Server hosting
Bunker privacy rating
French cloud from France Nuage SAS offering virtual machines, managed open-source apps, PostgreSQL and S3-compatible storage in its own datacenters in France.
Summary
Bunker scores 40 out of 100 (grade D) on the server hosting criteria. It meets 2 of 12 criteria: open source and no ads or data sales. It partly meets no trackers or telemetry, TLS configuration and security headers. It does not meet independent audit, transparency report, tells users about requests, mail-friendly (port 25), Reverse DNS, IPv6 and anonymous payment. It is based in France: Nine Eyes member; EU member (GDPR). Automated tests: SSL Labs grade B and Mozilla HTTP Observatory grade B.
Score 40 out of 100. How scoring works
Criteria
-
Yes
Open source Weight 3 of 3 Source-available
Is all the source code needed to run the product public?
All platform code is public, including the control plane, agents and console, under the source-available Server Side Public License (SSPL-1.0), which is not OSI-approved.
-
Partial
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
No third-party trackers; first-party Matomo analytics run by default in CNIL exemption mode.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by paid subscriptions, with no advertising or data sales described in the privacy policy.
-
No
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Security measures are self-assessed and not certified or audited by a third party.
-
No
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
No transparency report or dedicated government request policy is published.
-
No
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
No published policy on notifying users about data requests.
-
No
Mail-friendly (port 25) Weight 1 of 3
Is outbound port 25 open by default, or opened on request?
Not documented. The documentation does not say whether outbound port 25 is open.
-
No
Reverse DNS Weight 1 of 3
Can reverse DNS (PTR) records be set for IPv4 and IPv6?
Not documented. The documentation does not mention reverse DNS.
-
No
IPv6 Weight 1 of 3
Is native IPv6 included?
Not documented. The documentation does not mention IPv6.
-
No
Anonymous payment Weight 1 of 3
Can servers be paid for with cryptocurrency or without identity checks?
Payment is by credit card, bank transfer or SEPA direct debit.
Automated tests
-
Partial
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade B
-
Partial
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade B (75/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.