How We Keep This Site Secure

Cette page n'est pas encore disponible dans ta langue. Tu consultes la version anglaise.
 Dernière mise à jour le 6 novembre 2026

We know that sites like this can become the target of state surveillance and hacking, so we've gone to great lengths to protect this site and the people who use it. This page explains the main things we've done.

If you want to know what information we collect, see our privacy page.

Our entire website's code is open source if you (or someone with coding skills that you trust) want to review it.

The security (and privacy) principles we follow:

  • We do not collect anything that could easily be used to identify you. (It's impossible to fully prevent this, but we reduce it as much as possible.)
  • We never log true IP addresses, email addresses, or anything you type into a form.
  • We don't load any external services or third-party libraries in your browser that could expose your IP address.
  • We don't use third-party services (like Mailchimp) that would come with a risk of a court order we aren't told about.
  • We encrypt contact form messages before they leave our server, and we encrypt our newsletter and analytics database backups.

Server

We chose May First as our web host specifically because they support activist projects like ours. We've also disabled logging on our hosting account (no visitor logs, no IP address logs, no error logs) so if the government tries to subpoena us or May First to see who has visited the site, we have nothing to turn over.

Newsletter

Our subscriber list is the most sensitive thing we have, so we went to greater lengths to lock it down. We run our own newsletter software on our own servers instead of handing your email to a company like Mailchimp (which would come with a risk of a court order we aren't told about). We protect access to it with Cloudflare, so it's much harder for a hacker to use some undisclosed exploit to get into the database and steal everyone's email addresses.

Why do we run a newsletter at all? Well, if you want to get updates, the options are (A) an RSS feed, which most people don't use, (B) social media, which makes it very easy for the state to know you're interested in activist digital security, or (C) an email list, which requires a lot more work for them to access.

Forms

If you message us using our contact form, our server encrypts your message (using our PGP key), along with any contact details you give us, before it leaves our server. Only we can read it.

Privacy

We don't load any external services or third-party libraries in your browser that could expose your IP address to sites that would log it.

We do track a bit of information in an anonymous way to help us understand how folks are using this site, but our server replaces about half of your IP address with random data before it reaches our analytics.

You can read our privacy page for more info.

For extra network privacy, you can also visit the site using Tor.

Security practices

We also protect the accounts we use to run the site, and we run automated checks on changes before they go live.

And we maintain a warrant canary, which we update every 4 months to confirm that we haven't been forced to modify the site or been gagged from telling you about a legal demand for user data.

Found a security problem?

You can report security problems privately on GitHub (you'll need a GitHub account) or through our contact form, which is encrypted.