If a product says it is privacy first, offline first, trauma informed, or resilient, the hard question is not whether the copy sounds good.

The hard question is whether the system earns the claim.

That is what the Protective Legitimacy Score is for.

If you want privacy-first, offline health tech to exist without surveillance funding it: sponsor the build → https://paintracker.ca/sponsor

PLS is not a badge, not a certification, and not a compliance shortcut. It is a structural scoring method for checking whether a system's trust language is supported by architecture, defaults, failure behavior, and recovery paths.

The short version:

claims do not generate score

structure generates score

defaults matter more than marketing

graceful failure matters more than polished happy paths

If you want the doctrine underneath the score, start with the Protective Computing canon , then the live Protective Computing library .

Why this score exists

Modern software is full of protective language that collapses on…