Confidential Document Submission
An end-to-end encrypted confidential document submission form for journalists. Journalist privilege and source protection under Swiss Art. 17 BV. Documents are encrypted in the browser before upload.
The riskiest thing about a leaked document is usually not its contents. It is the metadata travelling with it — the author field, the revision history, the printer that produced it — which can identify a source who took every other precaution. A submission channel that does not address that is protecting the wrong half of the problem.
Metadata is the hidden risk
Every document created with standard office software contains metadata: the username of the creator, the computer name, revision history, the last save date and time, and in some cases printer-specific steganographic watermarks. These metadata fields can identify the specific person who created or printed a document even if the visible content is entirely anonymous. Sources who need to remain anonymous should use dedicated tools to strip metadata before submission — or submit photographs of printed documents rather than original digital files.
What the form collects
- Description of the documents and their significance
- How the source obtained the documents
- Context about the organisation or matter involved
- Whether the source believes any legal risk attaches to the documents
- Optional verification contact for the journalist to follow up
- The document files themselves (encrypted before upload)
Handling leaked documents responsibly
Receiving leaked documents creates significant editorial and legal responsibilities. Before publication, a journalist must assess: whether the documents are authentic, whether they were obtained lawfully by the source, what public interest justifies publication, whether any individuals named in the documents have been given the opportunity to respond, and whether any legal risk to the publication exists — for example, if documents are subject to a non-disclosure order.
Swiss law distinguishes between a journalist receiving documents from a source and a journalist actively soliciting the theft of documents. The former is protected by press freedom under Art. 17 BV and the Redaktionsgeheimnis; the latter may give rise to criminal liability under the Swiss Criminal Code. A passive submission channel — as opposed to active solicitation — keeps the newsroom within the protected zone.
Press freedom and the legal frame in Switzerland
The Swiss Federal Supreme Court has confirmed that press freedom under Art. 17 BV includes the right to receive information from confidential sources, including documents. Art. 172 StPO (Schweizerische Strafprozessordnung) provides journalists with a statutory right to refuse to testify about sources. This right extends to the documents themselves: a journalist cannot generally be compelled to surrender source documents obtained in confidence. However, these protections are not absolute — courts may in limited circumstances override them where the competing interest is of overriding public importance.
Opening a channel
Use this template
Copy it into your dashboard — the document upload and optional-contact fields are already structured.
Restrict access to one journalist
Ensure only the designated journalist holds the decryption key. Do not share keys via email or unencrypted channels.
Publish the form link
Share the link in your publication's masthead, secure communications page, or via encrypted messaging to potential sources.
Advise sources on metadata hygiene
Add a note to your form description advising sources to review document metadata before submission if their anonymity is important.
Questions sources ask
What types of documents can be submitted?
Any document that a source believes is in the public interest. This commonly includes internal corporate communications, regulatory filings, financial records, contracts, whistleblower evidence, policy drafts, and correspondence. The journalist receiving the documents will assess the editorial and legal position before any use of the material.
What happens to documents if the journalist does not publish?
Documents submitted to the form are stored encrypted and accessible only to the designated journalist. Your retention and deletion policy should specify what happens to documents that are not used — including when and how they are securely deleted. This policy should be disclosed to sources at the point of submission.
Can the platform operator see my submitted documents?
No. All file uploads through Schweizerform are encrypted in the source's browser using the journalist's public key before leaving the device. The Schweizerform platform receives only ciphertext — it cannot decrypt or read the file contents. Only the journalist holding the corresponding private key can access the documents.