Leed
Sign up

Security

Leed can’t tell anyone who a source is. Here is how, and where that stops.

A source’s identity, files and messages are locked in their own browser before anything is sent. Leed stores the locked copies and never holds the keys, so a break-in or a court order reaches nothing readable about who they are.

Who the source is
Locked; Leed can’t open it
Who holds the keys
The source, and the newsroom’s devices
Leed staff
Never see a source

01 / What Leed sees

Readable, locked, and never sent

The tip text and answers
Readable by Leed, so Sherlock can sort it. Emails and phone numbers are removed before any AI reads it.
The source's name and how to reach them
Locked in the source's browser. Leed stores it and can't open it. It opens for a newsroom only when the source accepts a request.
Evidence files
Cleaned (photos) and locked to the newsroom's approved devices before upload. Leed can't open them.
Messages between reporter and source
Locked on both ends. Leed carries them and can't read them.
The source's codename
Never sent. Leed keeps a one-way code made from it.
The source's internet address
Not stored. A daily-changing code made from it limits floods and is deleted within two days. Over the onion address, Leed never sees it at all.
An alert email or SMS number
Readable, because Leed has to reach it. Only if the source chooses email alerts or texts a tip. Deleted after 180 days without activity.

02 / How the locking works

Two kinds of key, neither held by Leed

The source’s key. When a source sends a tip, their browser makes an eight-word codename and a key pair. Their name and how to reach them are locked to that key. The private half is stored only locked by the codename, which never leaves the page. When they accept a reporter, their browser unlocks who they are and locks it again for that newsroom.

The newsroom’s key.An editor creates it in their browser when the newsroom turns on its vault, and writes down a twelve-word recovery code. Every reporter’s device gets its own copy, locked so only that device can open it, after an editor approves it and both compare a check code. Removing a lost device and making a new newsroom key cuts it off from everything sent afterward.

The locks are standard, built into every modern browser (WebCrypto): elliptic-curve key agreement (P-256) and AES-256-GCM. Each locked item is bound to its tip and its purpose, so it can’t be moved to another tip and still open.

03 / The AI

What Sherlock reads

Sherlock reads the tip text and the answers to its questions, never who sent it. Emails, phone numbers and social handles are removed from the text first. It runs on Anthropic’s API. Under Anthropic's commercial terms, API data isn't used to train models by default; Leed has not yet signed a zero-data-retention agreement.

A newsroom can instead run its own open-weight model on its own servers. Then no outside AI reads its tips at all; follow-up questions, public-records research and the AI brief turn off.

04 / Where data lives

Leed’s cloud, or the newsroom’s own server

Leed runs on Vercel and stores data in Supabase, in the United States. Locked files go to Leed’s private storage, or, if the newsroom runs the Leed vault server, to its own hardware. Leed source pages load no analytics and no outside scripts, and can talk only to Leed itself.

Sources who want to hide their internet address can use Tor Browser; an onion address for the tip pages is coming.

05 / Limits

What this doesn’t protect against

The locking code comes from Leed
A web page's code is delivered by its server. If Leed's server were broken into, or forced by a court, it could serve code that leaks what a source types. Leed publishes its source code and keeps source pages free of outside scripts, but a source facing serious danger should use their newsroom's SecureDrop, which avoids this by design.
The tip itself can identify someone
Leed can lock a name, not a story only one person could tell. Sherlock warns sources about details only they would know, and the intake points the riskiest tips to SecureDrop.
Lost keys can't be recovered
If a newsroom loses every approved device and its recovery code, what was locked to it is gone. A source who loses their codename loses their messages. That is the price of Leed not holding the keys.
Documents can carry their author
Photos are cleaned in the browser. PDFs and other documents can keep an author name or company in their properties; Leed can't remove that without reading the file.
Email and text messages aren't anonymous
Tips sent by email or SMS pass through mail providers and phone carriers, which see the sender. The intake tells sources this and points them to the web page.
Not yet independently audited
No outside firm has reviewed Leed's security yet. Until one has, judge it by this page and the source code.

06 / Report a vulnerability

Tell us, and we won’t come after you

If you find a way to learn who a source is, read something locked, reach another newsroom’s tips, or get around sign-in, write to us. Include the steps and what you could see. Don’t look at more real data than you need to show the problem, and give us time to fix it before telling anyone else.

We won’t take legal action against research done in good faith under these rules. We answer within three working days, and credit you once it’s fixed if you’d like. Rewards for serious findings are agreed case by case.

security@leed.mediaOpen in mail

07 / Transparency

Demands for data

Leed will publish, twice a year, how many legal demands for user or source data it received and how it answered. Because Leed can’t open who a source is, the most it could hand over about a source is locked data and the tip text.