// Trust & Security Report
Cultured Code GmbH & Co. KG
Things 3 — personal task management app for Mac, iPhone, iPad, Apple Watch, and Vision Pro; includes Things Cloud sync service (free with app purchase)
Certifications held
1
Maturity
Startup
Trains on your data
No
Trust center
No
// Certification ledger
Each held certification is backed by a verbatim quote from the vendor's own trust or security page. “Not confirmed” means we could not verify it publicly, not that the vendor lacks it.
Verify on culturedcode.com“We collect and process all your personal data in accordance with the relevant data protection regulations, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).”
> Show 7 unconfirmed / not-held certifications
source: culturedcode.comNo public evidence on vendor domain. No SOC 2 report, trust center, or compliance page found. Cultured Code is a 12-person consumer-focused company with no enterprise compliance documentation.
source: culturedcode.comNo public evidence on vendor domain. No ISO 27001 certificate or any mention found on any Cultured Code page.
source: culturedcode.comNo public evidence on vendor domain. Product is a personal task manager with no healthcare use case; no HIPAA mention found anywhere on the site.
source: culturedcode.comNot applicable. Purchases are processed through the Apple App Store; Cultured Code does not handle payment card data directly.
source: culturedcode.comNot applicable. Things 3 has no AI features. Cultured Code is not an AI company and does not operate AI/ML pipelines.
source: culturedcode.comNo public evidence on vendor domain. unknown / no public evidence.
source: culturedcode.comNot applicable. Consumer-focused German product with no US federal government use case or mention.
// Privacy & AI training
Trains on customer data
No
Data processing agreement
Not offered
Data region
EU / Germany likely. Company HQ in Stuttgart, Germany; compliance with GDPR, BDSG, and TDDDG. Specific hosting location (data center) not publicly disclosed.
Things 3 has no AI features and does not train on customer data. The privacy policy states data may be used for internal research to improve products, but there is no AI component or training program. A dedicated support article warns users not to share Things Cloud credentials with AI tools, reinforcing that the service is not integrated with AI pipelines.
// Security controls
Encryption in transit
TLS with 2048-bit certificate for all Things Cloud data exchange between client and server
culturedcode.comEncryption at rest
256-bit AES encryption; no data stored in clear text on Things Cloud servers
culturedcode.comEnd-to-end encryption
Not implemented. Data is decryptable by Cultured Code on their servers. Noted by independent privacy community as a limitation.
culturedcode.comAccess control
Access to personal information restricted to employees who need it; employees bound by confidentiality agreements and subject to discipline including termination
culturedcode.comSecurity reviews
Internal reviews of data collection, storage, and processing practices mentioned in privacy policy; no independent third-party audit evidence found
culturedcode.comData deletion
Users can request deletion of Things Cloud account and all associated content via app settings; some data may be retained for legal compliance periods
culturedcode.comTracking and analytics
No tracking, no analytics, no profiling on Things Cloud service per vendor statement
culturedcode.com// Products & data scope
data: To-do items, projects, tasks, notes, tags synced via Things Cloud
One-time purchase at $49.99 USD; macOS 10.15 or later; Apple Design Award winner
data: To-do items, projects, tasks, notes synced via Things Cloud
One-time purchase at $9.99 USD; iOS 15 or later
data: To-do items, projects, tasks, notes synced via Things Cloud
One-time purchase at $19.99 USD; iPadOS 15 or later
data: Subset of to-do items from Things Cloud
Companion app; included with iPhone purchase
data: To-do items, projects, tasks, notes synced via Things Cloud
One-time purchase at $29.99 USD; visionOS 26 or later
data: Full task database synced across Apple devices; email content if Mail to Things feature is enabled
Complimentary sync service included with any app purchase; GDPR compliant; no tracking or profiling; AES-256 encryption at rest; TLS in transit
// What to watch
- No dedicated trust center or security page; security information is scattered across the privacy policy and individual support articles
- No publicly available DPA (Data Processing Agreement); limits suitability for enterprise, regulated, or public-sector procurement
- No SOC 2, ISO 27001, or any third-party security audit certification; consistent with a 12-person consumer app company but rules out regulated enterprise use
- Data hosting / data center location not publicly disclosed; EU residency is likely given German HQ and GDPR compliance but cannot be confirmed from public documentation
- No end-to-end encryption; task data is readable by Cultured Code on the server side — privacy-focused users should note this
- Terms of Service grants Cultured Code a broad worldwide license to 'use, host, store, reproduce, modify, create derivative works, communicate, and distribute' user content; stated to be for 'limited purpose of operating and improving our Service' but the language is broader than necessary
- Things Cloud Terms of Service was last modified August 16, 2012 — over a decade old — and may not reflect current GDPR obligations, AI-era considerations, or modern data practices
// At a glance
Pricing model
One-time purchase per platform; no subscription. Mac $49.99, iPhone $9.99, iPad $19.99, Vision Pro $29.99; Things Cloud sync included free
Self-hostable
No
// How we verified this
Every certification marked HELD is confirmed against a verbatim quote on Cultured Code GmbH & Co. KG's own trust, security, or privacy pages. We reject certifications claimed only on third-party aggregators, on a cloud host's behalf, or by a similarly named company.
Last verified 2026-06-29. Compliance changes over time. Always confirm directly with the vendor before relying on any certification for a purchasing or compliance decision.
culturedcode.com