GlobaLeaks Whistleblowing Platform Hosting

GlobaLeaks is a Python plus JavaScript platform that exposes a submission interface to whistleblowers and a review interface to authorized recipients. The architecture supports multi-tenant configurations where a single instance hosts multiple separate whistleblowing channels with isolated data spaces, which is a common pattern for NGOs that operate distinct channels for different countries or different anti-corruption programs. The platform handles end-to-end encryption of submissions, integrates with PGP for recipient key management and supports both Tor-only and Tor-plus-clearnet deployment modes.

The recommended deployment is Tor-only, with the submission interface exposed exclusively as a Tor v3 onion service. The platform documentation also supports a Tor-plus-clearnet mode where the interface is reachable from both networks, which is appropriate for organizations whose threat model prioritizes accessibility over the strongest source-side anonymity. The choice depends on the specific channel's source population and is configurable per tenant in multi-tenant deployments.

Resource requirements scale with traffic volume and submission count. A small single-tenant deployment serving an NGO with modest submission traffic operates comfortably on a 2 vCPU, 4 GB RAM, 50 GB NVMe VPS. A multi-tenant deployment hosting several channels with active submission flows scales to 4 vCPU, 8 GB RAM, 100 GB NVMe or larger. AnubizHost offshore plans cover both sizing profiles and operators can scale up without migrating the deployment to new infrastructure.

Multi-tenant GlobaLeaks deployments are a distinguishing feature of the platform compared to SecureDrop. A single instance can host multiple independent channels with separate domain entries, separate recipient lists, separate retention policies and separate submission forms. This is operationally efficient for umbrella organizations such as transparency NGOs that operate multiple country-specific channels, or for service providers that host whistleblowing channels on behalf of multiple client organizations under a shared infrastructure model.

Each tenant has its own URL path under the main GlobaLeaks domain or, in the Tor-only deployment, its own onion address. Tenants are administratively independent: a tenant administrator can configure their own submission form, recipient list, retention policies and access controls without visibility into other tenants on the same instance. The platform enforces logical separation at the database layer.

The recipient workflow involves a designated set of authorized reviewers who receive notification of new submissions and access them through an authenticated interface. The submissions themselves are encrypted with the recipients' PGP keys, which means a compromise of the GlobaLeaks server would not directly expose submission content. Key management discipline at the recipient side is the load-bearing component, and the platform documentation provides specific guidance for recipient organizations on PGP key generation, secure storage and rotation.

The operating organization's privacy posture varies. Established transparency NGOs typically operate with public infrastructure relationships and pay through invoicing channels. Smaller projects, regional anti-corruption initiatives and independent journalism collectives frequently prefer crypto-only payment to keep the hosting relationship outside conventional financial trails. AnubizHost supports both. Crypto payment via BTC, ETH, XMR or USDT, no KYC at signup, and a billing record that contains only the account email and the transaction hash give operating organizations the flexibility to choose their privacy posture for the hosting relationship.

At the hypervisor level we do not retain traffic captures or netflow archives for GlobaLeaks customer traffic beyond live abuse triage. The Tor-only deployment combined with the no-log host means submission traffic produces essentially no network-level metadata that could be used to deanonymize sources. The application-level PGP encryption of submission content adds a second layer that protects the content even if the platform is compromised at the database level.

Jurisdiction choice is consequential. Iceland and Romania are both available and both have active operator communities for GlobaLeaks deployments. Iceland is the strongest default for the highest-sensitivity deployments due to constitutional press protections and explicit source-confidentiality jurisprudence. Romania is appropriate for EU-based NGOs that prefer EU legal framework familiarity, particularly those operating under the EU Whistleblower Protection Directive transposed into national law. AnubizHost staff can coordinate with operating organizations during provisioning to align the jurisdiction choice with the deployment's threat model.