Security and anonymity

How Voxlibre protects reporters and reports.

A whistleblowing channel is only useful if people trust it. Trust comes from knowing how it works. So here it is.

For the reporter

No IP addresses, no device identifiers

We don't store the reporter's IP address, user agent or any device identifier. The reporting and follow-up pages set no cookies, load no analytics and make no third-party requests. We have even switched off our hosting provider's request logging for this service, because those logs keep request metadata.

Voice is disguised before it leaves the device

A voice report is pitch- and formant-shifted in the reporter's own browser. The reporter listens to the disguised version and chooses whether to send it. The original voice is never uploaded, so it isn't anywhere for us, you, or anyone else to recover.

The disguised voice goes to a transcription model with data collection refused

To produce a transcript, the disguised audio is sent to a transcription model through OpenRouter, with the provider's data-collection option set to deny. The real voice never goes anywhere.

Follow-up without identity

The reporter gets a case number and a secret key with about 100 bits of randomness. We store a hash of the key, not the key itself. Handler names are never shown to the reporter.

For the organisation

Encryption at rest, with a key per organisation

Every report field, message, note and recording is encrypted with AES-256-GCM. Each organisation's key is derived from a master key that lives only as a secret in the runtime, never in the database. An exported database or storage bucket is unreadable without it.

A full audit log

Every view, reply, note, status change and deletion is recorded with who did it and when.

Emails that say nothing

Handlers are emailed that a case needs attention. The email never contains the category, the content or the reporter's details.

Handler accounts

Invite as many handlers as you need, as administrators or case handlers. Every handler confirms their email address before they get case alerts. Two-step sign-in works with passkeys (fingerprint, face or device PIN) or an authenticator app, with one-time recovery codes, and an administrator can require it for the whole team. Ten wrong passwords lock an account for 15 minutes. Sign-ins, invitations, role changes and security changes are on an audit log your administrators can read.

Hosting

Voxlibre runs on Cloudflare Workers, with its database and file storage in Western Europe. Every page is served over HTTPS with a strict content security policy: no inline scripts, no third-party scripts, no embedding in other sites.

Reporting a security problem

If you find a vulnerability in Voxlibre, email hello@voxlibre.app. We'll reply, and tell you what we did about it.