See something we missed?

If you have a tracked donor, named executive, or routing pattern we should know about, four channels are open. Pick whichever matches your risk profile.

FOUR CHANNELS· PICK BY RISK PROFILE

Public keys & address

01OPERATIONAL · MVP
Encrypted email.
Send to support@boycat.io with the subject prefix [TIP]. Our PGP key is published on the methodology page; encrypt before sending if the source is at risk.
support@boycat.io
02OPERATIONAL · MVP
Signed PGP.
Public key fingerprint listed on the methodology page. We sign every acknowledgment. Decrypt happens off-net on a dedicated key handled by a single editor.
View PGP key
03V2 · Q4 2026
SecureDrop.
An onion service for higher-sensitivity tips. URL is published only here once the intake is hardened. We do not log IP, cookies, or any browser fingerprint at this endpoint.
URL PUBLISHED ON LAUNCH
04OPERATIONAL
Signed letter.
A physical mailing address is listed on the methodology page. Useful when air-gap is the constraint. We acknowledge receipt to the return address you supply (or none if you don't).
URL PUBLISHED ON LAUNCH

SOURCE PROTECTION

We don't log what you don't want logged.

No request logs. The tip endpoints don't persist IP, user-agent, or referrer. Email is decrypted offline.
Offline decryption. PGP is processed on an air-gapped key handled by a single editor. Plaintext lives only on disk briefly.
Right of reply. Any company named in a tip gets 14 days to respond before we publish — unless the tip is already public record.
No identification. We don't ask for a real name, return address, or relationship to the company. Ever.

Open mail client

Right of reply policy

See something we missed?

Encrypted email.

Signed PGP.

SecureDrop.

Signed letter.

We don't log what you don't want logged.

See something we missed?

Encrypted email.

Signed PGP.

SecureDrop.

Signed letter.

We don't log what you don't want logged.