{"data":{"slug":"proton-pass","name":"Proton Pass","domain":"proton.me","url":"https://proton.me/pass","kyc":"none","kycLevel":0,"kycNote":"A Proton account is required. Captcha, email or SMS checks may be requested. Payment options vary by platform; Bitcoin requires upgrading an existing free account.","fee":"Free plan; paid prices vary by billing cycle and current offer.","categories":["Privacy Tools"],"countries":["GLOBAL"],"bestFor":["Password and passkey storage","Email aliases","Cross-device password management"],"features":["End-to-end encrypted vaults","Encrypted metadata","Open-source apps","Independent Cure53 audit","Passkeys","Hide-my-email aliases","Secure vault and item sharing","Dark web monitoring","Emergency access","Command line interface"],"status":"ok","updatedAt":"2026-10-25","description":"End-to-end encrypted password and identity manager from Proton AG with encrypted vault fields and metadata, open-source clients, passkeys, sharing and hide-my-email aliases.","cardSummary":"Audited open-source password manager with encrypted vaults.","networks":["Web","Browser extensions","Windows","macOS","Linux","Android","iOS","CLI"],"checkedAt":"2026-10-25","lastReviewed":"2026-10-25","reviewSource":"official_source_review_2026-10-25","jurisdictionConfidence":"verified","kycLastChecked":"2026-10-25","trending":true,"jurisdiction":"CH","evidenceStatus":"partial","riskLevel":"caution","privacyWarning":"Vault contents and vault metadata are end-to-end encrypted. Account and payment records remain. Alias addresses are readable, and alias functions use SimpleLogin's contracted cloud servers.","auditedBy":["Cure53"],"corporate":{"entityType":{"value":"company","citation":"https://proton.me/legal/terms","note":"Registry-sourced corporate record established in pass 1 via legalEntity."},"legalEntity":{"value":"Proton AG","citation":"https://proton.me/legal/terms"},"registrationNumber":{"value":"unknown","citation":"unknown"},"registryUrl":{"value":"https://www.zefix.ch/","citation":"https://auditorstats.ch/firms/CHE-354.686.492"},"incorporationJurisdiction":{"value":"Switzerland","citation":"https://proton.me/legal/terms"},"incorporationDate":{"value":"unknown","citation":"unknown"},"registeredAddress":{"value":"Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland","citation":"https://proton.me/legal/terms"},"ultimateOwner":{"value":"unknown","citation":"unknown"},"officers":{"value":[],"citation":"unknown"},"priorEntities":{"value":[],"citation":"unknown"},"source":"registry research 2026-08-08, task t_047dfd90","reviewedAt":"2026-08-08"},"agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/proton-pass","canonical_score":37,"score_status":"rated","score_evidence":"limited","score_version":"4.0","score_breakdown":{"privacy":12,"control":0,"transparency":0,"security":17,"accountability":8},"applied_caps":[{"key":"closed-critical-core-without-audit","maximum":69,"reason":"A closed or unknown critical core without current audit evidence limits the score to 69."}],"score_rationale":["privacy: 12 of 25 points.","control: 0 of 20 points.","transparency: 0 of 20 points.","security: 17 of 25 points.","accountability: 8 of 10 points.","Limited evidence: operatorDataExposure, controlModel, sourceModel scored zero.","A closed or unknown critical core without current audit evidence limits the score to 69."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"unknown","controlModel":"unknown","sourceModel":"unknown"},"score_review":{"outcome":"PASS","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://proton.me/pass","https://proton.me/legal/terms","https://proton.me/pass/privacy-policy","https://proton.me/legal/privacy","https://proton.me/pass/security","https://proton.me/blog/pass-open-source-security-audit","https://status.proton.me/","https://github.com/protonpass/android-pass"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://proton.me/pass","https://proton.me/legal/terms","https://proton.me/pass/privacy-policy","https://proton.me/legal/privacy","https://proton.me/pass/security","https://proton.me/blog/pass-open-source-security-audit","https://status.proton.me/","https://github.com/protonpass/android-pass"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://proton.me/pass","https://proton.me/legal/terms","https://proton.me/pass/privacy-policy","https://proton.me/legal/privacy","https://proton.me/pass/security","https://proton.me/blog/pass-open-source-security-audit","https://status.proton.me/","https://github.com/protonpass/android-pass"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}},"privacy_observations":{"identity_exposure_level":0,"identity_requirement":"none","hosted_operator_data":null,"jurisdiction":"CH","jurisdiction_confidence":"verified","jurisdiction_context":"other"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"other","primary_category":"Privacy Tools","primary_bucket":"Privacy Tools","corporate_identity":{"entity_type":"company","entity_type_note":"Registry-sourced corporate record established in pass 1 via legalEntity.","governance_model":null,"repository_url":null,"legal_entity":"Proton AG","registration_number":null,"registry_url":"https://www.zefix.ch/","incorporation_jurisdiction":"Switzerland","incorporation_date":null,"registered_address":"Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland","parent_entity":null,"ultimate_owner":null,"prior_entities":[],"officers":[],"citations":{"legalEntity":{"url":"https://proton.me/legal/terms","note":null,"agent_verified":false},"incorporationJurisdiction":{"url":"https://proton.me/legal/terms","note":null,"agent_verified":false},"registeredAddress":{"url":"https://proton.me/legal/terms","note":null,"agent_verified":false},"entityType":{"url":"https://proton.me/legal/terms","note":null,"agent_verified":false}},"basis":"registry-sourced, not audited","agent_verified":false,"source":"registry research 2026-08-08, task t_047dfd90","reviewed_at":"2026-08-08"},"evidence_provenance":{"strongest_tier":"independent-audit","tiers":["independent-audit","third-party-reported","self-reported"],"counts":{"directly-tested":0,"independent-audit":1,"third-party-reported":1,"self-reported":5},"total_sources":7},"privacy_score":100,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":0,"detail":"No required account or identity data recorded (level 0 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Hosted operator; recorded jurisdiction: CH"}],"evidence_confidence":72,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":42,"detail":"Some material claims still need confirmation"},{"key":"freshness","label":"Review age","value":30,"detail":"All recorded checks are within 30 days"}],"score_computed_at":"2026-11-06T02:07:20.073Z","score_inputs":{"kycLevel":0,"noOperatorData":false,"jurisdiction":"CH","jurisdictionConfidence":"verified","evidenceStatus":"partial","checkedAt":"2026-10-25","lastReviewed":"2026-10-25","kycLastChecked":"2026-10-25"},"citation":{"canonical_url":"https://cunicula.com/en/provider/proton-pass","api_url":"https://cunicula.com/api/v1/services/proton-pass","schema_version":"1.1.0","publisher":"Cunicula","reviewed":"2026-10-25","retrieved":"2026-11-06","attribution":"Cunicula, \"Proton Pass\", cunicula.com, reviewed 2026-10-25, retrieved 2026-11-06, https://cunicula.com/en/provider/proton-pass","attribution_template":"Cunicula, \"{name}\", cunicula.com, reviewed {reviewed}, retrieved {retrieved}, {url}","license":"LicenseRef-Cunicula-Attribution-1.0","license_url":"https://cunicula.com/en/cite","cite_guide_url":"https://cunicula.com/en/cite"},"edit_history":[{"changed_at":"2026-10-25T16:29:26+11:00","action":"updated","why":"fix: refresh overdue sources and recover publication pipeline","source":{"commit":"5705a0837a385381243c579d4f1331a89843169e","url":"https://cunicula.com/en/provider/proton-pass#history-5705a0837a38","review_source":"official_source_review_2026-10-25"},"changes":[{"field":"checkedAt","operation":"changed","before":"2026-08-25","after":"2026-10-25"},{"field":"corporate.incorporationDate.citation","operation":"changed","before":"https://auditorstats.ch/firms/CHE-354.686.492","after":"unknown"},{"field":"corporate.incorporationDate.value","operation":"changed","before":"18.07.2014","after":"unknown"},{"field":"corporate.priorEntities.citation","operation":"changed","before":"https://en.wikipedia.org/wiki/Proton_AG","after":"unknown"},{"field":"corporate.priorEntities.value","operation":"changed","before":["Proton Technologies AG"],"after":[]},{"field":"corporate.registrationNumber.citation","operation":"changed","before":"https://auditorstats.ch/firms/CHE-354.686.492","after":"unknown"},{"field":"corporate.registrationNumber.value","operation":"changed","before":"CHE-354.686.492","after":"unknown"},{"field":"corporate.ultimateOwner.citation","operation":"changed","before":"https://proton.me/legal/terms","after":"unknown"},{"field":"corporate.ultimateOwner.value","operation":"changed","before":"Proton Foundation","after":"unknown"},{"field":"evidenceStatus","operation":"changed","before":"verified","after":"partial"},{"field":"fee","operation":"changed","before":"Free plan; Pass Plus advertised from $1.99/month; paid pricing varies by billing cycle and plan","after":"Free plan; paid prices vary by billing cycle and current offer."},{"field":"kycLastChecked","operation":"changed","before":"2026-08-05","after":"2026-10-25"},{"field":"kycNote","operation":"changed","before":"The free plan needs a Proton account but no document identity check. Paid plans can add card, PayPal, Apple Pay, Google Pay, Bitcoin, cash, or bank-payment records depending on the checkout path.","after":"A Proton account is required. Captcha, email or SMS checks may be requested. Payment options vary by platform; Bitcoin requires upgrading an existing free account."},{"field":"lastReviewed","operation":"changed","before":"2026-08-25","after":"2026-10-25"},{"field":"privacyWarning","operation":"changed","before":"A Proton account still creates account and activity metadata. Hide-my-email alias addresses are not encrypted, and paid subscriptions add payment records. Vault content and vault metadata are end-to-end encrypted.","after":"Vault contents and vault metadata are end-to-end encrypted. Account and payment records remain. Alias addresses are readable, and alias functions use SimpleLogin's contracted cloud servers."},{"field":"reviewSource","operation":"changed","before":"official_proton_pass_security_privacy_payment_audit_2026-08-05","after":"official_source_review_2026-10-25"},{"field":"updatedAt","operation":"changed","before":"2026-08-05","after":"2026-10-25"}]},{"changed_at":"2026-08-27T08:50:11+10:00","action":"updated","why":"fix: reconcile score 4.0 evidence","source":{"commit":"18e788afe003dcb0febe08a578aaf9cb087161b2","url":"https://cunicula.com/en/provider/proton-pass#history-18e788afe003","review_source":"official_proton_pass_security_privacy_payment_audit_2026-08-05"},"changes":[{"field":"scoreAssessment.controlModel","operation":"changed","before":"hosted-account","after":"unknown"},{"field":"scoreAssessment.operatorDataExposure","operation":"changed","before":"moderate","after":"unknown"},{"field":"scoreAssessment.sourceModel","operation":"changed","before":"open","after":"unknown"},{"field":"scoreReview","operation":"added","before":null,"after":{"outcome":"PASS","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://proton.me/pass","https://proton.me/legal/terms","https://proton.me/pass/privacy-policy","https://proton.me/legal/privacy","https://proton.me/pass/security","https://proton.me/blog/pass-open-source-security-audit","https://status.proton.me/","https://github.com/protonpass/android-pass"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://proton.me/pass","https://proton.me/legal/terms","https://proton.me/pass/privacy-policy","https://proton.me/legal/privacy","https://proton.me/pass/security","https://proton.me/blog/pass-open-source-security-audit","https://status.proton.me/","https://github.com/protonpass/android-pass"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://proton.me/pass","https://proton.me/legal/terms","https://proton.me/pass/privacy-policy","https://proton.me/legal/privacy","https://proton.me/pass/security","https://proton.me/blog/pass-open-source-security-audit","https://status.proton.me/","https://github.com/protonpass/android-pass"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}}}]},{"changed_at":"2026-08-26T16:27:32+10:00","action":"updated","why":"feat: apply full-service rereview and score 4.0","source":{"commit":"faa73ed3ef3cfbd8ae2fbc31753e0d1ddc6b11cf","url":"https://cunicula.com/en/provider/proton-pass#history-faa73ed3ef3c","review_source":"official_proton_pass_security_privacy_payment_audit_2026-08-05"},"changes":[{"field":"cardSummary","operation":"changed","before":"Password manager with encrypted vault items.","after":"Audited open-source password manager with encrypted vaults."},{"field":"checkedAt","operation":"changed","before":"2026-08-05","after":"2026-08-25"},{"field":"description","operation":"changed","before":"Password manager from Proton AG encrypting vault items and metadata, with readable hide-my-email aliases.","after":"End-to-end encrypted password and identity manager from Proton AG with encrypted vault fields and metadata, open-source clients, passkeys, sharing and hide-my-email aliases."},{"field":"features","operation":"changed","before":["End-to-end encrypted vaults","Encrypted metadata","Open-source apps","Independent Cure53 audit","Passkeys","Hide-my-email aliases","Secure vault sharing","Command line interface"],"after":["End-to-end encrypted vaults","Encrypted metadata","Open-source apps","Independent Cure53 audit","Passkeys","Hide-my-email aliases","Secure vault and item sharing","Dark web monitoring","Emergency access","Command line interface"]},{"field":"fee","operation":"changed","before":"Free plan / paid plans","after":"Free plan; Pass Plus advertised from $1.99/month; paid pricing varies by billing cycle and plan"},{"field":"lastReviewed","operation":"changed","before":"2026-08-05","after":"2026-08-25"},{"field":"networks","operation":"changed","before":["Web","Browser extensions","Desktop","Mobile","CLI"],"after":["Web","Browser extensions","Windows","macOS","Linux","Android","iOS","CLI"]},{"field":"scoreAssessment","operation":"added","before":null,"after":{"operatorDataExposure":"moderate","controlModel":"hosted-account","sourceModel":"open"}}]},{"changed_at":"2026-08-09T15:02:38+10:00","action":"updated","why":"Schema coherence: make \"no legal entity\" a statable answer","source":{"commit":"075c50f012e80ede7c8cdaf232ba498568a04276","url":"https://cunicula.com/en/provider/proton-pass#history-075c50f012e8","review_source":"official_proton_pass_security_privacy_payment_audit_2026-08-05"},"changes":[{"field":"corporate.entityType","operation":"added","before":null,"after":{"value":"company","citation":"https://proton.me/legal/terms","note":"Registry-sourced corporate record established in pass 1 via legalEntity."}}]},{"changed_at":"2026-08-08T20:39:10+10:00","action":"updated","why":"data: registry-sourced corporate identity for 79 services","source":{"commit":"e6b09ff769a03b6bcda957c24e2cfd447d7b6c46","url":"https://cunicula.com/en/provider/proton-pass#history-e6b09ff769a0","review_source":"official_proton_pass_security_privacy_payment_audit_2026-08-05"},"changes":[{"field":"corporate","operation":"added","before":null,"after":{"legalEntity":{"value":"Proton AG","citation":"https://proton.me/legal/terms"},"registrationNumber":{"value":"CHE-354.686.492","citation":"https://auditorstats.ch/firms/CHE-354.686.492"},"registryUrl":{"value":"https://www.zefix.ch/","citation":"https://auditorstats.ch/firms/CHE-354.686.492"},"incorporationJurisdiction":{"value":"Switzerland","citation":"https://proton.me/legal/terms"},"incorporationDate":{"value":"18.07.2014","citation":"https://auditorstats.ch/firms/CHE-354.686.492"},"registeredAddress":{"value":"Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland","citation":"https://proton.me/legal/terms"},"ultimateOwner":{"value":"Proton Foundation","citation":"https://proton.me/legal/terms"},"officers":{"value":[],"citation":"unknown"},"priorEntities":{"value":["Proton Technologies AG"],"citation":"https://en.wikipedia.org/wiki/Proton_AG"},"source":"registry research 2026-08-08, task t_047dfd90","reviewedAt":"2026-08-08"}}]},{"changed_at":"2026-08-08T04:17:21+10:00","action":"updated","why":"chore(data): concise summaries batch 6","source":{"commit":"1100ceb495b23b8614141f1aa40a4d94ed68cbf0","url":"https://cunicula.com/en/provider/proton-pass#history-1100ceb495b2","review_source":"official_proton_pass_security_privacy_payment_audit_2026-08-05"},"changes":[{"field":"description","operation":"changed","before":"Password manager from Proton AG. Vault items and metadata are end-to-end encrypted. Hide-my-email alias addresses remain readable so mail forwarding can work.","after":"Password manager from Proton AG encrypting vault items and metadata, with readable hide-my-email aliases."}]},{"changed_at":"2026-08-07T19:15:57+10:00","action":"updated","why":"fix(cards): authored card summaries, sweep 5/5 (records 161-163)","source":{"commit":"e1367e1107569f6eb3298080787422171025de41","url":"https://cunicula.com/en/provider/proton-pass#history-e1367e110756","review_source":"official_proton_pass_security_privacy_payment_audit_2026-08-05"},"changes":[{"field":"cardSummary","operation":"added","before":null,"after":"Password manager with encrypted vault items."}]},{"changed_at":"2026-08-06T11:14:13+10:00","action":"updated","why":"feat: consolidate comparisons scores and design system","source":{"commit":"6285d0d61970ee36e5a7c4ef72e2e76273f2c4a4","url":"https://cunicula.com/en/provider/proton-pass#history-6285d0d61970","review_source":"official_proton_pass_security_privacy_payment_audit_2026-08-05"},"changes":[{"field":"evidenceStatus","operation":"added","before":null,"after":"verified"},{"field":"riskLevel","operation":"added","before":null,"after":"caution"},{"field":"trustLevel","operation":"removed","before":"caution","after":null}]},{"changed_at":"2026-08-05T21:38:52+10:00","action":"created","why":"feat: ship practical privacy release","source":{"commit":"5d1ad0feca1f045c2ea5c46ae1fd8a7cc4c5e7c7","url":"https://cunicula.com/en/provider/proton-pass#history-5d1ad0feca1f","review_source":"official_proton_pass_security_privacy_payment_audit_2026-08-05"},"changes":[{"field":"record","operation":"added","before":null,"after":"created"}]}],"history_scope":{"schema_version":"1.0.0","source_path":"data/services.json","source_repository":"https://cunicula.com/en/methodology#record-history","source_commit":"656629f3a2cfd1544249be7a37a0b0526c6bbe7e","record_identity":"id","scope":"Committed public record changes. Creation events are summarized; later events contain field-level before/after values. Internal affiliate and numeric identity fields are excluded, and unsupported public claims remain redacted.","event_count":9},"related_services":[{"slug":"calyx-institute","name":"Calyx Institute","domain":"calyxinstitute.org","url":"https://calyxinstitute.org/","kyc":"light","kycLevel":1,"kycNote":"No identity KYC to use Calyx tools, but memberships/hardware require user-provided contact/shipping and payment data; privacy policy says cash or Bitcoin payments retain only provided information plus membership ID.","fee":"CalyxOS is free; mobile internet memberships start at USD 500/year","categories":["Privacy Tools"],"countries":["GLOBAL"],"features":["CalyxOS","Android fork","microG included","Pixel, Motorola, Fairphone and SHIFT support","Open source","VPN included with mobile internet membership","No Google account required"],"status":"ok","updatedAt":"2026-09-05","description":"US nonprofit digital-rights organization offering privacy tools, memberships, hotspots and CalyxOS phones.","cardSummary":"US nonprofit privacy tools and hotspots.","networks":[],"checkedAt":"2026-08-27","lastReviewed":"2026-09-05","reviewSource":"https://calyxinstitute.org/membership","jurisdictionConfidence":"verified","kycLastChecked":"2026-09-05","trending":false,"jurisdiction":"US","evidenceStatus":"verified","riskLevel":"caution","privacyWarning":"Mobile internet membership requires contact, shipping and payment data and uses Mobile Citizen and T-Mobile infrastructure. T-Mobile can observe network and location metadata, and Calyx recommends using a VPN. Encrypted membership data is hosted on Vultr. New CalyxOS phone memberships remain temporarily paused, while existing memberships and phones are unaffected.","auditedBy":null,"corporate":{"entityType":{"value":"foundation","citation":"https://calyxinstitute.org/about","note":"Official site and IRS filings describe it as a 501(c)(3) nonprofit/public charity (New York domestic not-for-profit corporation) founded 2010."},"governanceModel":{"value":"foundation","citation":"https://projects.propublica.org/nonprofits/organizations/272800937"},"repositoryUrl":{"value":"https://gitlab.com/CalyxOS","citation":"https://gitlab.com/CalyxOS"},"legalEntity":{"value":"The Calyx Institute (CALYX INSTITUTE)","citation":"https://calyxinstitute.org/files/2022CalyxForm990-Public.pdf"},"registrationNumber":{"value":"EIN 27-2800937; NY DOS ID 3951504","citation":"https://projects.propublica.org/nonprofits/organizations/272800937"},"registryUrl":{"value":"https://apps.dos.ny.gov/publicInquiry/","citation":"https://en.wikipedia.org/wiki/Calyx_Institute"},"incorporationJurisdiction":{"value":"New York, United States","citation":"https://calyxinstitute.org/files/2022CalyxForm990-Public.pdf"},"incorporationDate":{"value":"2010-05-19","citation":"https://en.wikipedia.org/wiki/Calyx_Institute"},"registeredAddress":{"value":"254 36th St Ste C660, Brooklyn, NY 11232, USA","citation":"https://calyxinstitute.org/files/2022CalyxForm990-Public.pdf"},"parentEntity":{"value":"none","citation":"https://www.causeiq.com/organizations/calyxinstitute,272800937/"},"ultimateOwner":{"value":"none (501(c)(3) public charity)","citation":"https://projects.propublica.org/nonprofits/organizations/272800937"},"officers":{"value":["Nicholas Merrill (President)","Ellen McDermott (Interim Executive Director)","Eric Bortel (Engineering Director)","Benjamin Knauss (Finance Director)","Ashi Krishnan (Director)","Liz O'Sullivan (Director)","Carey Shenkman (Director)","Kobi Snitz (Director)"],"citation":"https://projects.propublica.org/nonprofits/organizations/272800937"},"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewedAt":"2026-08-09"},"twitter":"https://x.com/calyxinstitute","agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/calyx-institute","canonical_score":56,"score_status":"rated","score_evidence":"limited","score_version":"4.0","score_breakdown":{"privacy":14,"control":7,"transparency":8,"security":17,"accountability":10},"applied_caps":[{"key":"partially-reviewable-critical-core","maximum":79,"reason":"A partially reviewable critical core without current audit evidence limits the score to 79."}],"score_rationale":["privacy: 14 of 25 points.","control: 7 of 20 points.","transparency: 8 of 20 points.","security: 17 of 25 points.","accountability: 10 of 10 points.","A partially reviewable critical core without current audit evidence limits the score to 79."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"moderate","controlModel":"hosted-account","sourceModel":"partial"},"score_review":{"outcome":"HOLD","checkedAt":"2026-08-27","inputs":{"operatorDataExposure":{"value":"moderate","sourceUrls":["https://calyx.org/legal/privacy-policy"],"reviewedAt":"2026-08-27","note":"membership identity/contact, membership ID, possible IP logs and service-provider data"},"controlModel":{"value":"hosted-account","sourceUrls":["https://calyx.org/legal/privacy-policy"],"reviewedAt":"2026-08-27","note":"mixed-membership-service-and-open-source-os"},"sourceModel":{"value":"partial","sourceUrls":["https://calyxos.org/news/2026/07/01/calyxos-official-release-is-back/"],"reviewedAt":"2026-08-27","note":"open-source-os-plus-operator-service"}},"audit":{"scoreEligible":false,"reason":"No current organization/service-wide independent audit citation/date/scope established."}},"privacy_observations":{"identity_exposure_level":1,"identity_requirement":"light","hosted_operator_data":null,"jurisdiction":"US","jurisdiction_confidence":"verified","jurisdiction_context":"five_eyes"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"five_eyes","primary_category":"Privacy Tools","primary_bucket":"Privacy Tools","corporate_identity":{"entity_type":"foundation","entity_type_note":"Official site and IRS filings describe it as a 501(c)(3) nonprofit/public charity (New York domestic not-for-profit corporation) founded 2010.","governance_model":"foundation","repository_url":"https://gitlab.com/CalyxOS","legal_entity":"The Calyx Institute (CALYX INSTITUTE)","registration_number":"EIN 27-2800937; NY DOS ID 3951504","registry_url":"https://apps.dos.ny.gov/publicInquiry/","incorporation_jurisdiction":"New York, United States","incorporation_date":"2010-05-19","registered_address":"254 36th St Ste C660, Brooklyn, NY 11232, USA","parent_entity":"none","ultimate_owner":"none (501(c)(3) public charity)","prior_entities":[],"officers":[{"name":"Nicholas Merrill (President)","role":null},{"name":"Ellen McDermott (Interim Executive Director)","role":null},{"name":"Eric Bortel (Engineering Director)","role":null},{"name":"Benjamin Knauss (Finance Director)","role":null},{"name":"Ashi Krishnan (Director)","role":null},{"name":"Liz O'Sullivan (Director)","role":null},{"name":"Carey Shenkman (Director)","role":null},{"name":"Kobi Snitz (Director)","role":null}],"citations":{"legalEntity":{"url":"https://calyxinstitute.org/files/2022CalyxForm990-Public.pdf","note":null,"agent_verified":false},"registrationNumber":{"url":"https://projects.propublica.org/nonprofits/organizations/272800937","note":null,"agent_verified":false},"incorporationJurisdiction":{"url":"https://calyxinstitute.org/files/2022CalyxForm990-Public.pdf","note":null,"agent_verified":false},"incorporationDate":{"url":"https://en.wikipedia.org/wiki/Calyx_Institute","note":null,"agent_verified":false},"registeredAddress":{"url":"https://calyxinstitute.org/files/2022CalyxForm990-Public.pdf","note":null,"agent_verified":false},"parentEntity":{"url":"https://www.causeiq.com/organizations/calyxinstitute,272800937/","note":null,"agent_verified":false},"ultimateOwner":{"url":"https://projects.propublica.org/nonprofits/organizations/272800937","note":null,"agent_verified":false},"officers":{"url":"https://projects.propublica.org/nonprofits/organizations/272800937","note":null,"agent_verified":false},"entityType":{"url":"https://calyxinstitute.org/about","note":null,"agent_verified":false},"governanceModel":{"url":"https://projects.propublica.org/nonprofits/organizations/272800937","note":null,"agent_verified":false}},"basis":"registry-sourced, not audited","agent_verified":false,"source":"corporate identity pass 2 (t_d7269d23), cited web research via grok web search","reviewed_at":"2026-08-09"},"evidence_provenance":{"strongest_tier":"third-party-reported","tiers":["third-party-reported","self-reported"],"counts":{"directly-tested":0,"independent-audit":0,"third-party-reported":8,"self-reported":4},"total_sources":12},"privacy_score":80,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":-20,"detail":"Basic account or payment metadata recorded (level 1 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Hosted operator; recorded jurisdiction: US (Five Eyes context)"}],"evidence_confidence":94,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":70,"detail":"Material claims checked against current sources"},{"key":"freshness","label":"Review age","value":24,"detail":"Oldest recorded check is 71 days old"}],"score_computed_at":"2026-11-06T02:07:20.075Z","score_inputs":{"kycLevel":1,"noOperatorData":false,"jurisdiction":"US","jurisdictionConfidence":"verified","evidenceStatus":"verified","checkedAt":"2026-08-27","lastReviewed":"2026-09-05","kycLastChecked":"2026-09-05"}},{"slug":"cashu","name":"Cashu","domain":"cashu.space","url":"https://cashu.space","kyc":"none","kycLevel":0,"kycNote":"Cashu does not require identity documents by default. Mints can require login through optional authentication and set their own access rules.","fee":"Protocol and mint fees vary; Lightning routing and on-chain fees may also apply.","categories":["Privacy Tools","Wallet"],"countries":["GLOBAL"],"bestFor":["Lightning privacy","Offline Bitcoin payments","Advanced users"],"features":["Chaumian ecash","Lightning funding and redemption","Bearer-token transfers","Open protocol specifications","Independent wallets and mints","Optional mint authentication"],"tagline":"Open Bitcoin ecash with custody held by each mint.","status":"ok","updatedAt":"2026-10-25","description":"Chaumian e-cash protocol on Bitcoin Lightning where each mint is a custodian holding the backing funds.","cardSummary":"Chaumian e-cash on Bitcoin Lightning.","networks":["Bitcoin","Lightning Route","FOSS"],"checkedAt":"2026-10-25","lastReviewed":"2026-10-25","reviewSource":"https://cashu.space/","jurisdictionConfidence":"unknown","kycLastChecked":"2026-10-25","trending":false,"jurisdiction":null,"evidenceStatus":"verified","riskLevel":"caution","privacyWarning":"Ecash depends on its mint to redeem it. Blind signatures limit transaction linking, but do not hide all network data or remove mint custody risk.","auditedBy":[],"corporate":{"entityType":{"value":"project-no-legal-entity","citation":"https://cashu.space/","note":"The official site describes Cashu as a protocol with no company or treasury. Independent operators run mints."},"governanceModel":{"value":"maintainer-group","citation":"https://github.com/cashubtc/nuts"},"repositoryUrl":{"value":"https://github.com/cashubtc","citation":"https://github.com/cashubtc"},"source":"Official Cashu site and public protocol repository.","reviewedAt":"2026-10-25"},"twitter":"https://x.com/CashuBTC","agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/cashu","canonical_score":35,"score_status":"rated","score_evidence":"limited","score_version":"4.0","score_breakdown":{"privacy":12,"control":0,"transparency":0,"security":17,"accountability":6},"applied_caps":[{"key":"closed-critical-core-without-audit","maximum":69,"reason":"A closed or unknown critical core without current audit evidence limits the score to 69."}],"score_rationale":["privacy: 12 of 25 points.","control: 0 of 20 points.","transparency: 0 of 20 points.","security: 17 of 25 points.","accountability: 6 of 10 points.","Limited evidence: operatorDataExposure, controlModel, sourceModel scored zero.","A closed or unknown critical core without current audit evidence limits the score to 69."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"unknown","controlModel":"unknown","sourceModel":"unknown"},"score_review":{"outcome":"PASS","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://cashu.space/","https://github.com/cashubtc/nuts/commits/main.atom","https://cashu.space"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://cashu.space/","https://github.com/cashubtc/nuts/commits/main.atom","https://cashu.space"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://cashu.space/","https://github.com/cashubtc/nuts/commits/main.atom","https://cashu.space"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}},"privacy_observations":{"identity_exposure_level":0,"identity_requirement":"none","hosted_operator_data":null,"jurisdiction":null,"jurisdiction_confidence":"unknown","jurisdiction_context":"unknown"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"unknown","primary_category":"Privacy Tools","primary_bucket":"Privacy Tools","corporate_identity":{"entity_type":"project-no-legal-entity","entity_type_note":"The official site describes Cashu as a protocol with no company or treasury. Independent operators run mints.","governance_model":"maintainer-group","repository_url":"https://github.com/cashubtc","legal_entity":null,"registration_number":null,"registry_url":null,"incorporation_jurisdiction":null,"incorporation_date":null,"registered_address":null,"parent_entity":null,"ultimate_owner":null,"prior_entities":[],"officers":[],"citations":{"entityType":{"url":"https://cashu.space/","note":null,"agent_verified":false},"governanceModel":{"url":"https://github.com/cashubtc/nuts","note":null,"agent_verified":false}},"basis":"registry-sourced, not audited","agent_verified":false,"source":"Official Cashu site and public protocol repository.","reviewed_at":"2026-10-25"},"evidence_provenance":{"strongest_tier":"third-party-reported","tiers":["third-party-reported","self-reported"],"counts":{"directly-tested":0,"independent-audit":0,"third-party-reported":2,"self-reported":1},"total_sources":3},"privacy_score":100,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":0,"detail":"No required account or identity data recorded (level 0 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Hosted operator with unknown jurisdiction"}],"evidence_confidence":100,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":70,"detail":"Material claims checked against current sources"},{"key":"freshness","label":"Review age","value":30,"detail":"All recorded checks are within 30 days"}],"score_computed_at":"2026-11-06T02:07:20.076Z","score_inputs":{"kycLevel":0,"noOperatorData":false,"jurisdiction":null,"jurisdictionConfidence":"unknown","evidenceStatus":"verified","checkedAt":"2026-10-25","lastReviewed":"2026-10-25","kycLastChecked":"2026-10-25"}},{"slug":"cryptomator","name":"Cryptomator","domain":"cryptomator.org","url":"https://cryptomator.org/","kyc":"none","kycLevel":0,"kycNote":"No account and no identity check for the desktop app. Encryption runs locally, so Skymatic never receives file contents or a user account. Buying a mobile licence or Hub seat is a normal commercial purchase and does create a payment record with Skymatic and its processors.","fee":"Free on desktop, EUR 29.99 one-time per mobile platform","categories":["Privacy Tools"],"countries":["GLOBAL"],"bestFor":["Encrypting files before cloud upload","Using untrusted cloud storage","No-account local encryption"],"features":["Client-side vault encryption","Works with any cloud storage","Unlimited vaults","Open source","Independently audited","Free on Windows, macOS, and Linux","No account required","Filename encryption","Cryptomator Hub for teams"],"tagline":"Client-side vault encryption for any cloud storage, free on desktop.","status":"ok","updatedAt":"2026-08-25","description":"Client-side encryption for files you keep in any cloud. Free on desktop, one-time purchase on mobile, no account needed.","cardSummary":"Local vault encryption for any cloud, no account.","networks":[],"checkedAt":"2026-08-25","lastReviewed":"2026-08-25","reviewSource":"official_cryptomator_site_legal_pricing_repo_advisories_2026-08-25","jurisdictionConfidence":"verified","kycLastChecked":"2026-08-25","trending":false,"jurisdiction":"DE","noOperatorData":true,"evidenceStatus":"verified","riskLevel":"standard","privacyWarning":"Cryptomator protects file contents and filenames inside a vault, but it does not hide the vault itself: the cloud provider still sees vault size, file count, and modification times. Mobile apps are free only in read-only mode, and a paid licence is tied to one platform.","auditedBy":[],"corporate":{"entityType":{"value":"company","citation":"https://cryptomator.org/impressum/","note":"Official Impressum and Privacy Policy identify Skymatic GmbH as the responsible operating company for Cryptomator and related services."},"governanceModel":{"value":"company-sponsored","citation":"https://github.com/cryptomator"},"repositoryUrl":{"value":"https://github.com/cryptomator/cryptomator","citation":"https://github.com/cryptomator/cryptomator"},"legalEntity":{"value":"Skymatic GmbH","citation":"https://cryptomator.org/impressum/"},"registrationNumber":{"value":"HRB 22635","citation":"https://cryptomator.org/impressum/"},"incorporationJurisdiction":{"value":"Germany (Amtsgericht Bonn)","citation":"https://cryptomator.org/impressum/"},"registeredAddress":{"value":"Am Hauptbahnhof 6, 53111 Bonn, Germany","citation":"https://cryptomator.org/impressum/"},"officers":{"value":["Tobias Hagemann (Geschäftsführer)","Sebastian Stenzel (Geschäftsführer)"],"citation":"https://cryptomator.org/impressum/"},"source":"official Cryptomator Impressum, privacy policy, terms, pricing, and repository","reviewedAt":"2026-08-25"},"agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/cryptomator","canonical_score":45,"score_status":"rated","score_evidence":"limited","score_version":"4.0","score_breakdown":{"privacy":12,"control":0,"transparency":0,"security":25,"accountability":8},"applied_caps":[{"key":"closed-critical-core-without-audit","maximum":69,"reason":"A closed or unknown critical core without current audit evidence limits the score to 69."}],"score_rationale":["privacy: 12 of 25 points.","control: 0 of 20 points.","transparency: 0 of 20 points.","security: 25 of 25 points.","accountability: 8 of 10 points.","Limited evidence: operatorDataExposure, controlModel, sourceModel scored zero.","A closed or unknown critical core without current audit evidence limits the score to 69."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"unknown","controlModel":"unknown","sourceModel":"unknown"},"score_review":{"outcome":"PASS","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://cryptomator.org/","https://cryptomator.org/pricing/","https://cryptomator.org/privacy/","https://cryptomator.org/impressum/","https://cryptomator.org/terms/","https://docs.cryptomator.org/security/security-target/","https://github.com/cryptomator/cryptomator/releases/tag/1.19.3","https://github.com/cryptomator/cryptomator/security/advisories/GHSA-9q8x-whrw-x44p","https://github.com/cryptomator/cryptomator/security/advisories/GHSA-34rf-rwr3-7g43"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://cryptomator.org/","https://cryptomator.org/pricing/","https://cryptomator.org/privacy/","https://cryptomator.org/impressum/","https://cryptomator.org/terms/","https://docs.cryptomator.org/security/security-target/","https://github.com/cryptomator/cryptomator/releases/tag/1.19.3","https://github.com/cryptomator/cryptomator/security/advisories/GHSA-9q8x-whrw-x44p","https://github.com/cryptomator/cryptomator/security/advisories/GHSA-34rf-rwr3-7g43"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://cryptomator.org/","https://cryptomator.org/pricing/","https://cryptomator.org/privacy/","https://cryptomator.org/impressum/","https://cryptomator.org/terms/","https://docs.cryptomator.org/security/security-target/","https://github.com/cryptomator/cryptomator/releases/tag/1.19.3","https://github.com/cryptomator/cryptomator/security/advisories/GHSA-9q8x-whrw-x44p","https://github.com/cryptomator/cryptomator/security/advisories/GHSA-34rf-rwr3-7g43"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}},"privacy_observations":{"identity_exposure_level":0,"identity_requirement":"none","hosted_operator_data":false,"jurisdiction":"DE","jurisdiction_confidence":"verified","jurisdiction_context":"other"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"other","primary_category":"Privacy Tools","primary_bucket":"Privacy Tools","corporate_identity":{"entity_type":"company","entity_type_note":"Official Impressum and Privacy Policy identify Skymatic GmbH as the responsible operating company for Cryptomator and related services.","governance_model":"company-sponsored","repository_url":"https://github.com/cryptomator/cryptomator","legal_entity":"Skymatic GmbH","registration_number":"HRB 22635","registry_url":null,"incorporation_jurisdiction":"Germany (Amtsgericht Bonn)","incorporation_date":null,"registered_address":"Am Hauptbahnhof 6, 53111 Bonn, Germany","parent_entity":null,"ultimate_owner":null,"prior_entities":[],"officers":[{"name":"Tobias Hagemann (Geschäftsführer)","role":null},{"name":"Sebastian Stenzel (Geschäftsführer)","role":null}],"citations":{"legalEntity":{"url":"https://cryptomator.org/impressum/","note":null,"agent_verified":false},"registrationNumber":{"url":"https://cryptomator.org/impressum/","note":null,"agent_verified":false},"incorporationJurisdiction":{"url":"https://cryptomator.org/impressum/","note":null,"agent_verified":false},"registeredAddress":{"url":"https://cryptomator.org/impressum/","note":null,"agent_verified":false},"officers":{"url":"https://cryptomator.org/impressum/","note":null,"agent_verified":false},"entityType":{"url":"https://cryptomator.org/impressum/","note":null,"agent_verified":false},"governanceModel":{"url":"https://github.com/cryptomator","note":null,"agent_verified":false}},"basis":"registry-sourced, not audited","agent_verified":false,"source":"official Cryptomator Impressum, privacy policy, terms, pricing, and repository","reviewed_at":"2026-08-25"},"evidence_provenance":{"strongest_tier":"third-party-reported","tiers":["third-party-reported","self-reported"],"counts":{"directly-tested":0,"independent-audit":0,"third-party-reported":2,"self-reported":7},"total_sources":9},"privacy_score":100,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":0,"detail":"No required account or identity data recorded (level 0 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Local software or protocol with no hosted operator data"}],"evidence_confidence":94,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":70,"detail":"Material claims checked against current sources"},{"key":"freshness","label":"Review age","value":24,"detail":"Oldest recorded check is 73 days old"}],"score_computed_at":"2026-11-06T02:07:20.076Z","score_inputs":{"kycLevel":0,"noOperatorData":true,"jurisdiction":"DE","jurisdictionConfidence":"verified","evidenceStatus":"verified","checkedAt":"2026-08-25","lastReviewed":"2026-08-25","kycLastChecked":"2026-08-25"}},{"slug":"grapheneos","name":"GrapheneOS","domain":"grapheneos.org","url":"https://grapheneos.org/","kyc":"none","kycLevel":0,"kycNote":"No user account or identity KYC required for OS use; donation routes through GitHub Sponsors, crypto, PayPal, Wise or bank transfer may identify donors by rail.","fee":"Free","categories":["Privacy Tools"],"countries":["GLOBAL"],"features":["Hardened Android fork","Google-free option","Sandboxed Google Play","Verified boot","Open source","Pixel devices","No account required","Auto-updates","Advanced permission controls","Duress PIN/password"],"status":"ok","updatedAt":"2026-08-09","changedAt":"2026-08-09","description":"Open-source Android-compatible mobile OS for Pixel devices, with no account required to install or use it.","cardSummary":"Hardened Android OS for Pixel devices.","networks":[],"checkedAt":"2026-08-09","lastReviewed":"2026-08-09","reviewSource":"https://grapheneos.org/features#duress","jurisdictionConfidence":"inferred","kycLastChecked":"2026-06-22","trending":true,"jurisdiction":"CA","noOperatorData":true,"evidenceStatus":"verified","riskLevel":"standard","privacyWarning":null,"auditedBy":null,"corporate":{"entityType":{"value":"company","citation":"https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577&crpNm=grapheneos","note":"Registry-sourced corporate record established in pass 1 via legalEntity."},"legalEntity":{"value":"GrapheneOS Foundation","citation":"https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577&crpNm=grapheneos"},"registrationNumber":{"value":"1485757-7","citation":"https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577&crpNm=grapheneos"},"registryUrl":{"value":"https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577&crpNm=grapheneos","citation":"https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577&crpNm=grapheneos"},"incorporationJurisdiction":{"value":"Canada (federal)","citation":"https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577&crpNm=grapheneos"},"incorporationDate":{"value":"2023-03-17","citation":"https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577&crpNm=grapheneos"},"registeredAddress":{"value":"198 Bain Avenue, Toronto ON M4K 1G1, Canada","citation":"https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577&crpNm=grapheneos"},"officers":{"value":["Khalykbek Yelshibekov","Daniel Micay","Dmytro Mukhomor"],"citation":"https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577&crpNm=grapheneos"},"priorEntities":{"value":[],"citation":"unknown"},"source":"registry research 2026-08-08, task t_047dfd90","reviewedAt":"2026-08-08"},"twitter":"https://x.com/grapheneos","agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/grapheneos","canonical_score":44,"score_status":"rated","score_evidence":"limited","score_version":"4.0","score_breakdown":{"privacy":12,"control":0,"transparency":0,"security":25,"accountability":7},"applied_caps":[{"key":"closed-critical-core-without-audit","maximum":69,"reason":"A closed or unknown critical core without current audit evidence limits the score to 69."}],"score_rationale":["privacy: 12 of 25 points.","control: 0 of 20 points.","transparency: 0 of 20 points.","security: 25 of 25 points.","accountability: 7 of 10 points.","Limited evidence: operatorDataExposure, controlModel, sourceModel scored zero.","A closed or unknown critical core without current audit evidence limits the score to 69."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"unknown","controlModel":"unknown","sourceModel":"unknown"},"score_review":{"outcome":"PASS","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://grapheneos.org/"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://grapheneos.org/"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://grapheneos.org/"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}},"privacy_observations":{"identity_exposure_level":0,"identity_requirement":"none","hosted_operator_data":false,"jurisdiction":"CA","jurisdiction_confidence":"inferred","jurisdiction_context":"five_eyes"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"five_eyes","primary_category":"Privacy Tools","primary_bucket":"Privacy Tools","corporate_identity":{"entity_type":"company","entity_type_note":"Registry-sourced corporate record established in pass 1 via legalEntity.","governance_model":null,"repository_url":null,"legal_entity":"GrapheneOS Foundation","registration_number":"1485757-7","registry_url":"https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577&crpNm=grapheneos","incorporation_jurisdiction":"Canada (federal)","incorporation_date":"2023-03-17","registered_address":"198 Bain Avenue, Toronto ON M4K 1G1, Canada","parent_entity":null,"ultimate_owner":null,"prior_entities":[],"officers":[{"name":"Khalykbek Yelshibekov","role":null},{"name":"Daniel Micay","role":null},{"name":"Dmytro Mukhomor","role":null}],"citations":{"legalEntity":{"url":"https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577&crpNm=grapheneos","note":null,"agent_verified":false},"registrationNumber":{"url":"https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577&crpNm=grapheneos","note":null,"agent_verified":false},"incorporationJurisdiction":{"url":"https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577&crpNm=grapheneos","note":null,"agent_verified":false},"incorporationDate":{"url":"https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577&crpNm=grapheneos","note":null,"agent_verified":false},"registeredAddress":{"url":"https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577&crpNm=grapheneos","note":null,"agent_verified":false},"officers":{"url":"https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577&crpNm=grapheneos","note":null,"agent_verified":false},"entityType":{"url":"https://ised-isde.canada.ca/cc/lgcy/fdrlCrpDtls.html?p=0&corpId=14857577&crpNm=grapheneos","note":null,"agent_verified":false}},"basis":"registry-sourced, not audited","agent_verified":false,"source":"registry research 2026-08-08, task t_047dfd90","reviewed_at":"2026-08-08"},"evidence_provenance":{"strongest_tier":"third-party-reported","tiers":["third-party-reported"],"counts":{"directly-tested":0,"independent-audit":0,"third-party-reported":8,"self-reported":0},"total_sources":8},"privacy_score":100,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":0,"detail":"No required account or identity data recorded (level 0 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Local software or protocol with no hosted operator data"}],"evidence_confidence":87,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":70,"detail":"Material claims checked against current sources"},{"key":"freshness","label":"Review age","value":17,"detail":"Oldest recorded check is 137 days old"}],"score_computed_at":"2026-11-06T02:07:20.076Z","score_inputs":{"kycLevel":0,"noOperatorData":true,"jurisdiction":"CA","jurisdictionConfidence":"inferred","evidenceStatus":"verified","checkedAt":"2026-08-09","lastReviewed":"2026-08-09","kycLastChecked":"2026-06-22"}},{"slug":"joinmarket","name":"JoinMarket","domain":"github.com","url":"https://github.com/JoinMarket-Org/joinmarket-clientserver","kyc":"none","kycLevel":0,"kycNote":"No account, registration or identity KYC; users run local/self-custodial Bitcoin software and coordinate CoinJoins through the protocol.","fee":"Maker fees vary by offer; Bitcoin network fees also apply.","categories":["Privacy Tools","Bitcoin"],"countries":["GLOBAL"],"bestFor":["Bitcoin CoinJoin","Advanced privacy","Earning fees from liquidity"],"features":["Decentralized CoinJoin","No coordinator","Earn fees as maker","Bitcoin privacy","Tor-native","Open source","Self-custodial","JoinMarket-Qt GUI"],"tagline":"Bitcoin CoinJoin with a maker-taker fee market.","status":"warning","updatedAt":"2026-10-25","description":"Bitcoin CoinJoin software with a maker-taker fee market. The linked clientserver implementation is archived and no longer updated.","cardSummary":"Bitcoin CoinJoin with a maker-taker market.","networks":[],"checkedAt":"2026-10-25","lastReviewed":"2026-10-25","reviewSource":"https://github.com/JoinMarket-Org/joinmarket-clientserver/releases/tag/v0.9.12","jurisdictionConfidence":"unknown","kycLastChecked":"2026-10-25","trending":false,"jurisdiction":"??","evidenceStatus":"verified","riskLevel":"caution","privacyWarning":"The clientserver maintainers no longer recommend this implementation for use and say it will receive no further updates. CoinJoin privacy also depends on transaction history and how coins are spent.","auditedBy":[],"corporate":{"entityType":{"value":"unresolved","citation":"https://github.com/JoinMarket-Org/joinmarket-clientserver","note":"The sources identify an open-source project, not a verified legal operator."},"governanceModel":{"value":"maintainer-group","citation":"https://github.com/JoinMarket-Org/joinmarket-clientserver"},"repositoryUrl":{"value":"https://github.com/JoinMarket-Org/joinmarket-clientserver","citation":"https://github.com/JoinMarket-Org/joinmarket-clientserver"},"source":"Official repository and final-release notice.","reviewedAt":"2026-10-25"},"twitter":null,"agentUsability":{"status":"hard-blocked","evidence":"No reviewed programmatic agent-payment profile is recorded; this dataset treats the service as hard-blocked until a control surface is documented.","derivedFrom":["agentMoney.compatible"]},"details_url":"https://cunicula.com/en/provider/joinmarket","canonical_score":31,"score_status":"rated","score_evidence":"limited","score_version":"4.0","score_breakdown":{"privacy":12,"control":0,"transparency":0,"security":17,"accountability":2},"applied_caps":[{"key":"closed-critical-core-without-audit","maximum":69,"reason":"A closed or unknown critical core without current audit evidence limits the score to 69."}],"score_rationale":["privacy: 12 of 25 points.","control: 0 of 20 points.","transparency: 0 of 20 points.","security: 17 of 25 points.","accountability: 2 of 10 points.","Limited evidence: operatorDataExposure, controlModel, sourceModel scored zero.","A closed or unknown critical core without current audit evidence limits the score to 69."],"last_scored":"2026-10-25","not_rated_reasons":[],"score_assessment":{"operatorDataExposure":"unknown","controlModel":"unknown","sourceModel":"unknown"},"score_review":{"outcome":"PASS","checkedAt":"2026-08-25","inputs":{"operatorDataExposure":{"value":"unknown","sourceUrls":["https://github.com/JoinMarket-Org/joinmarket-clientserver","https://github.com/JoinMarket-Org/joinmarket-clientserver/releases/tag/v0.9.12"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"controlModel":{"value":"unknown","sourceUrls":["https://github.com/JoinMarket-Org/joinmarket-clientserver","https://github.com/JoinMarket-Org/joinmarket-clientserver/releases/tag/v0.9.12"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."},"sourceModel":{"value":"unknown","sourceUrls":["https://github.com/JoinMarket-Org/joinmarket-clientserver","https://github.com/JoinMarket-Org/joinmarket-clientserver/releases/tag/v0.9.12"],"reviewedAt":"2026-08-25","note":"The reviewed packet did not map this normalized Score 4.0 input to a field-level source; unknown is preserved until that mapping is completed."}},"audit":{"scoreEligible":false,"reason":"No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit."}},"privacy_observations":{"identity_exposure_level":0,"identity_requirement":"none","hosted_operator_data":null,"jurisdiction":null,"jurisdiction_confidence":"unknown","jurisdiction_context":"unknown"},"scoring_source_url":"https://cunicula.com/methodology#cunicula-score","jurisdiction_exposure":"unknown","primary_category":"Privacy Tools","primary_bucket":"Privacy Tools","corporate_identity":null,"evidence_provenance":{"strongest_tier":"self-reported","tiers":["self-reported"],"counts":{"directly-tested":0,"independent-audit":0,"third-party-reported":0,"self-reported":3},"total_sources":3},"privacy_score":100,"privacy_score_version":"3.1","privacy_factors":[{"key":"baseline","label":"Baseline","value":100,"detail":"Starting privacy exposure score"},{"key":"identity","label":"Identity exposure","value":0,"detail":"No required account or identity data recorded (level 0 of 4)"},{"key":"operator-context","label":"Operator context","value":0,"detail":"Hosted operator with unknown jurisdiction"}],"evidence_confidence":100,"evidence_confidence_status":"deprecated","evidence_confidence_sunset_on":"2027-02-26","evidence_score_version":"3.1","evidence_factors":[{"key":"source-coverage","label":"Source coverage","value":70,"detail":"Material claims checked against current sources"},{"key":"freshness","label":"Review age","value":30,"detail":"All recorded checks are within 30 days"}],"score_computed_at":"2026-11-06T02:07:20.076Z","score_inputs":{"kycLevel":0,"noOperatorData":false,"jurisdiction":"??","jurisdictionConfidence":"unknown","evidenceStatus":"verified","checkedAt":"2026-10-25","lastReviewed":"2026-10-25","kycLastChecked":"2026-10-25"}}]},"meta":{"total":1,"api_version":"1.3","powered_by":"cunicula.com","documentation_url":"https://cunicula.com/en/api-docs","machine_index_url":"https://cunicula.com/llms.txt","license":"LicenseRef-Cunicula-Attribution-1.0","license_url":"https://cunicula.com/en/cite","attribution":"Cunicula, \"{name}\", cunicula.com, reviewed {reviewed}, retrieved {retrieved}, {url}","cite_guide_url":"https://cunicula.com/en/cite","dataset_url":"https://cunicula.com/api/v1/dataset","schema_version":"1.1.0","related_total":5,"history_total":9}}