A whistleblower practice needed infrastructure that matched its promiseWhistleblow.co

Testimonial

Insite helped us turn Whistleblow.co from an idea into a credible, secure, and accessible platform. Their thoughtful RFP response showed they understood the sensitivity of the mission, and they brought that same care, judgment, and technical skill to every stage of the build.

Goals

• Give whistleblowers a submission channel where sensitive documents are encrypted end to end and never stored in readable form.
• Publish whistleblowing news continuously so the site earns trust and search visibility, without turning the firm into a full-time newsroom.
• Meet WCAG 2.1 AA so the site is usable by everyone who needs it.
• Let firm staff manage content and review submissions without developer involvement.
• Deliver on a fixed 12 to 14 week timeline with client sign-off at each stage gate.

Pain Points

• The firm had no secure intake channel; a typical contact form stores submissions in plaintext, in a database, exactly where a whistleblower's identity should never sit.
• WordPress, the default choice for law firm sites, is the most attacked CMS on the web, and its plugin model creates an attack surface this audience cannot afford.
• Keeping a news section current by hand means daily research and data entry the firm did not have staff for, so the section would go stale.
• Three distinct audiences (whistleblowers, referring attorneys, the general public) needed different things from the same site, and the stakes of getting the first one wrong were the highest.

Solution

Insite built the site on Wagtail, a Python and Django CMS chosen over WordPress for its security model and version-controlled configuration. The submission pipeline is the heart of the build: each submission is validated, scanned for malware with ClamAV, zipped, encrypted to the firm's PGP public key, and delivered by email. No plaintext file and no submission blob is ever written to disk. Bot protection, rate limiting at the edge, and two-factor authentication on the admin round out the hardening, verified through static and dynamic security scanning and cooperation with third-party penetration testing.

For the news problem, Insite designed an automated curation pipeline as a follow-on change order. It monitors trusted sources daily, uses AI to summarize, tag, and score candidate stories, removes duplicates semantically rather than by URL, and creates the top stories as drafts in Wagtail. Nothing publishes without a human decision, and rejected stories never resurface. The automation does the research; the firm's reviewer keeps the judgment.