{ "generated_at": "2026-10-29T18:23:54.071Z", "method_version": "btr-0.1", "dimensions": [ { "id": "telemetry_egress", "label": "Telemetry and egress", "weight": 25, "anchor_10": "Published destination allowlist; cold idle produces zero unlisted packets, independently confirmed.", "anchor_0": "Covert collection, or egress that cannot be enumerated." }, { "id": "verifiability", "label": "Verifiability", "weight": 20, "anchor_10": "Reproducible build verified on the scored platform.", "anchor_0": "Closed source, or no way to prove the binary matches the source." }, { "id": "server_retention", "label": "Server-side retention", "weight": 15, "anchor_10": "Subpoena answer is two timestamps or an empty set.", "anchor_0": "Content readable by the vendor." }, { "id": "ownership_jurisdiction", "label": "Ownership, jurisdiction, business model", "weight": 12, "anchor_10": "Nonprofit or cooperative, no ad model, strong process protections.", "anchor_0": "State-controlled." }, { "id": "local_data_exposure", "label": "Local data exposure", "weight": 10, "anchor_10": "All artifacts encrypted at rest under a user-presence key.", "anchor_0": "Everything plaintext on disk." }, { "id": "dependency_surface", "label": "Dependency surface", "weight": 8, "anchor_10": "Small audited dependency tree, signed and pinned update channel.", "anchor_0": "Huge unaudited tree, unsigned updates." }, { "id": "user_control_exit", "label": "User control and exit", "weight": 5, "anchor_10": "Usable export, real deletion, no identity hostage-taking.", "anchor_0": "No export, deletion that does not delete." }, { "id": "incident_record", "label": "Incident record", "weight": 5, "anchor_10": "Flaws found, disclosed honestly, fixed fast.", "anchor_0": "Unblemished only because nobody is allowed to test it." } ], "products": [ { "id": "alpaca", "name": "Alpaca", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "chatgpt", "name": "ChatGPT", "platform": "web", "category_id": "ai", "vendor_id": "openai", "sovereign": 0, "boss": 0, "art_slot": "outlaw_chatgpt", "monthly_cost": 20, "vendor": "OpenAI", "entity_type": "private", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "chatqt", "name": "ChatQT", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "gpt4all", "name": "GPT4ALL", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "gai", "name": "Gai", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "gemini", "name": "Google Gemini", "platform": "web", "category_id": "ai", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_gemini", "monthly_cost": 0, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "lm-studio", "name": "LM Studio", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "mindmate", "name": "MindMate", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "moose", "name": "Moose", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "reins-chat-for-ollama", "name": "Reins: Chat for Ollama", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "tarotcaster", "name": "TarotCaster", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "writing-tools", "name": "Writing Tools", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "chromium-web-browser", "name": "Chromium Web Browser", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "firedragon", "name": "FireDragon", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "firefox", "name": "Firefox", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "chrome", "name": "Google Chrome", "platform": "web", "category_id": "browser", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_chrome", "monthly_cost": 0, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "librewolf", "name": "LibreWolf", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "microsoft-edge", "name": "Microsoft Edge", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "mullvad-browser", "name": "Mullvad Browser", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "waterfox", "name": "Waterfox", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "web", "name": "Web", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "web-apps", "name": "Web Apps", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "yandex-browser", "name": "Yandex Browser", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "google-calendar", "name": "Google Calendar", "platform": "web", "category_id": "calendar", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_google_calendar", "monthly_cost": 0, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "salesforce", "name": "Salesforce", "platform": "web", "category_id": "crm", "vendor_id": "salesforce", "sovereign": 0, "boss": 0, "art_slot": "outlaw_salesforce", "monthly_cost": 25, "vendor": "Salesforce, Inc.", "entity_type": "public", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "github", "name": "GitHub", "platform": "web", "category_id": "dev", "vendor_id": "microsoft", "sovereign": 0, "boss": 0, "art_slot": "outlaw_github", "monthly_cost": 0, "vendor": "Microsoft Corporation", "entity_type": "public", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "vercel", "name": "Vercel", "platform": "web", "category_id": "dev", "vendor_id": "vercel", "sovereign": 0, "boss": 0, "art_slot": "outlaw_vercel", "monthly_cost": 20, "vendor": "Vercel Inc.", "entity_type": "private", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "aerion", "name": "Aerion", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "betterbird", "name": "Betterbird", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "convey", "name": "Convey", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "geary", "name": "Geary", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "gmail", "name": "Gmail", "platform": "web", "category_id": "email", "vendor_id": "google", "sovereign": 0, "boss": 1, "art_slot": "outlaw_gmail", "monthly_cost": 0, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "kanmail", "name": "Kanmail", "platform": "source", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "mail", "name": "Mail", "platform": "source", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "mailspring", "name": "Mailspring", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "meli", "name": "Meli", "platform": "source", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "meron", "name": "Meron", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "outlook", "name": "Outlook", "platform": "web", "category_id": "email", "vendor_id": "microsoft", "sovereign": 0, "boss": 0, "art_slot": "outlaw_outlook", "monthly_cost": 0, "vendor": "Microsoft Corporation", "entity_type": "public", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "protonmail", "name": "Proton Mail", "platform": "web", "category_id": "email", "vendor_id": "proton", "sovereign": 0, "boss": 0, "art_slot": "outlaw_protonmail", "monthly_cost": 5, "vendor": "Proton AG", "entity_type": "private", "jurisdiction": "CH", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "thunderbird", "name": "Thunderbird", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "thunderbird-esr", "name": "Thunderbird ESR", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "tuta-experimental", "name": "Tuta (Experimental)", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "dropbox", "name": "Dropbox", "platform": "web", "category_id": "files", "vendor_id": "dropbox", "sovereign": 0, "boss": 0, "art_slot": "outlaw_dropbox", "monthly_cost": 12, "vendor": "Dropbox, Inc.", "entity_type": "public", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "google-drive", "name": "Google Drive", "platform": "web", "category_id": "files", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_google_drive", "monthly_cost": 3, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "lazyrsync", "name": "Lazyrsync", "platform": "source", "category_id": "files", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud", "name": "Nextcloud (self-hosted)", "platform": "web", "category_id": "files", "vendor_id": "nextcloud-gmbh", "sovereign": 1, "boss": 0, "art_slot": "ally_nextcloud", "monthly_cost": 0, "vendor": "Nextcloud GmbH", "entity_type": "private", "jurisdiction": "DE", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "ocis", "name": "Ocis", "platform": "source", "category_id": "files", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "onedrive", "name": "OneDrive", "platform": "web", "category_id": "files", "vendor_id": "microsoft", "sovereign": 0, "boss": 0, "art_slot": "outlaw_onedrive", "monthly_cost": 7, "vendor": "Microsoft Corporation", "entity_type": "public", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "oxicloud", "name": "OxiCloud", "platform": "source", "category_id": "files", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "seafile", "name": "Seafile", "platform": "source", "category_id": "files", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "syncthing-macos", "name": "Syncthing Macos", "platform": "source", "category_id": "files", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "twentythreeandme", "name": "23andMe", "platform": "web", "category_id": "health", "vendor_id": "23andme", "sovereign": 0, "boss": 0, "art_slot": "outlaw_23andme", "monthly_cost": 0, "vendor": "23andMe Holding Co.", "entity_type": "public", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "fitbit", "name": "Fitbit", "platform": "web", "category_id": "health", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_fitbit", "monthly_cost": 10, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "bitchat", "name": "Bitchat", "platform": "source", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "chat", "name": "Chat", "platform": "source", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "discord", "name": "Discord", "platform": "web", "category_id": "messaging", "vendor_id": "discord", "sovereign": 0, "boss": 0, "art_slot": "outlaw_discord", "monthly_cost": 0, "vendor": "Discord Inc.", "entity_type": "private", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "flare", "name": "Flare", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "fluxer", "name": "Fluxer", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "gnunet-messenger", "name": "GNUnet Messenger", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "gajim", "name": "Gajim", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "kaidan", "name": "Kaidan", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "karere", "name": "Karere", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "lightning", "name": "Lightning", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "mumble", "name": "Mumble", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "parla", "name": "Parla", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "signal-desktop", "name": "Signal Desktop", "platform": "linux-x86_64", "category_id": "messaging", "vendor_id": "signal-foundation", "sovereign": 0, "boss": 0, "art_slot": "outlaw_signal", "monthly_cost": 0, "vendor": "Signal", "entity_type": "nonprofit", "jurisdiction": "US", "business_model": "none", "weighted_total": 75.9, "grade": "B", "policy": 85, "infra": 58, "weakest_dimension": "local_data_exposure", "headline": "The strongest transport on the internet, sitting behind the weakest desktop client we have scored.", "assessed_on": "2026-10-29" }, { "id": "simplex-chat", "name": "Simplex Chat", "platform": "source", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "slack", "name": "Slack", "platform": "web", "category_id": "messaging", "vendor_id": "salesforce", "sovereign": 0, "boss": 0, "art_slot": "outlaw_slack", "monthly_cost": 8, "vendor": "Salesforce, Inc.", "entity_type": "public", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "whatsie", "name": "Whatsie", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "mint", "name": "Mint (Intuit)", "platform": "web", "category_id": "money", "vendor_id": "intuit", "sovereign": 0, "boss": 0, "art_slot": "outlaw_mint", "monthly_cost": 0, "vendor": "Intuit Inc.", "entity_type": "public", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "plaid", "name": "Plaid", "platform": "web", "category_id": "money", "vendor_id": "plaid", "sovereign": 0, "boss": 0, "art_slot": "outlaw_plaid", "monthly_cost": 0, "vendor": "Plaid Inc.", "entity_type": "private", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "beaver-notes", "name": "Beaver Notes", "platform": "linux-flatpak", "category_id": "notes", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "evernote", "name": "Evernote", "platform": "web", "category_id": "notes", "vendor_id": "evernote", "sovereign": 0, "boss": 0, "art_slot": "outlaw_evernote", "monthly_cost": 8, "vendor": "Evernote", "entity_type": "private", "jurisdiction": "IT", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "notes", "name": "Notes", "platform": "linux-flatpak", "category_id": "notes", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "notesnook", "name": "Notesnook", "platform": "linux-flatpak", "category_id": "notes", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "notion", "name": "Notion", "platform": "web", "category_id": "notes", "vendor_id": "notion", "sovereign": 0, "boss": 0, "art_slot": "outlaw_notion", "monthly_cost": 10, "vendor": "Notion Labs", "entity_type": "private", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "obsidian-sync", "name": "Obsidian Sync", "platform": "web", "category_id": "notes", "vendor_id": "obsidian", "sovereign": 0, "boss": 0, "art_slot": "outlaw_obsidian_sync", "monthly_cost": 5, "vendor": "Dynalist Inc.", "entity_type": "private", "jurisdiction": "CA", "business_model": "license", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "scrivano-for-handwritten-notes", "name": "Scrivano for Handwritten Notes", "platform": "linux-flatpak", "category_id": "notes", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "standard-notes", "name": "Standard Notes", "platform": "linux-flatpak", "category_id": "notes", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "sticky-notes", "name": "Sticky Notes", "platform": "linux-flatpak", "category_id": "notes", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "swifty-notes", "name": "Swifty Notes", "platform": "linux-flatpak", "category_id": "notes", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "trilium-notes", "name": "Trilium Notes", "platform": "linux-flatpak", "category_id": "notes", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "android", "name": "Google Android", "platform": "web", "category_id": "os", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_android", "monthly_cost": 0, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "windows", "name": "Windows 11", "platform": "web", "category_id": "os", "vendor_id": "microsoft", "sovereign": 0, "boss": 0, "art_slot": "outlaw_windows", "monthly_cost": 0, "vendor": "Microsoft Corporation", "entity_type": "public", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "onepassword", "name": "1Password", "platform": "web", "category_id": "passwords", "vendor_id": "1password", "sovereign": 0, "boss": 0, "art_slot": "outlaw_1password", "monthly_cost": 3, "vendor": "AgileBits Inc.", "entity_type": "private", "jurisdiction": "CA", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "key-rack", "name": "Key Rack", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "lastpass", "name": "LastPass", "platform": "web", "category_id": "passwords", "vendor_id": "lastpass", "sovereign": 0, "boss": 0, "art_slot": "outlaw_lastpass", "monthly_cost": 3, "vendor": "LastPass", "entity_type": "private", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud-password-client", "name": "Nextcloud Password Client", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nitrokey-app2", "name": "Nitrokey App2", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "onekeepass", "name": "OneKeePass", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "password", "name": "Password", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "password-generator", "name": "Password Generator", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "password-safe", "name": "Password Safe", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "password-secure", "name": "Password Secure", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "passwords-and-keys", "name": "Passwords and Keys", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "proton-pass", "name": "Proton Pass", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "a-photo-tool-libre", "name": "A Photo Tool (Libre)", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "camera", "name": "Camera", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "ente-photos", "name": "Ente Photos", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "gnu-image-manipulation-program", "name": "GNU Image Manipulation Program", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "google-photos", "name": "Google Photos", "platform": "web", "category_id": "photos", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_google_photos", "monthly_cost": 3, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "photocollage", "name": "PhotoCollage", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "photoqt", "name": "PhotoQt", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "photobooth", "name": "Photobooth", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "photoflare", "name": "Photoflare", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "photometry", "name": "Photometry", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "photos", "name": "Photos", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "icloud-photos", "name": "iCloud Photos", "platform": "web", "category_id": "photos", "vendor_id": "apple", "sovereign": 0, "boss": 0, "art_slot": "outlaw_icloud_photos", "monthly_cost": 3, "vendor": "Apple Inc.", "entity_type": "public", "jurisdiction": "US", "business_model": "hardware", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "google-workspace", "name": "Google Workspace", "platform": "web", "category_id": "productivity", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_google_workspace", "monthly_cost": 14, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "microsoft-365", "name": "Microsoft 365", "platform": "web", "category_id": "productivity", "vendor_id": "microsoft", "sovereign": 0, "boss": 0, "art_slot": "outlaw_microsoft_365", "monthly_cost": 13, "vendor": "Microsoft Corporation", "entity_type": "public", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "asana", "name": "Asana", "platform": "web", "category_id": "project", "vendor_id": "asana", "sovereign": 0, "boss": 0, "art_slot": "outlaw_asana", "monthly_cost": 11, "vendor": "Asana, Inc.", "entity_type": "public", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "trello", "name": "Trello", "platform": "web", "category_id": "project", "vendor_id": "atlassian", "sovereign": 0, "boss": 0, "art_slot": "outlaw_trello", "monthly_cost": 0, "vendor": "Atlassian Corporation", "entity_type": "public", "jurisdiction": "AU", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nest", "name": "Google Nest", "platform": "web", "category_id": "smarthome", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_nest", "monthly_cost": 0, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "ring", "name": "Ring (Amazon)", "platform": "web", "category_id": "smarthome", "vendor_id": "amazon", "sovereign": 0, "boss": 0, "art_slot": "outlaw_ring", "monthly_cost": 0, "vendor": "Amazon.com, Inc.", "entity_type": "public", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "facebook", "name": "Facebook", "platform": "web", "category_id": "social", "vendor_id": "meta", "sovereign": 0, "boss": 0, "art_slot": "outlaw_facebook", "monthly_cost": 0, "vendor": "Meta Platforms", "entity_type": "public", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "twitter", "name": "X (Twitter)", "platform": "web", "category_id": "social", "vendor_id": "x-corp", "sovereign": 0, "boss": 0, "art_slot": "outlaw_twitter", "monthly_cost": 0, "vendor": "X Corp.", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "netflix", "name": "Netflix", "platform": "web", "category_id": "streaming", "vendor_id": "netflix", "sovereign": 0, "boss": 0, "art_slot": "outlaw_netflix", "monthly_cost": 16, "vendor": "Netflix, Inc.", "entity_type": "public", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "teams", "name": "Microsoft Teams", "platform": "web", "category_id": "video", "vendor_id": "microsoft", "sovereign": 0, "boss": 0, "art_slot": "outlaw_teams", "monthly_cost": 0, "vendor": "Microsoft Corporation", "entity_type": "public", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "otter", "name": "Otter.ai", "platform": "web", "category_id": "video", "vendor_id": "otter", "sovereign": 0, "boss": 0, "art_slot": "outlaw_otter", "monthly_cost": 17, "vendor": "Otter.ai", "entity_type": "private", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "zoom", "name": "Zoom", "platform": "web", "category_id": "video", "vendor_id": "zoom", "sovereign": 0, "boss": 0, "art_slot": "outlaw_zoom", "monthly_cost": 16, "vendor": "Zoom Communications", "entity_type": "public", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "whisper-api", "name": "OpenAI Whisper API", "platform": "web", "category_id": "voice", "vendor_id": "openai", "sovereign": 0, "boss": 0, "art_slot": "outlaw_whisper_api", "monthly_cost": 0, "vendor": "OpenAI", "entity_type": "private", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nordvpn", "name": "NordVPN", "platform": "web", "category_id": "vpn", "vendor_id": "nord-security", "sovereign": 0, "boss": 0, "art_slot": "outlaw_nordvpn", "monthly_cost": 4, "vendor": "Nord Security", "entity_type": "private", "jurisdiction": "PA", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null } ], "assessments": [ { "id": "A-2026-10-29-SIGNAL-DESKTOP", "product_id": "signal-desktop", "version": "8.36.0-alpha.1", "source_commit": "5dad34ad5ea1a5b6229412e5c8ac0a696ff7532d", "assessed_on": "2026-10-29", "method_version": "btr-0.1", "reproducible_build": 1, "weighted_total": 75.9, "grade": "B", "weakest_dimension": "local_data_exposure", "headline": "The strongest transport on the internet, sitting behind the weakest desktop client we have scored.", "not_tested": "No live account was used. No packet capture was run (D1 to D4 not executed, this is a source audit only). Android and iOS clients not assessed. No attempt to verify the shipped .deb against a local rebuild." } ], "scores": [ { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "telemetry_egress", "value": 9, "rationale": "Zero analytics packages across 224 dependencies. Crash reporter started with uploadToServer:false. Only signal.org, support.signal.org, updates*.signal.org and sfu.voip.signal.org appear in source. Docked one point for update checks on launch and the megaphone channel, neither of which is telemetry but both of which are vendor-initiated contact.", "label": "Telemetry and egress", "weight": 25 }, { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "verifiability", "value": 6, "rationale": "Fully open source. Reproducible builds exist for Linux only, via Docker, and Signal labels them experimental and possibly non-functioning on public releases. macOS and Windows have none. Capped at 6 by the instrument rule.", "label": "Verifiability", "weight": 20 }, { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "server_retention", "value": 10, "rationale": "The published answer to a 2021 federal grand jury subpoena was registration date and last connection date. No messages, contacts, groups, profile or avatar exist server-side to hand over.", "label": "Server-side retention", "weight": 15 }, { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "ownership_jurisdiction", "value": 8, "rationale": "501(c)(3) nonprofit, EIN 82-4506840, no advertising and no data sale, so the incentive to surveil is absent rather than merely restrained. Docked for US jurisdiction and for early Open Technology Fund grant funding.", "label": "Ownership, jurisdiction, business model", "weight": 12 }, { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "local_data_exposure", "value": 5, "rationale": "Received attachments are stored unencrypted at ~/.config/Signal/attachments.noindex (CVE-2023-24069). The SQLCipher key lives in gnome-keyring, so anything running as the user can read db.sqlite. On this operator machine that means every agent process.", "label": "Local data exposure", "weight": 10 }, { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "dependency_surface", "value": 6, "rationale": "224 dependencies, Electron 45.0.0 pinned. Electron has produced CVEs enabling persistent backdoors in exactly this class of app. Update channel is a signed apt repo, which is the good part.", "label": "Dependency surface", "weight": 8 }, { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "user_control_exit", "value": 7, "rationale": "Registration still requires a phone number, though usernames and phone-number privacy now reduce the exposure. No practical encrypted export of message history in a portable format.", "label": "User control and exit", "weight": 5 }, { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "incident_record", "value": 7, "rationale": "Roughly 15 CVEs under the signal vendor entry. The 2023 local-storage flaws were acknowledged and fixed in 6.2.0. Signal is under continuous scrutiny, which is a better position than an untested clean record.", "label": "Incident record", "weight": 5 } ], "evidence": [ { "id": 8, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "local_data_exposure", "claim": "Attachments are stored unencrypted on the filesystem; the SQLCipher key is held by the OS keyring.", "tier": 1, "kind": "source", "artifact": "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/01-capture-sites.txt", "sha256": null, "observed_at": "2026-10-29T13:13:56-05:00" }, { "id": 9, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "telemetry_egress", "claim": "Electron media permission defaults to false and audio is denied unless the user has enabled mediaPermissions.", "tier": 1, "kind": "source", "artifact": "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/02-permissions.txt", "sha256": "0a64f213f3c241c1211dec56c0018d9220651c2550a7cf44609d586e74369cf2", "observed_at": "2026-10-29T13:13:56-05:00" }, { "id": 10, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "telemetry_egress", "claim": "Zero analytics, tracker or crash-upload dependencies across 224 packages.", "tier": 1, "kind": "source", "artifact": "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/05-dependencies.txt", "sha256": null, "observed_at": "2026-10-29T13:13:56-05:00" }, { "id": 11, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "telemetry_egress", "claim": "Only two audio capture call sites exist and both are reachable only from an explicit UI action.", "tier": 1, "kind": "source", "artifact": "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/03-call-path.txt", "sha256": null, "observed_at": "2026-10-29T13:13:56-05:00" }, { "id": 12, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "verifiability", "claim": "Signal states reproducible builds for macOS and Windows are not available, and the Linux build is experimental.", "tier": 2, "kind": "record", "artifact": "https://github.com/signalapp/Signal-Desktop/blob/main/reproducible-builds/README.md", "sha256": null, "observed_at": "2026-10-29T13:13:56-05:00" }, { "id": 13, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "server_retention", "claim": "Grand jury subpoena response returned two timestamps and nothing else.", "tier": 2, "kind": "filing", "artifact": "https://signal.org/bigbrother/cd-california-grand-jury/", "sha256": null, "observed_at": "2026-10-29T13:13:56-05:00" }, { "id": 14, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "ownership_jurisdiction", "claim": "Signal Technology Foundation is a 501(c)(3) with EIN 82-4506840.", "tier": 2, "kind": "record", "artifact": "https://projects.propublica.org/nonprofits/organizations/824506840", "sha256": null, "observed_at": "2026-10-29T13:13:56-05:00" } ], "findings": [ { "id": 5, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "high", "title": "Received attachments are stored unencrypted on disk", "detail": "Every image and file received is readable by any process running as the user. On a machine running agent software under the same account, this is the most likely real-world exposure.", "status": "by_design", "cve": "CVE-2023-24069" }, { "id": 6, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "medium", "title": "No verified reproducible build for the Linux package", "detail": "The source is auditable; the shipped binary is not yet provably the same artifact. Until this closes, a source audit is evidence about the repository, not about the running process.", "status": "open", "cve": null }, { "id": 7, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "medium", "title": "Local database key is held in the OS keyring", "detail": "Any process running in the unlocked session can decrypt db.sqlite. There is no user-presence gate.", "status": "accepted", "cve": null }, { "id": 8, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "low", "title": "Registration requires a phone number", "detail": "Mitigated by usernames and phone-number privacy, but the account root remains a phone number.", "status": "accepted", "cve": null } ] }