# DigitalOcean privacy rating

US cloud provider offering virtual machines (Droplets), Kubernetes, managed databases and object storage.

## Summary

DigitalOcean scores 48 out of 100 (grade D) on the server hosting criteria. It meets 5 of 12 criteria: transparency report, tells users about requests, TLS configuration, Reverse DNS and IPv6. It partly meets no ads or data sales, independent audit and anonymous payment. It does not meet open source, no trackers or telemetry, security headers and mail-friendly (port 25). It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade C.

- Website: https://www.digitalocean.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Home page trackers: Amplitude, TrustArc (not scored)
- Category: [Server hosting](https://privacyratings.com/server-hosting/)
- Grade: D (48/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The home page loads Amplitude (automated test). |  |
| No ads or data sales | Partial | The privacy policy lets third-party advertising partners collect data on its services to show targeted ads. | https://www.digitalocean.com/legal/privacy-policy |
| Independent audit | Partial | SOC 2 Type II and SOC 3 reports from an independent auditor are only available to customers after sign-in. | https://www.digitalocean.com/trust/certification-reports |
| Transparency report | Yes | Publishes request counts and outcomes twice a year. | https://www.digitalocean.com/legal/transparency-report |
| Tells users about requests | Yes | Notifies users of legal process for their account unless prohibited by law or court order. | https://www.digitalocean.com/legal/law-enforcement-guidelines |
| TLS configuration | Yes | Grade A | https://www.ssllabs.com/ssltest/analyze.html?d=www.digitalocean.com&hideResults=on |
| Security headers | No | Grade C (55/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.digitalocean.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| Mail-friendly (port 25) | No | SMTP ports are blocked on all Droplets, with no documented way to open them. | https://docs.digitalocean.com/support/why-is-smtp-blocked/ |
| Reverse DNS | Yes | PTR records for IPv4 and the first IPv6 address are set from the Droplet name. | https://docs.digitalocean.com/products/networking/dns/how-to/manage-records/ |
| IPv6 | Yes | Each Droplet can enable 16 IPv6 addresses at no extra cost. | https://docs.digitalocean.com/products/networking/ipv6/ |
| Anonymous payment | Partial | Stablecoin payment is offered to some customers, and every account needs a verified payment method. | https://docs.digitalocean.com/platform/billing/manage-payment-methods/ |

Forward Email also runs infrastructure on DigitalOcean.

Some DigitalOcean IP ranges have a history of spam listings, so check an IP's reputation before sending mail from it.

Source: https://privacyratings.com/server-hosting/digitalocean/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/server-hosting/digitalocean.md