Skip to content

For what you shouldn’t say in plaintext.

Encrypt it to security@eclean.gg and only we can read it. Usually that means a vulnerability report, but anything private is welcome.

Fingerprint

1736 5809 F645 A554 138C 9BB0 61C9 8FC6 1C63 6124

Verify every character before you trust the key. A fingerprint that almost matches is still a different key.

The key itself.

Bound to
eclean <secure@eclean.gg>
Key ID
61C98FC61C636124
Algorithm
Ed25519
Created
July 31, 2026
-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEamxzBxYJKwYBBAHaRw8BAQdAhvKjDg2pyK99b3QyFW/8XC4NEp8sxeF/3Bvu
CeC17JK0GWVjbGVhbiA8c2VjdXJlQGVjbGVhbi5nZz6IrwQTFgoAVxYhBBc2WAn2
RaVUE4ybsGHJj8YcY2EkBQJqbHMHGxSAAAAAAAQADm1hbnUyLDIuNSsxLjEyLDAs
MwIbAwULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRBhyY/GHGNhJDmqAQDC
KFFWTYHGbDnFJ0Kx88XuPH64EwFzXCHqbArZa/qndwEA+TCwibhhXwgXzP4AWEts
sm01ORLYORo6lkLjZp+txgW4OARqbHMHEgorBgEEAZdVAQUBAQdAyd62N8j1EPKd
oymZyin4pbFiOlPcUUaJnVjsY9je5g0DAQgHiJQEGBYKADwWIQQXNlgJ9kWlVBOM
m7BhyY/GHGNhJAUCamxzBxsUgAAAAAAEAA5tYW51MiwyLjUrMS4xMiwwLDMCGwwA
CgkQYcmPxhxjYSRk3wD+NzePVI2xnRD9oJoLZPkR8U01zhBwcY4CX1NB4yXpYeAA
/0vnRPOg9kESuwKILy04OsXhbhOsFkhQ62qy1s7q74wE
=A8s8
-----END PGP PUBLIC KEY BLOCK-----

The raw file at eclean.gg/pgp/eclean-security.asc carries this same key. It is what your tooling imports and what our security.txt points to. The key is also published on keys.openpgp.org for WKD lookups, so treat this page as the source of record.

Three commands, start to finish.

The whole flow runs in stock gpg, with nothing to install beyond what you already run.

  1. 1

    Import the key

    Fetch the raw key straight into your keyring. The file and this page carry the same key.

    curl -s https://eclean.gg/pgp/eclean-security.asc | gpg --import
  2. 2

    Verify the fingerprint

    The output must match the fingerprint above, all forty characters of it.

    gpg --fingerprint secure@eclean.gg
  3. 3

    Encrypt and send

    Mail the result to security@eclean.gg. A person decrypts it, and only that person reads it.

    gpg --armor --encrypt -r secure@eclean.gg message.txt

Asked and answered.

Who is this for?

Anyone with something confidential to tell us. Security researchers use it most, but the key works the same for a whistleblower, a journalist, or a customer who would rather not write in the clear.

What is PGP?

An encryption standard from 1991, also called OpenPGP. Anyone can lock a message with the public key on this page, and only our private key can unlock it. Free tools like gpg speak it on every platform.

Do I have to encrypt?

No. Plain mail to security@eclean.gg reaches the same person. It just travels like any other email and can be read along the way. Encrypt when the content deserves it, or use the whistleblowing service below.

Can I get support here?

No. Support is faster at hello@eclean.gg, where the whole team can help you. This inbox is reserved for messages that actually need encryption.

Who can read what I send?

Between your machine and ours, nobody, which is what the encryption is for. At our end, one person holds the private key and decrypts on hardware we control. The plaintext is not pasted into ticket systems or shared inboxes.

Will I get a reply?

Yes, from a person, confirming what you sent arrived and what happens next. Include your own public key if you want that reply encrypted too.

Reported bugs get fixed. Reporters get named.

Report a vulnerability privately, give us time to fix it, and your name goes on the acknowledgements page for good.

Read the acknowledgements

Rather skip the key entirely?

The whistleblowing service takes anything confidential straight through the browser, no key or mail client required, open to customers and eclean employees alike.

Go to whistle.eclean.gg