F-Droid Due Diligence
Run due diligence on F-Droid: check compliance and get alerts when suppliers change.
Germany · f-droid.org · 10 vendors
F-Droid is a free and open-source app store and software repository for Android devices. It provides a curated collection of applications that adhere to open-source principles, focusing on user privacy and freedom. Operating as a non-profit volunteer project, it offers an alternative to traditional app stores by hosting only free and open-source software.
Resilience scores
- Digital Sovereignty: 50
- Digital Resilience: 5
- Financial Resilience: 5
Technology vendors
- Cure53 — Cybersecurity — Germany
- Net By Net Holding LLC — Telecommunications — Russia
- Transifex — Technology — United States
- and 10 more
Services catalogue
1 service in catalogue across 1 category; runs on 10 sub-vendors.
- Application distribution
Insights
Last updated 2026-07-29 · revision 6
10 direct vendors, 70 subvendors
Direct vendors by controlling owner country (sample)
- Czech Republic: 1
- Russia: 1
- Germany: 3
Subvendors by controlling owner country (sample)
- Denmark: 2
- Australia: 2
- Japan: 3
Compliance
4 in-scope frameworks identified; showing 3.
ISO 27001 (source) — No public evidence
Evidence: https://f-droid.org/en/docs/Security_Model, https://f-droid.org/en/docs/Signing_Process, https://f-droid.org/en/docs/Reproducible_Builds, https://f-droid.org/en/docs/Building_a_Signing_Server, https://f-droid.org/en/about/
Cyber Resilience Act (source) — No public evidence
Evidence: https://f-droid.org/en/about/, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202402847, https://commonsconservancy.org/programmes/#F-Droid
GDPR (source) — No public evidence
Evidence: https://f-droid.org/en/about/, https://f-droid.org/en/docs/Government_Requests, https://commonsconservancy.org/programmes/#F-Droid, https://dracc.commonsconservancy.org/0039/, https://f-droid.org
Financials
Three-year financials
- 2025: revenue EUR 15.16K, equity EUR 24.10K
- 2024:
- 2023:
Financial Resilience Score: 5/10
F-Droid is not a company but a volunteer-run FOSS project legally represented by the Commons Conservancy Programme (a Dutch stichting). It has no revenue, no EBIT, no equity, and no audited accounts in the corporate sense. Its financial activity is limited to donation flows through Open Collective (EUR and USD), Liberapay, and GitHub Sponsors. The Euro collective shows a balance of €24,098.42, total raised of €38,182.99 all-time, and an estimated annual budget of €15,160.34. In 2025 it received a one-time $50,000 FLOSS/Fund grant, materially boosting inflows. Resilience is underpinned by full financial transparency, a highly diversified donor base (1,203+ contributors on the € collective), near-zero fixed costs (all volunteer, no salaried staff), and legal continuity via the Commons Conservancy umbrella. Institutional validation from the FLOSS/Fund grant and recurring foundation donors (Digitalcourage e.V., sysmocom GmbH, Disroot.org) strengthens sustainability. However, the scale of funding (~€15k/year on the Euro side) is very small relative to the technical and security-review workload for thousands of Android apps, making the project heavily dependent on unpaid volunteer labor. The most acute risk is not financial but regulatory/platform: Google's 2025-2026 Android Developer Verification and sideloading restrictions pose an existential threat to F-Droid's distribution model.
Key strengths: Fully transparent finances via Open Collective public ledger, Highly diversified donor base with 1,203+ contributors on the Euro collective, Zero salaried permanent staff; variable, low-cost structure, Legal umbrella via Commons Conservancy (NL) ensures IP and governance continuity, One-time $50,000 FLOSS/Fund grant received in 2025, Recurring institutional donors (Digitalcourage e.V., sysmocom GmbH, Disroot.org), 15-year track record as the default FOSS alternative Android app store
Risk factors: Google's Android Developer Verification / sideloading restrictions pose existential platform risk, Very small annual budget (~€15k EUR side) vs. large technical workload, Heavy dependence on unpaid volunteer labor, Key-person risk: only three named admins on the Euro collective, FLOSS/Fund $50k grant is one-off; long-term sustainability relies on many small donors, No audited financials and no publicly stated reserves policy, Legacy F-Droid Limited (UK) dormant but still on Companies House
Revenue by geography
- Eurozone (esp. Germany): 55%
- United States: 25%
- Rest of world: 10%
- India (FLOSS/Fund): 10%
Revenue by product/service
- One-time individual donations: 40%
- Grants (FLOSS/Fund): 25%
- Recurring individual donations: 25%
- Institutional/organizational sponsorships: 10%
Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.