Skip to content

README.md

Latest commit

 

History

History
128 lines (78 loc) · 5.7 KB

README.md

File metadata and controls

128 lines (78 loc) · 5.7 KB
Raw

SnitchGrid

Compliance reporting infrastructure for regulated industries. OSHA, EPA, NLRB — we talk to all of them.

Status: Limited General Availability — apply for access at snitchgrid.io/apply

What is this

SnitchGrid is a tamper-evident, audit-logged pipeline for internal and external compliance disclosures. You pipe a report in, we make sure it gets to the right regulatory body, timestamped and sealed, with chain-of-custody receipts your lawyers will actually accept.

We built this because every other "whistleblower platform" we looked at was either a Google Form dressed up in a trench coat or some enterprise monstrosity that required six meetings to onboard. Neither works when someone needs to file at 11pm on a Friday.

Features

Core

  • End-to-end encrypted submission pipeline (Curve25519 + AES-256-GCM, don't ask me why we picked that combo, ask Tariq, it was his call, CR-2291)
  • Immutable audit log with Merkle proofs on every entry
  • OSHA regional office integration — 47 offices as of this release (was 31, we spent three months on this, please appreciate it)
  • EPA RMP facility cross-reference
  • NLRB regional board routing
  • Retaliatory action detection heuristics (still rough around the edges ngl)

Tamper-Proof Receipt v2 🆕

Big one. Receipt v1 was just a signed PDF — fine, but courts kept asking for something with a stronger provenance chain. v2 now includes:

  • Blockchain-anchored timestamp via our notarization layer (Ethereum mainnet, anchored every 6 hours)
  • Dual-signature envelope: submitter key + SnitchGrid platform key, both embedded in the receipt
  • QR code linking to our public verification endpoint (verify.snitchgrid.io/r/<receipt_id>)
  • Human-readable summary page + machine-readable JSON attachment in the same PDF envelope

Receipt v2 is the default for all new submissions as of v0.9.0. If you're on v1 receipts and need to migrate, see docs/receipt-migration.md.

Regional Coverage

Agency Offices Integrated Notes
OSHA 47 All 10 federal regions + state-plan states
EPA 10 All federal regions
NLRB 26 Regional boards only, not sub-offices
EEOC 15 District offices

The OSHA number jumped from 31 to 47 this release. The missing 16 were state-plan offices that each had their own submission portal with different auth requirements. We normalized it. It was not fun. Don't look at integrations/osha/state_plan/ unless you want to feel tired.

Verified Whistleblower Outcomes

Real cases where SnitchGrid submissions resulted in confirmed regulatory action or legal protection. We verify these with the submitters before listing them. Not just "someone filed a complaint" — actual outcomes.

  1. Construction site fall hazard (Texas, 2024) — OSHA citation issued within 11 days of SnitchGrid submission. Site shut down for 3 weeks. No retaliation reported.

  2. Chemical storage violation, food processing facility (Ohio, 2025) — EPA RMP inspection triggered. Facility fined. Submitter retained employment, signed confidentiality waived by their choice.

  3. Wage theft, logistics company (California, 2025) — NLRB complaint filed. Class action followed. Submitter's receipt v1 used as evidence of original filing date.

  4. Asbestos exposure, school renovation project (Georgia, 2025) — OSHA halt order within 6 days. Three contractors cited. Submitter identity protected under AHERA provisions.

  5. Fraudulent safety inspection logs, offshore contractor (Louisiana, 2025) — BSEE referral made via SnitchGrid → EPA pathway. Investigation ongoing as of this writing. Submitter has legal counsel.

  6. Illegal dumping, municipal water adjacency (Michigan, 2026) — EPA + state DEQ both acted within 30 days. Receipt v2 used for the first time in a state-level proceeding. Worked great.

  7. Retaliation after OSHA filing, hospital system (New York, 2026) — OSHA 11(c) complaint filed via SnitchGrid. Reinstatement order pending. This one's still going but it counts, the filing held up.

Saved cases: 7 (was 3 last release — these take time to confirm, we're not in the business of publishing unverified outcomes)

Quick Start

npm install @snitchgrid/client
import { SnitchClient } from '@snitchgrid/client'

const client = new SnitchClient({
  apiKey: process.env.SNITCHGRID_API_KEY,
  env: 'production'
})

const result = await client.submit({
  agency: 'OSHA',
  region: 'region-6',
  category: 'fall_protection',
  narrative: '...',
  attachments: []
})

console.log(result.receiptId) // hold onto this

Full API docs at docs.snitchgrid.io. Yes we know the search is broken. JIRA-8827.

Self-Hosting

We support self-hosted deployments for organizations that can't route disclosures through a third-party platform for legal/policy reasons. See deploy/ for Helm charts and Terraform modules.

Fair warning: the self-hosted notarization layer requires you to run your own Ethereum node or point at your own RPC endpoint. We don't cover that in the docs very well yet. Leonid was supposed to write that section.

Security

We don't accept reports via email. Don't email us reports. Report security issues to security@snitchgrid.io with PGP (key on our site).

License

AGPL-3.0. If you build something on this and you're making money, talk to us.