GnuPG (GPG) is a free, open-source, local implementation of the OpenPGP encryption and signing standard, distributed under the GPL; the Android implementation OpenKeychain is folded into this entity per Diego's pairing decision. The project's own privacy policy states its web infrastructure does not track site usage or store user data beyond what a user's own request requires, uses cookies only for session management with no personal data, and shares no data with external parties unless the user explicitly requests it. The legal entity behind paid development is g10 Code GmbH, a privately owned company registered at Amtsgericht Wuppertal (HRB 14459) led by Werner Koch, funded historically by major donors including the Linux Foundation, Stripe, Facebook and First Look Media. A separate charitable association, GnuPG e.V., existed from 2017 but was dissolved by its own membership vote in 2024 and formally deregistered in 2025 — the project's own site currently describes GnuPG as "an international community project run by volunteers and not a legal entity," with g10 Code GmbH as the sole named legal entity. The project publishes a full-disclosure security policy and disclosed and patched a Libgcrypt denial-of-service bug (security advisory T8211) in April 2026, stating the current stable GnuPG release itself was not affected.
TIMELINE
1 ENTRY
[2026-08-30] · NEW RECEIPTS
8 new sources on file for GnuPG.
GnuPG's file gained 8 new sourced claims since its last review.
GnuPG's Privacy Policy states the project's web properties do not track site usage or store user data except as needed to fulfill a user's own request, to fix technical problems, or to meet financial accounting requirements.
GnuPG's Imprint page states g10 Code GmbH is the privately owned legal entity behind the GnuPG project, employing paid developers, registered at Amtsgericht Wuppertal under registry number HRB 14459 with Werner Koch as managing director and a published VAT identification number.
GnuPG's Donate page names its largest historical financial supporters as the Linux Foundation, Stripe, Facebook, and First Look Media, alongside many individual donors, and describes moving to a RedHat-like sustainable development model funded by paying customers while keeping the software itself free and open source.
GnuPG's own Verein page states the GnuPG e.V. (a German charitable association founded in 2017 by seven active GnuPG developers) was dissolved by a membership-assembly vote on 2024-08-17, with the Amtsgericht Düsseldorf formally registering the termination on 2025-02-19.
GnuPG's Privacy Policy states no data is ever shared with external parties unless the user explicitly requests it, with the disclosed exception of the payment processors used for donation transactions.
GnuPG's Security page states the project generally follows a full-disclosure approach, with all bugs in its public bug tracker and all code changes in its public repository visible, while coordinating privately with affected downstream distributions before disclosing severe vulnerabilities.
GnuPG's own homepage news feed disclosed Security Advisory T8211 for Libgcrypt on 2026-04-21, describing a bug that could be used to mount a denial-of-service attack, released fixed versions (1.12.2, 1.11.3, 1.10.4), and stated the current stable GnuPG version itself was not affected.
GnuPG's Privacy Policy states cookies are used only for session management and carry no personal data, and that IP addresses in web-analytics log files are anonymized by truncation before any usage report is produced.