Armed
If this check-in is missed, the file leaves.
Snooze resets the clock — 30 days at most. The public page can show that this trigger exists without showing the payload.
- Next check-in
- 0d
- Real delete
- PIN
A switch for people who hold files
Trishul
If you can check in, they can still talk. If you cannot, the file is guaranteed to leave.
Silencing a journalist should not bury the story. Arm email triggers and snooze them — 30 days at most. Miss a check-in and they fire. A public page proves the switch is live, without showing more than you choose.
NewsroomField reportingSource protectionWhistleblowingLegal holdHostile travelActivist filesInsurance copy
NewsroomField reportingSource protectionWhistleblowingLegal holdHostile travelActivist filesInsurance copy
NewsroomField reportingSource protectionWhistleblowingLegal holdHostile travelActivist filesInsurance copy
NewsroomField reportingSource protectionWhistleblowingLegal holdHostile travelActivist filesInsurance copy
The inversion
The fear of a leak is the problem. It is also the lock.
People have been killed because someone feared a file. Trishul inverts that: while you can check in, there is still a maybe. If you are silenced, there is none.
01
You can still check in
The dispatch might leave. There is room to wait, snooze, or negotiate. The payload is not public by default.
02
You cannot check in
The dispatch is guaranteed to leave. No meeting cancels it. Deletion still needs the PIN they should never see.
Three tines
Arm. Check in. Prove it.
Arm the dispatch
Schedule what must leave. It sits until you snooze it — or until you cannot.
Check in, or it fires
Snooze is the heartbeat. Thirty days at most. If you do not return, the trigger does not wait.
Prove it is armed
The public page exists so those who would silence you can see the switch is live. You decide what they see.
Sequence
Arm it. Keep the heartbeat. Show the proof.
- 01
Write what must leave
Recipient, subject, body, attachments — the dispatch as it should go out.
- 02
Arm the clock
Set the hour. Until you snooze, it is armed, not sent.
- 03
Snooze is the check-in
Reset the window — 30 days at most. Missing it is the signal.
- 04
Publish the proof
A public page and QR show that triggers exist, with only the fields you reveal.
Heartbeat
Snooze is how you stay in the story.
Each check-in pushes the clock. If the check-ins stop, the dispatches do not.
Heartbeat
Trigger armed
Waiting on the next snooze
The kit
Enough proof to deter. Not enough to leak.
You choose the reveal
Show recipient, subject, body — or none of it. The page is a deterrent, not a dump.
PIN to delete
Real deletion asks for the seal. A coerced “wipe” should not reach the live triggers.
30-day heartbeat
Snooze one trigger or the whole desk. Miss the window and they fire.
QR as proof
Hand someone a code that shows the switch is armed. The payload stays off the page.
Under duress
A lookalike desk, on purpose.
A decoy password will open a fake dashboard so a forced “delete everything” can happen on empty triggers. That layer is not in this build yet. Today, live deletion still requires the PIN.
Next tine
PIN to delete
Real deletion asks for the seal. A coerced “wipe” should not reach the live triggers.
Deterrence
Let them see the switch is live.
The public page is for the people who would rather you disappeared. They should see that killing the messenger releases the file.
Scheduled
Dispatch armed
Payload hidden by sender
Until next check-in
0d
Fields shown
0/5
Make silence the worse option.
Hosted in Germany. You control the payload, the proof, and the PIN.