Privacy & source protection

How we protect sources

• Separation. Who submitted a report is kept apart from what was reported. Public pages never link back to a confidential source.
• Least privilege. Only staff explicitly assigned to a case can access its materials, and every important action is logged.
• Private evidence. Files are stored privately, never publicly downloadable, and redacted before any part is published.
• Data minimization. We avoid collecting IP addresses, identity documents, and device fingerprints unless there is a clear need and a defined retention period.
• No third-party exposure. Confidential submissions are not put into analytics tools, advertising systems, error logs, or external AI services.
• Never for sale. We never sell source identities, raw evidence, or confidential submissions.

Identity verification

Where we verify identity, we aim to use a third-party provider that returns only the minimum result we need, such as “verified,” rather than storing copies of government IDs ourselves.

Before you share sensitive material

• Don’t use a work device, work network, or work email account.
• Remember that documents and photos can contain hidden metadata (authors, locations, timestamps).
• Think about who else had access to a document; that can narrow down who leaked it.
• Statutory whistleblower protections vary by jurisdiction and by who you report to.

Legal demands and incidents

We will have documented procedures for legal demands, security incidents, and notifying affected sources. We will publish an annual transparency report covering investigations, corrections, security incidents, and funding.

This page describes our principles. A full privacy policy reviewed by counsel will be published before we accept any reports.