Trust & security
SecretDrop is built to hand someone a credential and leave nothing behind. Here's exactly how it protects what you send.
Gone on read
Every secret has a fuse: a read limit, an expiry, or both. The moment it's read — or the moment it expires — the ciphertext is permanently zeroed on our servers. Not hidden, not archived, not soft-deleted. Unrecoverable, including by us. A small metadata tombstone (a hash and a burn timestamp, never the content) is kept briefly to block replay attacks, then purged.
Encrypted, and unreadable to us after it burns
Your secret is encrypted in transit (TLS) and at rest using ChaCha20-Poly1305. Once it burns, the encryption key material for that secret is destroyed along with it — so even we cannot recover or read what you sent.
No account, no identity
There's no sign-up, no email, no app. We don't ask who you are and we don't try to find out. There's no user profile to leak, because there's no user profile.
European by design — built in Norway, hosted in Germany
SecretDrop is made by Agdir Drift AS, a Norwegian company, and runs on servers in Germany — inside the EU and under the General Data Protection Regulation (GDPR). Your secret never leaves European jurisdiction. See our privacy policy for the full detail.
SOC 2 Ready
SecretDrop is built against SOC 2 Type II security controls: access control, encryption at rest and in transit, audit logging, and incident response procedures are all in place. We are preparing for formal third-party audit.