# Cure53 privacy rating

Berlin security firm that performs penetration tests and source code audits of web, mobile, browser, VPN and cryptographic software, and publishes many client reports.

**Our pick.** Publishes a large public library of full audit reports, many for open-source and privacy projects, and maintains the DOMPurify sanitizer. Its website uses no cookies or analytics.

## Summary

Cure53 scores 100 out of 100 (grade A) on the security audit firms criteria. It meets 4 of 4 criteria: publishes full reports, audits open-source projects, public research and no trackers on website. It is based in Germany: Fourteen Eyes member; EU member (GDPR). Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.

- Website: https://cure53.de
- Jurisdiction: Germany. Fourteen Eyes member. EU member (GDPR).
- Home page trackers: none found
- Category: [Security audit firms](https://privacyratings.com/security-audit-firms/)
- Grade: A (100/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Publishes full reports | Yes | The publications section links many full client reports as PDFs. | https://cure53.de/#publications-anchor |
| Audits open-source projects | Yes | Published reports cover many open-source projects, such as Psiphon, Mullvad VPN and KeePassium. | https://cure53.de/pentest-report_psiphon-conduit-library.pdf |
| Public research | Yes | Maintains the open-source DOMPurify sanitizer and publishes research papers on browser and web security. | https://github.com/cure53/DOMPurify |
| No trackers on website | Yes | The privacy policy states the site uses no cookies and no user analytics, and the tracker test found none. | https://cure53.de/datenschutz.php |

Source: https://privacyratings.com/security-audit-firms/cure53/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/security-audit-firms/cure53.md