Whistleblowing channel

An encrypted drop box for whistleblowers, journalists and internal audits; the reporter does not need you to be online.

Key facts

• Encrypted in the reporter’s browser with the organisation’s public key (ECDH P-256 + HKDF + AES-256-GCM); the private key stays with the organisation.
• The server only keeps encrypted content, with no IP address and no cookie.
• EXIF/GPS metadata and PDF properties are removed in the browser, with a warning if a file could not be cleaned.
• A follow-up key shown once to the reporter: status, replies and additions with no account or e-mail.
• Designed with the EU Whistleblower Directive and the French Sapin II law in mind (design intent, not a compliance certification).

Good to know

• To hide their IP address from the network (ISP), reporters should use Tor Browser.

How to

1. The organisation opens https://filenymous.eu/app/#report-new and creates its channel (private key protected by a passphrase).
2. It publishes the reporting link.
3. It reads the encrypted reports in its inbox and replies.

All features

• Direct file transfer
• Dropzone (receive files)
• One-time secret
• Sharewall (ephemeral live wall for humans and AI agents)
• Streamed sharing (video and audio)
• npm CLI “filenymous” (CI/CD)
• Browser extension (Chrome, Firefox)

Updated 2026-10-19