# Stalwart privacy rating

Self-hosted mail and collaboration server written in Rust, with JMAP, IMAP, POP3, SMTP, CalDAV, CardDAV and WebDAV support, built-in spam filtering and a web admin interface.

## Summary

Stalwart scores 100 out of 100 (grade A) on the mail server software criteria. It meets 4 of 4 criteria: open source, no trackers or telemetry, no ads or data sales and independent audit. It is based in the United Kingdom: Five Eyes member; GDPR-style data protection law; CLOUD Act data access agreement with the US.

- Website: https://stalw.art
- Source code: https://github.com/stalwartlabs/stalwart
- Jurisdiction: United Kingdom. Five Eyes member. GDPR-style data protection law. CLOUD Act data access agreement with the US.
- Platforms: Linux, macOS, Windows
- Home page trackers: Cloudflare Web Analytics (cookieless analytics)
- Category: [Mail server software](https://privacyratings.com/mail-server-software/)
- Grade: A (100/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | All code is public. Most is AGPL-3.0, and enterprise features in the same repository use the source-available Stalwart Enterprise License, which is not open source. | https://github.com/stalwartlabs/stalwart/blob/main/LICENSES/AGPL-3.0-only.txt |
| No trackers or telemetry | Yes | The websites load no third-party analytics, and the self-hosted server does not send data to Stalwart Labs. | https://stalw.art/legal/privacy |
| No ads or data sales | Yes | Funded by paid enterprise licenses and support. The privacy policy says personal information is not sold. | https://stalw.art/pricing/ |
| Independent audit | Yes | Code review and penetration test by Radically Open Security, full report public. | https://stalw.art/blog/security-audit/ros-report.pdf |

Source: https://privacyratings.com/mail-server-software/stalwart-mail-server/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/mail-server-software/stalwart-mail-server.md