{ "generated_at": "2026-10-29T22:18:53.099Z", "method_version": "btr-0.1", "dimensions": [ { "id": "telemetry_egress", "label": "Telemetry and egress", "weight": 25, "anchor_10": "Published destination allowlist; cold idle produces zero unlisted packets, independently confirmed.", "anchor_0": "Covert collection, or egress that cannot be enumerated." }, { "id": "verifiability", "label": "Verifiability", "weight": 20, "anchor_10": "Reproducible build verified on the scored platform.", "anchor_0": "Closed source, or no way to prove the binary matches the source." }, { "id": "server_retention", "label": "Server-side retention", "weight": 15, "anchor_10": "Subpoena answer is two timestamps or an empty set.", "anchor_0": "Content readable by the vendor." }, { "id": "ownership_jurisdiction", "label": "Ownership, jurisdiction, business model", "weight": 12, "anchor_10": "Nonprofit or cooperative, no ad model, strong process protections.", "anchor_0": "State-controlled." }, { "id": "local_data_exposure", "label": "Local data exposure", "weight": 10, "anchor_10": "All artifacts encrypted at rest under a user-presence key.", "anchor_0": "Everything plaintext on disk." }, { "id": "dependency_surface", "label": "Dependency surface", "weight": 8, "anchor_10": "Small audited dependency tree, signed and pinned update channel.", "anchor_0": "Huge unaudited tree, unsigned updates." }, { "id": "user_control_exit", "label": "User control and exit", "weight": 5, "anchor_10": "Usable export, real deletion, no identity hostage-taking.", "anchor_0": "No export, deletion that does not delete." }, { "id": "incident_record", "label": "Incident record", "weight": 5, "anchor_10": "Flaws found, disclosed honestly, fixed fast.", "anchor_0": "Unblemished only because nobody is allowed to test it." } ], "products": [ { "id": "alpaca", "name": "Alpaca", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "chatgpt", "name": "ChatGPT", "platform": "web", "category_id": "ai", "vendor_id": "openai", "sovereign": 0, "boss": 0, "art_slot": "outlaw_chatgpt", "monthly_cost": 20, "vendor": "OpenAI", "entity_type": "private", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "chatqt", "name": "ChatQT", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "gpt4all", "name": "GPT4ALL", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "gai", "name": "Gai", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "gemini", "name": "Google Gemini", "platform": "web", "category_id": "ai", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_gemini", "monthly_cost": 0, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "lm-studio", "name": "LM Studio", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "mindmate", "name": "MindMate", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "moose", "name": "Moose", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "reins-chat-for-ollama", "name": "Reins: Chat for Ollama", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "tarotcaster", "name": "TarotCaster", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "writing-tools", "name": "Writing Tools", "platform": "linux-flatpak", "category_id": "ai", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "chromium-web-browser", "name": "Chromium Web Browser", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "firedragon", "name": "FireDragon", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "firefox", "name": "Firefox", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "chrome", "name": "Google Chrome", "platform": "web", "category_id": "browser", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_chrome", "monthly_cost": 0, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "librewolf", "name": "LibreWolf", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "microsoft-edge", "name": "Microsoft Edge", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "mullvad-browser", "name": "Mullvad Browser", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "waterfox", "name": "Waterfox", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "web", "name": "Web", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "web-apps", "name": "Web Apps", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "yandex-browser", "name": "Yandex Browser", "platform": "linux-flatpak", "category_id": "browser", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "google-calendar", "name": "Google Calendar", "platform": "web", "category_id": "calendar", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_google_calendar", "monthly_cost": 0, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud-calendar", "name": "Nextcloud Calendar", "platform": "web", "category_id": "calendar", "vendor_id": "nextcloud-gmbh", "sovereign": 1, "boss": 0, "art_slot": null, "monthly_cost": 0, "vendor": "Nextcloud GmbH", "entity_type": "private", "jurisdiction": "DE", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud-contacts", "name": "Nextcloud Contacts", "platform": "web", "category_id": "calendar", "vendor_id": "nextcloud-gmbh", "sovereign": 1, "boss": 0, "art_slot": null, "monthly_cost": 0, "vendor": "Nextcloud GmbH", "entity_type": "private", "jurisdiction": "DE", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "salesforce", "name": "Salesforce", "platform": "web", "category_id": "crm", "vendor_id": "salesforce", "sovereign": 0, "boss": 0, "art_slot": "outlaw_salesforce", "monthly_cost": 25, "vendor": "Salesforce, Inc.", "entity_type": "public", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "github", "name": "GitHub", "platform": "web", "category_id": "dev", "vendor_id": "microsoft", "sovereign": 0, "boss": 0, "art_slot": "outlaw_github", "monthly_cost": 0, "vendor": "Microsoft Corporation", "entity_type": "public", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "vercel", "name": "Vercel", "platform": "web", "category_id": "dev", "vendor_id": "vercel", "sovereign": 0, "boss": 0, "art_slot": "outlaw_vercel", "monthly_cost": 20, "vendor": "Vercel Inc.", "entity_type": "private", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "aerion", "name": "Aerion", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "betterbird", "name": "Betterbird", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "convey", "name": "Convey", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "geary", "name": "Geary", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "gmail", "name": "Gmail", "platform": "web", "category_id": "email", "vendor_id": "google", "sovereign": 0, "boss": 1, "art_slot": "outlaw_gmail", "monthly_cost": 0, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "kanmail", "name": "Kanmail", "platform": "source", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "mail", "name": "Mail", "platform": "source", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "mailspring", "name": "Mailspring", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "meli", "name": "Meli", "platform": "source", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "meron", "name": "Meron", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud-mail", "name": "Nextcloud Mail", "platform": "web", "category_id": "email", "vendor_id": "nextcloud-gmbh", "sovereign": 1, "boss": 0, "art_slot": null, "monthly_cost": 0, "vendor": "Nextcloud GmbH", "entity_type": "private", "jurisdiction": "DE", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "outlook", "name": "Outlook", "platform": "web", "category_id": "email", "vendor_id": "microsoft", "sovereign": 0, "boss": 0, "art_slot": "outlaw_outlook", "monthly_cost": 0, "vendor": "Microsoft Corporation", "entity_type": "public", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "protonmail", "name": "Proton Mail", "platform": "web", "category_id": "email", "vendor_id": "proton", "sovereign": 0, "boss": 0, "art_slot": "outlaw_protonmail", "monthly_cost": 5, "vendor": "Proton AG", "entity_type": "private", "jurisdiction": "CH", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "thunderbird", "name": "Thunderbird", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "thunderbird-esr", "name": "Thunderbird ESR", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "tuta-experimental", "name": "Tuta (Experimental)", "platform": "linux-flatpak", "category_id": "email", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "dropbox", "name": "Dropbox", "platform": "web", "category_id": "files", "vendor_id": "dropbox", "sovereign": 0, "boss": 0, "art_slot": "outlaw_dropbox", "monthly_cost": 12, "vendor": "Dropbox, Inc.", "entity_type": "public", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "google-drive", "name": "Google Drive", "platform": "web", "category_id": "files", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_google_drive", "monthly_cost": 3, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "lazyrsync", "name": "Lazyrsync", "platform": "source", "category_id": "files", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud", "name": "Nextcloud (self-hosted)", "platform": "web", "category_id": "files", "vendor_id": "nextcloud-gmbh", "sovereign": 1, "boss": 0, "art_slot": "ally_nextcloud", "monthly_cost": 0, "vendor": "Nextcloud GmbH", "entity_type": "private", "jurisdiction": "DE", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud-migrate-dropbox", "name": "Nextcloud Dropbox Migration", "platform": "web", "category_id": "files", "vendor_id": "nextcloud-gmbh", "sovereign": 1, "boss": 0, "art_slot": null, "monthly_cost": 0, "vendor": "Nextcloud GmbH", "entity_type": "private", "jurisdiction": "DE", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud-files", "name": "Nextcloud Files", "platform": "web", "category_id": "files", "vendor_id": "nextcloud-gmbh", "sovereign": 1, "boss": 0, "art_slot": null, "monthly_cost": 0, "vendor": "Nextcloud GmbH", "entity_type": "private", "jurisdiction": "DE", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud-migrate-gdrive", "name": "Nextcloud Google Drive Migration", "platform": "web", "category_id": "files", "vendor_id": "nextcloud-gmbh", "sovereign": 1, "boss": 0, "art_slot": null, "monthly_cost": 0, "vendor": "Nextcloud GmbH", "entity_type": "private", "jurisdiction": "DE", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud-server", "name": "Nextcloud Server", "platform": "server", "category_id": "files", "vendor_id": "nextcloud-gmbh", "sovereign": 1, "boss": 0, "art_slot": null, "monthly_cost": 0, "vendor": "Nextcloud GmbH", "entity_type": "private", "jurisdiction": "DE", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "ocis", "name": "Ocis", "platform": "source", "category_id": "files", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "onedrive", "name": "OneDrive", "platform": "web", "category_id": "files", "vendor_id": "microsoft", "sovereign": 0, "boss": 0, "art_slot": "outlaw_onedrive", "monthly_cost": 7, "vendor": "Microsoft Corporation", "entity_type": "public", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "oxicloud", "name": "OxiCloud", "platform": "source", "category_id": "files", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "seafile", "name": "Seafile", "platform": "source", "category_id": "files", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "syncthing-macos", "name": "Syncthing Macos", "platform": "source", "category_id": "files", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "twentythreeandme", "name": "23andMe", "platform": "web", "category_id": "health", "vendor_id": "23andme", "sovereign": 0, "boss": 0, "art_slot": "outlaw_23andme", "monthly_cost": 0, "vendor": "23andMe Holding Co.", "entity_type": "public", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "fitbit", "name": "Fitbit", "platform": "web", "category_id": "health", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_fitbit", "monthly_cost": 10, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "bitchat", "name": "Bitchat", "platform": "source", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "chat", "name": "Chat", "platform": "source", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "discord", "name": "Discord", "platform": "web", "category_id": "messaging", "vendor_id": "discord", "sovereign": 0, "boss": 0, "art_slot": "outlaw_discord", "monthly_cost": 0, "vendor": "Discord Inc.", "entity_type": "private", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "flare", "name": "Flare", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "fluxer", "name": "Fluxer", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "gnunet-messenger", "name": "GNUnet Messenger", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "gajim", "name": "Gajim", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "kaidan", "name": "Kaidan", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "karere", "name": "Karere", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "lightning", "name": "Lightning", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "mumble", "name": "Mumble", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud-spreed-signaling", "name": "Nextcloud Spreed Signaling (HPB)", "platform": "server", "category_id": "messaging", "vendor_id": "nextcloud-gmbh", "sovereign": 1, "boss": 0, "art_slot": null, "monthly_cost": 0, "vendor": "Nextcloud GmbH", "entity_type": "private", "jurisdiction": "DE", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud-talk", "name": "Nextcloud Talk", "platform": "web", "category_id": "messaging", "vendor_id": "nextcloud-gmbh", "sovereign": 1, "boss": 0, "art_slot": null, "monthly_cost": 0, "vendor": "Nextcloud GmbH", "entity_type": "private", "jurisdiction": "DE", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "parla", "name": "Parla", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "signal-desktop", "name": "Signal Desktop", "platform": "linux-x86_64", "category_id": "messaging", "vendor_id": "signal-foundation", "sovereign": 0, "boss": 0, "art_slot": "outlaw_signal", "monthly_cost": 0, "vendor": "Signal", "entity_type": "nonprofit", "jurisdiction": "US", "business_model": "none", "weighted_total": 76.4, "grade": "B", "policy": 85, "infra": 58, "weakest_dimension": "local_data_exposure", "headline": "The strongest transport on the internet, sitting behind the weakest desktop client we have scored.", "assessed_on": "2026-10-29" }, { "id": "simplex-chat", "name": "Simplex Chat", "platform": "source", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "slack", "name": "Slack", "platform": "web", "category_id": "messaging", "vendor_id": "salesforce", "sovereign": 0, "boss": 0, "art_slot": "outlaw_slack", "monthly_cost": 8, "vendor": "Salesforce, Inc.", "entity_type": "public", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "whatsie", "name": "Whatsie", "platform": "linux-flatpak", "category_id": "messaging", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "mint", "name": "Mint (Intuit)", "platform": "web", "category_id": "money", "vendor_id": "intuit", "sovereign": 0, "boss": 0, "art_slot": "outlaw_mint", "monthly_cost": 0, "vendor": "Intuit Inc.", "entity_type": "public", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "plaid", "name": "Plaid", "platform": "web", "category_id": "money", "vendor_id": "plaid", "sovereign": 0, "boss": 0, "art_slot": "outlaw_plaid", "monthly_cost": 0, "vendor": "Plaid Inc.", "entity_type": "private", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "beaver-notes", "name": "Beaver Notes", "platform": "linux-flatpak", "category_id": "notes", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "evernote", "name": "Evernote", "platform": "web", "category_id": "notes", "vendor_id": "evernote", "sovereign": 0, "boss": 0, "art_slot": "outlaw_evernote", "monthly_cost": 8, "vendor": "Evernote", "entity_type": "private", "jurisdiction": "IT", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud-notes", "name": "Nextcloud Notes", "platform": "web", "category_id": "notes", "vendor_id": "nextcloud-gmbh", "sovereign": 1, "boss": 0, "art_slot": null, "monthly_cost": 0, "vendor": "Nextcloud GmbH", "entity_type": "private", "jurisdiction": "DE", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "notes", "name": "Notes", "platform": "linux-flatpak", "category_id": "notes", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "notesnook", "name": "Notesnook", "platform": "linux-flatpak", "category_id": "notes", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "notion", "name": "Notion", "platform": "web", "category_id": "notes", "vendor_id": "notion", "sovereign": 0, "boss": 0, "art_slot": "outlaw_notion", "monthly_cost": 10, "vendor": "Notion Labs", "entity_type": "private", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "obsidian-sync", "name": "Obsidian Sync", "platform": "web", "category_id": "notes", "vendor_id": "obsidian", "sovereign": 0, "boss": 0, "art_slot": "outlaw_obsidian_sync", "monthly_cost": 5, "vendor": "Dynalist Inc.", "entity_type": "private", "jurisdiction": "CA", "business_model": "license", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "scrivano-for-handwritten-notes", "name": "Scrivano for Handwritten Notes", "platform": "linux-flatpak", "category_id": "notes", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "standard-notes", "name": "Standard Notes", "platform": "linux-flatpak", "category_id": "notes", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "sticky-notes", "name": "Sticky Notes", "platform": "linux-flatpak", "category_id": "notes", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "swifty-notes", "name": "Swifty Notes", "platform": "linux-flatpak", "category_id": "notes", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "trilium-notes", "name": "Trilium Notes", "platform": "linux-flatpak", "category_id": "notes", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "android", "name": "Google Android", "platform": "web", "category_id": "os", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_android", "monthly_cost": 0, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "windows", "name": "Windows 11", "platform": "web", "category_id": "os", "vendor_id": "microsoft", "sovereign": 0, "boss": 0, "art_slot": "outlaw_windows", "monthly_cost": 0, "vendor": "Microsoft Corporation", "entity_type": "public", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "onepassword", "name": "1Password", "platform": "web", "category_id": "passwords", "vendor_id": "1password", "sovereign": 0, "boss": 0, "art_slot": "outlaw_1password", "monthly_cost": 3, "vendor": "AgileBits Inc.", "entity_type": "private", "jurisdiction": "CA", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "key-rack", "name": "Key Rack", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "lastpass", "name": "LastPass", "platform": "web", "category_id": "passwords", "vendor_id": "lastpass", "sovereign": 0, "boss": 0, "art_slot": "outlaw_lastpass", "monthly_cost": 3, "vendor": "LastPass", "entity_type": "private", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud-password-client", "name": "Nextcloud Password Client", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud-passwords", "name": "Nextcloud Passwords", "platform": "web", "category_id": "passwords", "vendor_id": "nextcloud-gmbh", "sovereign": 1, "boss": 0, "art_slot": null, "monthly_cost": 0, "vendor": "Nextcloud GmbH", "entity_type": "private", "jurisdiction": "DE", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nitrokey-app2", "name": "Nitrokey App2", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "onekeepass", "name": "OneKeePass", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "password", "name": "Password", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "password-generator", "name": "Password Generator", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "password-safe", "name": "Password Safe", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "password-secure", "name": "Password Secure", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "passwords-and-keys", "name": "Passwords and Keys", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "proton-pass", "name": "Proton Pass", "platform": "linux-flatpak", "category_id": "passwords", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "a-photo-tool-libre", "name": "A Photo Tool (Libre)", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "camera", "name": "Camera", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "ente-photos", "name": "Ente Photos", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "gnu-image-manipulation-program", "name": "GNU Image Manipulation Program", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "google-photos", "name": "Google Photos", "platform": "web", "category_id": "photos", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_google_photos", "monthly_cost": 3, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud-photos", "name": "Nextcloud Photos", "platform": "web", "category_id": "photos", "vendor_id": "nextcloud-gmbh", "sovereign": 1, "boss": 0, "art_slot": null, "monthly_cost": 0, "vendor": "Nextcloud GmbH", "entity_type": "private", "jurisdiction": "DE", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "photocollage", "name": "PhotoCollage", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "photoqt", "name": "PhotoQt", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "photobooth", "name": "Photobooth", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "photoflare", "name": "Photoflare", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "photometry", "name": "Photometry", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "photos", "name": "Photos", "platform": "linux-flatpak", "category_id": "photos", "vendor_id": "unknown", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Unknown vendor", "entity_type": "unknown", "jurisdiction": "unknown", "business_model": "unknown", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "icloud-photos", "name": "iCloud Photos", "platform": "web", "category_id": "photos", "vendor_id": "apple", "sovereign": 0, "boss": 0, "art_slot": "outlaw_icloud_photos", "monthly_cost": 3, "vendor": "Apple Inc.", "entity_type": "public", "jurisdiction": "US", "business_model": "hardware", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "google-workspace", "name": "Google Workspace", "platform": "web", "category_id": "productivity", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_google_workspace", "monthly_cost": 14, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "microsoft-365", "name": "Microsoft 365", "platform": "web", "category_id": "productivity", "vendor_id": "microsoft", "sovereign": 0, "boss": 0, "art_slot": "outlaw_microsoft_365", "monthly_cost": 13, "vendor": "Microsoft Corporation", "entity_type": "public", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud-office", "name": "Nextcloud Office", "platform": "web", "category_id": "productivity", "vendor_id": "nextcloud-gmbh", "sovereign": 1, "boss": 0, "art_slot": null, "monthly_cost": 0, "vendor": "Nextcloud GmbH", "entity_type": "private", "jurisdiction": "DE", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "asana", "name": "Asana", "platform": "web", "category_id": "project", "vendor_id": "asana", "sovereign": 0, "boss": 0, "art_slot": "outlaw_asana", "monthly_cost": 11, "vendor": "Asana, Inc.", "entity_type": "public", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nextcloud-deck", "name": "Nextcloud Deck", "platform": "web", "category_id": "project", "vendor_id": "nextcloud-gmbh", "sovereign": 1, "boss": 0, "art_slot": null, "monthly_cost": 0, "vendor": "Nextcloud GmbH", "entity_type": "private", "jurisdiction": "DE", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "trello", "name": "Trello", "platform": "web", "category_id": "project", "vendor_id": "atlassian", "sovereign": 0, "boss": 0, "art_slot": "outlaw_trello", "monthly_cost": 0, "vendor": "Atlassian Corporation", "entity_type": "public", "jurisdiction": "AU", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nest", "name": "Google Nest", "platform": "web", "category_id": "smarthome", "vendor_id": "google", "sovereign": 0, "boss": 0, "art_slot": "outlaw_nest", "monthly_cost": 0, "vendor": "Google LLC", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "ring", "name": "Ring (Amazon)", "platform": "web", "category_id": "smarthome", "vendor_id": "amazon", "sovereign": 0, "boss": 0, "art_slot": "outlaw_ring", "monthly_cost": 0, "vendor": "Amazon.com, Inc.", "entity_type": "public", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "facebook", "name": "Facebook", "platform": "web", "category_id": "social", "vendor_id": "meta", "sovereign": 0, "boss": 0, "art_slot": "outlaw_facebook", "monthly_cost": 0, "vendor": "Meta Platforms", "entity_type": "public", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "twitter", "name": "X (Twitter)", "platform": "web", "category_id": "social", "vendor_id": "x-corp", "sovereign": 0, "boss": 0, "art_slot": "outlaw_twitter", "monthly_cost": 0, "vendor": "X Corp.", "entity_type": "private", "jurisdiction": "US", "business_model": "advertising", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "netflix", "name": "Netflix", "platform": "web", "category_id": "streaming", "vendor_id": "netflix", "sovereign": 0, "boss": 0, "art_slot": "outlaw_netflix", "monthly_cost": 16, "vendor": "Netflix, Inc.", "entity_type": "public", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "kino-ai", "name": "Kino", "platform": "web", "category_id": "video", "vendor_id": "kino-ai", "sovereign": 0, "boss": 0, "art_slot": null, "monthly_cost": null, "vendor": "Kino AI", "entity_type": "private", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "teams", "name": "Microsoft Teams", "platform": "web", "category_id": "video", "vendor_id": "microsoft", "sovereign": 0, "boss": 0, "art_slot": "outlaw_teams", "monthly_cost": 0, "vendor": "Microsoft Corporation", "entity_type": "public", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "otter", "name": "Otter.ai", "platform": "web", "category_id": "video", "vendor_id": "otter", "sovereign": 0, "boss": 0, "art_slot": "outlaw_otter", "monthly_cost": 17, "vendor": "Otter.ai", "entity_type": "private", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "zoom", "name": "Zoom", "platform": "web", "category_id": "video", "vendor_id": "zoom", "sovereign": 0, "boss": 0, "art_slot": "outlaw_zoom", "monthly_cost": 16, "vendor": "Zoom Communications", "entity_type": "public", "jurisdiction": "US", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "whisper-api", "name": "OpenAI Whisper API", "platform": "web", "category_id": "voice", "vendor_id": "openai", "sovereign": 0, "boss": 0, "art_slot": "outlaw_whisper_api", "monthly_cost": 0, "vendor": "OpenAI", "entity_type": "private", "jurisdiction": "US", "business_model": "mixed", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null }, { "id": "nordvpn", "name": "NordVPN", "platform": "web", "category_id": "vpn", "vendor_id": "nord-security", "sovereign": 0, "boss": 0, "art_slot": "outlaw_nordvpn", "monthly_cost": 4, "vendor": "Nord Security", "entity_type": "private", "jurisdiction": "PA", "business_model": "subscription", "weighted_total": null, "grade": null, "policy": null, "infra": null, "weakest_dimension": null, "headline": null, "assessed_on": null } ], "assessments": [ { "id": "A-2026-10-29-SIGNAL-DESKTOP", "product_id": "signal-desktop", "version": "8.36.0-alpha.1", "source_commit": "5dad34ad5ea1a5b6229412e5c8ac0a696ff7532d", "assessed_on": "2026-10-29", "method_version": "btr-0.1", "reproducible_build": 1, "weighted_total": 76.4, "grade": "B", "weakest_dimension": "local_data_exposure", "headline": "The strongest transport on the internet, sitting behind the weakest desktop client we have scored.", "not_tested": "No live account was used. No packet capture was run (D1 to D4 not executed, this is a source audit only). Android and iOS clients not assessed. No attempt to verify the shipped .deb against a local rebuild." } ], "scores": [ { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "telemetry_egress", "value": 9, "rationale": "Zero analytics packages across 224 dependencies. Crash reporter started with uploadToServer:false. Only signal.org, support.signal.org, updates*.signal.org and sfu.voip.signal.org appear in source. Docked one point for update checks on launch and the megaphone channel, neither of which is telemetry but both of which are vendor-initiated contact.", "label": "Telemetry and egress", "weight": 25 }, { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "verifiability", "value": 6, "rationale": "Fully open source. Reproducible builds exist for Linux only, via Docker, and Signal labels them experimental and possibly non-functioning on public releases. macOS and Windows have none. Capped at 6 by the instrument rule.", "label": "Verifiability", "weight": 20 }, { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "server_retention", "value": 10, "rationale": "The published answer to a 2021 federal grand jury subpoena was registration date and last connection date. No messages, contacts, groups, profile or avatar exist server-side to hand over.", "label": "Server-side retention", "weight": 15 }, { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "ownership_jurisdiction", "value": 8, "rationale": "501(c)(3) nonprofit, EIN 82-4506840, no advertising and no data sale, so the incentive to surveil is absent rather than merely restrained. Docked for US jurisdiction and for early Open Technology Fund grant funding.", "label": "Ownership, jurisdiction, business model", "weight": 12 }, { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "local_data_exposure", "value": 5, "rationale": "Received attachments are stored unencrypted at ~/.config/Signal/attachments.noindex (CVE-2023-24069). The SQLCipher key lives in gnome-keyring, so anything running as the user can read db.sqlite. On this operator machine that means every agent process.", "label": "Local data exposure", "weight": 10 }, { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "dependency_surface", "value": 6, "rationale": "224 dependencies, Electron 45.0.0 pinned. Electron has produced CVEs enabling persistent backdoors in exactly this class of app. Update channel is a signed apt repo, which is the good part.", "label": "Dependency surface", "weight": 8 }, { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "user_control_exit", "value": 7, "rationale": "Registration still requires a phone number, though usernames and phone-number privacy now reduce the exposure. No practical encrypted export of message history in a portable format.", "label": "User control and exit", "weight": 5 }, { "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "incident_record", "value": 8, "rationale": "Roughly 15 CVEs under the signal vendor entry. In 2026 a large phishing campaign was widely reported as \"Signal hacked\"; the FBI and CISA PSA260626 state plainly that neither the app nor its encryption was compromised, and Signal published a precise correction within days and shipped additional linkage confirmations by 13 May 2026. Fast, accurate, independently corroborated incident handling. Not a 9 or 10 because the linked-device QR flow remained easy to phish for months, which is a design weakness even when the cryptography holds.", "label": "Incident record", "weight": 5 } ], "evidence": [ { "id": 55, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "local_data_exposure", "claim": "Attachments are stored unencrypted on the filesystem; the SQLCipher key is held by the OS keyring.", "tier": 1, "kind": "source", "artifact": "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/01-capture-sites.txt", "sha256": null, "observed_at": "2026-10-29T13:13:56-05:00" }, { "id": 56, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "telemetry_egress", "claim": "Electron media permission defaults to false and audio is denied unless the user has enabled mediaPermissions.", "tier": 1, "kind": "source", "artifact": "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/02-permissions.txt", "sha256": "0a64f213f3c241c1211dec56c0018d9220651c2550a7cf44609d586e74369cf2", "observed_at": "2026-10-29T13:13:56-05:00" }, { "id": 57, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "telemetry_egress", "claim": "Zero analytics, tracker or crash-upload dependencies across 224 packages.", "tier": 1, "kind": "source", "artifact": "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/05-dependencies.txt", "sha256": null, "observed_at": "2026-10-29T13:13:56-05:00" }, { "id": 58, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "telemetry_egress", "claim": "Only two audio capture call sites exist and both are reachable only from an explicit UI action.", "tier": 1, "kind": "source", "artifact": "00-Artifacts/2026/10-Oct/29/clu-big-tech-report/03-call-path.txt", "sha256": null, "observed_at": "2026-10-29T13:13:56-05:00" }, { "id": 59, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "verifiability", "claim": "Signal states reproducible builds for macOS and Windows are not available, and the Linux build is experimental.", "tier": 2, "kind": "record", "artifact": "https://github.com/signalapp/Signal-Desktop/blob/main/reproducible-builds/README.md", "sha256": null, "observed_at": "2026-10-29T13:13:56-05:00" }, { "id": 60, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "server_retention", "claim": "Grand jury subpoena response returned two timestamps and nothing else.", "tier": 2, "kind": "filing", "artifact": "https://signal.org/bigbrother/cd-california-grand-jury/", "sha256": null, "observed_at": "2026-10-29T13:13:56-05:00" }, { "id": 61, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "ownership_jurisdiction", "claim": "Signal Technology Foundation is a 501(c)(3) with EIN 82-4506840.", "tier": 2, "kind": "record", "artifact": "https://projects.propublica.org/nonprofits/organizations/824506840", "sha256": null, "observed_at": "2026-10-29T13:13:56-05:00" }, { "id": 62, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "incident_record", "claim": "FBI and CISA PSA260626: Russian intelligence compromised individual Signal accounts via phishing and Backup Recovery Key theft, but NOT the encryption or the application itself.", "tier": 2, "kind": "advisory", "artifact": "https://www.ic3.gov/PSA/2026/PSA260626", "sha256": null, "observed_at": "2026-10-29T15:26:00-05:00" }, { "id": 63, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "incident_record", "claim": "Signal statement, 28 April 2026: \"Signal was not hacked, in that our encryption, infrastructure, and the integrity of the app code was not compromised.\" Additional linkage confirmations shipped 13 May 2026.", "tier": 2, "kind": "record", "artifact": "https://x.com/signalapp/status/2048866663580246302", "sha256": null, "observed_at": "2026-10-29T15:26:00-05:00" }, { "id": 64, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "ownership_jurisdiction", "claim": "Open Technology Fund funded Open Whisper Systems $2,955,000 across 2013 to 2016, itemised on OTF own project page. This is the factual core under the \"US government funded Signal\" claim, and it is already reflected in the two points docked on this dimension.", "tier": 2, "kind": "record", "artifact": "https://www.opentech.fund/projects-we-support/supported-projects/signal-open-whisper-systems", "sha256": null, "observed_at": "2026-10-29T15:26:00-05:00" }, { "id": 65, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "dimension_id": "user_control_exit", "claim": "Signal publicly committed to leaving the UK (2023, Online Safety Act) and Sweden (Feb 2025) rather than weaken encryption. A vendor that threatens to lose a market is behaving incompatibly with a secret backdoor.", "tier": 2, "kind": "record", "artifact": "https://www.infosecurity-magazine.com/news/signal-exit-sweden-government/", "sha256": null, "observed_at": "2026-10-29T15:26:00-05:00" } ], "findings": [ { "id": 25, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "high", "title": "Received attachments are stored unencrypted on disk", "detail": "Every image and file received is readable by any process running as the user. On a machine running agent software under the same account, this is the most likely real-world exposure.", "status": "by_design", "cve": "CVE-2023-24069" }, { "id": 26, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "medium", "title": "No verified reproducible build for the Linux package", "detail": "The source is auditable; the shipped binary is not yet provably the same artifact. Until this closes, a source audit is evidence about the repository, not about the running process.", "status": "open", "cve": null }, { "id": 27, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "medium", "title": "Local database key is held in the OS keyring", "detail": "Any process running in the unlocked session can decrypt db.sqlite. There is no user-presence gate.", "status": "accepted", "cve": null }, { "id": 28, "assessment_id": "A-2026-10-29-SIGNAL-DESKTOP", "severity": "low", "title": "Registration requires a phone number", "detail": "Mitigated by usernames and phone-number privacy, but the account root remains a phone number.", "status": "accepted", "cve": null } ] }