The short version
When you use our Contact, Join or event-signup form, your browser takes the personal information you entered and encrypts it with DeFlock Metro Detroit’s public OpenPGP key before those form contents are sent to our server-side form handler.
The submission that leaves your browser contains an encrypted PGP message instead of readable personal fields such as your name, email address, municipality, Matrix ID, message or event membership answer.
Only the matching private key can decrypt that content. That private key is kept in our Proton Mail account and is never placed on this website.
We never need your private encryption key, either.
What happens when you press Submit
- Your browser validates the fields you chose to complete.
- On forms that offer an optional OpenPGP public-key attachment, your browser reads and validates that key locally if you supplied one.
- Your browser packages the form information together.
- OpenPGP encryption runs in your browser using our published public key.
- The browser sends the encrypted PGP block, a Cloudflare Turnstile anti-abuse token and a non-sensitive spam-trap field to our form endpoint. Event signups also send the public event slug, title, date and time outside the ciphertext so the delivery email can be labeled.
- Cloudflare verifies the anti-abuse token.
- Our server-side form handler forwards the encrypted PGP block through Resend. Contact and Join submissions use a generic subject. Event signups use a subject containing only the already-public event title, date and time so we can sort registrations without exposing attendee details.
- The encrypted message arrives in our Proton mailbox, where the corresponding private key can decrypt it.
We do not intentionally create a separate website database or CRM record from an ordinary Contact, Join or event-signup submission.
What the encryption protects
The encrypted payload contains the information you intentionally entered in the form, including your:
- name or alias;
- email address;
- municipality;
- Matrix ID on the Join form;
- message, participation choices or event membership answer;
- supporting URL, if supplied;
- and optional OpenPGP public key for an encrypted reply.
Those fields are encrypted before submission.
We also avoid putting your email address into the outbound email’s Reply-To header. Contact and Join submissions use a generic subject. Event signup subjects contain the public event title, date and time, but not the attendee name, email address or membership answer.
What the encryption does not make anonymous
Encryption protects message contents. It does not make the network connection disappear.
Your internet provider and the infrastructure used to deliver the website necessarily handle technical connection information. Cloudflare can process information such as the connecting IP address and browser/security signals in order to deliver the site, operate Turnstile and provide other anti-abuse protections.
Our form code does not copy your IP address into your submission or email it to us.
The form endpoint also reveals to Cloudflare which form endpoint the browser contacted. Resend necessarily sees our website sender address, our Proton recipient address, the email subject and the encrypted PGP block it is asked to deliver. For an event signup, the subject contains public event information as described above.
So this is content encryption, not an anonymous tip system.
Why we do it this way
A privacy-focused organization should not ask people to trust more intermediaries with readable personal information than necessary.
HTTPS already encrypts traffic while it travels between your browser and the website. Browser-side OpenPGP adds another layer: the message itself is encrypted for our key before it enters the form-delivery pipeline.
That means an email relay does not need the ability to read the message merely to deliver it.
What if the website itself were compromised?
Browser-side encryption has an important limitation: the encryption code is delivered by this website.
If an attacker gained control of the website and maliciously replaced that code, they could potentially change what the browser does before encryption takes place.
We reduce that risk by keeping the site small, avoiding advertising scripts, minimizing third-party JavaScript, keeping Google Analytics off until a visitor explicitly allows it, bundling the OpenPGP library with our own site build rather than loading it from a third-party CDN, using a restrictive Content Security Policy, and publishing the public key used by the form.
No web form should be described as magically risk-free.
Our public key
The public key used by the forms is intentionally public. A public key can encrypt information for us, but it cannot decrypt messages that were encrypted to it.
Download the public OpenPGP key used by our forms
Current fingerprint: D865 6765 DF95 85E7 0585 09F7 4ED5 E857 6348 38DD
The forms verify that the downloaded key matches this fingerprint before enabling submission. If we deliberately rotate the key, we will replace the published key and fingerprint together and date this page. If we believe the private key may have been compromised, we will stop accepting encrypted form submissions until a replacement is deployed, revoke the old key where the key service permits, and publish a notice identifying the retired fingerprint. We do not ask visitors to rely on a silently changed key.
Our private key is not stored on this website and should never be shared.
Want an encrypted reply?
If your email address is hosted by Proton Mail, ongoing Proton-to-Proton messages are automatically end-to-end encrypted by Proton. That is the easiest option for people who want encrypted correspondence without managing OpenPGP manually.
If you use another provider and already have an OpenPGP key pair, the Contact and Join forms let you optionally attach your public key. Your browser includes that public key inside the encrypted submission. After we verify and add it to the appropriate Proton contact, Proton can use it to encrypt replies to that external address.
Never send us your private key.
Why we recommend Proton for the easy route
OpenPGP works with many providers and mail clients, but manual key management can be awkward.
Proton integrates PGP directly. Messages between Proton users are end-to-end encrypted automatically, while advanced users can also configure PGP encryption for external addresses.
You do not need a Proton account to contact us. It is simply the easiest option if you want the conversation after your form submission to remain end-to-end encrypted with minimal setup.
This still is not an anonymous tip line
Please do not confuse encryption with anonymity.
If you need to protect your identity from network observers, device compromise, legal process or other advanced threats, an ordinary website form may not be the right channel. DeFlock Metro Detroit does not currently claim to operate an anonymous whistleblower or secure-drop system.
We would rather describe the protection accurately than promise more than the technology provides.
Technical references
- Proton Mail: How to use PGP
- Proton Mail: Downloading and sharing public keys
- OpenPGP.js documentation