# RM Compliance Prompt

You are working on a product built by Rang & Mall Private Limited (an Indian company, servers in India, users worldwide, paying customers mainly in the US, UK, and India). Before you build or fix anything, obey the rules below. They are the compact form of the master playbook at https://compliance.freedomlabs.in (raw markdown: https://compliance.freedomlabs.in/llms.txt). When the app you are touching is named in the app register, open its entry and its domain modules first: https://compliance.freedomlabs.in/playbook/04-app-register.md and https://compliance.freedomlabs.in/playbook/03-domain-modules.md. Machine-readable register: https://compliance.freedomlabs.in/apps.json.

## Operating facts

- Legal entity: Rang & Mall Private Limited, Visakhapatnam, Andhra Pradesh (GST state code 37). Operator identity in internal UIs is "Rang & Mall"; customer-facing products show only "An R&M Product".
- Data lives in India. India has no UK or EU adequacy decision. UK and EU users' data needs contractual transfer tools (UK IDTA or Addendum, EU SCCs) and the privacy notice must say data is stored in India.
- Obligations follow the user's region, never the server. Every account carries a region tag (IN, US-state, UK, EU-country, OTHER) that drives consent UX, tax, cancellation rights, disclaimers, and breach clocks. Unknown region gets the strict path.
- Regimes that always apply: India DPDP Act 2023 and Rules 2025 (build as if in force), IT Act and SPDI Rules, CERT-In Directions (6-hour incident reporting, 180-day logs in India), IT Rules 2021 for anything hosting user content, Consumer Protection Act and the dark-patterns guidelines, GST. US: FTC Act section 5, CAN-SPAM, TCPA, COPPA, CalOPPA, state breach laws, FTC Health Breach Notification Rule, Washington My Health My Data, BIPA, ESIGN. UK: UK GDPR and DPA 2018, PECR, Online Safety Act, Consumer Contracts Regulations, DMCC Act, UK VAT on digital services. EU when an EU user appears: GDPR, ePrivacy, AI Act Article 50, OSS VAT.
- AI is local Ollama by default. Cloud LLMs only where the app register lists an approved exception (Scribe, Research, Merit, AIBookly managed mode, Imprint, Nimitra, OrbitShell). Breaking a local-only promise is deception.
- Outbound mail is Resend from rmmail.in only, 100 per day shared across all apps; expect 429 and keep a copy-link fallback.

## Red lines (reject the change if it crosses one)

1. Never claim a security or privacy property the code lacks: no "end-to-end encrypted", "HIPAA compliant", "GDPR compliant", "bank-grade", "zero-knowledge", "SOC 2" unless literally true and evidenced. "Encrypted in transit and at rest" is the honest phrase.
2. Never fabricate social proof: no invented customers, logos, ratings, testimonials, uptime, usage numbers, or results. Every number needs a denominator and a period.
3. Never store card numbers, CVVs, or bank credentials. Hosted fields and tokens only (Stripe, Razorpay). Never hold or route money that belongs to someone else; use Stripe Connect or Razorpay Route.
4. Never send personal data or user content to a cloud AI from a local-only app. Never train on user data without separate explicit consent. Never use children's data for ads, profiling, or training.
5. Never let AI decide alone on medical, legal, immigration, financial, employment, housing, child-safety, or content-removal outcomes. AI drafts, a human approves, the UI says so.
6. Never commit secrets. Env files mode 600 or systemd drop-ins. Rotate anything that ever touched git.
7. Never build a dark pattern: no pre-ticked consent, confirm-shaming, hidden cancellation, fake countdowns, drip pricing, or forced accounts to see a price. Cancellation takes no more steps than signup.
8. Never collect a field no code uses. Never log passwords, tokens, card data, health data, message bodies, or children's data.
9. Never automate against a third-party platform beyond what its official API and terms allow (LinkedIn, X, YouTube, Indeed, job boards, ATS vendors) without a written exception in the app register.
10. Never invent facts in AI output: citations, statutes, cases, statistics, prices, people, references must be verified against a source or dropped.

## Defaults you must implement

- Privacy: a data map per app (field, class P0/P1/P2, purpose, retention, location, processor). P0 (health, sex life, biometrics, children, immigration status, financial accounts, precise location, religion or caste, criminal history, government IDs, credentials, message content, recordings) gets its own consent checkbox, encryption at rest, access logging, exclusion from analytics and prompts, and a short retention.
- Consent ledger: who, which text version, when, how, and withdrawal time. Marketing consent is never bundled with terms.
- Rights in settings without a ticket: export, correct, delete, withdraw consent, complain. Identity-verify first. 30-day service.
- Retention defaults: logs 180 days; invoices 8 years; account data life plus 30 days; recordings 90 days; uploads until deleted; backups 30 daily and 12 monthly with deletion propagation.
- Security: OWASP ASVS L2. Gate SSO with PKCE; passwords min 8, breached-list check, argon2id or bcrypt, no forced rotation; MFA available to all and enforced for admins; httpOnly Secure SameSite cookies; server-side authorisation on every object (tenant scoping at the query layer, row-level security with session context reapplied after commit); CSRF on cookie sessions; CORS allow-lists; CSP and security headers set by the app; SSRF guards on server-side fetches; rate limits on auth, OTP, reset, public forms, share links; no state-changing GET; path containment for any filesystem path from a request; uploads sniffed, capped, stored outside web root, re-encoded; dependencies pinned and scanned; TLS 1.2 plus; backups encrypted and off-box with tested restores; security.txt on every public host.
- AI: disclose AI where output appears and at chat start; human approval before publishing, sending, filing, or changing a health plan; prompts in the repo with adversarial tests; model output is untrusted input (never executed, never rendered unsanitised); deterministic safety filters after the model for self-harm, emergencies, child safety, violence; companion-style bots have a self-harm protocol and block minors; label generated media; no emotion inference, biometric categorisation, or manipulation.
- Communications: transactional and marketing are separate streams; marketing needs consent by region (PECR opt-in or soft opt-in, DPDP consent, CAN-SPAM opt-out, CASL express consent); one-click unsubscribe (RFC 8058); postal address and sender identity in every commercial email; shared suppression list enforced at the send path; SMS to India through DLT-registered templates; US texts with TCPA consent and STOP; daily send caps with a kill switch.
- Payments and subscriptions: all material terms on one screen before the button (price, tax treatment, period, renewal, trial end, how to cancel); receipts; refunds policy; UK and EU 14-day cancellation with waiver for instant access; renewal reminders; webhooks signature-verified and idempotent; GST 18 percent domestic, exports zero-rated under LUT, UK and EU VAT with number validation for B2B, US sales tax when nexus triggers; only RM Bills issues numbered invoices; in-app digital purchases follow Apple and Google billing rules.
- Content hosting: DMCA agent and takedown page, IT Rules grievance officer (24-hour acknowledgement, 15-day resolution), Online Safety Act reporting path, CSAM reporting path, malware and hash scanning on upload, share links expire by default, statement of reasons on removal.
- Accessibility and copy: WCAG 2.2 AA; keyboard and screen-reader pass per release; short declarative sentences; no em-dashes; no emoji in product copy; no jargon in consent text; no content that exists only behind a script that can fail.
- Trust pages on every public product: privacy, terms, cookies (UK and EU), refunds (if charging), sub-processors, DPA (business), grievance officer (India), AI page, accessibility, security with security.txt, DMCA (uploads), retention, children statement (18 plus unless designed for children).
- Incident clocks: CERT-In 6 hours; DPDP Board and principals immediately then 72 hours; ICO 72 hours; FTC HBNR and US states up to 60 days; contracts 24 to 72 hours. Region tags must make affected users queryable in minutes.

## Domain triggers (open the module before touching these)

- Health, wellness, body metrics, food photos, HealthKit or Health Connect, symptom or test-strip interpretation: module M1 and M1b. No diagnosis, no drugs, deterministic eating-disorder and red-flag guardrails, no coaching for under-18s, HBNR and Washington MHMDA obligations, medical-device law if software interprets tests.
- Children, students, parents, schools: M2. Under-18 parental consent in India, no tracking or ads, schools are the fiduciary and we are the processor, no cross-school training, POCSO escalation, no mandatory Aadhaar, fees settle to the school through a licensed aggregator.
- Legal, immigration, petitions, contracts advice: M3. Not a law firm; Texas 81.101(c) style disclosure in the UI; cite real authority with dates; no outcome promises; never inflate a record; attorney hand-off.
- Money, invoices, ledgers, trading signals: M4. Never an aggregator or wallet; tax math tested; immutable numbering; SEBI registration before any external research output.
- Mail, chat, meetings, file sharing, civic reports: M5. Intermediary duties; recording consent and indicators by region; server-side host controls; no E2EE claims without E2EE; tracking notices on data rooms; law-enforcement request policy.
- Music, video, books, generated media: M6. RM Music stays private household-only (unlicensed YouTube path); label synthetic media; no voice or likeness cloning; verified references; AI disclosure for KDP and journals.
- E-signature and evidence exports: M7. Region-specific signature level statements; ESIGN consumer consent; India First Schedule exclusions; BSA 2023 section 63 (never the repealed Evidence Act) with a human custodian signature; PAdES-LTV and RFC 3161.
- Job applying, recruiting, candidate data: M8. User approves each submission; never infer protected-class, work-authorisation, legal-name, or criminal-history answers; H-1B claims only from DOL LCA data with case numbers; platform terms per channel; Google restricted scopes need verification and CASA; execution stays on the user's device.
- Hosting clients: M9. CERT-In 5-year KYC and 180-day logs; DPA with every client; tenant isolation; off-site tested backups; no unmeasured uptime claims.
- Social publishing and outreach: M10. Official APIs only; per-customer encrypted tokens; customer approval before publish; endorsement disclosure; no fake reviews or engagement; B2B email with opt-out and suppression.
- Subscriptions and app stores: M11. Pre-purchase disclosure, easy cancel, store billing rules, in-app account deletion, Data Safety and App Privacy labels that match the code.
- Astrology and belief products: M12. Entertainment and reflection positioning by region; no remedies, no death, disease, fertility, or marriage-veto outputs; explicit consent for religion or caste; AI-forward persona.
- Research and publishing: M13. AI is never an author; disclose assistance; verify every reference; human-subjects consent; confidential manuscripts.
- Government and defence: M14. CERT-In empanelled audit before go-live; GIGW 3.0; Hindi and English; Official Secrets handling of station data (never in public repos or cloud prompts); zero-PII stays zero-PII.
- Housing: M15. Fair Housing and FCRA adverse-action flows; no cross-landlord pricing; state-aware templates with a counsel note.
- Identity and secrets: M16. Key rotation with JWKS overlap; consent screens; audit logs; phone-only approval tokens for push MFA; vault secrets never in logs.

## Before you finish

Run the ship gate (https://compliance.freedomlabs.in/playbook/05-ship-gate.md) and print the COMPLIANCE GATE block: data, claims, ai, auth, comms, money, content, region, tests, open. If the product is inside the SOC 2 scope (Gate, Mail, Drive, Meet, Writer, Sign, Bills, RM Cloud), also obey https://compliance.freedomlabs.in/SOC2_PROMPT.md and print its SOC 2 GATE block after this one. If you are unsure whether a rule applies, say so in "open" rather than guessing. This prompt is engineering guidance, not legal advice; items marked counsel or verify in the playbook need a human.