# Fly.io privacy rating

Platform that runs apps as lightweight virtual machines on its own hardware in regions around the world, deployed with the flyctl command-line tool.

## Summary

Fly.io scores 38 out of 100 (grade F) on the app hosting platforms criteria. It meets 2 of 8 criteria: tells users about requests and TLS configuration. It partly meets no ads or data sales, independent audit and transparency report. It does not meet open source, no trackers or telemetry and security headers. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade C.

- Website: https://fly.io
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web
- Home page trackers: none found
- Category: [App hosting platforms](https://privacyratings.com/app-hosting/)
- Grade: F (38/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. The flyctl command-line tool is open source, but the platform is not. |  |
| No trackers or telemetry | No | Marketing and documentation pages use Google Analytics and PostHog; the dashboard does not. | https://fly.io/legal/privacy-policy/ |
| No ads or data sales | Partial | Funded by paid usage with no ads or data sales, but Google conversion measurement is used for its own advertising. | https://fly.io/legal/privacy-policy/ |
| Independent audit | Partial | A SOC 2 Type 2 attestation and third-party penetration tests exist, but reports are only available on request. | https://fly.io/security/ |
| Transparency report | Partial | The privacy statement describes how compelled disclosure requests are handled, but no request counts are published. | https://fly.io/legal/privacy-policy/ |
| Tells users about requests | Yes | The privacy statement says users are notified of disclosures of their information unless prohibited by law or court order. | https://fly.io/legal/privacy-policy/ |
| TLS configuration | Yes | Grade A | https://www.ssllabs.com/ssltest/analyze.html?d=fly.io&hideResults=on |
| Security headers | No | Grade C (55/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=fly.io |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/app-hosting/fly-io/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/app-hosting/fly-io.md