Skip to content

Developer infrastructure

A secure tip line your sources can trust, that you can run yourself.

An open-source, self-hostable secure intake system.

60 self-hosted deployments including at least three recognised newsrooms
25 hosted customers
A published independent cryptographic audit

The problem

Organisations that need confidential submissions mostly use an email address, which exposes the source completely, or a hosted whistleblowing service whose operator can see everything and is subject to legal compulsion.

Sources are increasingly sophisticated and will not use a system they cannot verify, so the disclosures that matter most never arrive.

Who this is for

Newsrooms, investigative units, human rights organisations, corporate ethics and whistleblower programmes, and regulators who receive sensitive disclosures.

Copy a config that actually runs

Free and open source forever, with genuinely good documentation and a one-command deployment. Runs in your browser. No account, no card, no call.

Your service

Generates locally. Copy the output and it runs.

p50 latency
25 ms
p99 latency
80 ms
Worst case
30.3 s
all retries exhausted
my-service.config.yaml yaml
# my-service — generated by OpenCyph
# Copy to my-service.config.yaml. Every value below is live, not a placeholder.
apiVersion: v1
kind: Service
metadata:
  name: my-service
  region: us-east
spec:
  endpoint: https://my-service.opencyph.com/v1
  auth:
    mode: apikey
    credential: ${MY_SERVICE_TOKEN}
  limits:
    requestsPerMinute: 600
    timeoutMs: 10000
    maxRetries: 2
    backoff: exponential
  observability:
    structuredLogs: true
    tracing: w3c
    replayRetentionDays: 7
Try it now bash
curl -sS https://my-service.opencyph.com/v1/run \
  -H "X-API-Key: $TOKEN" \
  -H "Content-Type: application/json" \
  --max-time 10.0 \
  -d '{"input": {"task": "hello"}}'
Client node
import { Client } from "@my-service/sdk";

const client = new Client({
  endpoint: "https://my-service.opencyph.com/v1",
  auth: { mode: "apikey", token: process.env.TOKEN! },
  timeoutMs: 10000,
  maxRetries: 2,
});

const result = await client.run({ task: "hello" });
console.log(result.data);
Things this configuration will do to you
  • API keys do not expire on their own. Set a rotation reminder now.

Take this with you

No email required. It is your result.

OpenCyph — config
· my-service · us-east · apikey
· p50 25ms, p99 80ms
· 1,500,000 requests/month at 600 rpm burst

Run it yourself: https://opencyph.com

How it works

Three steps, and the first one costs nothing.

  1. 01

    Run the free tool

    Free and open source forever, with genuinely good documentation and a one-command deployment.

  2. 02

    See your own numbers

    An open-source, self-hostable secure intake system.

  3. 03

    Upgrade only if it earns it

    Keep the free result either way. Move to a paid plan when OpenCyph is already doing the work.

What you actually get

Six things that are true on the first day, not on the roadmap.

One command to production

A working, authenticated endpoint from a single command. No YAML archaeology.

Typed SDKs

Generated clients for TypeScript, Python and Go, versioned with the API and never out of date.

Observable by default

Structured logs, traces and per-request replay. Debugging is reading, not guessing.

Rate limits and quotas

Per-key limits with clear headers and honest 429s, so your clients degrade predictably.

Self-host option

Run it in your own VPC under a commercial licence when compliance requires it.

Versioned, never broken

Dated API versions with a published deprecation policy. Nothing changes under you.

Questions people actually ask

Do I need to talk to anyone to try this?
No. The free OpenCyph tool runs without an account, a card or a call. That is the point of it.
What does it cost?
Pricing is published in full on this page.
Who is this actually for?
Newsrooms, investigative units, human rights organisations, corporate ethics and whistleblower programmes, and regulators who receive sensitive…
What problem does it solve?
Organisations that need confidential submissions mostly use an email address, which exposes the source completely, or a hosted whistleblowing service whose operator can…
Can I get my data out?
Yes. Everything you put in can be exported as CSV or JSON at any time, and deleting your account deletes your data.
Why should I trust the result?
Trust in this category is earned only through auditability, which makes open source a requirement rather than a strategy.

Pricing

Published in full. No “contact us for pricing”, no per-seat surprise on renewal.

Free

The wedge, free forever. Enough to run on.

Freeforever
  • Free and open source forever, with genuinely good documentation and a one-command…
  • No credit card
  • Core loop included
  • Community support
Start free
Most popular

Pro

For newsrooms, investigative units, human rights organisations…

$199per month
  • Everything in Free
  • Unlimited usage
  • Full history and exports
  • Integrations and API access
  • Email support
Start 14-day trial

Scale

For teams that depend on this in production.

$6,000per month
  • Everything in Pro
  • SSO and SCIM
  • Audit log and data residency
  • 99.9% uptime SLA
  • Dedicated support channel
Talk to sales

Prices in USD. Cancel any time from the dashboard — no email, no retention call.

Copy a config that actually runs

Free and open source forever, with genuinely good documentation and a one-command deployment. Runs in your browser. No account, no card, no call.

Open the free tool

It runs in your browser. OpenCyph never sees your inputs.