Privacy & Data Protection

What we collect

The details of your report, any evidence you upload, and — for confidential or identified reports — the contact details you choose to provide. Anonymous reports contain no identity.

How we protect it

• Identity and contact details are encrypted at rest.
• Evidence is stored privately, hashed (SHA-256) for integrity, and never served from the public web root.
• Every access to personal data or evidence is written to a tamper-evident audit log.
• Follow-up codes are stored only as one-way hashes — we cannot recover them.

Who can see it

Only authorised officers, strictly on a need-to-know basis, governed by role and jurisdiction. Technical administrators do not have access to intelligence content by design.

Retention

Records are retained according to a defined retention schedule and reviewed periodically. Unverified material may be purged in line with policy.

Your choices

You choose how to report. Anonymous reporting is always available and is designed so that we hold nothing that identifies you.