# X41 D-Sec privacy rating

German security firm in Aachen that performs source code audits, penetration tests, fuzzing and red teaming, with many published audits of open-source projects.

## Summary

X41 D-Sec scores 100 out of 100 (grade A) on the security audit firms criteria. It meets 4 of 4 criteria: publishes full reports, audits open-source projects, public research and no trackers on website. It is based in Germany: Fourteen Eyes member; EU member (GDPR). Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.

- Website: https://x41-dsec.de
- Jurisdiction: Germany. Fourteen Eyes member. EU member (GDPR).
- Home page trackers: none found
- Category: [Security audit firms](https://privacyratings.com/security-audit-firms/)
- Grade: A (100/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Publishes full reports | Yes | The references page links around thirty full public audit reports. | https://x41-dsec.de/references/ |
| Audits open-source projects | Yes | Regularly audits open-source projects, many for OSTIF, including Git, Envoy, CRI-O, Hickory DNS and BIND 9. | https://x41-dsec.de/static/reports/X41-OSTIF-Hickory-DNS-2025-Audit-Report-Public.pdf |
| Public research | Yes | Publishes security advisories and research through its lab and blog. | https://x41-dsec.de/news/lab/ |
| No trackers on website | Yes | The home page loads no third-party scripts, and the privacy policy describes only server log files, with no analytics services. | https://x41-dsec.de/privacy/ |

Source: https://privacyratings.com/security-audit-firms/x41-d-sec/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/security-audit-firms/x41-d-sec.md