Whistleblowing, private.
A mature, self-hosted reporting platform with air-gapped operation, encrypted storage, and local AI. Designed to support EU Directive workflows.
Sensitive reporting needs controlled infrastructure
European whistleblowing rules create operational requirements around secure reporting, confidentiality, follow-up, and record keeping. The software is only one part of that system, but it should not force sensitive reports into infrastructure you do not control.
Reporters need to trust the system with their identity. That trust shouldn't depend on a third-party cloud.
Reporting that stays where you put it
DARC runs on your infrastructure — a server room, a Raspberry Pi, or a secure VM. Reports are encrypted at rest. AI runs locally through Ollama, anonymizing personally identifiable information without data ever leaving your network.
When deployed air-gapped, the reporting workflow and local AI can operate without external cloud accounts or model calls.
System architecture
DARC runs as a single Docker container. The browser client communicates with an Express server over REST. The service layer handles business logic, encryption, and database operations.
All data is encrypted using AES-256-CBC before reaching the SQLite database. Local AI through Ollama provides PII anonymization without any external network calls.
The entire system operates air-gapped. No external API calls. No telemetry. No cloud dependencies.
In practice
What DARC includes
A stable technical foundation for private reporting workflows; organizational policy and legal review remain part of compliance.
Air-gapped deployment
Runs fully offline. No internet connection required after setup.
Local AI (Ollama)
PII anonymization, report categorization, and triage — all on-device.
AES-256-CBC encryption
Reports are encrypted before they are stored in the local SQLite database.
Anonymous communication
Reporters and handlers communicate securely without revealing identity.
Case management
Track, assign, and resolve reports with full audit trail.
EU Directive workflow support
Supports confidential intake, follow-up, case handling, and audit records; it does not replace organizational and legal controls.
Docker deployment
Single command deployment. Runs anywhere Docker runs.
Raspberry Pi ready
A lightweight deployment option for controlled, small-footprint environments.
PWA and mobile responsive
Accessible from any device, no app store required.
Audit trail
Case actions are logged to support review and compliance documentation.
Deploy in minutes
Self-hosted whistleblowing with local AI, running on your hardware.
# Clone DARC
git clone https://github.com/formray/darc.git
cd darc
# Guided local setup
./setup.sh
# Verify the service
curl http://localhost:3000/healthOpen-source, open trust
DARC v5.6.0 is available under the MIT license. The repository includes reporting, encrypted storage, local AI integration, and case management.
The permissive license keeps a mature self-hosted product usable and adaptable without presenting an unverified commercial tier as part of the current offer.
A DARC deployment still needs an organization-specific risk assessment, operating procedures, retention policy, and legal review.
Ready to deploy?
DARC remains a maintained, mature option when a reporting workflow needs to stay on infrastructure you control.