# Barracuda Email Protection privacy rating

Email security suite from Barracuda Networks that filters spam, phishing and malware through a cloud gateway or by API for Microsoft 365 and Google Workspace. It adds account takeover detection, encryption, archiving and backup.

## Summary

Barracuda Email Protection scores 31 out of 100 (grade F) on the spam and virus filtering criteria. It meets 1 of 8 criteria: tells users about requests. It partly meets no ads or data sales, independent audit, transparency report and TLS configuration. It does not meet open source, no trackers or telemetry and security headers. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade B and Mozilla HTTP Observatory grade D-.

- Website: https://www.barracuda.com/products/email-protection
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web
- Home page trackers: Facebook SDK, Google Analytics, Google Tag Manager, Mixpanel, OneTrust (not scored)
- Category: [Spam and virus filtering](https://privacyratings.com/spam-filters/)
- Grade: F (31/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The website loads Google Tag Manager, Adobe tags, Marketo and Demandbase, and the privacy notice describes cookies used for behavior-based advertising. | https://trust.barracuda.com/privacy/documentation/privacy-notice |
| No ads or data sales | Partial | Paid business service with no ads, and Barracuda says it does not sell personal data for money, but website data is shared with advertising networks for targeted advertising. | https://trust.barracuda.com/privacy/documentation/privacy-notice |
| Independent audit | Partial | Barracuda offers SOC 2 reports on request and holds ISO 27001 certification for Cloud-to-Cloud Backup, but no audit report is public and Email Protection is not named in scope. | https://trust.barracuda.com/security |
| Transparency report | Partial | Legal process guidelines require a search warrant for US requests for customer data and describe challenges to overbroad requests, but no request counts are published. | https://assets.barracuda.com/assets/docs/dms/US_Law_Enforcement_Guidelines.pdf |
| Tells users about requests | Yes | Barracuda states it notifies customers when their data is sought by legal process, unless notice is prohibited by law or a court order or would create a risk of harm. | https://assets.barracuda.com/assets/docs/dms/US_Law_Enforcement_Guidelines.pdf |
| TLS configuration | Partial | Grade B | https://www.ssllabs.com/ssltest/analyze.html?d=us.ess.barracudanetworks.com&hideResults=on |
| Security headers | No | Grade D- (25/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=us.ess.barracudanetworks.com |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/spam-filters/barracuda-email-protection/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/spam-filters/barracuda-email-protection.md