Protect yourself
Before you report anything, protect yourself.
Most whistleblower cases aren't lost on the facts — they're weakened by an avoidable mistake early on: a work email, a company laptop, a conversation with the wrong coworker. This is a practical, non-legal checklist for the period before and while you're gathering what you know.
This is safety guidance, not legal advice. For anything case-specific, an attorney experienced in whistleblower matters should weigh in — see the attorney directory.
Before you talk to anyone
- Don't tell your employer, HR, or the people involved that you're considering reporting — internal reports can trigger the exact retaliation you're trying to avoid, and they don't create the same legal protections a formal filing does.
- Be careful who among coworkers you confide in. Even well-meaning colleagues can (intentionally or not) tip off the people you're concerned about.
- If you're going to talk to anyone before filing, make it a whistleblower attorney under privilege — not a friend, not a journalist, not an anonymous forum.
Device & network hygiene
- Use a personal device, on your home or personal mobile network — never a company laptop, company phone, or company Wi-Fi to research, write, or upload anything related to this.
- Assume company devices are monitored: browser history, email, chat logs, and file access are commonly logged by IT and can be reviewed after the fact.
- Don't search for whistleblower attorneys, "qui tam," or this website from a work computer or while on a corporate VPN.
- Keep your personal accounts (email, cloud storage) separate from work accounts, with a strong, unique password and two-factor authentication.
Evidence handling
- Only take documents and data you already have lawful access to as part of your normal job — never break into systems, bypass access controls, or take things you were never authorized to see. Doing so can undermine your case and expose you to liability, regardless of what it reveals.
- Prefer copies over originals, and keep a simple log of what you have, where it came from, and when — this is what our evidence binder in the submission flow is built for.
- Before sharing photos or scanned documents outside your own devices, consider stripping identifying metadata with our metadata scrubber — photos especially can carry GPS location and device data you didn't intend to share.
- Store copies somewhere your employer can't reach — a personal cloud account or external drive, not a company drive or company email to yourself.
Communication opsec
- Use a personal, encrypted channel for anything sensitive — Signal is a reasonable default — rather than SMS, work chat tools, or regular email.
- Avoid discussing details over work Slack/Teams, work email, or on a call that could be recorded or logged by your employer.
- You can start completely anonymously — our submission flow and case quiz never require a name, email, or phone number to begin.
Avoiding retaliation triggers
- Keep doing your job the way you normally would. A sudden change in behavior, performance, or attitude can itself draw scrutiny.
- Document your own performance record as you go (positive reviews, completed work) — if retaliation happens later, a clean record makes it easier to show.
- Know your protections and learn to recognize retaliation early — see our retaliation protections guide and self-check.