Ente Photos is an open-source, end-to-end encrypted photo backup and sharing service run by Ente Technologies, Inc., a Delaware-incorporated company with a Dover, DE mailing address that says it was started in 2020 and is funded by customer subscriptions. Its privacy policy (last updated June 15, 2026) states files, metadata and derived indexes such as face geometry are stored end-to-end encrypted with keys only the user holds, that no in-app feature-usage analytics are collected, and that the account-level data it does hold is limited to items such as email address, referral details, public keys, server logs, IP address and user agent, and payment invoices from third-party processors; a published architecture document describes the libsodium-based key hierarchy, and machine-learning features (face recognition, semantic search) run on-device with encrypted indexes synced. Encrypted blobs are replicated across Backblaze (Amsterdam), Wasabi (Frankfurt) and Scaleway (Paris), and the policy lists roughly twenty third-party providers including PostHog for anonymized website analytics and Hugging Face for model hosting; the policy also permits disclosure on legal request and in a merger or sale, and F-Droid flags that the client depends on a non-free network service and downloads ML models from Ente's CDN. Ente's architecture and clients were audited by Cure53 with Symbolic Software in March 2023 and its server code and infrastructure by Cure53 in a CERN-sponsored audit published November 2025, with reports linked; no breach or regulatory action was found in this research, and the published security policy is a coordinated-disclosure policy without a stated funded bounty.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
16 ON FILE
COLLECTION
The App Store listing for Ente Photos (seller: Ente Technologies, Inc.) carries a developer-declared privacy label of Contact Info (name, email address) and Identifiers (user ID) as data linked to the user's identity, and Diagnostics (crash, performance and other diagnostic data) as data not linked to identity; Apple notes it has not verified this information.
Ente's privacy policy (last updated June 15, 2026) states files, their metadata and any derived indexes (including face geometry) are stored end-to-end encrypted with decryption only on user devices, that it collects only the bare minimum needed to operate, and that it does not collect feature-usage analytics; the data it lists collecting is the user's email address, referral details, email addresses of share recipients, support communications, public keys, anonymized crash reports, server logs, device identifiers including IP address and user agent, takedown history, and payment invoices from third-party processors. Retention after account termination is stated as 60 days, after which identifying data is anonymized.
Ente's About page states the company was started in 2020 as an open-source company, describes itself as a sustainable business funded by customer subscriptions, and lists its team and contributors by first name and role -- no investors, shareholders or parent entities are named.
The Ente monorepo's LICENSE file publishes the code under the GNU Affero General Public License version 3, which requires that anyone running a modified server version make the source available to its users.
The Ente README describes a single public monorepo containing all client apps (iOS, Android, F-Droid, web, Linux, macOS, Windows) and the server that powers them, states the service can be self-hosted, and asserts that its source code and cryptography have been externally audited by Cure53, Symbolic Software and Fallible; the Fallible audit is Ente's own statement and no separate Ente report page for it was fetched in this research.
Ente's privacy policy identifies the operator as Ente Technologies, Inc., gives a mailing address at 1111B S Governors Ave #6032, Dover, DE 19904, states the company is headquartered in the United States with servers or hosting partners in Europe, applies Delaware law to US users, and names Manav Rathi as Data Protection Officer.
Ente's replication document states encrypted data is kept in three copies across three cloud providers in the EU -- Backblaze (Amsterdam) as primary hot storage, Wasabi (Frankfurt) as secondary hot storage with a 21-day compliance lock, and Scaleway (Paris) as cold storage -- so third-party storage providers hold ciphertext only.
Privacy Guides lists Ente Photos on its Photo Management page under criteria that require cloud-hosted providers to enforce end-to-end encryption, be open source and allow easy export; the page also notes a Cure53 audit of the server-side code and infrastructure in October 2025 and earlier audits by Cure53 (March 2023) and Fallible (April 2023).
Ente publishes an architecture document describing a libsodium-based key hierarchy: a master key that never leaves the device unencrypted, per-collection and per-file keys encrypted under it, only the encrypted master key and a plaintext public key stored on the server, and album sharing implemented by encrypting the collection key to the recipient's public key -- so the operator cannot read shared or unshared content; the page states this design has been audited.
Ente's privacy policy states it does not sell, trade or rent personal information, lists its third-party providers by name and use-case (Apple, Google, Stripe, BitPay and PayPal for payments; Scaleway, Backblaze, Wasabi and Hetzner for compute/storage; Cloudflare, Amazon SES, Postmark, Zoho, Grafana, Hugging Face, PostHog, OpenStreetMap, Stadia Maps and Anthropic), and reserves disclosure to comply with court orders or legal process and in the event of a merger or sale of the business; it also states the company is US-headquartered with servers in Europe and that EU personal data may be transferred to the US under standard contractual clauses.
Ente's SECURITY.md publishes a coordinated vulnerability disclosure policy with a security@ email, a GitHub security-advisory intake form, a PGP key, in-scope and out-of-scope definitions and safe-conduct asks for researchers; it does not state monetary rewards or reward tiers, so no funded bug bounty with published scope was found in this research.
On March 22, 2023 Ente announced that its architecture and source code across all clients had been audited by Cure53 in collaboration with Symbolic Software (Dr. Nadim Kobeissi and Dr.-Ing. Mario Heiderich), with the original report linked; the one high-severity finding (weak passwords permitted in the web app) was fixed and verified by the auditors, and two medium-severity findings were acknowledged as future hardening work.
On November 3, 2025 Ente announced that its server-side code and the infrastructure it runs on had been audited by a team of five Cure53 researchers over two weeks in an audit sponsored by CERN (described as an early customer); no data-integrity issues were found, 12 of 15 security issues were fixed during the audit, and the full Cure53 report is linked from the post.
Ente's machine-learning document states that face detection, clustering and CLIP-based semantic search run locally on the user's device because the service has no access to photos, that indexes are stored locally and also encrypted before being stored on the server, and that models are downloaded and run via ONNX Runtime -- a face-recognition feature that exists, but is documented as on-device and consent-gated.
F-Droid distributes Ente Photos under the GNU AGPLv3 and flags an anti-feature: the app depends on a non-free network service and downloads assets such as ML models, release info and FAQs from Ente's CDN -- a network dependency the client has even when built from source.
Ente's privacy policy states it sets no cookies on its website or app and collects no in-app feature-usage analytics; its third-party provider list nevertheless discloses PostHog for "Anonymized website analytics", Hugging Face for "Model hosting and downloads", Grafana for infrastructure monitoring, Cloudflare for networking and Anthropic for support knowledge-base management -- a website-side analytics tool and model-download dependency rather than an in-app tracker.