5, 9, or 14 Eyes: Is your VPN actually safe?

There is no doubt that the secret European branch of the "SIGINT Seniors" spy network (known commonly as "14 Eyes") existed at the time the Snowden files were released.
Today, however, it is hard to confirm that the network still exists, or that the secret treaty on signals intelligence is still in force. We assume it does until proven otherwise.

Even if we currently cannot prove the existence of the network or the treaty, many other undisclosed alliances likely exist between countries outside of the hypothetical 14 Eyes network. Let’s assume there are least as many secret networks as there are countries.

Does this matter? Not really. Just assume all communication is secretly tapped. This is likely the most correct assumption.

What matters are the laws that apply to your VPN provider based on the country that it's located in. One should be particularly cautious of countries that are less transparent than those within the EU.

Sweden as an EU member state, where Mullvad VPN is located, is subject to strict European privacy laws such as the General Data Protection Regulation (GDPR). Most importantly, none of the Swedish regulations can force VPN providers to secretly collect traffic-related data. In our case, it would be impossible for any government to attain data logs from us because we have none to give.

In that sense, Sweden is still a very safe country from a privacy perspective for both VPN providers and users of VPN services.