# Psono privacy rating

Open source password manager for teams and companies from esaqa GmbH, with a web client, browser extensions and mobile apps. Vaults are encrypted on the client, and the server can be self-hosted or used as the psono.pw hosted service.

## Summary

Psono scores 55 out of 100 (grade D) on the password managers criteria. It meets 5 of 11 criteria: no ads or data sales, TLS configuration, security headers, end-to-end encrypted vault and local or self-hosted option. It partly meets open source and full export. It does not meet no trackers or telemetry, independent audit, transparency report and tells users about requests. It is based in Germany: Fourteen Eyes member; EU member (GDPR). Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.

- Website: https://psono.com
- Source code: https://gitlab.com/esaqa/psono/psono-server
- Jurisdiction: Germany. Fourteen Eyes member. EU member (GDPR).
- Platforms: Android, iOS, Web
- Home page trackers: none found
- Category: [Password managers](https://privacyratings.com/password-managers/)
- Grade: D (55/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Partial | The clients and Community Edition server are Apache-2.0, but the Enterprise Edition server is not published. | https://gitlab.com/esaqa/psono/psono-server/-/blob/master/LICENSE.md |
| No trackers or telemetry | No | The website uses Google Tag Manager and Google Analytics. | https://psono.com/privacy-policy |
| No ads or data sales | Yes | Funded by paid business plans, with no ads. | https://psono.com/ |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=www.psono.pw&hideResults=on |
| Security headers | Yes | Grade A+ (110/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.psono.pw |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encrypted vault | Yes | Vault data is encrypted on the client before it is stored on the server. | https://doc.psono.com/admin/development/cryptography.html |
| Local or self-hosted option | Yes | The server can be self-hosted. | https://doc.psono.com/admin/installation/install-preparation.html |
| Full export | Partial | Exports secrets and passwords to a file, but files are not included. | https://doc.psono.com/user/other/export.html |

Source: https://privacyratings.com/password-managers/psono/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/password-managers/psono.md