generated: '2026-08-28'
method: searched
source: https://freetts.org/developers
also_read:
- https://freetts.org/privacy
- https://freetts.org/terms
- https://freetts.org/llms.txt
- probed live responses from https://freetts.org/api/*
note: >-
  No OpenAPI exists for this provider, so every assertion below is read from the
  provider's own documentation or from a live probe, and each carries its
  evidence. Nothing is inferred from a spec, because there is no spec.
standards:
- id: ssml
  name: W3C Speech Synthesis Markup Language (SSML) 1.1
  conforms: true
  evidence: >-
    /developers technical notes: "You can pass raw SSML if you set the text
    field to a complete SSML document. Useful for multi-voice conversations,
    pauses, or emphasis." The FAQ "Can I use SSML for pauses, emphasis and
    multiple voices?" repeats it and adds that PRO has a dedicated SSML endpoint
    with validation. llms.txt does not mention SSML in its API quick start.
  domain_standard: true
  note: >-
    This is the domain-standard signature for the speech-synthesis market: a
    caller who already writes SSML for Azure, Polly or Google Cloud TTS can
    reuse those documents here without a bespoke connector. No SSML version is
    named and no supported-element subset is published, and there is no
    documented endpoint for the "dedicated SSML endpoint with validation" the
    FAQ mentions, so the claim is real but unspecified.
- id: srt
  name: SubRip (.srt) subtitle format
  conforms: true
  evidence: >-
    GET /api/srt/{file_id} returns a SubRip document; /developers publishes a
    verbatim sample with word-level cues (00:00:00,000 --> 00:00:00,620). The
    404 shape was confirmed live as {"detail":"SRT not found"}.
  domain_standard: true
  note: >-
    Word-level timestamps are described as converted from Microsoft viseme data.
    /srt (the marketing page) also advertises VTT download, but no VTT endpoint
    is published on /developers.
- id: microsoft-neural-voice-naming
  name: Microsoft neural voice ShortName convention (locale-NameNeural)
  conforms: true
  evidence: >-
    Live GET /api/voices returns 1,410 objects using Microsoft's own field
    names - Name, ShortName, Gender, Locale, LocaleName, SuggestedCodec,
    FriendlyName, Status, VoiceTag - so a client written against Azure Speech's
    voice list can consume this endpoint nearly unchanged.
  domain_standard: true
- id: bcp47
  name: BCP 47 language tags
  conforms: true
  evidence: >-
    Every voice object's Locale field is a BCP 47 tag (af-ZA, en-US, zh-CN,
    ar-SA), and voice ShortNames embed it.
- id: rfc9457
  name: RFC 9457 Problem Details for HTTP APIs
  conforms: false
  evidence: >-
    Probed error bodies are the FastAPI default {"detail":"..."} with
    Content-Type application/json, not application/problem+json. See
    errors/freetts-problem-types.yml.
- id: oauth2
  name: OAuth 2.0
  conforms: false
  evidence: >-
    API-key-only. /.well-known/oauth-authorization-server and
    /.well-known/oauth-protected-resource both 404.
- id: oidc
  name: OpenID Connect
  conforms: false
  evidence: >-
    /.well-known/openid-configuration returns 404. Sign-in on the website uses
    Google (accounts.google.com appears in the site CSP form-action and
    frame-src) and Supabase, but no OIDC surface is exposed to API consumers.
- id: rfc9116
  name: RFC 9116 security.txt
  conforms: false
  evidence: /.well-known/security.txt 404, /security.txt 404
- id: rfc8594
  name: RFC 8594 Sunset header
  conforms: false
  evidence: no Sunset or Deprecation header on any probed response
- id: ratelimit-headers
  name: IETF RateLimit header fields
  conforms: false
  evidence: >-
    A live 200 from GET /api/voices carried no RateLimit-*, X-RateLimit-* or
    Retry-After header.
- id: pagination
  name: any documented pagination convention
  conforms: false
  evidence: GET /api/voices returns all 1,410 voices in one unpaginated response
- id: idempotency
  name: idempotent write semantics
  conforms: false
  evidence: no Idempotency-Key or equivalent documented; see conventions/
- id: cors
  name: W3C CORS
  conforms: false
  evidence: >-
    /developers states the API does not emit CORS headers and directs browser
    callers to proxy server-side.
regulatory_claims:
- id: gdpr
  name: EU General Data Protection Regulation
  status: claimed
  certification: none
  evidence: >-
    The privacy policy has a "Your Rights Under Privacy Laws" section naming
    GDPR and CCPA and answering right-to-know / right-to-delete, and states
    servers are Hetzner in Falkenstein DE with EU data staying in the EU.
    llms.txt says "GDPR-friendly hosting in Germany".
  note: >-
    A self-published privacy posture, not an audited program. Recorded as
    claimed.
- id: ccpa
  name: California Consumer Privacy Act
  status: claimed
  certification: none
  evidence: named in the same privacy-policy section
- id: eaa-en301549
  name: European Accessibility Act / EN 301 549
  status: subject-matter-only
  certification: none
  evidence: >-
    FreeTTS publishes a substantive German-language guide
    (/blog/bfsg-vorlesefunktion-barrierefreiheit) arguing that a read-aloud
    button does NOT make a site BFSG/EN 301 549 compliant. This is editorial
    content about the regime, not a conformance claim about FreeTTS itself, and
    it is recorded here only so the accessibility tag is not mistaken for a
    compliance posture.
certifications_published: []
compliance_program_published: false
note_on_compliance_pointer: >-
  No `Compliance` pointer is emitted. FreeTTS publishes no SOC 2, ISO 27001,
  PCI, HIPAA or FedRAMP attestation, no trust center, no DPA and no
  sub-processor list - probe-security-programs.py found neither a vulnerability
  disclosure program nor a trust center. What exists is a plain-language privacy
  policy, which is already pointed at by the PrivacyPolicy property.