Journalism & Secure Tip Lines

Investigative journalism depends on a single, fragile property: a source needs to be able to reach a reporter without being identified. That property has never been purely technical — it has always combined legal privilege, editorial practice, and the physical precautions the source and the reporter take together. But the channel itself matters. A tip submitted through a form whose vendor can read it is a tip that exists, in plain text, on someone else's server before the reporter has even opened it.

Schweizerform is built on the opposite premise. Every submission — a short tip, a long memo, an uploaded document — is encrypted in the sender's browser before it reaches our servers. We physically cannot read it. For investigative desks, public-interest reporters, editors at small outlets, and freelance journalists, that property is the difference between a tip line that can be taken seriously and one that can only receive non-sensitive messages.

Why Most Contact Forms Are Unsafe for Sources

Most online form tools operate on a conventional SaaS model: the sender's browser sends plain-text data over HTTPS, and the provider's server stores it. That server can read everything. So can the provider's staff, their integration partners, anyone who compromises their infrastructure, and any authority that serves a lawful order on the provider. For a marketing survey, that's fine. For a source who wants to share a document about a public-interest matter, it is not.

• A source submits a description of alleged corruption via the newsroom's contact form; the provider's database contains a readable account before the reporter reads it
• A document upload field accepts a scanned contract; the file is processed by the provider's antivirus, cached by a CDN, and often stored in US-hosted cloud regions
• A subpoena, warrant, or data-access request targets the form vendor; the request reaches source content without the source ever being notified
• The provider suffers a breach; every historical tip — including ones that identify sources — is exposed at once
• The provider's own email notifications send plain-text summaries of submissions to reporters, exposing sensitive content outside any encrypted flow

How Schweizerform Protects the Channel

Schweizerform is a zero-knowledge end-to-end encrypted form platform. The encryption happens in the source's browser, before any data leaves their device. Only holders of the form's Access Code can decrypt submissions. We — the provider — cannot.

Concrete Journalism Use Cases

General newsroom tip line

A single encrypted tip form, linked from the newsroom's contact page, replaces the unsecured 'tips@outlet' email address for sensitive submissions. Sources can send a short message or attach documents; every field is encrypted in their browser, and only the tip-line editor can decrypt. For most stories this is enough; high-risk stories may warrant layered channels on top.

Investigative-desk document drop

Investigation units frequently need to accept large documents — contracts, datasets, internal memos — from insiders. A dedicated encrypted drop form accepts uploads in-browser-encrypted form, which are decrypted on the investigator's workstation and moved into the desk's internal secure workspace. The provider never holds a decryptable copy.

Freelancer tip intake

Freelance journalists often lack access to enterprise secure-submission platforms. A Schweizerform tip line gives an independent reporter the same architectural guarantee — the vendor cannot read tips — at a price point and operational complexity suitable for a single person.

Editor-only confidential channel

Some submissions should only reach the editor-in-chief or the legal desk, not the general inbox. A separate form with its own Access Code, held only by those people, creates a narrower compartment — useful for corrections involving powerful subjects, sensitive source outreach, or legal-threat coordination.

Reader-letters channel with identity protection

Opinion and letters desks receive contributions from readers who may be personally at risk if their identity is widely exposed — dissidents, minors, survivors, employees of named organisations. An encrypted reader-contact form protects their text from being cached, indexed, or analysed by third parties, while still allowing the desk to decide, with the contributor, how to handle attribution.

Cross-border collaboration intake

For collaborative investigations across multiple outlets — where a tip needs to reach a small, pre-agreed group of reporters — per-form Access Codes can be held collectively by the project team. A single submission becomes decryptable only by that project, not by any wider newsroom system.

What Sources, Adversaries, and Subpoenas See

Legal and Ethical Context

Switzerland has long-standing statutory source protection: Art. 28a of the Swiss Criminal Code and Art. 172 of the Code of Criminal Procedure together give journalists a right to refuse testimony about their sources, subject to narrow exceptions. The European Convention on Human Rights has repeatedly affirmed, through cases like Goodwin v. UK and Sanoma v. the Netherlands, that source protection is a cornerstone of press freedom under Art. 10. Council of Europe Recommendation R(2000)7 sets out the principles in detail.

These protections attach to journalists. They do not automatically extend to third-party service providers that handle source communications in plain text. A newsroom's choice of intake channel affects how much of that protection the architecture actually provides. A zero-knowledge form narrows the circle of people and systems that can see a source's identity or content — consistent with the spirit of press-freedom case law even though the platform itself is not a journalist.

Features Relevant to Journalism

• Zero-knowledge end-to-end encryption on every submission — no provider read access
• True anonymous submission — no account required, no source metadata collected by default
• Encrypted document uploads — contracts, memos, images, recordings, PDFs — encrypted in the source's browser
• Multi-language forms (EN / DE / FR / IT) — essential for newsrooms serving multilingual communities or cross-border investigations
• Per-form Access Codes scoped to specific desks or projects, so a general tip form and an investigative drop can be strictly separated
• Swiss hosting with nFADP-aligned data-processing posture — tip payloads do not leave Switzerland
• Audit log of access events (which reporter opened which submission, and when) without exposing the submission content
• Free tier suitable for a single journalist or a small independent outlet piloting a secure tip line

Common Objections

"We already use a plain email address for tips."

Email is still the default, but it is also the least controlled channel — unencrypted between mail servers, retained on personal devices, searchable by anyone who later gains access to the account, and subject to the email provider's own data-access regime. A clearly branded encrypted tip form sits on the newsroom's own page, tells the source they can submit without identifying themselves, and gives a cleaner legal and technical posture than a generic inbox.

"Won't this be used for spam and hoaxes?"

Any public intake channel attracts noise, and a zero-knowledge channel is not magic. Mitigations are operational: explain the channel's purpose clearly, triage submissions as you would triage emails, and require optional categorisation fields that help the desk filter serious tips from noise. The signal is better than an open inbox; it is not perfect.

"If we lose the Access Code, we lose the tips."

Correct — this is a deliberate property of zero-knowledge architecture. The recommended practice is documented key custody: a sealed envelope held by the editor-in-chief, a backup with the outlet's lawyer, or a hardware security module. It avoids single-person failure while preserving the 'we cannot be compelled to read what we do not have' property.

"We already use SecureDrop for high-risk sources."

SecureDrop is a stronger threat model — Tor-only, isolated air-gapped workstations, dedicated infrastructure — and remains the right tool for high-risk investigative tip lines. Schweizerform is not a replacement. It complements by covering the everyday reader-contact and desk-level tip cases where the full SecureDrop workflow is disproportionate, while still giving an architectural guarantee the vendor cannot read submissions.

Rolling Out a Schweizerform Tip Line

The Bottom Line

Source protection is a system: legal privilege, editorial practice, operational security, and the submission channel itself. Most of the system is already in place in a serious newsroom. The submission channel is often the weakest link — because it is cheap, convenient, and invisible, and because its flaws only show up the day a subpoena arrives or a provider suffers a breach.

Schweizerform offers a narrow but important improvement to that channel: zero-knowledge end-to-end encryption on every form, Swiss hosting, and an architecture where the platform itself cannot identify who wrote to you. No paid upgrade for security. No US-cloud dependency for tip content. No third-party-readable copy of source material on a server you do not control.