What happens to your words and files after you press “Encrypt and send”, and who can read them.
Step by step
- Your browser makes a new key. A random key is created on your device, for this submission only.
- Everything is locked with it. Your text, your choices about publishing, your contact details if you give any, and every file and its name are encrypted in your browser before they leave it.
- The key is locked for the editors. The key itself is then locked with the editors' public key. A public key can only lock. Opening needs the matching private key, which only the editors hold.
- Our server stores what it cannot read. It checks that the form was sent by a person and not a spam bot, then stores the locked text in its database and the locked files in private storage that has no public address. It has no key that can open them.
- You get a receipt code (keeping it is optional). The server makes a random code and shows it to you once. It keeps only a fingerprint of the code, enough to recognise it but not to show it again. Keeping the code is optional: with it you can add more material to the same submission later. A submission cannot be withdrawn or changed once sent.
Who can read it
Only the editors of this site, who hold the private key that opens submissions. That key is never on our server: an editor loads it into their own browser only while reading submissions, and it is forgotten when they lock or close the page.
Nobody else can read what you send: not our hosting provider; not anyone watching your internet connection; not someone who breaks into our server or its database.
What our server can see
Encryption hides what you wrote, not the fact that something was sent. The server can see:
- when your submission, and anything you add later, arrived;
- which kind you chose: your experience, a case, or evidence;
- how many files you sent, and the size of each file and of the encrypted text, which roughly shows how long they are;
- the fingerprint of your receipt code.
It does not store your IP address, and request logging is switched off.
What “anonymous” means here
- You don't need an account, and you don't have to give your name.
- The only contact field is optional, and it is encrypted with everything else.
- We don't store your IP address. Our hosting provider, which also runs the anti-spam check, still sees it when you connect, and our server uses it for a moment to limit how often one connection can send.
Before anything is published
- Nothing you send is published automatically. The editors read and check it first.
- Your account is published only if you allowed it, and never with more of your name than you chose. A published account shows the month it was received.
- The identities of survivors, their families and anonymous sources are taken out of accounts and blacked out in documents before publication. What a document shows about abuse or cover-ups is not blacked out: that is what the record is for.
- Every published file is cleaned of hidden data: no author, device, location, software or edit history. Photos are re-saved from their pixels. PDFs are rebuilt from an image of each page, so hidden text and earlier versions cannot survive.
- The editors' private notes, such as sources and contact details, are never published.
Technical details
- Cryptography runs in your browser with libsodium.
- Each submission gets a random 256-bit key. Separate subkeys for the text and for files are derived from it with crypto_kdf (BLAKE2b), so the two never share a key.
- Text: XChaCha20-Poly1305 (IETF AEAD) with a random 192-bit nonce. The encrypted message holds the form fields, consent choices, optional contact and the file list (names, types, sizes).
- Files: crypto_secretstream_xchacha20poly1305 in authenticated 64 KiB chunks; a final tag detects truncation.
- Key wrapping: the submission key is sealed to each editor public key with crypto_box_seal (X25519 with a throwaway key pair, XSalsa20-Poly1305). The editors' public key is built into this page.
- Anything added later with a receipt code is encrypted with a new key in the same way.
- Receipt code: 26 characters (130 random bits) made by the server; only its SHA-256 hash is stored.
- Storage: a database for the encrypted text and a private file store for encrypted files, both holding only ciphertext. The rate limit is keyed on the connecting IP inside the host's rate limiter and is not stored; the anti-spam token is verified without sending your IP.
- Script integrity: every script file the form loads is pinned with a SHA-384 hash in an import map, so browsers that support import-map integrity refuse altered files. The Content Security Policy only allows scripts from this site and the anti-spam check. This protects against swapped script files, not against someone who takes over the site and changes the page itself, which is why the hashes are published: form script hashes.