IronVest

What Is IronVest?

If you’re tired of handing your real email address, phone number, and payment details to every random checkout form on the internet—and then dealing with spam, tracking, and breach fallout—IronVest is built for that exact problem. The core idea is simple: use masks (aliases) so websites and merchants don’t get your real identifiers in the first place.

In practice, IronVest sits in your browser (and on mobile) and helps you do three things: autofill logins and identity data, generate masked emails/phones/cards for signups and purchases, and reduce tracking on the sites you visit. It also puts a lot of emphasis on account-access security (biometric-focused flows and protection of passcodes/2FA codes), positioning itself as more than a standard password manager. (addons.mozilla.org)

One important caveat: the “IronVest” name is currently used in two noticeably different ways online—(1) the consumer privacy wallet / masking + password manager tooling (the thing most individuals will recognize from the Blur/MaskMe lineage), and (2) a fraud-prevention offering pitched at financial institutions (ActionID/KYRi intent verification). This review is about the consumer identity/privacy product set (masking, vault, autofill, passcode protection), not the bank/fintech fraud stack. (ironvest.com)

IronVest Features and Performance

IronVest’s feature set is centered on masking + autofill. On the masking side, it supports masked email addresses, masked phone numbers, and virtual/masked cards (IronVest calls these “Masked Cards” in its legal docs, and elsewhere they’re described as virtual cards / single-use cards). The Firefox add-on listing also explicitly describes masked emails, “single-use virtual cards,” and masked mobile numbers as part of the offering. (addons.mozilla.org)

For email masking specifically, IronVest’s own blog states that free users can create up to three masked email addresses, while premium subscribers can create unlimited masked emails (and can turn off addresses). PCWorld’s 2023 review matches that “3 masked emails on free” description, though plan details may evolve over time.

On the account-security side, IronVest markets a zero-knowledge posture for passwords and says it can’t access your passwords. The Firefox add-on listing claims “zero-knowledge infrastructure,” AES-256 encryption, and architectural separation of keys used for auth vs. data encryption. Meanwhile, the Privacy Policy explicitly lists “Your master password” and “Your login credentials and passwords” under data IronVest says it cannot access, and also states it can’t access your browsing activity. (addons.mozilla.org)

A distinctive feature (and one IronVest leans on heavily) is Passcode Protection: the idea is to use a masked phone number for SMS/verification codes so the codes don’t hit your real number. IronVest’s knowledge base claims passcodes sent to your masked phone are “intercepted by IronVest and never reach your actual phone number,” and that the extension can automatically capture and fill them. That’s a very specific claim with a very specific dependency: you must actually change the target phone number for verification on your accounts to the IronVest masked number. (ironvest-kb.instantdocsbase.com)

Tracking protection is also part of the package. PCWorld describes IronVest blocking trackers and letting you see who’s trying to follow you, with controls in the browser extension to enable/disable per site. The Terms of Service also references blocking software tracking as a core use-case of the services.

Performance-wise, this isn’t a VPN and there are no network “protocols” or throughput benchmarks to measure the way you would for a VPN. The real-world “speed” question with IronVest is whether it reliably detects form fields, reliably generates masks, and reliably autofills without breaking sites. IronVest’s own Privacy Policy acknowledges optional browser-extension telemetry used to improve “form detection and autofill performance,” which implies that correct form matching is a meaningful engineering focus. (ironvest.com)

Pricing and Plans

IronVest’s consumer plans have historically been presented as a free tier plus paid tiers. PCWorld (Apr 12, 2023) described a free account plus Plus and Ultimate tiers, with Plus at $5.95/month or $39/year and Ultimate at $14.95/month or $99/year at the time of that review.

More current pricing evidence shows up via Apple’s App Store listing, which includes in-app purchases for IronVest Plus Monthly ($5.99), IronVest Plus Yearly ($39.99), IronVest Ultimate Monthly ($14.99), and IronVest Ultimate Yearly ($99.99). That aligns closely with PCWorld’s earlier figures (with slight rounding).

Refunds: IronVest’s Masked Cards Account Terms state that new subscriptions include a 14-day money-back guarantee for a full refund if canceled within 14 days of purchase, and that canceling after that retains access for the remainder of the year (with access revoked at the end of the year). That’s one of the few places the refund window is spelled out cleanly in primary documentation.

One more complication: IronVest also operates an “Ivy” branded site (getivy.ai) with separate pricing and plan limits, and it explicitly states that Ivy billing is separate from the IronVest app and that existing IronVest users’ plan is unchanged. If you’re evaluating pricing, you need to be careful you’re looking at the product you’re actually signing up for.

Privacy and Security Assessment

Jurisdiction: You provided a verified spec that IronVest’s jurisdiction is United States (Delaware). In practice, that means US legal process can apply, and users shouldn’t assume the kind of statutory privacy protections sometimes associated with different jurisdictions. (This is not automatically “bad,” but it is a real constraint for threat models involving government access.)

Data collection & sharing: IronVest’s Privacy Policy makes several concrete claims:

• It states “We never sell your personal data.” (ironvest.com)
• It uses Customer.io for email delivery and explicitly notes that clicking email links results in tracking data collection (IP and estimated geolocation, device/browser info, click behavior). (ironvest.com)
• It lists a set of service providers and categories of data shared with them (e.g., Stripe/Galileo for payments, Twilio/Bandwidth for masked phones, Anonybit/Coresight for biometrics, Google Analytics 4 for consent-gated site analytics). (ironvest.com)
• It claims it “encrypt[s] your sensitive data and can't access your passwords or browsing activity.” (ironvest.com)

Zero-knowledge posture: IronVest markets “zero-knowledge” both in storefront copy (Firefox add-on listing) and in its Privacy Policy’s “We Cannot Access” section. That’s meaningful, but it’s still vendor-asserted rather than independently verified in the sources we found. (addons.mozilla.org)

Audits & certifications: IronVest’s Security page claims SOC 2 Type II and “GDPR & CCPA compliant by design,” but the same page also contains an explicit note: “this is placeholder copy pending review” and says a full security whitepaper is available on request. That undercuts how much confidence you should place in that page without additional documentation. (ironvest.com)

Incidents / criticisms: We did not find an official public incident disclosure page in the sources above. However, there are documented complaints in user-review ecosystems (e.g., Trustpilot has a low average score and some complaints about reliability of forwarding features). Treat that as user-reported experience, not as a verified security incident—but it does matter if your use-case depends on long-lived forwarding or consistent access to old masks.

Open-source: The Firefox listing invites people to ask about source code, but does not provide a public repository link in the captured text, and we didn’t find a definitive claim that the extensions/apps are open-source. So: no credit for open-source transparency here.

Strengths and Limitations

Strengths

• Masking breadth: Email, phone, and payment masking in one place, integrated into autofill. (addons.mozilla.org)
• Practical anti-account-takeover idea: Passcode Protection targets SMS verification flows directly by shifting them onto masked numbers. (ironvest-kb.instantdocsbase.com)
• Clear “no sale” statement: The Privacy Policy explicitly says it doesn’t sell personal data. (ironvest.com)
• Concrete refund window in primary docs: 14-day money-back guarantee is stated in Masked Cards Terms.

Limitations

• Plan/product naming confusion: “IronVest” and “Ivy” appear side-by-side with different pricing/limits and separate billing, which can confuse buyers.
• Not a VPN / not network privacy: This won’t hide your IP address from sites; it’s about identity data minimization and account security.
• Reliability concerns reported by users: If forwarding breaks, you can lose access to important account emails/texts. (User-reported; not universally verified.)

Who Should Use IronVest?

Good fit if you are:

1. A frequent online shopper who wants to avoid handing out the same real email and card details to dozens of merchants (and reduce breach fallout by using masks). (addons.mozilla.org)
2. Someone cleaning up spam and signup exposure by using masked emails per service, with the option to disable masks later.
3. A user worried about account takeover via SMS codes who’s willing to migrate key accounts to a masked number and rely on the extension/app for passcode capture/fill. (ironvest-kb.instantdocsbase.com)

Not a great fit if you are:

1. Looking for VPN-style privacy (IP masking, encrypted tunnel, protocol choices). IronVest is not that.
2. Allergic to third-party processors/telemetry: the Privacy Policy lists multiple vendors (Customer.io, Stripe, GA4, Twilio, etc.) used to operate the service. (ironvest.com)
3. Depending on perfect long-term forwarding reliability for mission-critical accounts; user reports indicate some people have had issues with forwarding/access over time.