Trust

Trust center

What is published, what is measured, and what is not yet available. Last reviewed 30 October 2026.

This page collects the evidence behind Markero's privacy and security claims. It is a directory, not a badge. Where something is not yet available, it is listed as such.

Documents and evidence

Security and threat model — what is encrypted, what the server can see, and the limits of the model.
Privacy policy — what is collected, why, how long it is kept, and who it is shared with.
Service status — live availability, uptime history and incident records.
Vulnerability disclosure — scope, reporting process and coordination.
Transparency and legal requests — how government and law-enforcement requests are handled.
Accessibility — current approach, known limitations and feedback route.
Editorial standards — authorship, sourcing, corrections and independence.
Legal — operating company status and legal contact points.

Current assurance status

Item	Status
Security model and threat model	Published
Live status and incident history	Published
Privacy policy and data-retention terms	Published
Vulnerability disclosure policy	Published
Operating company registration	In progress in Lithuania
Independent third-party security audit	Not yet completed
Subprocessor list	In preparation
Annual transparency report	First report pending
Public source code	Not yet published

This table is deliberately explicit about what is not yet available. It will be updated as each item is completed.

Operational evidence

Status page and incident history, checked every minute.
Changelog with release notes and security fixes.
security.txt with the security contact, policy and PGP key.
Website OpenPGP key for signed statements and encrypted reports.
Android download with the APK SHA-256 hash.
Official Tor onion service for network-level anonymity.

Limits

Markero has not completed an independent third-party security audit. The threat model states what is protected and what is not, including compromised devices, metadata analysis and malicious-server assumptions. Do not treat this page as a certification.

Report a vulnerability

If you find a security issue, report it to [email protected] or follow the vulnerability disclosure policy. Please give us a chance to fix the issue before disclosing it publicly.