Penpot is an open-source design and prototyping platform, offered both as a hosted cloud product at penpot.app and as a self-hostable deployment, built by the Spanish company Kaleidos Subsidiary S.L. (Madrid). Its own Privacy Policy names Kaleidos Subsidiary S.L. as the data controller with a filed address and Spanish tax ID, and discloses that the website and app run Google Analytics plus PostHog, the latter collecting IP address (stored de-identified), device/browser information, screen size, coarse country-level location and preferred language. The policy also discloses standard GDPR data-subject rights (access, rectification, deletion, portability) and describes cross-border transfers to payment, hosting, CRM and email-service vendors under Standard Contractual Clauses. The codebase is MPL-2.0 licensed on GitHub, and the project publishes a security policy directing vulnerability reports to GitHub Security Advisories, with at least one credited, presumably-remediated critical path-traversal finding on record. This dossier scores the hosted cloud product, which is what most users encounter; the self-host option exists and materially changes the posture but was not separately audited here.
TIMELINE
1 ENTRY
[2026-08-31] · NEW RECEIPTS
6 new sources on file for Penpot.
Penpot's file gained 6 new sourced claims since its last review.
Penpot's Privacy Policy states that Kaleidos collects information provided directly through contact and registration channels, such as the register or contact form.
Penpot's GitHub repository describes the project as open source and designed for self-hosting, putting teams in complete control of their design environment, under the MPL-2.0 license.
The Privacy Policy discloses that personal data is transferred only to bounded processor categories -- payment-service companies and IT/hosting/CRM/emailing vendors -- under contractual safeguards.
Penpot's published Security Policy states vulnerabilities should be reported through GitHub Security Advisories rather than a public issue, and separately credits an external researcher by name for identifying a critical path-traversal vulnerability -- evidence the coordinated-disclosure program has processed at least one real, triaged finding.
The Privacy Policy discloses that Penpot uses PostHog for product analytics, which collects device IP address (stored de-identified), device and browser information, screen size and coarse country-level location, in addition to Google Analytics.