# RM Compliance > Compliance master playbook for every Rang & Mall product (RM Orbit, RM Portfolio, RM External). Load PROMPT.md into any coding agent before building or fixing an RM app. Reviewed 2026-08-21. ## Start here - [The Prompt](https://compliance.freedomlabs.in/PROMPT.md): compact rules every tool must obey, with pointers into the playbook. - [App register (JSON)](https://compliance.freedomlabs.in/apps.json): per-app data classes, regimes, red flags, must-do list. ## Playbook - [RM Compliance Playbook](https://compliance.freedomlabs.in/playbook/00-readme.md): The single compliance source of truth for every product Rang & Mall Private Limited builds: the RM Orbit suite, RM Portfolio, RM External, and the standalone apps. It exists so that any engineer or AI coding tool can build or fix an RM app - [01 Jurisdictions: which law applies to which user](https://compliance.freedomlabs.in/playbook/01-jurisdictions.md): Rang & Mall is an Indian company with Indian servers and a global user base. Three legal systems matter every day (India, United States, United Kingdom), a fourth (the EU) matters whenever an EU user shows up, and a few others are handled b - [02 Universal baseline: rules every RM app obeys](https://compliance.freedomlabs.in/playbook/02-universal-baseline.md): These apply to every product, internal tool, prototype that touches real people's data, and every AI-assisted change. The [app register](/playbook/04-app-register) adds app-specific rules on top; it never subtracts from here. - [03 Domain modules: rules by the kind of thing you are building](https://compliance.freedomlabs.in/playbook/03-domain-modules.md): Pick the modules that match the app (the [app register](/playbook/04-app-register) names them per app). Each module adds to the [universal baseline](/playbook/02-universal-baseline). - [04 App register: every RM product, its data, its law, its red flags](https://compliance.freedomlabs.in/playbook/04-app-register.md): Ordered by compliance risk. Each entry lists what the app is, who uses it and where, the data classes it holds, the domain modules that apply, the red flags found in the live code or memory as of 2026-08-21, and the must-do list. The machin - [05 Ship gate: what a change must pass before deploy](https://compliance.freedomlabs.in/playbook/05-ship-gate.md): Use this as the last step of any PR or deploy on an RM app. It is written so an AI agent can self-check and print the answers. "N/A" is an acceptable answer only with a one-line reason. - [06 Incident and breach runbook](https://compliance.freedomlabs.in/playbook/06-incident-runbook.md): A breach is any unauthorised access to, disclosure of, alteration of, or loss of personal data or P0 content, including a misconfiguration that exposed data even if nobody is known to have read it, a leaked token, a lost laptop with access, - [07 Templates and copy blocks](https://compliance.freedomlabs.in/playbook/07-templates.md): Copy these into products. Keep the plain style: short sentences, no em-dashes, no emoji. Replace the bracketed fields. Anything marked counsel gets a lawyer's pass before it ships to paying customers. - [08 Open questions, counsel items, and the verify list](https://compliance.freedomlabs.in/playbook/08-open-questions.md): This is the honest list of what is not settled. Items move off this page only when a human closes them with a decision and a date. - [09 Scoreboard: what the live sites actually have](https://compliance.freedomlabs.in/playbook/09-scoreboard.md): Automated probe of every public RM hostname on 2026-08-21, rendered in a real browser. It checks the trust surface that [02 Universal baseline](/playbook/02-universal-baseline) makes mandatory: a real privacy page, a real terms page, `/.wel ## RM Orbit legal notices (suite-level, link these from Orbit apps) - [RM Orbit legal notices](https://compliance.freedomlabs.in/legal/orbit/index.md) - [RM Orbit privacy notice](https://compliance.freedomlabs.in/legal/orbit/privacy.md) - [RM Orbit terms of use](https://compliance.freedomlabs.in/legal/orbit/terms.md) - [RM Orbit sub-processors](https://compliance.freedomlabs.in/legal/orbit/sub-processors.md) - [How RM Orbit uses AI](https://compliance.freedomlabs.in/legal/orbit/ai.md) - [Cookies and tracking in RM Orbit](https://compliance.freedomlabs.in/legal/orbit/cookies.md) - [RM Orbit data retention](https://compliance.freedomlabs.in/legal/orbit/retention.md) - [RM Orbit security and vulnerability reporting](https://compliance.freedomlabs.in/legal/orbit/security.md) - [Grievance officer and data requests](https://compliance.freedomlabs.in/legal/orbit/grievance.md) - [RM Orbit accessibility statement](https://compliance.freedomlabs.in/legal/orbit/accessibility.md) ## SOC 2 program (controls, policies, gate) - [SOC 2 prompt](https://compliance.freedomlabs.in/SOC2_PROMPT.md): compact SOC 2 rules for coding agents; print the SOC 2 GATE block. - [SOC 2 program: what it is, what it is not, and how RM gets there](https://compliance.freedomlabs.in/soc2/00-readme.md): This section is the SOC 2 program for Rang & Mall Private Limited. It sits beside the [compliance playbook](/) and does not replace it. The playbook answers "is this lawful and honest". This section answers "can an independent auditor confi - [01 Scope: the system, the criteria, and what is inside the boundary](https://compliance.freedomlabs.in/soc2/01-scope.md): A SOC 2 report describes one **system**: the infrastructure, software, people, procedures and data that deliver a named service. The narrower and cleaner the boundary, the cheaper and more credible the audit. This page is the scope decision - [02 Control matrix: every control, mapped to the Trust Services Criteria](https://compliance.freedomlabs.in/soc2/02-controls.md): These are the controls the auditor will test. Each has an ID, the criteria it addresses (TSC 2017, revised points of focus 2022), an owner role from [00](/soc2/#owners), a frequency, the evidence it leaves behind, and the policy it rests on - [03 Roadmap: from today to a SOC 2 Type II report](https://compliance.freedomlabs.in/soc2/03-roadmap.md): Seven phases. Each has an exit test. Do not start the audit clock (Phase 5) until Phase 4 has run cleanly for a full month, because every miss inside the observation window becomes an exception printed in the report. - [04 Evidence calendar: what to capture, when, and where it lives](https://compliance.freedomlabs.in/soc2/04-evidence.md): An auditor tests a control by asking for its evidence. For a Type II, they pick samples across the window (for example, 25 changes, 3 quarterly access reviews, 2 monthly restore tests) and ask for each one. This calendar says what must exis - [05 SOC 2 gate: the change check for in-scope systems](https://compliance.freedomlabs.in/soc2/05-soc2-gate.md): Every change to a product inside the [SOC 2 scope](/soc2/01-scope) passes this gate in addition to the [compliance ship gate](/playbook/05-ship-gate). The compliance gate asks whether the change is lawful and honest. This one asks whether t - [06 System description (draft of report Section III)](https://compliance.freedomlabs.in/soc2/06-system-description.md): This is the draft of the description the auditor examines against the AICPA Description Criteria (DC 200). It is written by management, not by the auditor, and every statement in it is tested. Placeholders in square brackets are filled afte - [07 Vendor register](https://compliance.freedomlabs.in/soc2/07-vendors.md): Every organization that stores, processes, transmits, or can reach data or systems inside the [SOC 2 scope](/soc2/01-scope). The customer-facing sub-processor list in [legal/orbit/sub-processors](/legal/orbit/sub-processors) is a subset of - [10 Information security policy](https://compliance.freedomlabs.in/soc2/10-information-security.md): To protect the confidentiality, integrity and availability of customer data and of the systems that deliver Rang & Mall's services, and to meet the commitments made to customers. - [11 Code of conduct and acceptable use policy](https://compliance.freedomlabs.in/soc2/11-conduct-acceptable-use.md): 1. Act honestly with customers, colleagues and regulators. Do not make claims about our products that are not true of the code (see the [universal baseline](/playbook/02-universal-baseline) red lines). 2. Treat customer data as the customer - [12 People security and training policy](https://compliance.freedomlabs.in/soc2/12-people-security.md): 1. A written role description exists for every role with access to in-scope systems (GOV-07). 2. A confidentiality agreement or contract clause is signed before any access (GOV-05). 3. Background verification is completed for anyone who wil - [13 Access control policy](https://compliance.freedomlabs.in/soc2/13-access-control.md): Unique identity, least privilege, MFA, approval before access, removal on departure, and a regular review that actually changes something. - [14 Asset and data management policy](https://compliance.freedomlabs.in/soc2/14-asset-data-management.md): 1. The inventory lists every in-scope host, database, storage bucket, domain and hostname, repository, SaaS account, and endpoint device, with an owner, environment (production, staging, development), and data classification (ACC-01). 2. It - [15 Cryptography and key management policy](https://compliance.freedomlabs.in/soc2/15-cryptography.md): 1. **In transit:** TLS 1.2 or higher on every external connection and every connection that leaves a host (database replicas, backups, vendor APIs). HSTS on every public hostname (ACC-12). 2. **At rest:** production disks, databases, object - [16 Secure development and change management policy](https://compliance.freedomlabs.in/soc2/16-secure-development-change.md): 1. Development, staging and production are separate (CHG-06). Production hosts do not run development servers, experiments or interactive coding sessions. 2. Production data is not copied to development or staging unless masked, or under an - [17 AI coding agents policy](https://compliance.freedomlabs.in/soc2/17-ai-agents.md): Rang & Mall builds with AI coding agents. An agent with a shell can do anything its user can: read every secret on the host, restart production, change a database, push code. Auditors test whether every change and every privileged action be - [18 Operations security policy: logging, monitoring, vulnerabilities and patching](https://compliance.freedomlabs.in/soc2/18-operations-security.md): 1. Every in-scope system sends logs to the central log platform: OS authentication and sudo, SSH, audit daemon, firewall, web server and edge, application, database errors and connections, deploys (OPS-01). 2. Applications write an audit lo - [19 Network security policy](https://compliance.freedomlabs.in/soc2/19-network-security.md): 1. **Default deny inbound** on every production host and security group. The only inbound traffic allowed is from the edge (Cloudflare) to the application ports, and administrative access through the approved path (OPS-05, ACC-08). 2. **No - [20 Incident response policy](https://compliance.freedomlabs.in/soc2/20-incident-response.md): The legal notification clocks and the step-by-step first hours are in the [incident and breach runbook](/playbook/06-incident-runbook). This policy adds the SOC 2 requirements: classification, records, review, and testing. Where they overla - [21 Business continuity, disaster recovery and backup policy](https://compliance.freedomlabs.in/soc2/21-continuity-recovery.md): Set per service. Publish to customers only what the exercise has measured. - [22 Vendor management policy](https://compliance.freedomlabs.in/soc2/22-vendor-management.md): 1. **No vendor without a register entry.** Before a new SDK, API, SaaS tool, AI provider, relay, or contractor touches in-scope data or systems, it is added to the [vendor register](/soc2/07-vendors) with purpose, data, location and risk ti - [23 Risk management policy](https://compliance.freedomlabs.in/soc2/23-risk-management.md): 1. A risk assessment runs at least yearly and whenever there is a significant change: a new product in scope, a new vendor of High tier, a new region, a new data class, an infrastructure move, or a severity 1 incident (RSK-01, RSK-03). 2. I - [24 Physical and environmental security policy](https://compliance.freedomlabs.in/soc2/24-physical-security.md): 1. In-scope production runs in facilities operated by a subservice organization with its own SOC 2 Type II or ISO 27001 report covering physical access, environmental protection (power, cooling, fire, flood), and hardware disposal (ACC-15, - [25 Data retention and disposal policy](https://compliance.freedomlabs.in/soc2/25-retention-disposal.md): The retention schedule is the table in the [universal baseline](/playbook/02-universal-baseline#retention), which this policy adopts. An app register entry may set a shorter period for its product; it may not set a longer one without a docu ## Optional - [HTML site](https://compliance.freedomlabs.in/) for humans.