The investigator's copy is only one place an anonymous report can exist. A platform may remove identifying detail before delivery while retaining an earlier version elsewhere. The security question is what remains retrievable—not just what the next recipient sees.
October's Crime Stoppers suspensions make that distinction operational. Toronto's timeline also illustrates an evidence trap: affected tip counts and associated names are different measures, and the names' roles were unclear. Neither should be converted into a universal count of exposed reporters.
A useful review begins with a defined anonymity promise, the first persistent write, and evidence of what survives processing, deletion, and recovery. It also asks what happens to urgent reporting if a channel is paused. Minimization helps; no single redaction step or clean synthetic test guarantees anonymity against every observer.
Read the practical review approach.