<commit_before>.. _Deployment:

Overview
========

SecureDrop is only as secure as the environment that surrounds it. To
keep sources safe, the news organization's website must employ a set of
basic security best practices or else you risk losing any source
protection provided by SecureDrop.

While SecureDrop itself is located on a Tor hidden service, news
organizations also need to create a SecureDrop landing page that will
explain how SecureDrop works, give sources instructions on how to access
the Tor hidden service, and disclose the risks.

It is important to keep in mind that implementing SecureDrop will bring
more attention to your organization by security researchers, hackers,
and other like-minded people. If the landing page minimum requirements
are not implemented, these people will be sure to loudly point this out
on Twitter and other blogs as a #SecurityFail. This will discourage
potential sources from using your instance of SecureDrop. However, it
can easily be avoided by following the below best practices.

Freedom of the Press Foundation eventually plans to `list all of those
SecureDrop onion URLs <https://securedrop.org/directory>`__ as
"verified" on its website that meet the minimum requirements for
deployment best practices. If your organization cannot follow the
minimum guidelines we cannot recommend to users that your SecureDrop
instance is safe to use.<commit_msg>Recommend in deployment introduction that orgs have a privacy policy<commit_after>.. _Deployment:

Overview
========

SecureDrop is only as secure as the environment that surrounds it. To
keep sources safe, the news organization's website must employ a set of
basic security best practices or else you risk losing any source
protection provided by SecureDrop.

While SecureDrop itself is located on a Tor hidden service, news
organizations also need to create a SecureDrop landing page that will
explain how SecureDrop works, give sources instructions on how to access
the Tor hidden service, and disclose the risks. We recommend to also include a
privacy policy (see our :ref:`Sample Privacy Policy`)
that describes what data is collected and how it will be used by your
organization.

It is important to keep in mind that implementing SecureDrop will bring
more attention to your organization by security researchers, hackers,
and other like-minded people. If the landing page minimum requirements
are not implemented, these people will be sure to loudly point this out
on Twitter and other blogs as a #SecurityFail. This will discourage
potential sources from using your instance of SecureDrop. However, it
can easily be avoided by following the below best practices.

Freedom of the Press Foundation eventually plans to `list all of those
SecureDrop onion URLs <https://securedrop.org/directory>`__ as
"verified" on its website that meet the minimum requirements for
deployment best practices. If your organization cannot follow the
minimum guidelines we cannot recommend to users that your SecureDrop
instance is safe to use.
{'fraction_non_alphanumeric': 0.03194993412384717, 'fraction_numerical': 0.0, 'mean_word_length': 5.086172344689379, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1051220', 'n_tokens_mistral': 691, 'n_tokens_neox': 648, 'n_words': 458}