# Santa privacy rating

A binary and file access authorization system for macOS that allows or blocks apps by hash, signing certificate or team ID. Created at Google and now maintained by North Pole Security.

## Summary

Santa scores 50 out of 100 (grade D) on the macOS hardening criteria. It meets 2 of 4 criteria: open source and no ads or data sales. It does not meet no trackers or telemetry and independent audit. It is based in the United States: Five Eyes member; subject to the US CLOUD Act.

- Website: https://northpole.dev
- Source code: https://github.com/northpolesec/santa
- License: Apache-2.0
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: macOS
- Home page trackers: Google Analytics, Google Tag Manager, Plausible (cookieless analytics)
- Category: [macOS hardening](https://privacyratings.com/macos-hardening/)
- Grade: D (50/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | Apache-2.0. | https://github.com/northpolesec/santa/blob/main/LICENSE |
| No trackers or telemetry | No | The agent reports only to a sync server chosen by the administrator, but the website loads Google Analytics. | https://northpole.security/privacy |
| No ads or data sales | Yes | Funded by North Pole Security's commercial management service, with no ads. | https://northpole.security |
| Independent audit | No | No independent audit is published. |  |

Source: https://privacyratings.com/macos-hardening/santa/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/macos-hardening/santa.md