Privacy and encryption

Who can read a conversation

New report text, replies, and attachment contents are encrypted using AES-256-GCM before upload. Attachment names and file details are included inside encrypted messages. The conversation key is wrapped for the organization using X-Wing, combining ML-KEM-768 and X25519, with HKDF-SHA-256 and AES-256-GCM. This hybrid construction is designed to resist quantum attacks on key exchange. It does not provide forward secrecy or protect a compromised device.

The server stores encrypted content. An organization's recipients use its private key to unlock a report in their browser; that key is not uploaded by this application. A reporter's secret return code also unlocks the conversation. Anyone with that code can read it and send reporter messages while access remains available. The service cannot recover a lost return code for you.

Recipients can copy or download the information they read. Their handling of those copies is outside this application's control. Browser encryption also depends on an uncompromised device, browser, and delivery of the site's code.

Organization accounts and payments

Owner email addresses, sign-in records, organization ownership and Stripe billing references are stored in US application storage, separately from your selected report-storage region. Cloudflare Email Service processes the address and message when delivering sign-in codes. Short-lived keyed address digests limit sign-in abuse; raw IP addresses are not retained by the application for this purpose.

Owner sign-in uses a secure session cookie lasting up to seven days. Sign-in codes expire after ten minutes. Stripe hosts payment and billing pages and processes payment details, invoices and billing contact information. The application retains subscription status and access dates, not card numbers or invoice contents. No report contents, reporter credentials or private decryption keys are sent to Stripe or in sign-in emails.

The recovery kit contains your private decryption key and recipient credential. Keep it securely: email sign-in restores account administration but cannot recover that key. Unfinished unpaid registrations are eligible for removal after seven days once payment status is confirmed. Cancellation or overdue billing pauses new reports; existing cases and follow-up retain their normal expiry.

What the service processes

Cloudflare hosts this site and its application storage. The application stores the destination organization, case and message identifiers, key identifier, wrapped encryption key, sender role, timestamps, case status, expiration, encrypted attachment identifiers, and ciphertext sizes. It stores a hash of the reporter's access token, not the secret return code. The derived access token is sent to the server to authorize follow-up requests.

These details can reveal when and how much you communicate. Cloudflare also processes network requests, including your IP address and request headers, to deliver and protect the service. Content encryption does not hide this network information from the hosting provider.

We do not add analytics, advertising trackers, session recording, third-party embeds, or remote font requests. Application observability logging is disabled in the project's deployment configuration; that does not mean infrastructure providers never process operational or security data.

Accounts, browser storage, and downloads

Reporters do not need an account or email address. Recipient access uses an organization-specific token sent over HTTPS. The server stores only its hash; the inbox keeps the token in page memory and clears it on lock or page exit, without authentication cookies. Signing in and possessing the decryption key are separate requirements for recipients to read a report.

Platform administrators use a separate session cookie that lasts 12 hours, or 7 days when they choose to stay signed in. It is restricted to the dashboard host and cannot be read by JavaScript. EU application storage holds a hash of the session identifier, a token hash used to check rotation, the issuing origin, and expiry. Signing out revokes that session; expired records are removed at subsequent sign-ins. The dashboard caches its static interface for offline loading, but does not save administration data for offline use.

By default, the application keeps drafts, return codes, and unlocked keys in page memory, not in localStorage. Closing or reloading a page can lose an unsent draft. Use the lock or clear control when finished. Locking clears page memory; encrypted offline data and queued sends remain until delivered, expired, or explicitly cleared. A theme preference is the only non-sensitive value this interface stores in localStorage when you choose a theme.

A service worker saves the static interface for offline use after a successful visit. IndexedDB stores encrypted conversation snapshots, downloaded encrypted evidence, and pending encrypted sends for up to 7 days, subject to known report expiration. Public organization configuration is cached for up to 24 hours. Offline copies can be out of date; deletion and access changes are checked when connected. Local expiration cleanup runs when the application or background sync runs.

Recipients can enable encrypted device recovery in inbox session settings. This saves reply drafts, their attachments, and read markers in IndexedDB, encrypted for the organization's private key. It does not save that key or the inbox access token. Unlocking with the matching key restores recovery for reports that have not expired. Disable recovery in session settings to delete its saved copy; browser storage may also be cleared or evicted. Locking alone does not delete saved encrypted recovery.

Pending reporter sends retain a report-specific access token so they can be delivered after the page closes when the browser permits. That token authorizes access to encrypted content and delivery; it does not decrypt the report. Return codes, private keys, and organization access tokens are never saved automatically. Recipient replies wait for the corresponding inbox to be unlocked. Cached conversation snapshots are additionally encrypted using a key derived from the access token; opening them still requires the original credentials.

Use “Clear saved reports and pending sends” under “Data on this device” to remove local conversation data and cancel pending sends. Close other tabs first. Requests already sent cannot be recalled. Browser storage can be evicted or disabled, and background delivery is not guaranteed. “Saved on this device” does not mean the server has confirmed delivery. Keep your return code and check for confirmation.

Saving a return code or downloading evidence creates a file on your device. Those files, clipboard contents, browser history, and any device or browser backups can remain after you close the page. The application cannot erase those copies.

Optional inbox notifications

Recipients can opt in to desktop push notifications for new reports and reporter replies. The push request has an empty application payload; the inbox service worker displays only “New message”. No report content, organization name, case identifier, or count is sent in that payload. The browser's push provider still processes a device subscription endpoint and delivery timing, and the operating system may display the website identity.

Subscription endpoints and push encryption keys are stored with the organization in its regional database. An EU coordination directory stores a hash of the device endpoint, random association identifiers and an expiry to prevent simultaneous inbox associations across regions. It does not store the endpoint, push keys or report content. Subscriptions expire after 90 days without authenticated renewal. Access-token changes invalidate them. Delivery jobs use opaque queue identifiers, expire after one hour, and are removed within 24 hours of creation. Regional storage does not mean that push delivery or request processing stays within that region.

Notifications continue while the inbox is locked or closed. Disable them in inbox session settings or the browser's site settings. No recipient access token or report decryption key is saved for notifications. Delivery is best effort; requests already sent cannot be recalled.

Retention and deletion

An organization chooses the retention period for new conversations, between 1 and 365 days; the default is 90 days from creation. The reporting form shows that period before submission. Replies and changes in case status do not extend the expiration date.

Expired cases become inaccessible immediately. Scheduled cleanup runs hourly to remove expired encrypted messages and attachments from application storage and retry incomplete removals. Authorized recipients can also delete a case before it expires; deletion removes application access immediately. Closing a case stops new messages but does not delete its existing content.

After deletion or expiration, a separate record retains the random case identifier for 30 days to prevent a delayed submission retry from recreating the case. This record contains no report content, organization identifier, or reporter access-token hash. Earlier versions of the reporting service are also subject to the organization's configured retention period, or the 90-day default.

Organization capacity accounting also keeps opaque operation hashes, request fingerprints, reserved amounts, and admission and expiry times in regional Durable Objects. Interrupted or deleted submissions do not refund these reservations: reports count for one rolling hour, and encrypted attachment bytes count until midnight UTC. Expired entries stop counting immediately and are removed during activity or by a cleanup alarm at the latest outstanding reservation expiry. Organization limits and their revision remain so restarts preserve accounting rules. This ledger contains no report text, filenames, access credentials, IP addresses, or private keys.

Deletion from application storage does not guarantee immediate erasure from provider backups or copies already downloaded by a reporter or recipient. Provider backup retention is governed by the provider's service settings and terms.

Privacy has limits

We do not guarantee anonymity, protection from retaliation, or that a recipient will act on a report. Your writing, evidence metadata, network, or a managed device may identify you. Share only the details you intend the recipient to receive, and consider the circumstances in which you access the channel.

This website does not claim ISO certification or guarantee GDPR or other legal compliance. Organizations are responsible for their reporting policies, access decisions, response processes, and applicable obligations. Review the receiving organization's own reporting information as well.

Questions about the service

For general privacy or setup questions, contactsupport.dshkls7hgzlud@undisclosed.report. Email is not the encrypted reporting channel. Do not send report content, return codes, evidence, or private keys to this address.

Open an existing conversation through your organization's reporting channel.