Safety & Privacy
Whistle42 allows you to submit information without creating an account or providing your name or email. You can then return to a private case mailbox for questions and follow-up. This page explains the safeguards, the role of AI, and the limits you should understand before submitting.
Before you submit: protect yourself
Your own security choices are as important as the technical design of the reporting channel.
Device and connection
- Do not use an employer-controlled device, email account, browser profile, VPN or workplace network for a sensitive report.
- For higher-risk disclosures, consider Tor Browser on a private device and network. Avoid signing into personal or work accounts in the same session.
- Choose a location and time that do not unnecessarily connect the submission to you.
Information and evidence
- Remove unnecessary names, signatures, account details and other identifiers from documents and screenshots.
- Review filenames, PDF properties, comments, document authors and other metadata before uploading.
- Do not submit passwords, private keys, seed phrases or account-access credentials. Never obtain new material through unauthorised access.
- Describe what you know directly, including dates, entities, transactions and how you learned the information.
Anonymous two-way communication
A report is no longer the end of the conversation. The new Whistle42 intake system allows editors to ask questions and sources to add evidence without an account or email address.
Submit your tip
Explain the issue and, if safe, upload supporting material. After submission, you receive a case number and passphrase.
Keep your credentials
Store both credentials privately and separately from workplace systems. They are needed to access your case mailbox later.
Return and respond
Use My Case to review status, read questions, reply and supply further information or files.
What the technology does—and does not do
We aim to minimise unnecessary data collection and access. These safeguards reduce risk; they do not make any online interaction completely untraceable.
Dedicated intake pages
The tip form and case mailbox load no third-party scripts, fonts or trackers. This describes those dedicated pages, not necessarily every page on the wider WordPress website.
IP addresses and server logs
The tip application does not store a source's IP address in the case record. Hosting and network providers may nonetheless create technical access logs. These are not the same as case data.
Stored materials
Tips and uploaded files are stored in encrypted form. Authorised editors can access case materials for review. Encryption of stored data is not a claim of end-to-end encryption from your device to every processing system.
File metadata
Location metadata is automatically removed from uploaded photos. PDF metadata is not automatically cleaned. Document content, properties, visible details and writing style can still identify a source.
AI-assisted screening. Human editorial decisions.
Whistle42 uses Anthropic's Claude as an external AI service to pre-screen relevant submission content. The submission form discloses this processing before a tip is sent.
What AI may do
- Extract company names, brands, domains, wallets, payment providers and other useful identifiers.
- Assess specificity, consistency, possible corroboration, available evidence, source proximity and public interest.
- Compare allegations with earlier reporting and suggest relevant public-source checks or follow-up questions.
- Flag possible contradictions or signs of manipulation for human review.
What people decide
- Whether a claim is credible and what independent evidence is required.
- Whether and how to ask a source for clarification.
- How to handle privacy, legal risks and the interests of named third parties.
- Whether information may support an investigation, referral or publication.
You can state conditions for using your information
The tip form includes a field for instructions about your documents and statements. Be specific if a screenshot must not be shown, an email must not be quoted verbatim, or information is supplied for background checking only.
Editorial handling
Whistle42 does not automatically publish raw submissions. Editors review and verify the material. Verified information may, where appropriate and consistent with applicable terms and safeguards, support reporting, further investigations or referrals. A source's restrictions must be considered before use.
Do not assume automatic confidentiality
Tell editors about any non-negotiable conditions. If a particular protection is essential, use the case mailbox to obtain clarification before providing additional sensitive material. Legal obligations and the nature of the evidence may limit what can be promised.
For formal information about processing, retention and your rights, read the Privacy Policy and Terms of Submission. This practical safety guide does not replace those documents or independent legal advice.
Safety & Privacy FAQ
Clear answers to the questions sources most often ask.
Do I need to create an account or leave my email address?
No. The dedicated tip form accepts reports without an account, name or email. You receive a case number and passphrase for anonymous follow-up. An optional external contact route may be provided, but is not required for the case mailbox.
How do I know whether editors have asked a question?
Return to My Case with your case number and passphrase. For anonymous cases, the system does not send automatic notifications, so check periodically.
Does anonymous submission guarantee that nobody can identify me?
No. You do not have to identify yourself to Whistle42, but document metadata, unique knowledge, writing style, workplace monitoring or technical logs elsewhere may reveal clues. Use a private device and network, share only what is necessary and consider Tor Browser if the risk is high.
Will an external AI provider process my information?
Yes. Relevant submission content is pre-screened by Anthropic's Claude. Optional contact details are not included in the screening input, but the information you write or upload may itself contain identifying details. Human editors decide what happens next.
Are files stripped of all identifying metadata?
No. The tip system removes location metadata from uploaded photos, but it does not automatically remove PDF metadata. Check document authors, properties, comments, filenames and visible content yourself.
Will my tip or documents be published?
Raw tips are not published automatically. Editors verify information and consider source instructions, legal requirements and risks to third parties before any reporting or disclosure. If you have specific limits, explain them clearly in the submission and discuss them through the case mailbox.
Can I request deletion or ask about data retention?
You can raise a request or concern through your case mailbox. The handling of deletion, retention and applicable rights is governed by the Privacy Policy and legal obligations; not every record can necessarily be removed immediately.
Will I receive a reward for a useful tip?
No reward is guaranteed. Whistle42 is testing a discretionary recognition model for materially useful contributions. This is not an active guaranteed-payout scheme, and submitting information does not create an automatic entitlement to money or tokens.
Ready to share what you know?
Start with a concise factual description and only the evidence you can share safely. You can add detail later through your private case mailbox. Every submission is reviewed by people.
Whistle42 is not an emergency service and does not provide legal advice.