Secure tip
If you have information about corruption, abuse of power or state-coordinated digital operations, we will read what you send. Before you choose a channel, the following is worth knowing.
No internet channel is perfectly secure. What follows are the available options, ordered from highest to lowest protection, with notes on what each one protects against and what it does not. You decide which one fits your situation.
Signal
Username:
SIGNAL_USERNAME_HERE
Show QR code
Scan with your phone camera — Signal will open a new conversation.
Signal encrypts messages end-to-end: only you and we can read them. For most situations, it is the most recommendable option. Our contact is a username, not a phone number — when you use it, your number is not shared with us. Before writing, turn on disappearing messages in the chat settings.
- Protects: the message content and attached files; your phone number is not shared with us.
- Does not protect: the fact that your Signal account contacted ours. Signal keeps minimal metadata on its servers, but an adversary with access to that information could see contact happened, even if not what was said.
PGP-encrypted email
Fingerprint:
52AB 017F 995E 9D74 9E79 B657 5C0B FE94 A8A1 0001
Send to:
[email protected]
If you know how to use PGP, encrypt the message against our public key before sending it by email. Check the fingerprint here against the one shown by the key: if they match, you are encrypting against the right key. If this page were compromised, a different fingerprint would be your only warning.
- Protects: the message content from anyone who intercepts the email in transit or reads it on the server.
- Does not protect: the email metadata (sender, subject, date). These travel unencrypted. If your email address identifies you, consider creating a new account for this purpose.
Practical advice
- If you handle the material at work, do not contact us from a work device, a work network, or a work VPN. Nor while connected to office WiFi.
- Consider sending the first message from a different physical location than where the information is kept.
- Do not include identifying details in the first contact. Before sharing names or documents, we can agree on a safer way to do it.
- If you use Tor Browser to open this page and then Signal or your email, do not mix sessions: closing the browser cleans traces on this end, but not on the conversation end.
- Do not forward documents directly from their original source (a work email, an internal repository). Move them to a separate device first, then send.
- If something looks wrong — a different PGP fingerprint, a Signal number that does not respond as expected, an odd reply — do not insist. Wait a day and return to this page to verify the details.
What we commit to
- Not to record data about sources beyond what the investigation strictly requires, and to delete what we do record once it is no longer needed.
- Not to share a source's identity with anyone outside the editorial team. This includes advertisers (we have none), institutional partners and lawyers, except by court order — in which case we will warn you beforehand if we can.
- To verify carefully what we receive before publishing. Your material does not automatically become a story.
- Not to use these channels for marketing, subscriptions or promotions. They are exclusively for editorial contact.