Grapheneos.social is a Mastodon instance run by or for the GrapheneOS project, the privacy-focused mobile operating system. For a social platform tied to a security brand, the overall setup is solid: the site has been around for three years, uses modern encryption, and enforces strict email authentication. That said, two things stand out. The SSL certificate is due to expire in just three days, which would throw browser warnings. For a project that prides itself on security, that's an oversight. Also, there's no easy way to contact the server admins from the homepage. Most Mastodon instances provide at least an email or a support account. If you're considering joining, wait until the certificate is renewed and look around for a contact method. Otherwise, the infrastructure, privacy policy, and long web history point to a legitimate community space, not a scam.
In plain English
This Mastodon server for the GrapheneOS project is mostly trustworthy, with a clean reputation and strong infrastructure. The main issue is a certificate that expires in three days you'll want to see that renewed before signing up, and the lack of a visible contact link is a minor transparency gap. Overall, it looks like a legitimate community instance with a few loose ends.
Where the score comes from
Solid security foundation with modern protections and good headers, but the certificate expires in 3 days. For a project built around security, that's a notable slip that needs immediate attention.
The site clearly belongs to the GrapheneOS project, with a 3-year history and a BIMI record that confirms a verified trademark. WHOIS is unavailable for this TLD, which is normal, so ownership is reasonably clear.
Clean record across blacklists, no Google Safe Browsing flags, and three years of Wayback history. Nothing here suggests abuse or shady activity.
An about page and legal pages are present, but contact info is missing from the homepage. For a server where users create accounts, a visible way to reach the admins would be expected.
Privacy policy and terms of service are published, which covers the basic legal expectations for a site hosting user data, even if it's a community project.
Strong tech setup: DNSSEC, strict email authentication, good DNS configuration, and a fast server. Infrastructure is well-maintained and professional.
What we checked
Run this site? Show your score.
Add a trust badge so visitors can see your live score for themselves.
Get your badge →