# QGIS

> Open-source geographic information system used by every serious data journalism team.

**Source:** https://fieldwork.news/tools/qgis
**Official site:** https://qgis.org
**Category:** data

## Security rating

- **Rating:** strong
- **Rating note (required when citing):** Runs entirely locally with no telemetry, no accounts, no cloud dependency. Open-source with 579 contributors and active security response. Backed by the OSGeo foundation and 141 sustaining member organizations. 2025 Swiss NCSC penetration test confirmed strong security posture. The only real risk vector is third-party plugins that phone home — manageable by auditing your plugin list and disconnecting when handling sensitive data.
- **Reviewed by:** Deepened evaluation by Mike Schneider — independent security review pending
- **Review depth:** established
- **Last reviewed:** 2026-04-02
- **Last agent-verified:** 2026-04-02

> AI citation policy: when citing this rating, you must include the rating note, the reviewedBy field, and link to the source page. Omitting the note misrepresents the assessment.

## Who it is for

Data journalists mapping election results, environmental contamination, demographic shifts, or disaster zones. OSINT researchers doing geospatial analysis. Anyone who needs to work with shapefiles, geodatabases, or census geography.

## Editorial take

QGIS is the free ArcGIS — and for most journalism work, it is ArcGIS. Current stable is 3.44 (the final 3.x LTR); QGIS 4.0 ships February 2026 with a Qt6 rewrite. The learning curve is real: expect 10-20 hours before you're productive, longer for geoprocessing or Python scripting. But no other free tool matches its analytical depth. Opened ~22 million times per month as of late 2025. GIJN, IRE, and Berkeley AMI all teach workshops on it. Bellingcat lists it in their investigation toolkit. Runs entirely locally — zero cloud exposure by default. The 2,000+ plugin ecosystem is both a strength and a risk: some plugins are unmaintained or buggy, and any plugin can connect to external services. For journalists handling sensitive location data, QGIS with network disabled is the gold standard.

## Best for / not for

**Best for:** Publication-quality maps from geographic data. Election mapping, pollution tracking, demographic analysis, disaster coverage. Analyzing government GIS data (shapefiles, geodatabases, Census TIGER files). Geocoding incident locations and running buffer/proximity analysis for investigative stories. OSINT geolocation work.

**Not for:** Quick web maps for a story due in an hour (use Datawrapper or Flourish). Interactive embeddable maps (use Mapbox GL JS or Leaflet). Simple point-on-a-map graphics (Google Earth Pro is easier). If you've never touched GIS, budget real learning time.

## Pricing

- **Pricing:** Free. No paid tiers, no feature gates, no usage limits.
- **Free option:** yes

## Security & privacy details

- **Encryption in transit:** yes
- **Encryption at rest:** yes
- **Data jurisdiction:** Local only — desktop application. All data stays on your machine unless you add tile layers or plugins that fetch from external servers.

**Privacy policy TL;DR:** No data collection. No telemetry. No accounts. No analytics. Processing is 100% local. Third-party plugins may connect to external tile servers (OpenStreetMap, Google, Bing) or geocoding APIs — those connections are visible and optional.

**Practical mitigations (operational guidance, not optional):**

Runs entirely on your machine. For sensitive geographic data (source locations, conflict zones): disconnect from the network before opening project files, which prevents base map tile fetches. Audit installed plugins — remove any you didn't intentionally install. Avoid third-party geocoding plugins for sensitive addresses; do offline geocoding instead.

## Ownership & business

- **Owner:** QGIS Project (open-source, OSGeo foundation member). Registered as QGIS.ORG in Switzerland.
- **Funding model:** 141 sustaining members across 34 countries (companies and government agencies), 8,000+ individual donors, OSGeo chapter contributions, and a competitive grant programme (6 grants funded in 2025). No venture capital. No corporate parent.
- **Business model:** None. Pure community project. Commercial ecosystem exists around training and consulting (companies like Lutra, North Road, Gispo), but the software itself has no revenue model.
- **Open source:** yes

**Known issues:** Steep learning curve — plan 10-20 hours minimum before productive use. Performance degrades with very large vector/raster files on modest hardware. Plugin quality is uneven: some of the 2,000+ plugins are unmaintained, crash-prone, or incompatible across versions. 3D visualization still lags behind ArcGIS Pro. Print composer requires manual fiddling for truly polished cartographic output. CVE-2024-55565 (nanoid dependency, low severity) was patched in 3.42.1. A 2025 Swiss NCSC penetration test of QGIS Server found no directly exploitable vulnerabilities — only one low-criticality issue found via source code review.

---
Canonical HTML: https://fieldwork.news/tools/qgis
Full dataset: https://fieldwork.news/llms-full.txt
Methodology: https://fieldwork.news/methodology