Submit a SecureDrop instance

Do not attempt to submit documents here. See the directory. This is for adding new SecureDrop instances to the directory.

We are happy to add new SecureDrop instances to the directory, as long as they meet the security requirements outlined in our documentation.

By submitting an instance to the directory, you agree to the following:

Freedom of the Press Foundation may keep your contact information on file, and reach out to you in case we have questions about your SecureDrop instance.
Freedom of the Press Foundation may perform routine, automated tests against your SecureDrop .onion service and your landing page, to verify uptime and version information, and to perform basic security checks against our landing page recommendations.

If you'd like to remove or update your entry, feel free to contact us any time at securedrop@freedom.press (GPG encrypted).

Organization *

The organization or publication name for your SecureDrop instance. Use the more recognizable name, as this will be the primary name for your directory entry.

Description *

A neutral description of the organization, e.g., "A Lithuanian daily newspaper".

Organization URL

Your organization's main website address (for a publication, where you publish stories).

Landing page URL *

The website on the open web where potential sources can learn about your SecureDrop.

Source interface .onion address *

The hidden service address of the SecureDrop document submission interface (ends in .onion).

Would you like to register an onion name in the form <yourname>.securedrop.tor.onion? If so, what would you like <yourname> to be?

See https://securedrop.org/faq/getting-onion-name-your-securedrop/ .

Logo URL *

URL for a logo to use for your SecureDrop instance (PNG preferred, a minimum of 200px tall).

Is this organization primarily international or primarily national/regional? *

For primarily international sources, we add "All countries" to the list of countries covered.

primarily international

primarily national

primarily regional

If you do focus on specific countries and regions, which ones?

Even for international publications, there is often a primary country that is covered more than others.

What are the preferred languages for submitted documents and messages? *

You can also add "All languages" here, but preferences are still useful to list.

Any additional topics? *

Please feel free to suggest topics missing from the above list, but please consider whether you're likely to receive whistleblower submissions regarding these topics.

Technical contact name *

Who should we reach out to for technical questions or issues regarding this SecureDrop instance?

Technical contact email address *

Yes, please send monitoring alerts to the above email address when the source interface is unreachable:

Note that some alerts may be false positives due to network stability issues.

Technical contact GPG key fingerprint

If you want us to encrypt communcations, please add a fingerprint for a key published to a public keyserver.

Organizational contact name

Who should we reach out to in case the technical contact is unavailable, or for other organizational communications? (Optional)

Technical contact Signal phone number

If you use Signal (we recommend it; it's an open source end-to-end encrypted messaging tool), please add your Signal phone number here.

Organizational contact email address

Organizational contact GPG key fingerprint

Organizational contact Signal phone number

The organization followed the installation guide, including the setup of the physical hardware environment:

The landing page was set up according to the documented best practices:

The network firewall, as well as the Application and Monitor servers, are set up on separate physical hosts (i.e no virtualization):

The landing page does not log traffic, including but not limited to time of visit, IP address, pages viewed:

The current verified signed release branch was used for this installation:

The network firewall is dedicated to the sole purpose of protecting the SecureDrop servers without any other hosts connected to the non-uplink or WAN port:

There are no remote console devices connected to the SecureDrop devices:

The Ansible playbooks were not modified:

The installation was performed from a computer running the Tails operating system:

GPG keys for the Secure Viewing Station were generated and are stored on an airgapped machine:

No other software or access was introduced to the environment:

The Journalist and Admin guides will be followed by those using SecureDrop.

Someone in the organization is tasked with receiving the OSSEC email alerts and can decrypt them.

To the best of your knowledge, the SecureDrop environment has not been tampered with by any person not authorized by your organization:

If you left any boxes unchecked in the checklist above, please provide an explanation:

If you have any additional questions or comments, please add them below:

Have a document to share?

You are not anonymous while using this browser!

Your Tor security settings are too low!

Set your Tor security level to "Safest" for maximum protection

Have a document to share?

Follow these steps to protect your anonymity:

Submit a SecureDrop instance