# Netlify privacy rating

Platform for building and deploying websites and web apps from Git, with a global CDN, serverless and edge functions, forms and deploy previews.

## Summary

Netlify scores 34 out of 100 (grade F) on the app hosting platforms criteria. It meets 2 of 8 criteria: tells users about requests and TLS configuration. It partly meets independent audit, transparency report and security headers. It does not meet open source, no trackers or telemetry and no ads or data sales. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B+.

- Website: https://www.netlify.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web
- Home page trackers: Google Tag Manager, HubSpot, OneTrust (not scored)
- Category: [App hosting platforms](https://privacyratings.com/app-hosting/)
- Grade: F (34/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. The Netlify CLI is open source, but the platform is not. |  |
| No trackers or telemetry | No | The website loads Google Tag Manager, HubSpot and DoubleClick, and the privacy statement describes interest-based advertising cookies. | https://www.netlify.com/privacy/ |
| No ads or data sales | No | The privacy statement says it uses services that deliver interest-based ads and may transfer personal information to business partners for their use. | https://www.netlify.com/privacy/ |
| Independent audit | Partial | SOC 2 Type 2 reports are only available to Enterprise customers; the ISO 27001 certificate is public. | https://www.netlify.com/security/ |
| Transparency report | Partial | The data processing addendum sets out how public authority requests are handled, but no request counts are published. | https://www.netlify.com/pdf/netlify-dpa.pdf |
| Tells users about requests | Yes | The data processing addendum promises to notify customers of public authority requests unless legally prohibited. | https://www.netlify.com/pdf/netlify-dpa.pdf |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=app.netlify.com&hideResults=on |
| Security headers | Partial | Grade B+ (80/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=app.netlify.com |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/app-hosting/netlify/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/app-hosting/netlify.md