Scoreboard
What the live sites actually have
Automated probe of every public RM hostname on 2026-08-21, rendered in a real browser. It checks the trust surface that 02 Universal baseline makes mandatory: a real privacy page, a real terms page, /.well-known/security.txt, HSTS, CSP, clickjacking protection, X-Content-Type-Options, and the absence of banned claims on the landing page. Rerun with audit/probe.py then audit/render.py (see README in RM Orbit/Compliance).
How to read it
A "no" under privacy or terms means none of the usual paths (/privacy, /legal/privacy, /privacy-policy, /terms, /legal/terms, ...) rendered a distinct page with privacy or terms language. A page may exist at an unusual path or behind login; fix the path rather than the probe. Banned-claim detection only sees the public landing page, so claims inside authenticated screens (the Meet lobby E2EE text, for example) are not caught here and remain open in the app register.
Summary#
- Hostnames probed: 36. Reachable: 27. Down or unpublished: 9.
- Reachable sites with a real privacy page: 7 of 27. With a terms page: 7.
- With
security.txt: 2. With HSTS: 5. With CSP: 6. With clickjacking protection: 7. - Banned phrases on a landing page: 0.
Live sites#
| App | Host | Privacy | Terms | security.txt | HSTS | CSP | Frame | nosniff | Banned claims | Score /8 |
|---|---|---|---|---|---|---|---|---|---|---|
| Digitailor | home.digitailor.org | /legal/privacy | /legal/terms | no | yes | yes | yes | yes | none seen | 7 |
| MyJanata | myjanata.freedomlabs.in | /privacy | /terms | no | yes | yes | yes | yes | none seen | 7 |
| RM Health | health.freedomlabs.in | /privacy | /terms | no | no | yes | yes | yes | none seen | 6 |
| Gate SSO | sso.freedomlabs.in | no | no | no | yes | yes | yes | yes | none seen | 5 |
| RM Bills | bills.freedomlabs.in | no | no | no | yes | yes | yes | yes | none seen | 5 |
| RM Compliance | compliance.freedomlabs.in | no | no | no | yes | yes | yes | yes | none seen | 5 |
| Scribe | scribe.freedomlabs.in | /privacy | /terms | yes | no | no | no | no | none seen | 4 |
| Dwell | home.isdwell.com | /privacy | /terms | no | no | no | no | no | none seen | 3 |
| Folio | folio.freedomlabs.in | /privacy | /terms | no | no | no | no | no | none seen | 3 |
| RM Meet | meet.freedomlabs.in | no | no | no | no | no | yes | yes | none seen | 3 |
| Tulip | schools.freedomlabs.in | /privacy | /terms | no | no | no | no | no | none seen | 3 |
| AIBookly | aibookly.freedomlabs.in | no | no | yes | no | no | no | no | none seen | 2 |
| Atlas | atlas.freedomlabs.in | no | no | no | no | no | no | no | none seen | 1 |
| Authenticator | auth.freedomlabs.in | no | no | no | no | no | no | no | none seen | 1 |
| Chronos Calendar | calendar.freedomlabs.in | no | no | no | no | no | no | no | none seen | 1 |
| DuoFlow Dx | pharma.freedomlabs.in | no | no | no | no | no | no | no | none seen | 1 |
| Gate Admin | admin.freedomlabs.in | no | no | no | no | no | no | no | none seen | 1 |
| Lakshmi | lakshmi.freedomlabs.in | no | no | no | no | no | no | no | none seen | 1 |
| Planet | planet.freedomlabs.in | no | no | no | no | no | no | no | none seen | 1 |
| RM Drive | drive.freedomlabs.in | no | no | no | no | no | no | no | none seen | 1 |
| RM Fonts | fonts.freedomlabs.in | no | no | no | no | no | no | no | none seen | 1 |
| RM Mail | mail.freedomlabs.in | no | no | no | no | no | no | no | none seen | 1 |
| RM Music | music.freedomlabs.in | no | no | no | no | no | no | no | none seen | 1 |
| RM Pharma screening | healthtest.freedomlabs.in | no | no | no | no | no | no | no | none seen | 1 |
| RM Sign | sign.freedomlabs.in | no | no | no | no | no | no | no | none seen | 1 |
| Research | research.freedomlabs.in | no | no | no | no | no | no | no | none seen | 1 |
| Writer | docs.freedomlabs.in | no | no | no | no | no | no | no | none seen | 1 |
Down or unpublished#
| App | Host | What the probe saw |
|---|---|---|
| CoParent | coparent.freedomlabs.in | No DNS record: hostname reserved in PORTS.md but never published on the tunnel |
| LegalOS | legalos.freedomlabs.in | 502 from the edge: hostname published, origin not listening (service down or port moved) |
| Merit | merit.freedomlabs.in | No DNS record: hostname reserved in PORTS.md but never published on the tunnel |
| Nest | chat.freedomlabs.in | No DNS record: hostname reserved in PORTS.md but never published on the tunnel |
| RM Cloud console | cloud.freedomlabs.in | 502 from the edge: hostname published, origin not listening (service down or port moved) |
| Rollout | rollout.freedomlabs.in | 502 from the edge: hostname published, origin not listening (service down or port moved) |
| Imprint | architect.freedomlabs.in | No DNS record: hostname reserved in PORTS.md but never published on the tunnel |
| Learn | learn.freedomlabs.in | 403: Vite dev-server host check or an edge rule is refusing the public hostname |
| RM Designs | designs.freedomlabs.in | No DNS record: hostname reserved in PORTS.md but never published on the tunnel |
What to fix first (in order)#
- Trust pages on every reachable product. Orbit apps can link the suite notices at /legal/orbit/ instead of writing their own. Nineteen live sites have no privacy or terms page at a standard path. CalOPPA, DPDP, UK GDPR Article 13, and the app stores all require a published notice. Use the templates in 07 and serve them at
/legal/privacyand/legal/terms; SPAs can ship them as static HTML frompublic/. /.well-known/security.txteverywhere. Zero sites have one. It is a static file; the template is in 07.- HSTS and CSP. Cloudflare can add HSTS at the edge for all
*.freedomlabs.inhostnames in one setting; CSP is per app and is already done in Digitailor, RM Bills, MyJanata, Gate SSO, RM Health, and this site. Copy the pattern (app-level middleware or a Vite preview plugin, since nginx needs root here). - 502s are availability incidents. LegalOS, RM Cloud console, and Rollout are published but dead. RM Cloud console is client-facing: clients who hit a 502 on their billing console are an SLA event. Check the supervisors and
orbit-portsowners. - Unpublished hostnames. CoParent, Merit, Nest, Imprint, and RM Designs are reserved in PORTS.md but have no DNS. Either publish them deliberately (with trust pages first) or mark them internal in PORTS.md so nobody assumes they are live.
- Learn returns 403. A documentation portal that refuses its own public hostname is a Vite
allowedHostsor preview misconfiguration (the same class RM Bills hit).
Known limits of the probe#
- It does not log in, so authenticated screens, in-app consent flows, and cookie banners are not assessed.
- Privacy and terms detection is keyword based; a page in another language or at a non-standard path is reported as missing.
- Header checks read the response for
/only. - It does not judge content quality. A privacy page that exists but omits Indian storage, transfer tools, sub-processors, or the grievance officer still fails 02 I.