Independent · Investigative · Accountable
Sign InSubscribe
Justice for One Justice for All
Home

Security

Security & Encryption

A transparent overview of the technical measures we use to protect your data and the anonymity of our sources.

AES-256 Encrypted Submissions

All whistleblower submissions are encrypted before storage. No plaintext submission content is ever written to disk.

Technical Security Measures

AES-256-CBC Encryption

Whistleblower submission content is encrypted using AES-256-CBC with a randomly generated initialization vector (IV) for each submission. The IV is stored alongside the ciphertext; the key is derived server-side and never exposed.

Server-Side Key Derivation

Encryption keys are derived from a server-side secret using SHA-256. The secret is stored as an environment variable and never committed to source code or logs. Key rotation can be performed without data loss.

Zero Plaintext Storage

Submission content is encrypted in memory before any database write operation. The database stores only ciphertext. Even direct database access cannot reveal submission content without the server-side key.

No Identity Linkage

Submissions are stored with only a random tracking ID, category, status, and encrypted content. No IP address, user ID, session token, or any other identifying field is stored alongside a submission.

Account & Session Security

  • ✓Passwords are hashed using bcrypt with a work factor of 12 before storage — plaintext passwords are never stored
  • ✓Sessions use secure, HTTP-only cookies with SameSite protection to prevent CSRF attacks
  • ✓Authentication is handled by BetterAuth, a battle-tested open-source authentication library
  • ✓All API endpoints that modify data require valid session authentication
  • ✓Session tokens are invalidated on sign-out

Transport Security

All traffic between your browser and our servers is encrypted in transit using TLS 1.2 or higher. We enforce HTTPS on all pages. Cookies are marked Secure and are only transmitted over encrypted connections.

Have a security concern or vulnerability to report? Contact our team through the secure submission portal.

Secure Submission Portal