HecTec Labs rates devices and applications on privacy transparency and data sovereignty. The node is always live — its color tells you everything.
Signal Key
See real-time privacy threats, surveillance nodes, credential leaks, and botnet activity targeting your metro area — powered by open-source intelligence.
What we monitor
We never fingerprint, track, or monetize a visitor. The intellect is the funnel — the brand speaks for itself.
Sensitive data is anchored to iron you own and physically control — never surrendered to a rented cloud lease.
Three execution states enforce data custody structurally — not by policy, by topology. Patent filed 2025.
Architected for the law firms, medical offices, and family wealth offices that protect our community’s legacies.
For a bootstrapped B2B startup, copying the enterprise ad-tech playbook is financial quicksand. The case for Sovereign Marketing — deep research, technical transparency, and absolute data dignity — over rented attention.
Every action your agent takes is recorded in the vendor's vault, on the vendor's terms. You're renting your own history. So we built receipts for agents — signed, chained, on hardware you own — and published ours on a page that dares you to forge one.
A year ago I tried to take my own data out of Google and learned I was a tenant, not a customer. Now the companies that handed out the keys are changing the locks — and calling it safety. Tenant or owner?
For years, B2B marketing relied on a flawed playbook: collect personal data, route it through cloud brokers, and let third parties grade their own homework. It is a costly mistake.
Live Signal · Updated 2026-10-09
Each rating below is an editorial opinion grounded in cited public reporting, dated and methodology-bound. Click any card for the full Sovereign Beacon™ Grade Card on sovereignware.org — the canonical archive containing the full claim, named sources, methodology version, right-of-reply contact, and corrections log.
Editorial disclosure: opinion · cited · dated · methodology-bound · right-of-reply offered
Vivaldi Browser is rated green due to its strong commitment to user privacy, highlighted by its "zero-tracking policy" and explicit statement in its privacy policy (last updated December 15, 2023) that it "do[es] not share or sell information to any third party." The browser implements end-to-end encryption for its Sync service, meaning Vivaldi cannot decrypt user data such as passwords or browsing history. While a unique user ID and anonymized IP address (last octet removed) are sent daily for aggregate active user statistics, browsing activity remains local to the device. This privacy stance has been consistent, with Vivaldi's CEO criticizing Google's data practices as early as 2017, and the browser further enhancing protection with a built-in ad and tracker blocker by 2021.
Opinion · Cited sources · As of 2026-10-09
System76 demonstrates a strong commitment to user privacy, explicitly stating in its 2026 privacy policy update that it "does not sell your data." The company's Pop!_OS operating system, often pre-installed on its laptops, is designed with privacy in mind, featuring full-disk encryption by default since 2018 and implementing Network Time Security (NTS) for encrypted time synchronization by 2022. Furthermore, the policy states that "System76 does not collect or store any information from Pop!_OS user installations," with minimal OS and hardware data used only temporarily for updates and connectivity verification, and no telemetry or error reports collected. This commitment extends to hardware, as seen in 2017 when System76 announced its intention to disable the Intel Management Engine (ME) firmware due to security concerns. The company also publicly voiced concerns in 2026 regarding proposed age verification laws, arguing they could compromise user privacy.
Opinion · Cited sources · As of 2026-10-09
Ring is a significant privacy threat due to a history of severe security failures and internal misuse of customer data. In May 2023, the FTC filed a complaint, leading to a $5.8 million settlement in June 2023, for allowing employees unrestricted access to customer videos and failing to implement adequate security, enabling hackers to take control of accounts. This followed an acknowledgment in January 2020 of employees improperly accessing customer videos, with one employee viewing thousands of recordings in 2017. Furthermore, in December 2019, over 3,600 account credentials were leaked after hackers exploited vulnerabilities. While Ring's privacy notice (S0) states it collects "video or audio recordings, live video or audio streams" and claims to "maintain administrative, technical and physical safeguards," these incidents demonstrate a failure to protect this sensitive data. A class-action lawsuit in June 2026 also alleges the "Familiar Faces" feature collects biometric data without consent.
Opinion · Cited sources · As of 2026-10-09
Montana Senate Bill 375 (SB 375), passed in 2025, primarily regulates the sale of edible hemp products containing THC and does not contain specific provisions related to user privacy. While categorized as a privacy law, its technical mechanism focuses on product regulation rather than data collection, sharing, or retention. Unlike other Montana legislation such as the Montana Consumer Data Privacy Act (MCDPA) enacted in 2023, which establishes consumer rights regarding personal data, SB 375 does not address the collection, use, or protection of personal information. Therefore, it neither enhances nor diminishes user privacy, leading to a neutral impact in this category.
Opinion · Cited sources · As of 2026-10-09
Llama.cpp, despite its local-first design, poses a significant privacy threat due to numerous critical security vulnerabilities. For instance, in April 2024, a remote code execution (RCE) vulnerability (CVSS 9.6) was found in `llama-cpp-python` due to improper handling of chat templates, allowing arbitrary code execution. Furthermore, in April 2026, CVE-2026-34159 identified another critical RCE in the RPC backend, enabling unauthenticated attackers to read and write arbitrary process memory. The project's security policy explicitly warns users under "Data privacy" that "To protect sensitive data from potential leaks or unauthorized access, it is crucial to sandbox the model execution," and advises against using the RPC backend in untrusted environments, acknowledging the inherent risks. These vulnerabilities can lead to unauthorized data access and breaches if not properly mitigated by users.
Opinion · Cited sources · As of 2026-10-09
Startpage is a privacy-focused search engine that explicitly states it does not collect personal data for searches. Since 2009, it has not recorded IP addresses, and its policy confirms, "We don't record your IP address" and "We don't record your search queries." Technical mechanisms include anonymizing search queries before sending them to providers and using HTTPS encryption with SSL/TLS for all searches, a feature launched in 2011. Although acquired by System1 in 2019, Startpage maintains that its founders retain control over privacy implementations, and independent audits confirm its practices, including not building advertising profiles or selling personal data. A supplemental policy for accounts collects necessary billing and contact information, but explicitly states, "Having a Startpage account does not change how we treat your searches."
Opinion · Cited sources · As of 2026-10-09
X Corp. (formerly Twitter) has a history of privacy failures and a privacy policy that permits extensive data collection and sharing. In May 2022, Twitter agreed to a $150 million penalty with the FTC for misrepresenting that phone numbers and email addresses, collected for security, would not be used for advertising, a clear breach of trust. The current privacy policy (S0, effective January 15, 2026) explicitly states, "Based on your consent, we may collect and use your biometric information for safety, security, and identification purposes," and "We may collect and use your personal information (such as your biographical information, employment history, educational history...)" for job recommendations and sharing with employers. Furthermore, the policy allows sharing with "Third-party collaborators" who "may use it for their own independent purposes... including, for example, to train their artificial intelligence models." This broad data collection, coupled with past regulatory actions like the December 2020 GDPR fine for a data breach, demonstrates a significant threat to user privacy.
Opinion · Cited sources · As of 2026-10-09
The Delaware Personal Data Privacy Act (DPDPA), signed into law on September 11, 2023, significantly enhances consumer privacy by granting residents rights to access, correct, delete, and opt-out of the sale of their personal data, targeted advertising, and certain profiling activities. A key mechanism is the requirement for explicit consent to process "sensitive data," which broadly includes categories like racial origin, religious beliefs, health conditions, and status as transgender or nonbinary, as defined in § 12D-102(30) of the official text. The law, effective January 1, 2025, also uniquely applies to non-profit organizations. Further strengthening protections, House Bill 380, signed on September 2, 2026, lowers applicability thresholds and expands safeguards for minors, including prohibiting processing sensitive data of children under 13 without parental consent. While lacking a private right of action, enforcement is exclusively handled by the Delaware Department of Justice.
Opinion · Cited sources · As of 2026-10-09
BetterHelp has a history of sharing sensitive user data for advertising purposes. In March 2023, the Federal Trade Commission (FTC) settled with BetterHelp for $7.8 million over allegations that it shared consumers' health data, including email addresses, IP addresses, and health questionnaire responses, with platforms like Facebook and Snapchat between 2017 and 2020, despite promising privacy. While BetterHelp's current policy states, "To be clear, we don't share any data or information you share with your Therapist with any Third Party advertisers," and uses "industry-standard encryption technologies" (SSL) for data in transit, the past actions demonstrate a significant breach of trust. The policy also notes that if users opt-in to "Advertising cookies and web beacons," some "Visitor Data" (excluding therapy data) may be shared for advertising, which in California may be considered a "sale" of personal information. Furthermore, data like "Clinical Health Record" and communications are retained for 10 years after the last login if therapy was started and erasure was not requested.
Opinion · Cited sources · As of 2026-10-09
Microsoft Pluton, announced in November 2020, is a security processor integrated directly into the CPU, designed to protect credentials, identities, personal data, and encryption keys from physical attacks by eliminating the communication channel to a discrete TPM. This technical mechanism significantly enhances on-device security. Microsoft's privacy statement (S0) generally commits to "protecting the security of your personal data" and using "a variety of security technologies and procedures" including encryption. However, Microsoft's broader privacy record includes a June 2023 FTC fine for COPPA violations related to collecting children's data without consent, and a January 2024 disclosure of a corporate email system data breach. While Pluton offers robust hardware-level protection, these incidents highlight ongoing company-wide privacy and security challenges.
Opinion · Cited sources · As of 2026-10-09
Fathom Analytics is a privacy-first web analytics solution, designed for GDPR and ePrivacy compliance by not using cookies or fingerprinting for tracking (2019). It avoids persistent user profiles by generating site-specific visitor signatures using a daily rotating salt, IP address (stripped), and user-agent, without storing raw IP addresses. The privacy policy explicitly states, "We do not rent, buy or sell personal data from or to others," and "We process minimal personal data on your behalf" (IP address and User-Agent). In May 2020, Fathom undertook a comprehensive GDPR project, formalizing policies and appointing a Privacy Officer, and ensures EU visitor data is processed on European servers with IP addresses stripped within the EU. Data retention is limited to legal obligations.
Opinion · Cited sources · As of 2026-10-09
Acxiom, a data and marketing company, poses a significant threat to user privacy due to its extensive data collection and sharing practices. In 2002-2003, the company experienced a major data theft where 1.6 billion customer records were stolen from its FTP servers, highlighting severe security vulnerabilities. Its business model has repeatedly drawn scrutiny, including a 2003 complaint by EPIC to the FTC for sharing personal information without consent, and 2018 GDPR complaints by Privacy International alleging unlawful processing of data for profiling. The privacy policy, updated June 1, 2026, confirms its role in marketing data products, offering opt-out mechanisms for marketing and limiting sensitive personal information use, but this does not negate its fundamental practice of collecting and processing vast amounts of personal data for commercial purposes. Furthermore, a 2024 Bavarian data protection authority ruling implicated Acxiom in the alleged secret trading of personal data, and a 2026 lawsuit by the Texas AG alleged Netflix shared consumer profiles with data brokers like Acxiom.
Opinion · Cited sources · As of 2026-10-09