Whistleblower and Secure Source Policy

Purpose

DeshiAI welcomes credible information concerning wrongdoing, abuse of authority, deception, technology misuse, security failures, corruption, discrimination, privacy violations, data abuse, environmental harm, institutional misconduct and other matters carrying genuine public importance. A whistleblower may be an employee, former employee, contractor, adviser, official, professional, researcher, developer, customer, community member or another person with relevant knowledge.

A source does not need to establish an entire case before making initial contact. DeshiAI will nevertheless seek to verify material claims independently before publication. Providing information does not guarantee anonymity, payment, editorial acceptance or publication.

Matters That May Be Reported

Potential matters include fraud, corruption, misuse of public resources, concealed conflicts, deceptive technology practices, serious product or safety failures, unlawful discrimination, abuse or harassment, privacy violations, unauthorized surveillance, misuse of personal data, manipulation of records, scientific or technical misconduct, environmental damage, public-interest technology risks, institutional cover-ups, political or regulatory interference, election-related technology misconduct, cybersecurity failures, retaliation against employees, misleading claims about AI or technology, exploitation of vulnerable people or other conduct with significant public consequences.

A private employment or business dispute may contain a legitimate public-interest issue. DeshiAI distinguishes an individual grievance from evidence suggesting broader misconduct, systemic failure or harm affecting others.

Initial Contact

Initial contact may be made through editorial@deshiai.in. The first message should contain only enough information for DeshiAI to understand the nature of the matter, how the source knows about it, whether supporting evidence exists, who may be affected, whether there is an immediate safety risk, what consequences the source faces, the relevant jurisdiction, any important deadline and which communication method may be appropriate.

The first message should not include passwords, private keys, complete databases, collections of identity documents, unrelated medical records, intimate material, malware, harmful exploit code, archives that unnecessarily identify a source, classified information or legally restricted material without prior discussion. Ordinary email should not be assumed to provide complete confidentiality or end-to-end security.

No Automatic Confidential Relationship

Sending a message does not automatically create attorney-client privilege, employment protection, legal immunity, source confidentiality, legal representation, a commitment to publish, an obligation to pay or a guarantee of anonymity. Confidentiality and attribution arrangements are established expressly where applicable. DeshiAI nevertheless treats apparently sensitive information with appropriate care while assessing whether a protected source relationship can be established.

Information to Provide

Where it is safe to do so, a source should explain what happened, when and where it occurred, who was involved, the source’s role, how the information was obtained and what evidence exists. The source should also explain whether records are original, whether other people can corroborate the information, whether the matter was reported internally, whether regulatory or legal proceedings exist, whether the source has a dispute with the subject, what harm may continue, what risks disclosure could create and why the matter is of public interest. Direct firsthand knowledge should be distinguished from information received from others.

Identity Verification

DeshiAI may need to verify a source’s identity privately even when the source’s name will not be published. Verification may involve professional position, employment history, institutional access, direct communication, contemporaneous records, limited identity documentation, specialized knowledge, corroborating sources or other proportionate methods. DeshiAI will seek to avoid collecting unnecessary identifying information, and documents should not be sent until an appropriate submission method has been discussed.

Anonymous and Confidential Treatment

Anonymity may be considered where identifying the source creates a credible risk of dismissal, retaliation, legal action, discrimination, professional harm, physical danger, harassment, family consequences, financial punishment or another serious outcome. The responsible editor will generally need to know the source’s identity, basis of knowledge and relevant motivation. Published descriptions of anonymous sources will be as specific as safety reasonably permits. Anonymity is not provided simply to support unverified allegations or personal attacks.

Limits of Protection

DeshiAI may use proportionate security measures but cannot promise absolute confidentiality. Risks can arise from compromised devices, workplace monitoring, email metadata, cloud services, malware, shared accounts, backups, legal orders, physical seizure, communication patterns, document metadata, human error, third-party disclosure or information already known by others. Sources facing serious consequences should consider obtaining independent legal and digital-security advice. DeshiAI is not the source’s lawyer, union representative, employer adviser or personal security provider.

Secure Communication

The appropriate communication method depends on the level and nature of risk. Available safeguards may include encrypted messaging, encrypted email where available, secure file transfer, separate devices or accounts, avoiding workplace systems, strong authentication, metadata reduction, controlled document access, identity separation and secure storage. DeshiAI does not represent any communication method as completely secure, and sources should not be encouraged to use a technical system they cannot operate safely.

Documents and Evidence

Documents may be assessed for authenticity, origin, date, version, completeness, signatures, metadata, editing, missing context, internal consistency, legal restrictions, privacy implications, security concerns and the source’s relationship to the material. A confidential document does not automatically establish the truth of every statement within it. Draft policies should not be represented as final decisions, and screenshots may be altered, incomplete or misleading.

DeshiAI does not encourage sources to commit unlawful or disproportionate acts to obtain information. A source should not hack systems, deploy malware, steal unrelated personal information, expose credentials or private keys, collect intimate material, unlawfully enter restricted premises, impersonate another person, manipulate records, deliberately provoke misconduct, endanger others or obtain more information than reasonably necessary. DeshiAI may decline material where the method of acquisition creates unacceptable legal, ethical or safety concerns.

Verification

Whistleblower information is treated as a lead rather than automatically as established fact. Verification may involve documents, independent witnesses, public records, technical examination, financial analysis, direct observation, responses from the subject, regulatory records, contemporaneous communications, datasets and expert review. A source may be acting honestly while being mistaken, may have direct knowledge of a particular incident without knowing the wider circumstances, or may interpret evidence differently from what the evidence actually demonstrates.

Source Motivation

DeshiAI considers whether a source is motivated by public-interest concerns, a personal grievance, an employment dispute, political interests, financial interests, legal strategy, competition, ideology, an expectation of payment, retaliation or a combination of motives. A self-interested or mixed motive does not by itself make information false, but it may affect the level of corroboration required and whether relevant disclosure is appropriate.

Payment

DeshiAI does not ordinarily pay for source information. Payment can create incentives to exaggerate, fabricate or selectively provide evidence. Reasonable expenses may exceptionally be considered when necessary, approved beforehand and unrelated to the substance, sensational value or outcome of the information. No payment is promised simply because information appears important or newsworthy.

Editorial Control

A whistleblower or confidential source does not control the final article, headline, publication timing, source selection, inclusion of contrary evidence, legal review, classification, conclusions, corrections or subsequent reporting. A source may identify factual or safety concerns, but DeshiAI retains independent editorial responsibility for deciding whether and how material is published.

Limited source review may be permitted for quotation accuracy, chronology, technical explanation, description of the source, identifying details and safety concerns. Full-draft approval is not normally offered, and a source cannot require the removal of relevant evidence solely because it is unfavorable.

Public-Interest and Harm Assessment

Before publication, DeshiAI considers the seriousness of the conduct, reliability of the evidence, present or potential harm, power or influence of the subject, consequences for the public, source risk, privacy of uninvolved people, legal status, available alternatives, necessity of identification, proportionality and whether publication can be responsibly defended. Public curiosity, sensational appeal, search traffic or commercial value alone are not sufficient grounds for publication.

Protection of Uninvolved People

Leaked files may contain personal information belonging to people unrelated to the reported conduct. DeshiAI seeks to avoid publishing private addresses, account numbers, government identification numbers, health information, children’s information, private communications, family details, personal photographs, precise location information, passwords, private keys, unrelated financial information and other unnecessary personal data. Redactions should be assessed to reduce the possibility that hidden information can easily be recovered.

Immediate Danger

Where information indicates an immediate threat to life, physical safety, critical infrastructure or important digital systems, DeshiAI may consider action beyond ordinary publication. This could include contacting an appropriate authority, advising the source to seek emergency assistance, delaying publication, limiting technical details, coordinating responsible disclosure, preserving evidence, seeking legal advice or taking steps to protect affected people. Any response will consider source safety, applicable law, urgency and the risk that intervention could make the situation worse. DeshiAI is not an emergency service and cannot guarantee an emergency response.

Security Vulnerabilities

Good-faith reports of vulnerabilities affecting DeshiAI should be sent to security@deshiai.in. Vulnerabilities involving another organization may require coordinated disclosure before publication. A source should not continue exploiting a vulnerability after obtaining sufficient evidence, and DeshiAI will avoid publishing technical information that materially enables further harm before reasonable remediation where the public-interest benefit does not justify that risk.

Retaliation

Retaliation against a source may itself become a matter of public interest. DeshiAI may examine dismissal, threats, lawsuits, demotion, surveillance, harassment, blacklisting, disciplinary measures, immigration consequences, financial punishment or pressure placed on family members. DeshiAI does not promise that reporting will prevent retaliation, and any coverage remains subject to verification, fairness and public-interest considerations.

Withdrawal and Source Deception

A source may request withdrawal before publication. DeshiAI considers the original confidentiality arrangement, any new safety risk, independently obtained evidence, public interest, legal obligations, publication status, source deception, whether reporting can continue without exposing the source and the effect on the reliability of the work. Withdrawal does not automatically remove independently verified facts, although a credible new safety concern may justify delaying, modifying or cancelling publication.

If a source materially deceives DeshiAI, the publication may assess false identity, fabricated evidence, undisclosed financial interests, manipulated documents, incomplete records, false chronology, personal retaliation, coordinated influence efforts and the effect on other sources or published claims. The relationship may end, and previously published work may require correction or retraction. Confidentiality will not be withdrawn simply as punishment.

Records and Publication Disclosure

Source records are retained only for as long as reasonably necessary for verification, accountability, legal defense, source protection, corrections, investigation, safety and preservation of evidence. Access should be limited, and source identity should not be unnecessarily placed in public content-management systems, shared commercial folders or article metadata.

Where protected sourcing materially contributes to an article, DeshiAI will explain, as safely as possible, the source category, basis of knowledge, reason for anonymity, corroboration, documents reviewed, relevant limitations and whether the subject was given an opportunity to respond. The explanation should not expose the source through an unnecessary combination of identifying details.

No Guarantee of Publication

Providing information does not guarantee publication. DeshiAI may decline material because of insufficient verification, limited public interest, excessive risk, unclear rights, unlawful acquisition, source deception, editorial capacity, inability to adequately protect people, legal restrictions or incomplete evidence. DeshiAI may continue investigating information without immediately publishing it.

Contact

Initial source contact may be made through editorial@deshiai.in. A source who believes DeshiAI has breached an agreed confidentiality condition may contact complaints@deshiai.in and should avoid sending unnecessary sensitive information through ordinary email.