Home Assistant's privacy policy states that information collected by its applications is sent directly to the user's hosted instance and at no point logged or given to a third party; website visitor analytics, by contrast, are processed by Google Analytics.

Home Assistant publishes a vulnerability-disclosure policy with defined scope: reports are filed through GitHub Security Advisories, the project asks reporters to allow at least 90 days before public disclosure and targets a response within 7 days, it enumerates non-qualifying vulnerability classes and supported versions, and it commits to publishing GitHub Security Advisories and requesting CVEs for valid medium-or-higher findings in Home Assistant itself. The same page maintains a dated public timeline of past advisories with severity, CVSS score, assigned CVE, discoverer credit and fix version. The policy states explicitly that as an open source project Home Assistant cannot offer monetary bounties.

Home Assistant's core codebase is developed publicly on GitHub under the home-assistant organisation, where its data handling and release history are open to independent inspection; no breach or regulatory action involving the project appears in the drafted record.

Home Assistant's blog post of 2023-10-19 discloses two independent security audits of the project: Nabu Casa hired the cybersecurity firm Cure53 to audit critical parts of Home Assistant, which found issues including three rated critical severity (credential-theft-by-deception rather than authentication bypass), and in August 2023 the GitHub Security Lab audited Home Assistant Core and the iOS and Android apps and found six non-critical issues. The post states all reported issues were fixed in Home Assistant 2023.9, released 2023-09-06, quotes Cure53's report, and says all findings were added to the project's public security page timeline.

Home Assistant's blog post of 2026-03-26 states that the Open Home Foundation paid for an independent audit by the security engineering firm Trail of Bits of SecureTar v3, the rewritten backup-encryption library shipped in Home Assistant 2026.4. The review found the library follows best-in-class practices for hashing and encryption and raised three findings — a timing side-channel in a validation comparison, an insecure fallback to a legacy protocol version, and unpinned GitHub Actions workflow steps — all confirmed resolved in Trail of Bits' post-fix review; the published report is linked from the post at the trailofbits/publications repository.

In a post dated 2026-07-29 the Open Home Foundation announced it is moving analytics on its websites — including home-assistant.io — to Plausible, self-hosted on infrastructure the foundation maintains, stating the system creates no persistent identifiers, no cross-site or cross-device tracking and no cookies, uses IP addresses only for geolocation before discarding them, and exposes a public dashboard showing visitors the same data the foundation sees; the post also says affiliate links and other tracking elements are being removed. This addresses the third-party website analytics disclosed in Home Assistant's own privacy policy, though the post does not name the previous provider.

Home Assistant describes itself as open source home automation that puts local control and privacy first, powered by a worldwide community and serving over 2 million households -- device and automation data is processed on hardware the user controls rather than on vendor servers.