Speak up safely. We can't see who you are, by design.
If something at Coalfire doesn't look right, tell us. Reports go only to a small team in Legal and People, are encrypted on your device before they are sent, and can be made completely anonymously.
How your anonymity is protected
These protections are built into how the system works. They don't depend on anyone promising to look away.
We don't record where you are
Your IP address, browser and device are not logged when you submit or check a report. The service doesn't keep access logs for reports.
Encrypted before it leaves your device
Your report is encrypted in your browser. The server stores only unreadable data, so system administrators and hosting providers cannot read it.
Hidden file details removed
Photos and documents can carry your name, device or location. We strip that from images and Office files on your device and warn you about anything we can't clean.
Only named investigators can read it
Only the designated Legal and People investigators hold decryption keys. You can see who they are, and remove anyone involved in your concern.
Works with Tor Browser
For extra protection you can use Tor Browser on its Standard or Safer setting. We never block anonymous connections.
No cookies, trackers or analytics
This site loads nothing from any other company: no analytics, no fonts, no third-party scripts. Your visit leaves no trail with advertisers or vendors.
How it works
Tell us what happened
Describe your concern in your own words and attach any evidence. Share your name only if you choose to.
Save your receipt key
You'll get a 16-digit receipt key and set a password. Together they are the only way back to your report, and we can't recover them.
Check back for a response
We acknowledge every report within 7 days and give you feedback within 3 months. You can answer questions while staying anonymous.
Before you start: protect yourself
- Use a personal device, not a Coalfire laptop or phone.
- Don't use the Coalfire network or VPN. Mobile data or home internet is better.
- Use a private or incognito window, or Tor Browser.
- Leave out details that only you would know, unless you want to be identified.
- Keep your receipt key somewhere only you can reach, not in a work account.
Our commitment: no retaliation
Coalfire does not tolerate retaliation against anyone who raises a concern in good faith, whether or not the concern turns out to be substantiated. Retaliation is itself a serious violation of our Code of Conduct and will be investigated.
Nothing in our policies stops you from reporting to a regulator or government agency directly.
What you can report
If you are unsure whether something qualifies, report it anyway or ask a question. We would rather hear about it.
In an emergency, or if someone is in immediate danger, contact local emergency services. This service is not monitored around the clock.
Other ways to raise a concern at Coalfire
- Your manager or any Coalfire leader
- Legal or People team
Reporting outside Coalfire
You also have the right to report to regulators and authorities, including: