Njalla privacy rating

Summary

Njalla scores 48 out of 100 (grade D) on the server hosting criteria. It meets 5 of 12 criteria: no trackers or telemetry, no ads or data sales, TLS configuration, IPv6 and anonymous payment. It partly meets security headers. It does not meet open source, independent audit, transparency report, tells users about requests, mail-friendly (port 25) and Reverse DNS. It is based in Costa Rica: Not in the Five, Nine or Fourteen Eyes. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B+.

Score 48 out of 100. How scoring works

Criteria

• ✖No

  Open source ×3Weight 3 of 3

  Is all the source code needed to run the product public?

  Closed source.

• ✔Yes

  No trackers or telemetry ×3Weight 3 of 3

  Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?

  The terms say no data is collected beyond the email or XMPP address and password, and the website loads only its own scripts.

  njal.la

• ✔Yes

  No ads or data sales ×2Weight 2 of 3

  Is the product funded without advertising, ad targeting or selling user data?

  Funded by paid services, with data collection limited to account login details.

  njal.la

• ✖No

  Independent audit ×2Weight 2 of 3

  Has an independent security or privacy audit been published within the last three years?

  No independent audit is published.

• ✖No

  Transparency report ×2Weight 2 of 3

  Does the provider regularly publish how many government and legal requests it receives and how it responds?

  No transparency report or dedicated government request policy is published.

• ✖No

  Tells users about requests ×1Weight 1 of 3

  Does the provider promise to tell users about requests for their data, unless a court forbids it?

  No published policy on notifying users about data requests.

• ✖No

  Mail-friendly (port 25) ×1Weight 1 of 3

  Is outbound port 25 open by default, or opened on request?

  Outgoing SMTP is blocked on all servers.

  njal.la

• ✖No

  Reverse DNS ×1Weight 1 of 3

  Can reverse DNS (PTR) records be set for IPv4 and IPv6?

  Not documented. The servers page and FAQ do not mention reverse DNS.

  njal.la

• ✔Yes

  IPv6 ×1Weight 1 of 3

  Is native IPv6 included?

  Every server includes one IPv4 and one IPv6 address.

  njal.la

• ✔Yes

  Anonymous payment ×1Weight 1 of 3

  Can servers be paid for with cryptocurrency or without identity checks?

  Bitcoin, Litecoin, Monero and Ethereum are accepted.

  njal.la

Automated tests

• ✔Yes

  TLS configuration ×2Weight 2 of 3

  Does the website pass the Qualys SSL Labs test with a grade of A or better?

  Grade A+

  ssllabs.com

• ◐Partial

  Security headers ×1Weight 1 of 3

  Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?

  Grade B+ (80/100+)

  developer.mozilla.org

• …Not tested yet

  Modern web standards ×1Weight 1 of 3

  Does the website score 90% or higher on the Internet.nl website test?

  Not tested yet.