deSEC privacy rating

Summary

deSEC scores 77 out of 100 (grade B) on the DNS hosting criteria. It meets 8 of 11 criteria: open source, no trackers or telemetry, no ads or data sales, TLS configuration, security headers, DNSSEC, API access and two-factor login. It does not meet independent audit, transparency report and tells users about requests. It is based in Germany: Fourteen Eyes member; EU member (GDPR). Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.

Score 77 out of 100. How scoring works

Criteria

• ✔Yes

  Open source ×3Weight 3 of 3

  Is all the source code needed to run the product public?

  MIT.

  github.com

• ✔Yes

  No trackers or telemetry ×3Weight 3 of 3

  Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?

  The privacy policy states no tracking, behavioral analytics or externally hosted dependencies are used.

  desec.io

• ✔Yes

  No ads or data sales ×2Weight 2 of 3

  Is the product funded without advertising, ad targeting or selling user data?

  Run by a non-profit association funded by donations and grants. No ads.

  desec.io

• ✖No

  Independent audit ×2Weight 2 of 3

  Has an independent security or privacy audit been published within the last three years?

  No independent audit is published.

• ✖No

  Transparency report ×2Weight 2 of 3

  Does the provider regularly publish how many government and legal requests it receives and how it responds?

  No transparency report or government request policy is published.

• ✖No

  Tells users about requests ×1Weight 1 of 3

  Does the provider promise to tell users about requests for their data, unless a court forbids it?

  No published policy on notifying users about data requests.

• ✔Yes

  DNSSEC ×3Weight 3 of 3

  Can DNSSEC be turned on for hosted zones?

  Every hosted zone is signed with DNSSEC automatically. The DS record is added at the registrar.

  desec.io

• ✔Yes

  API access ×1Weight 1 of 3

  Can records be managed through an API on every plan?

  All records are managed through the REST API, which every free account can use.

  desec.readthedocs.io

• ✔Yes

  Two-factor login ×2Weight 2 of 3

  Do accounts support two-factor authentication with an authenticator app or security key?

  TOTP authenticator apps are supported for login.

  desec.io

Automated tests

• ✔Yes

  TLS configuration ×2Weight 2 of 3

  Does the website pass the Qualys SSL Labs test with a grade of A or better?

  Grade A+

  ssllabs.com

• ✔Yes

  Security headers ×1Weight 1 of 3

  Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?

  Grade A+ (105/100+)

  developer.mozilla.org

• …Not tested yet

  Modern web standards ×1Weight 1 of 3

  Does the website score 90% or higher on the Internet.nl website test?

  Not tested yet.