- Home
- Whistleblower Hotline Software
- GlobaLeaks
GlobaLeaks
What it is
GlobaLeaks is free, open-source software for setting up and maintaining a whistleblowing platform. It supports anonymous two-way messaging, file exchange, configurable reporting channels, report labels, and case statuses. Administrators can build multi-step questionnaires to structure submissions and manage the platform through a web interface; one setup can host multiple virtual whistleblowing sites. The software encrypts reports and recipient communications, supports Tor, and states that it does not log IP addresses. Listed security controls include TLS 1.3, two-factor authentication, AppArmor, network sandboxing, and PGP for email notifications and file downloads. The project says it has undergone independent security audits since 2011 and publishes the reports. GlobaLeaks is self-hosted, with documented Debian and Ubuntu Linux support and a Docker installation option. Its default attachment limit is 30MB per file, though administrators can configure a higher limit. The platform lists support for over 90 languages, including right-to-left languages, and WCAG 2.2 accessibility recommendations. Intended users include independent media, activists, public agencies, corporations, and other organizations.
For and against
For
- Free, open-source software.
- Supports anonymous two-way messaging and file exchange.
- One setup can host multiple virtual sites.
- Supports Tor and says it does not log IP addresses.
- Lists support for over 90 languages.
Against
- Self-hosted deployment is required.
- Default attachment limit is 30MB per file.
- Linux documentation covers Debian and Ubuntu.
The verdict
GlobaLeaks combines configurable report intake with tools for anonymous communication and case handling. Its self-hosted deployment and default attachment cap are important setup considerations.
Who it suits
It suits organizations that need to receive and manage whistleblowing reports, including independent media, activists, public agencies, and corporations. It requires a self-hosted deployment on supported Linux or Docker environments.
Plans and prices
Free Whistleblowing Software
free and open source software
Read 15 Oct 2026 · g2.com
GlobaLeaks
Free open-source software; self-hosted; default attachment limit 30MB per file, configurable higher
Read 3 Oct 2026 · globaleaks.org
On the record
- Administration
- The platform is managed through a web interface and supports multiple virtual whistleblowing sites on one setup.globaleaks.org · read 3 Oct 2026
- Adoption
- The project says it is used by more than 30,000 organizations worldwide.globaleaks.org · read 15 Oct 2026
- Anonymous reporting
- Whistleblowers receive a unique 16-digit receipt for anonymous report access.docs.globaleaks.org · read 15 Oct 2026
- API
- GlobaLeaks exposes a REST API.docs.globaleaks.org · read 15 Oct 2026
- API documentation limit
- A project discussion states that API documentation was evolving, no Swagger specification was available, and the team lacked dedicated resources for it at that time.github.com · read 15 Oct 2026
- Attachment limit
- The default attachment limit is 30 MB per file, but administrators can raise it to a virtually unlimited size.globaleaks.org · read 15 Oct 2026
- Audit history
- GlobaLeaks says independent security audits have been conducted since 2011 and published in full.globaleaks.org · read 15 Oct 2026
- Audits
- The project says it has undergone independent security audits since 2011 and publishes the reports in full.globaleaks.org · read 3 Oct 2026
- Case management
- Reports can be labeled and assigned customizable case statuses and sub-statuses.docs.globaleaks.org · read 15 Oct 2026
- Changelog: version 5.0.0
- Version 5.0.0 introduced a full client rewrite using Angular 18 and Bootstrap 5.github.com · read 15 Oct 2026
- Compliance
- The maker says the platform is compliant with ISO 37002, EU Directive 2019/1937, and GDPR, and designed in adherence to ISO/IEC 27001:2022.globaleaks.org · read 3 Oct 2026
- Compliance claims
- The project says it is designed around ISO 37002, EU Directive 2019/1937, GDPR and ISO/IEC 27001:2022 recommendations.globaleaks.org · read 15 Oct 2026
- Documentation depth
- Documentation covers installation, initialization, backup, reporting, administration, requirements, security, development, packaging and continuous integration.docs.globaleaks.org · read 15 Oct 2026
- Encryption
- Reports, attachments, messages and metadata are encrypted with per-user and per-report keys.docs.globaleaks.org · read 15 Oct 2026
- Encryption and anonymity
- The software encrypts reports and recipient communications, supports Tor, and states that it does not log IP addresses.globaleaks.org · read 3 Oct 2026
- Installation
- Official installation supports a verified Debian/Ubuntu script and Docker with a Linux amd64 image.docs.globaleaks.org · read 15 Oct 2026
- Integrations
- The software supports integration with enterprise case-management platforms and existing websites.docs.globaleaks.org · read 15 Oct 2026
- Intended users
- The maker describes use by independent media, activists, public agencies, corporations, and other organizations.globaleaks.org · read 3 Oct 2026
