# Passbolt privacy rating

Open source password manager for teams built on OpenPGP end-to-end encryption, with browser extensions, mobile and desktop apps. It can be self-hosted or used as a hosted cloud service.

## Summary

Passbolt scores 66 out of 100 (grade C) on the password managers criteria. It meets 7 of 11 criteria: no ads or data sales, independent audit, TLS configuration, security headers, end-to-end encrypted vault, local or self-hosted option and full export. It partly meets open source. It does not meet no trackers or telemetry, transparency report and tells users about requests. It is based in Luxembourg: Not in the Five, Nine or Fourteen Eyes; EU member (GDPR). Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.

- Website: https://www.passbolt.com
- Source code: https://github.com/passbolt/passbolt_api
- License: AGPL-3.0
- Jurisdiction: Luxembourg. Not in the Five, Nine or Fourteen Eyes. EU member (GDPR).
- Home page trackers: Google reCAPTCHA (not scored), Google Tag Manager, Matomo Cloud (cookieless analytics), Plausible (cookieless analytics)
- Category: [Password managers](https://privacyratings.com/password-managers/)
- Grade: C (66/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Partial | The Community Edition server and apps are AGPL-3.0, but Pro and Cloud features are proprietary. | https://github.com/passbolt/passbolt_api/blob/master/LICENSE.txt |
| No trackers or telemetry | No | The website loads Google Tag Manager, and the privacy policy lists Google Analytics, Matomo, Plausible, Google Ads and LinkedIn. | https://www.passbolt.com/privacy |
| No ads or data sales | Yes | Funded by paid Pro and Cloud plans, and the privacy policy says personal information is not sold. | https://www.passbolt.com/pricing/pro |
| Independent audit | Yes | Full Cure53 and Quarkslab reports are published, including an audit of the version 5 browser extension and API. | https://www.passbolt.com/docs/files/PBL-13-report.pdf |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=www.passbolt.com&hideResults=on |
| Security headers | Yes | Grade A+ (115/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.passbolt.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encrypted vault | Yes | Secrets are end-to-end encrypted with OpenPGP keys held by each user. | https://www.passbolt.com/security |
| Local or self-hosted option | Yes | The server can be self-hosted. | https://www.passbolt.com/docs/hosting/install/ |
| Full export | Yes | All resources can be exported to KDBX, or to CSV when an administrator allows it. | https://www.passbolt.com/docs/user/basic-features/browser/export/ |

Source: https://privacyratings.com/password-managers/passbolt/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/password-managers/passbolt.md