# Trail of Bits privacy rating

US security research and engineering firm that audits software, cryptography, blockchain and AI systems, and develops open-source security tools such as Slither and Echidna.

## Summary

Trail of Bits scores 86 out of 100 (grade B) on the security audit firms criteria. It meets 3 of 4 criteria: publishes full reports, audits open-source projects and public research. It does not meet no trackers on website. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade B and Mozilla HTTP Observatory grade D.

- Website: https://trailofbits.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Home page trackers: Cloudflare Web Analytics (cookieless analytics), HubSpot
- Category: [Security audit firms](https://privacyratings.com/security-audit-firms/)
- Grade: B (86/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Publishes full reports | Yes | The public publications repository lists hundreds of full security review reports. | https://github.com/trailofbits/publications |
| Audits open-source projects | Yes | Public reviews include many open-source projects, such as PyPI Warehouse, the Linux kernel release signing process and OSTIF-funded audits like NATS. | https://raw.githubusercontent.com/trailofbits/publications/master/reviews/2025-04-ostif-nats-securityreview.pdf |
| Public research | Yes | Publishes a regular research blog, conference papers and open-source security tools. | https://blog.trailofbits.com/ |
| No trackers on website | No | The home page loads HubSpot and Cloudflare Web Analytics. |  |

Source: https://privacyratings.com/security-audit-firms/trail-of-bits/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/security-audit-firms/trail-of-bits.md