WHAT THE POLICIES SAY

Cryptomator is an open-source, client-side encryption tool for cloud storage, run by Skymatic GmbH (Bonn, Germany) and represented by named individuals Tobias Hagemann and Sebastian Stenzel. Its privacy policy states that when the mobile apps access a user's cloud storage provider, all data processing happens solely on the user's local device and the company never receives any of it, and that the website's own analytics are a self-hosted, privacy-preserving, cookie-free service with pseudonymized IPs. Third-party data disclosure is limited to payment processors for purchases. The client is dual-licensed GPLv3/commercial with full source on GitHub. In March 2026 the project disclosed and patched a vulnerability in the Cryptomator Hub vault-unlock workflow (CVE-2026-32303/32317/32318) affecting Hub-managed vaults; the company states end-to-end encryption meant vault data itself was never at risk and reports no evidence of active exploitation. No independent third-party security audit report was found reachable at draft time, so track record rests on this single self-disclosed, promptly remediated incident rather than an audit artifact.

TIMELINE

1 ENTRY

[2026-08-30] · NEW RECEIPTS

7 new sources on file for Cryptomator.

Cryptomator's file gained 7 new sourced claims since its last review.

cryptomator.org ↗

TOOLS WE RECOMMEND

PLUS

RECEIPTS

7 ON FILE

[2025-04-01] · COLLECTION

Cryptomator's Privacy Policy states that when a user authorizes the iOS or Android app to access a cloud storage service, the application only accesses data in folders the user knowingly selected, that data is processed solely on the user's local device, and that the company will not receive any of this data under any circumstances; the same policy states standard technical website-visit data stored in server log files (browser, OS, referrer, IP address, access time) is retained only as long as needed for the site's operation and security, and is deleted after 7 days at the latest.

cryptomator.org ↗

OWNERSHIP TRANSPARENCY

Cryptomator's GitHub README states the client project is dual-licensed under the GPLv3 for FOSS use and under a separate commercial license for independent software vendors and resellers, with the full source published in the public repository.

raw.githubusercontent.com ↗

[2025-04-01] · OWNERSHIP TRANSPARENCY

Cryptomator's Privacy Policy names the responsible company as Skymatic GmbH, gives its full registered address in Bonn, Germany, and names its two individual representatives.

cryptomator.org ↗

SHARING

Cryptomator's published Security Target states the tool's design goal is that only people who know the vault password can read the files or change their contents undetected, for both file contents and filenames — an architectural claim that the operator itself, without the password, cannot access or share the plaintext.

docs.cryptomator.org ↗

[2025-04-01] · SHARING

Cryptomator's Privacy Policy's third-party disclosure table lists only a payment processor as a category of data recipient, for the purpose of processing a purchase and assigning payment to the customer — no advertising, analytics-broker, or data-broker destination is disclosed.

cryptomator.org ↗

[2026-03-13] · TRACK RECORD

Cryptomator publicly disclosed a March 2026 security vulnerability in the Cryptomator Hub vault-unlock workflow affecting Hub-managed vaults, assigned CVE identifiers across all three client platforms, shipped fixed versions, stated no evidence of active exploitation, and stated that because Cryptomator Hub uses end-to-end encryption, vault data itself was never at risk even though a session-token exfiltration path existed.

cryptomator.org ↗

[2025-04-01] · TRACKING TECH

Cryptomator's Privacy Policy states the website uses a privacy-preserving, self-hosted analytics service for internal audience measurement, that no cookies are stored on the visitor's device, and that any collected IP address is stored in completely pseudonymized form with re-identification not possible unless the user actively provides correlating data.

cryptomator.org ↗

LAST REVIEWED 2026-08-30 · METHODOLOGY v1.7