OPNsense is an open-source firewall and routing platform developed and commercially supported by Deciso B.V., a company headquartered at Edison 43, 3241 LS Middelharnis, the Netherlands. Deciso's own privacy statement (found at a non-obvious /privacy-en-cookies/ path, not a standard /privacy URL) discloses that it collects administrative data such as IP addresses to operate its website, optimize the site, combat abuse, and gather visitor statistics, and separately discloses that persistent cookies are used to let Deciso 'and our partner companies' recognize a returning visitor's browser, alongside a live Google Analytics script loaded on the privacy page itself -- while stating cookies are not used for re-marketing. The core OPNsense codebase is BSD-2-Clause licensed and public on GitHub, which also hosts an active, published vulnerability-disclosure program: 29 security advisories were published at draft time, including several credited to named external researchers (e.g. Brian Mariani of DigitalCanion SA), spanning low to high severity, all in 'published' (disclosed-with-fix) state. Deciso's business model includes a paid Business Edition requiring a per-subscription activation key during firmware update checks; the free Community Edition does not require this.
TIMELINE
1 ENTRY
[2026-08-30] · NEW RECEIPTS
7 new sources on file for OPNsense.
OPNsense's file gained 7 new sourced claims since its last review.
OPNsense's own documentation states that enabling a purchased Business Edition license requires entering a per-subscription activation key when checking for firmware updates against Deciso's commercial mirror -- a device/subscription-identifying data point not present when running the free Community Edition against community mirrors.
Deciso's privacy statement discloses that to operate its website it collects administrative information such as IP addresses, and separately uses that data for website optimization, abuse prevention, and visitor statistics.
GitHub's public API record for the opnsense/core repository confirms it is published under the BSD 2-Clause Simplified License and describes it as the OPNsense GUI, API and systems backend.
Deciso's privacy statement discloses that the open-source OPNsense project and its website are operated by Deciso B.V., naming the company's full street address in Middelharnis, the Netherlands.
Deciso's privacy statement discloses that personal information may be disclosed to processors assisting with the website under contractual confidentiality requirements, and separately to comply with legal or regulatory obligations.
GitHub's public security-advisories API for the opnsense/core repository lists 29 published advisories at draft time, including one crediting external researcher Brian Mariani of DigitalCanion SA with identifying multiple cross-site-scripting vulnerabilities -- an active, publicly documented coordinated vulnerability-disclosure program with named external credit, all advisories in disclosed/fixed state.
Deciso's privacy statement discloses it uses persistent cookies on its website that allow Deciso and its partner companies to recognize a returning visitor's browser, while stating cookies are not used for re-marketing purposes; the fetched page itself also loads a live Google Analytics tracking script.