Developer infrastructure
A secure tip line your sources can trust, that you can run yourself.
An open-source, self-hostable secure intake system.
- 60 self-hosted deployments including at least three recognised newsrooms
- 25 hosted customers
- A published independent cryptographic audit
The problem
Organisations that need confidential submissions mostly use an email address, which exposes the source completely, or a hosted whistleblowing service whose operator can see everything and is subject to legal compulsion.
Sources are increasingly sophisticated and will not use a system they cannot verify, so the disclosures that matter most never arrive.
Who this is for
Newsrooms, investigative units, human rights organisations, corporate ethics and whistleblower programmes, and regulators who receive sensitive disclosures.
Copy a config that actually runs
Free and open source forever, with genuinely good documentation and a one-command deployment. Runs in your browser. No account, no card, no call.
# my-service — generated by OpenCyph
# Copy to my-service.config.yaml. Every value below is live, not a placeholder.
apiVersion: v1
kind: Service
metadata:
name: my-service
region: us-east
spec:
endpoint: https://my-service.opencyph.com/v1
auth:
mode: apikey
credential: ${MY_SERVICE_TOKEN}
limits:
requestsPerMinute: 600
timeoutMs: 10000
maxRetries: 2
backoff: exponential
observability:
structuredLogs: true
tracing: w3c
replayRetentionDays: 7curl -sS https://my-service.opencyph.com/v1/run \
-H "X-API-Key: $TOKEN" \
-H "Content-Type: application/json" \
--max-time 10.0 \
-d '{"input": {"task": "hello"}}'import { Client } from "@my-service/sdk";
const client = new Client({
endpoint: "https://my-service.opencyph.com/v1",
auth: { mode: "apikey", token: process.env.TOKEN! },
timeoutMs: 10000,
maxRetries: 2,
});
const result = await client.run({ task: "hello" });
console.log(result.data);- API keys do not expire on their own. Set a rotation reminder now.
Take this with you
No email required. It is your result.
OpenCyph — config · my-service · us-east · apikey · p50 25ms, p99 80ms · 1,500,000 requests/month at 600 rpm burst Run it yourself: https://opencyph.com
How it works
Three steps, and the first one costs nothing.
- 01
Run the free tool
Free and open source forever, with genuinely good documentation and a one-command deployment.
- 02
See your own numbers
An open-source, self-hostable secure intake system.
- 03
Upgrade only if it earns it
Keep the free result either way. Move to a paid plan when OpenCyph is already doing the work.
What you actually get
Six things that are true on the first day, not on the roadmap.
One command to production
A working, authenticated endpoint from a single command. No YAML archaeology.
Typed SDKs
Generated clients for TypeScript, Python and Go, versioned with the API and never out of date.
Observable by default
Structured logs, traces and per-request replay. Debugging is reading, not guessing.
Rate limits and quotas
Per-key limits with clear headers and honest 429s, so your clients degrade predictably.
Self-host option
Run it in your own VPC under a commercial licence when compliance requires it.
Versioned, never broken
Dated API versions with a published deprecation policy. Nothing changes under you.
Questions people actually ask
- Do I need to talk to anyone to try this?
- No. The free OpenCyph tool runs without an account, a card or a call. That is the point of it.
- What does it cost?
- Pricing is published in full on this page.
- Who is this actually for?
- Newsrooms, investigative units, human rights organisations, corporate ethics and whistleblower programmes, and regulators who receive sensitive…
- What problem does it solve?
- Organisations that need confidential submissions mostly use an email address, which exposes the source completely, or a hosted whistleblowing service whose operator can…
- Can I get my data out?
- Yes. Everything you put in can be exported as CSV or JSON at any time, and deleting your account deletes your data.
- Why should I trust the result?
- Trust in this category is earned only through auditability, which makes open source a requirement rather than a strategy.
Pricing
Published in full. No “contact us for pricing”, no per-seat surprise on renewal.
Free
The wedge, free forever. Enough to run on.
- Free and open source forever, with genuinely good documentation and a one-command…
- No credit card
- Core loop included
- Community support
Pro
For newsrooms, investigative units, human rights organisations…
- Everything in Free
- Unlimited usage
- Full history and exports
- Integrations and API access
- Email support
Scale
For teams that depend on this in production.
- Everything in Pro
- SSO and SCIM
- Audit log and data residency
- 99.9% uptime SLA
- Dedicated support channel
Prices in USD. Cancel any time from the dashboard — no email, no retention call.
Copy a config that actually runs
Free and open source forever, with genuinely good documentation and a one-command deployment. Runs in your browser. No account, no card, no call.
Open the free toolIt runs in your browser. OpenCyph never sees your inputs.