Verified membership · Privacy by design · Independent by charter

Your Work Matters.
Your Privacy Matters More.

CivicVault is an independent digital space for verified journalists, activists, and human rights defenders to connect, communicate, and collaborate — with privacy at its core.

No fake identities·No data sale·No political affiliation·No voluntary disclosure to governments

Verified Membership

Identity verification helps prevent impersonation and fraudulent accounts. Verification establishes an identity or eligibility claim — nothing more.

Private Communication

Secure messaging and privacy-focused collaboration tools. The server stores only what delivery requires — never the contents of your private conversations.

Independent by Design

No political affiliation, worldwide. No selling member data, no advertising, and no voluntary disclosure of private user data to governments.

Why CivicVault Exists

The people documenting our world need a safer place to work.

Journalists, human rights defenders, and independent researchers face surveillance networks, impersonation, harassment, and account compromise — often simply for doing legitimate work in the public interest.

CivicVault reduces that exposure: verified membership, private communication, minimal data collection, and explicit independence from political and governmental influence.

What we will never do

  • Sell or monetize your personal information.
  • Advertise against sensitive personal attributes.
  • Profile members politically.
  • Voluntarily share private member data with governments.
  • Claim to be "unhackable," "invisible," or "government-proof."

Read our Government Data Request Policy →

Who Can Join

Built exclusively for verified public-interest professionals

Membership is by application only. CivicVault is not an open-registration social network.

Journalists & Independent Reporters

Institutional and independent reporters, editors, and photojournalists pursuing accountability reporting.

Human Rights Defenders & Activists

Those documenting abuses, advocating for dignity, and organizing lawful civic action.

Researchers & Eligible Professionals

Independent researchers and other professionals whose work serves transparency, justice, and public knowledge.

Request Verified Access

How Identity Verification Works

Verified membership, handled with restraint

  1. Apply — professional category, optional biography and credentials.
  2. Verify — human review of professional links — or, where a provider is configured, automated identity checks that never expose documents to staff.
  3. Review — an administrator approves, requests more information, or declines. Appeals are supported.
  4. Activate — MFA is required; passkeys and hardware keys are encouraged.

Full verification policy →

Deliberate separation

Legal identity materials, when collected, are kept apart from your public professional profile — and verification reviewers do not gain access to members' private communications or files.

Honest disclaimer: verification confirms an identity or eligibility claim. It does not guarantee that every statement made by a member is truthful.
Our Privacy Commitment

We collect the least we can

The technical architecture minimizes what the platform possesses in the first place. Message and file contents are end-to-end encrypted in transit between members; the server relays ciphertext and stores opaque encrypted objects. Security monitoring examines metadata only — never private contents.

Privacy Policy →

Your controls

  • Choose which profile fields other members may see.
  • Hide online status and last-seen information.
  • Control contact requests; block and report users.
  • Revoke devices and log out sessions remotely.
  • Data export and account deletion.
Security and Transparency

Engineered for the threats that matter

Protection against network interception, credential theft, account takeover, compromised devices, and API abuse — with limited, audited administrative access and tamper-evident audit logging. No platform is unhackable; we state plainly what we protect and what we cannot.

Security Principles → · Responsible Disclosure →

Security practices in production

  • Scrypt password hashing + TOTP multifactor.
  • Device-bound sessions; remote revoke.
  • Rate limiting, login throttling, and abuse detection.
  • Least-privilege administrator roles; hash-chained audit log.
  • Short retention for security telemetry; IPs anonymized.
Frequently Asked Questions

Straight answers

Is CivicVault completely secure or anonymous?

No — and anyone claiming that is misleading you. CivicVault protects the confidentiality of communications in transit between members and minimizes the data the platform holds. It cannot protect a compromised device holding your keys, and it does not grant legal immunity. See Security Principles.

Does CivicVault share data with governments?

CivicVault does not sell, broker, or voluntarily disclose members' private data to governments. Where lawful process compels disclosure, we review requests for legal validity and scope, challenge overbroad demands where legally possible, and notify affected members when permitted and safe. Full policy: Government Data Request Policy.

Who can read my messages?

Messages sent with end-to-end protection are ciphertext between members' devices; the server relays them without the ability to routinely read contents. Administrators use metadata-only signals (logins, devices, abuse patterns) to keep the platform safe — by design there is no administrative path to your private conversations or files.

What does "verified" mean?

A human reviewer confirmed your identity or eligibility claim using the evidence you provided (or a configured verification provider confirmed it). It establishes authenticity, not the truthfulness of everything a member may say.

Can anyone find my real identity from my profile?

No. The public-facing profile shows only the professional name or pseudonym you choose, plus fields you explicitly opt in to share. Legal names and verification records are never published. See Verification policy.

Can I delete my account and data?

Yes — via account deletion in your security settings (or by contacting support). Security telemetry has short retention, and verification records follow a documented retention and deletion policy. See Privacy Policy.

Request Access

Protect the Truth. Connect the Courageous.

Apply for verified membership. Applications are reviewed by administrators before access is granted.

Request Verified Access