GlobaLeaks - Secure Whistleblowing and Reporting Platform

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

What GlobaLeaks Does

GlobaLeaks is a free and open-source platform for receiving confidential reports. Newsrooms, NGOs, regulators, universities and companies use it to run a reporting channel that members of the public, employees or suppliers can use to raise concerns. A reporter opens the platform in a browser, answers the questions the organisation configured, optionally attaches files, and receives a randomly generated receipt code. That code is the only handle on the report, and it lets the reporter come back later to read replies and continue the conversation without ever creating an account or supplying an email address.

On the receiving side, reports land in an inbox that only designated recipients can open. GlobaLeaks separates duties across distinct roles so no single person holds every power: administrators configure the platform, recipients read and work reports, custodians can be required to approve access to a reporter's identity, and analysts see statistics without report content. Submissions and attachments are encrypted at rest with keys derived from each recipient's passphrase, so an operator with disk access cannot simply read them. Multiple contexts and questionnaires let one deployment serve several intake channels, and multi-tenancy lets one instance host separate platforms for separate organisations.

What This Image Provides

This is the official upstream GlobaLeaks package, installed unmodified from the project's own signed package repository and left registered so the instance keeps receiving upstream security updates. The platform is a single hardened service with an embedded database, so there is no separate database server, application server or web server to operate.

Nothing sensitive is baked into the image. There is no administrator account: the very first person to open the platform completes the setup wizard and chooses the administrator credentials and recovery key on that instance. The platform database, the receipt salt, the node identity and the TLS key pair are all created on your own instance at first boot, so no two customers ever share a secret. All of that state lives on a dedicated data volume you can resize, snapshot and encrypt independently of the operating system disk.

What This Image Does Not Provide - Read Before Accepting Real Reports

The image serves HTTPS from first boot using a self-signed certificate it generates for itself. A self-signed certificate encrypts the connection but does not let a reporter verify they reached your platform rather than an impostor, and browsers will warn on every visit. Before you publish the address to real reporters, point a DNS name at the instance and install a trusted certificate from Administration, Network, HTTPS, where the built-in ACME client can obtain one automatically.

This image is not an anonymity network and does not make reporters anonymous by itself. In the default configuration a reporter connects to your instance directly over the internet, so the reporter's network operator, your cloud provider and anyone observing the path can see that a connection took place, even though its contents are encrypted. GlobaLeaks can additionally publish a Tor onion service, which is what conceals a reporter's network address from observers and from the platform itself. That feature is deliberately switched off in this image so that nothing is published from your instance without your decision. If your threat model requires genuinely anonymous submission, enable it yourself and tell reporters to use Tor Browser. The deployment guide explains how, and explains the trade-offs in plain language.

cloudimg does not certify this image against any compliance regime. Whether a deployment meets a legal obligation depends on how you configure, operate, host and document it, and that assessment is yours to make.

Support

Every cloudimg image ships with a paired step-by-step deployment guide and 24/7 support from our engineers.