MySudo is a paid iOS/Android privacy app from Anonyome Labs, Inc. (Salt Lake City, Utah; founded 2014, privately held and venture-funded) that lets users create up to nine "Sudo" identities, each with its own phone number, email inbox, end-to-end-encrypted handle, private browser, and — for US users on paid plans — a Mastercard virtual card issued by Sutton Bank and powered by Marqeta. Anonyome's privacy policy and law-enforcement guidelines state that no personally identifiable information is collected when a user registers, that Sudo content is encrypted with the only key on the user's device, and that the company does not sell, trade, or exchange personal information; but the same documents state that virtual cards and UK phone numbers legally require identity verification (name, address, date of birth, sometimes a government ID) that is shared with GBG IDology and issuing bank partners and retained for five years, that in-app analytics run through Braze unless disabled in settings, and that legal-identity data will be produced to law enforcement on a valid subpoena or warrant. Calls and SMS from Sudo numbers are routed over regulated telecom partners. Anonyome self-attests PCI DSS Level 1 and a SOC 2 report and runs an email-based responsible-disclosure program with a hall of fame; no breach, regulatory action, or published third-party audit report involving MySudo was found in this research.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
11 ON FILE
COLLECTION
Privacy Guides lists MySudo (US, Paid) as a recommended payment-masking service alongside Privacy.com under criteria requiring the creation of multiple cards that shield the merchant from the user's personal finances and that do not require accurate billing address information; the listing notes MySudo's virtual cards are currently only available via its iOS app.
Anonyome Labs' law-enforcement guidelines (last updated December 10, 2025) state that by default no personally identifiable information is collected when a user downloads, installs and registers MySudo, that only the optional Virtual Cards and UK Telephone Numbers capabilities require legal-identity verification, that the company cannot decrypt user communications in transit or at rest, and that it will produce records only on valid legal process — while reserving, rather than promising, user notification.
Anonyome Labs' privacy policy (last updated June 17, 2026) states the company only asks for personal information necessary to use its services, collects anonymized app-performance data that users can opt out of in settings, does not sell, trade or exchange personal information, and has no way to track users' precise location; it separately states that Virtual Cards and telephony from some countries legally require verifying the user's name, address, date of birth and government-issued ID, and that legal identity is associated with the account only if those capabilities are used.
Anonyome Labs' company page states it has operated since 2014, names six executive leaders (CEO JD Mumford, CTO Dr. Paul Ashley, CSO Neil Readshaw, and heads of People, Product and Engineering), lists offices in Salt Lake City, Woodside (California) and Gold Coast (Australia), lists memberships in the Linux Foundation, Decentralized Identity Foundation, W3C, Trust Over IP and OpenID Foundation, and enumerates 23 issued US patents; it does not disclose owners, investors or funding.
A Tech Rockies news item dated August 28, 2017 reported that Salt Lake City-based Anonyome Labs raised a $20.4M Series B from Symantec CEO Greg Clark, Crosspoint Ventures founder John Mumford, LifeLock founder Todd Davis, Ariba co-founder Ken Eldred and Hanna Ventures, and was then led by former Solera Networks CEO Steve Shillingford — the only funding disclosure found; the company remains private with no later rounds or ownership stakes published on its own site.
Anonyome Labs' Terms of Service (last updated May 22, 2026) state that all content sent from and received by a Sudo is encrypted with the only decryption key stored on the user's device, so the company cannot associate a Sudo with the user's PII unless the user shares it; the same terms state virtual cards are US-only, verified through GBG IDology with identity data retained five years after use, issued by Sutton Bank (Member FDIC) under Mastercard license and powered by Marqeta, and that Sudo calls are routed through regulated and licensed telecom partners.
Anonyome Labs' privacy policy states that for Virtual Cards it shares identity data with GBG IDology (retained no more than 30 days) and with issuing bank partners under banking regulations (retained five years, including card-related support-request contents), sends funding-card number, billing address, IP address and device user-agent to payment processors, may share necessary details with a merchant in a dispute, shares telephony identity data with the number provider, and will share legal-identity information with law enforcement on a proper subpoena or warrant.
Anonyome Labs publishes a responsible-disclosure page inviting reports of security vulnerabilities to security@anonyome.com with a PGP key, committing to acknowledge within 24 hours and provide weekly updates, and crediting researchers in a hall of fame; the page describes no paid bounty, defined scope, or safe-harbor language, and no breach or regulatory action involving MySudo was found in this research.
Anonyome Labs' company page lists its security and compliance certifications as PCI DSS Level 1 (since 2017), EU-U.S. Data Privacy Framework (since 2017), CyberGRX Tier 2 Validated (since 2021) and a SOC 2 Report (since 2024); these are self-attested on the marketing page and no audit report or auditor name is published there.
The App Store listing for MySudo (seller Anonyome Labs, Inc; free with in-app subscriptions from $1.99/month to $149.99/year) carries a developer-supplied privacy label declaring only 'Data Not Linked to You' — Purchases, Identifiers (User ID), Usage Data (Product Interaction) and Diagnostics (Crash Data) — used for Analytics, App Functionality and 'Developer's Advertising or Marketing'; Apple notes the information has not been verified by Apple.
Anonyome Labs' privacy policy names Braze as the vendor for in-app usage analytics, which it describes as non-personally-identifying and disableable in the app's privacy settings; it also discloses request logs (date/time, request type, app version, IP address), a push-notification identifier it says cannot identify the device or Apple/Google account, aggregate-only advertising-performance measurement, and HubSpot/Salesforce processing of website contact-form data.