Whistleblower guide
Practical checklist for sources. Adapt to your threat model — this is general guidance, not a substitute for professional operational security.
1. Assess your risk
Consider who might target you, what resources they have, and what happens if your identity is revealed. High-risk sources should consult specialized counsel and use air-gapped or live-boot environments (e.g. Tails).
2. Choose a safer network path
Prefer Tor Browser over clearnet. Avoid workplace networks, personal mobile data tied to your identity, and accounts that re-identify you. Use the official onion when published.
3. Sanitize materials
Remove names, employee IDs, and metadata from documents when possible. Enable image metadata stripping on the official deposit panel. Prefer scans or redacted exports over original office files.
4. Verify the destination
Compare the operator key fingerprint with at least one independent source. If fingerprints disagree, stop. A phishing clone can look identical but seal to a different key.
5. Deposit only on the official site
Open safedepositbox.org (or the onion) and use their Encrypt & Upload panel. Do not upload sensitive files through third-party mirrors or demos.
6. Retain the receipt offline
Copy the receipt JSON to offline storage. Use the official Status page later — do not email the receipt from a personal account.
7. Limits of this tool
SafeDeposit cannot protect a compromised device, physical surveillance, or coerced disclosure. It is not legal advice and does not guarantee publication or immunity.