.9375-1.0964 3.1736-1.0964 1.2601 0 2.3213 0.33142 3.182 0.9963v-2.5909c-1.0907-0.54325-2.3029-0.81556-3.6364-0.81556zm-62.253 0.25283h-4.8006v12.683h2.7277v-4.1661h2.0743c3.6604 0 5.4892-1.4196 5.4892-4.2573 0-2.8389-1.8288-4.2587-5.4892-4.2587zm13.823 0h-5.2367v12.683h2.7277v-4.4394h2.001l3.436 4.4394h3.1468l-3.8015-4.7827c1.8556-0.59143 2.7827-1.8484 2.7827-3.7677 0-0.77319-0.14251-1.4381-0.42771-1.9936a3.1228 3.1228 0 0 0-1.1826-1.2857 5.5809 5.5809 0 0 0-1.6002-0.65327 8.0462 8.0462 0 0 0-1.8457-0.19475zm11.605 0h-2.7263v12.683h2.7277v-12.683zm5.9506 0h-2.9464l4.9474 12.683h2.7997l4.9643-12.683h-2.945l-3.4191 9.494zm17.705 0h-2.9464l-5.1999 12.683h2.8179l0.94546-2.3736h5.8194l0.92711 2.3736h2.8194zm21.909 0h-3.0734l4.9826 8.1901v4.493h2.7094v-4.4904l4.9643-8.1901h-3.072l-3.2554 5.6896-3.2554-5.6896zm-23.382 2.5191c0.06082 0.32458 0.15102 0.65771 0.27231 0.9963l1.7823 4.548h-4.1091l1.7639-4.548c0.12163-0.287 0.21867-0.62081 0.29042-0.9963zm-47.484-0.12642c1.7216 0 2.5823 0.62081 2.5823 1.8669 0 1.2433-0.86074 1.8655-2.5823 1.8655h-2.1999v-3.734h2.2013zm13.825 0c0.62934 0 1.1444 0.14692 1.5452 0.4346 0.40053 0.29042 0.59974 0.74381 0.59974 1.3588 0 0.60373-0.20309 1.0544-0.60823 1.3506-0.40638 0.29725-0.91858 0.44314-1.5381 0.44314h-2.636v-3.5871z" clip-rule="evenodd" fill-rule="evenodd" stroke-width="1.4111"/></svg>