Interesting that you mention those two as I'd not trust either with private data. They engage in too much magical thinking in their marketing for my liking...
Magical thinking, like Mullvad burning large amounts of engineering effort to make sure their infrastructure never stores anything worth a subpoena. Their VPN servers don't have hard drives. Mullvad is one of the rare examples of doing more than marketing.
https://mullvad.net/en/blog/we-have-successfully-completed-o...