Nitrokey is an open-source hardware security-key vendor operated by Nitrokey GmbH, an owner-managed company founded in Berlin, Germany in 2015, now registered in Teltow, Germany (Amtsgericht Potsdam, HRB 32882 P) under CEO Jan Suhr. The company states all Nitrokeys are produced in Germany and that both hardware and software are published as open source specifically so users and independent third parties can audit them. Its Data Privacy Policy states website analytics run on a self-hosted, IP-anonymized Matomo instance rather than a third-party tracker, and that order data is shared only with the shipping company and payment service provider needed to fulfil a purchase, deleted after legally required retention periods. In 2015, Nitrokey Storage's hardware, firmware and app underwent an eleven-day third-party security audit by Cure53, sponsored by the Open Technology Fund, concluding the device "is capable of functioning properly and securely." In 2017, Nitrokey stated it was not affected by the industry-wide ROCA/CVE-2017-15361 RSA-key vulnerability that hit several other vendors' Infineon-based hardware, because Nitrokey does not use Infineon components, using NXP hardware and its own open-source implementation instead.
TIMELINE
1 ENTRY
[2026-08-30] · NEW RECEIPTS
7 new sources on file for Nitrokey.
Nitrokey's file gained 7 new sourced claims since its last review.
Nitrokey's Data Privacy Policy states that data submitted when ordering goods or services is processed only as needed to fulfil the order, and that personal data is deleted after the order is completed, subject only to the retention periods required by tax and commercial law.
Nitrokey's Legal Information page names the responsible company as Nitrokey GmbH, located at Rheinstr. 10 C, 14513 Teltow, Germany, names CEO Jan Suhr, and gives its commercial registry court and record (Amtsgericht Potsdam, HRB 32882 P) plus its VAT identification number.
Nitrokey's About page states the owner-managed company was founded in Berlin, Germany in 2015, and states the company publishes its hardware and software developments as open source specifically so that users and independent third parties can check and audit the security of Nitrokey products.
Nitrokey's Data Privacy Policy states that in order to process a purchase, customer data is shared only with the shipping company responsible for delivery and/or the payment service provider, each strictly to the extent required to complete that function.
Nitrokey's 2015 announcement discloses a third-party security audit of the Nitrokey Storage hardware, firmware, and companion app, conducted over eleven days by security firm Cure53 under the lead of Dr.-Ing. Mario Heiderich and sponsored by the Open Technology Fund, with the full report published for download and a stated conclusion that the device is capable of functioning properly and securely.
Nitrokey's 2017 disclosure states the company's products were not affected by the industry-wide ROCA vulnerability (CVE-2017-15361), which allowed attackers to compute victims' private RSA keys and affected several other hardware vendors' Infineon-based chips, because Nitrokey does not use Infineon components, relying instead on NXP hardware and its own open-source software implementation.
Nitrokey's Data Privacy Policy states its website uses Matomo (formerly Piwik), self-hosted open-source analytics software, with the 'Automatically Anonymize Visitor IPs' function enabled, which truncates visitor IP addresses so they cannot be tied to an individual, and offers a working opt-out link.