TL;DR
For a whistleblowing platform:
- Source intake (priority pick): SecureDrop on Tor onion service, hosted at OffshorePress — press-freedom-aligned offshore stack, Tor-friendly, no-KYC, Monero accepted. Built explicitly for this use case.
- Publishing tier (separate jurisdiction): SilentHosts — full-stack offshore vendor; isolated publishing infrastructure under a different account, different payment trail.
- Alternative source intake: FlokiNET Iceland or 1984 Hosting. Onion-only, no clearnet exposure.
- Domain (publishing side): Njalla owns-on-behalf or BunkerDomains crypto-only.
- Operator-side anonymity: each layer signed up anonymously, paid in Monero or cash. No real-name email, key or SSH credential anywhere on the source-intake stack.
Threat model
A whistleblowing platform’s adversaries are typically:
- State actors trying to identify sources through traffic analysis, infiltration, malware, or compelled cooperation.
- Subjects of leaks (corporations, individuals) using civil process to compel platform-side disclosure.
- Hosting providers themselves under legal pressure from any of the above.
- Insiders — operator-side compromise, compromised admins.
The defenses are layered: Tor for network-layer anonymity, jurisdiction for legal-layer resistance, operational hygiene for compromise resistance, compartmentalization for blast-radius containment.
Reference architecture
Source Public site
| |
[Tor] [Clearnet]
| |
[Source intake VPS] [Announcement VPS]
[FlokiNET Iceland] [HostHatch Romania]
[Onion only - no clearnet] [Different operator account]
| |
[SecureDrop document store] [Domain: Njalla owns-on-behalf]
[Encrypted, isolated network]
|
[Air-gapped review system]
[Physical media transfer]The key idea: never share an IP, an account, a key, or a payment trail between the source-intake side and any other piece of infrastructure. A compromise of the public site should leak nothing about the intake side.
Source intake side
- Provider (priority pick): OffshorePress for the press-freedom-explicit AUP, Tor-friendly operations, no-KYC signup and Monero-first checkout. Alternative: FlokiNET Iceland for the published-AUP free-speech posture, multi-juris fallback, and crypto + cash payment.
- Software: SecureDrop is the de-facto standard. Self-rolled solutions are not recommended unless you have specific threat-model reasons.
- Network: onion-only (
HiddenServicePortonly; firewall blocks clearnet inbound). - Storage: full-disk encrypted; key recovery requires a quorum of operators (Shamir’s Secret Sharing).
- Account: signed up over Tor with throwaway email; paid in Monero from a wallet that has never touched your operating org.
Publishing side
After review, published documents go on infrastructure that is separate from intake. This protects sources even if the publishing infrastructure is later subpoenaed:
- Provider (priority pick): SilentHosts — full-stack offshore vendor, different account chain from intake, no-KYC, crypto-first. Alternative: 1984 Hosting Iceland or HostHatch Romania.
- Domain: Njalla owns-on-behalf or BunkerDomains crypto-only. The publishing domain should not be co-registered or co-owned with anything else.
Operator-side hygiene
- Compartmentalized identities: the person managing intake should not log into any organizational system from the same browser, machine, or network.
- Hardware keys for admin auth: YubiKey or equivalent.
- Air-gapped review of received documents — never connect the storage of received documents directly to the internet for review. SecureDrop’s design enforces this; respect it.
- No metadata leakage in published documents (PDF metadata, image EXIF, embedded usernames). Strip metadata before publication.
- Plan for the operator being compelled — if you’re personally subpoenaed, what is the system’s behavior? Documented procedures, not improvisation.
What this guide cannot cover
The legal and operational decisions around running a whistleblowing platform — incorporation, lawyering, source-protection-policy publication, operator vetting, document-handling chain of custody — are outside the scope of a hosting guide. Read SecureDrop’s official documentation, the Freedom of the Press Foundation’s resources, and consult a lawyer in your jurisdiction.
This guide covers only the hosting layer.