# How a journalist protects sources before a checkpoint > nTilia's Travel Mode separates what travels on the phone from what stays out of reach. Canonical: https://ntilia.com/u/davidherreman/en/how-a-journalist-protects-sources-before-a-checkpoint Language: en Author: David Herreman (https://ntilia.com/u/davidherreman) Published: 2026-09-01T16:06:53.294+00:00 Last updated: 2026-09-07T18:30:13.822+00:00 Series: nTilia (https://ntilia.com/u/davidherreman/s/ntilia?lang=en) Tags: travel mode, journalist safety, checkpoint, source protection, encrypted files, field reporting, data security, nTilia Pro --- > Purpose of this article: to help you understand nTilia's Travel Mode. To master *before* any mission in a sensitive area — where compromising journalistic content can cost far more than a scoop: a source's anonymity, the safety of a contact left behind, sometimes someone's freedom or life. On assignment, a phone is never a neutral object: it's a gateway to everything gathered, and a checkpoint is enough to open it. What follows is a fictional scenario, but every step corresponds to a real nTilia feature and to actions any field journalist can adopt. ## In line, 200 meters from the checkpoint The line has been crawling forward for half an hour. Night has fallen. Two rows back, a phone lights up in a car — too much light, a hand pushes it down against a thigh. Ahead, silhouettes, the glow of flashlights on hands, faces, pockets. A fixed post or a makeshift barrier: a checkpoint. Here, every phone gets searched. Some cars are waved to the side by armed soldiers. Before my turn, I run through the checklist again: Travel mode active, vault locked, Signal cleared, camera roll and maps wiped, biometrics off. It's my turn. The soldier holds out his hand. I unlock it, hand over the phone. ![Phone search at the checkpoint](https://estwtgoraddyvzadcfnx.supabase.co/storage/v1/object/public/article-images/c259246f-b887-4e6c-a30f-d8bc097924be/009c0757-9d4c-41f5-ab25-5e9b87fd5b6a/e8b94741-fc0d-40d5-8911-d2180787ab5a.jpg "Generated by Gemini. David Herreman - ntilia.com") He scrolls through the apps, opens nTilia. The screen lights up his face. He goes through the list: a hotel contact, a permit. He scrolls up, down, types a word in the search bar, deletes it. Nothing comes up — not the interviews, not the names, not three weeks of sources. There's nothing to find. Not by luck, not by concealment. The notebook left the pocket the night before, while there was still a signal. What the soldier is holding is a stay, a document, a freelancer doing logistics. The rest is with Léa, in a `.ntilia` file this device no longer knows about. The search drags on. The soldier looks up, shines the light on my face, scrolls down one last time on the screen. He hands back the phone and, with a nod, signals me to move forward. I go through. ## The scoop survives if it has already left the phone I'm a freelancer, and I use nTilia Pro when I'm on assignment in the field. This app let me send an encrypted `.ntilia` file to Léa, who stayed back at the newsroom, just before I left. Not a ZIP in the *Downloads* folder. An encrypted snapshot, which reaches her with every sync, on *her* nTilia account. That one was *already* with Léa — it wasn't found on my phone during the search. ![The encrypted file is no longer on the phone](https://estwtgoraddyvzadcfnx.supabase.co/storage/v1/object/public/article-images/c259246f-b887-4e6c-a30f-d8bc097924be/009c0757-9d4c-41f5-ab25-5e9b87fd5b6a/b68ea19d-9784-4088-a4e7-1e148f11cf1f.jpg "Generated by Gemini. David Herreman - ntilia.com") The difference comes down to one word: *already*. The file left before the trip, not in a panic 100 meters from the checkpoint. By the time the soldier opens nTilia, Léa's encrypted copy is living its own life on another device, in another city, out of my reach as much as his. Nothing happening at the barrier can touch it anymore: not a search, not a seizure, not even a BURN (full wipe) triggered under duress. The scoop is no longer tied to my phone. It no longer depends on it. This decoupling is what changes everything. As long as the source lives *on* the device, it shares its fate: if the phone falls, it falls with it. Once the `.ntilia` is with Léa, the device can be searched, emptied, confiscated — the information itself stays elsewhere, safe and recoverable. "What's found on my phone?" and "where are my sources?" become two separate questions, with two different answers. Travel mode isn't about hiding a notebook. Hiding means betting that no one will look in the right place — a bet you lose the first time there's a serious search. This is about removing the notebook from the device that might be searched. What's no longer there can't be found, not under a flashlight, not under pressure. ## Two Missions, before leaving. Not at the checkpoint. Three weeks earlier, still at the office. I'm not waiting in line at a makeshift checkpoint. I create two Missions. **Logistics.** The hotel, public contacts, the permit. I check it: this one, I take with me. If someone opens nTilia at the barrier, this is what they should find. A stay. A document. Nothing resembling a source. **Sources.** Interviews, names, sensitive notes. Unchecked. This one doesn't travel on this device. In the app's settings, I enter Léa's nTilia account. From the first sync, the encrypted `.ntilia` file reaches her. *Burning* everything (nTilia's BURN function) can erase everything, even what's on *my* cloud. The copy Léa received, no. That's the whole difference: a copy I don't own, one a gesture on *my* phone can't kill. There's another feature in the app: *Prepare for departure*. This function creates a ZIP file that stays in the phone's files, still searchable. It's meant for a network outage — for leaving with a copy on *this* device. The opposite of a checkpoint. Not to be confused. ## The night before. Still a signal. Now's the time. The night before, I still have a signal. This is the right moment. In fact, on assignment, in the field, you can often end up without WiFi or cellular. Once the signal is active, you know you have to use it. So I activate **Travel Mode**. The notes outside of logistics leave my phone. The vault locks. What remains is the hotel information. Nothing else is here anymore. ![Activating nTilia's "Travel" mode](https://estwtgoraddyvzadcfnx.supabase.co/storage/v1/object/public/article-images/c259246f-b887-4e6c-a30f-d8bc097924be/009c0757-9d4c-41f5-ab25-5e9b87fd5b6a/a0962299-02b6-4633-8b77-c0d5aaf129aa.jpg "Generated by Gemini. David Herreman - ntilia.com") If there had been no signal, I would have done things differently: I would have shared an encrypted `.ntilia` file with a colleague staying behind. Then I'd confirm the file was no longer here, on my phone, *before* purging it. I also clean up Signal, the photos left in my Album, the maps. Long PIN, biometrics off. nTilia won't do this for me. A checklist, not magic. Then, I'm ready for any potential checkpoint on the road. ## Caught off guard, it's too late: don't burn at random No more signal, Léa offline, already in line, not far from the checkpoint. In this case, the rule isn't panic. It's: *where is the last copy?* One question, asked with a clear head, that decides everything else. Depending on the answer, the right move isn't the same — and the wrong move is irreversible. **Léa already has it**, or an encrypted `.ntilia` file is already off my phone. Then, I can **burn** everything — that's the BURN function. The phone *and* this account's private cloud: empty. The copy, meanwhile, is intact, on *her* account, out of my reach as much as the checkpoint's. If needed, Léa sends it back to me once I'm somewhere safe. This is the only case where burning destroys nothing irreplaceable. **Only copy: this account's nTilia cloud.** Then **Wipe**, not burn. The device empties, the cloud remains intact. Once somewhere safe: Restore, and everything comes back. Burning would also destroy the copy I could recover — that would be shooting myself in the foot just to look clean. Wiping gives the clean device the search requires, without sacrificing what the cloud still protects. **Nothing has left the phone.** Then a choice must be made: the scoop on the device, or an empty device. nTilia doesn't do both. Without a copy off the phone, burning everything kills the scoop — permanently, with no way back. This is exactly the situation you never want to discover in line: three weeks of fieldwork hanging on a choice you no longer have time to make properly. In a checkpoint line, you don't improvise this choice. It was made beforehand, by designating Léa, sending the `.ntilia`, checking Logistics and unchecking Sources. At the barrier, all that's left is to carry out a decision already made — not to make it under the flashlight. ## The encrypted `.ntilia` file isn't a ZIP A ZIP is a copy that's readable once opened, often still in the *Files* or *Downloads* folder. It stays on the device, in plain sight as soon as it's extracted. Searchable. A soldier scrolling through folders comes across it just like any other attachment. A `.ntilia` file is the drop. An encrypted snapshot of the notebook, meant to *leave*: to Léa, to a colleague who doesn't go through the checkpoint. It doesn't live in *Files*, it leaves the device to land on *another* nTilia account. It must no longer be present when the phone is handed to the soldier at the checkpoint. What's no longer there can't be opened, copied, or seized. To reopen it later, you need the vault passphrase. The account password isn't enough: two separate secrets, two locks. You can give up your login credentials under duress without handing over the contents of the notebook. And this passphrase wasn't on the phone that went through the checkpoint, of course — it lives in my head, or with Léa. Without this passphrase, decrypting the file is impossible: even recovered, it stays unreadable, a string of bytes with no key. ## On the other side, Léa sends me back the file A room. WiFi. The other side of the line. No more checkpoint, no more queue, no more flashlight. The stress drops all at once. Léa sends me the `.ntilia` file. A single transfer, encrypted, the same gesture that had sent it to her three weeks earlier. I open it with the vault passphrase — the one that never left my head, never passed through the device that went through the barrier. The same notes come back, intact: the interviews, the names, the sensitive notes. Then I push it to an empty cloud, the one I had wiped the night before. The notebook returns to its place, exactly where I'd left it. The journal already published online wasn't burned, and that's normal. Yesterday's article isn't a secret: it's public, no one needs to recover it. What doesn't come back, however: the local version history, the personal glossary, intermediate drafts erased along with the device. These are losses, but acceptable ones — nothing irreplaceable. The story, though, is there. So are the names. That's what matters most, and that's precisely what Léa's file was protecting. The reference copy, the one that truly mattered, was already with Léa. It never depended on my phone. The checkpoint couldn't do anything to it, because it wasn't where they were looking. ## What I no longer confuse **Prepare for departure.** Sync + ZIP on *this* device. For a network outage, when you know you'll be leaving without a signal and need to carry a copy with you. The opposite of a checkpoint: the file stays on the phone, in plain sight once opened, therefore searchable. Reserve it for isolated fieldwork, never for a checkpoint. **Travel mode.** Sensitive notes leave the device, the vault locks. Logistics — hotel, permit, public contacts — can stay, checked, to show an ordinary stay. The off-device copy is already with Léa, sent before departure. What's handed to the soldier no longer contains anything sensitive. **Wipe.** Last resort in line, when this account's cloud is still the only copy. The device empties, the cloud stays intact. Once somewhere safe: Restore, and everything comes back. The move of someone who couldn't send the `.ntilia` file in time but refuses to sacrifice their fieldwork. **Burn everything (BURN).** Last resort when the copy is *already* off you. Phone and this account's cloud: destroyed, empty under the flashlight. The drop with Léa, no — it lives on *her* account, out of reach of any gesture on *my* phone. This is the only condition where burning destroys nothing irreplaceable. ## Three questions, before hitting the road **No more signal?** I share a `.ntilia` file with someone staying behind, who won't go through a checkpoint — Léa at the desk, a colleague further back. I confirm the file is no longer here, on my phone, by checking it has indeed landed on *their* account before touching anything else. Then I purge. A download in *Files* would still be the scoop in your pocket, in plain sight once opened, one fingertip from the flashlight: to be avoided at all costs. **No recipient?** Travel Mode still empties the device: sensitive notes leave the phone, the vault locks, logistics remains to show an ordinary stay. Burning everything, on the other hand, also kills my cloud — and the scoop with it, if no `.ntilia` file has already left. Without a copy off me, burning isn't protection, it's a clean loss. **And Signal, the photos in the album?** nTilia isn't the phone. The camera roll, messages, maps, browsing history: none of that is erased by the app. I do it myself, by hand, before getting in line — long PIN, biometrics off, a checklist rather than a hope. --- I'm not hiding a notebook. I'm removing it from the device that goes through a checkpoint, because a copy this account can't destroy already exists — with Léa. Fictional story. No country, no armed force named — just a principle that holds true anywhere you hand your phone to someone who should never have read it. The lesson, though, is anything but fictional: the best protection is absence. What's no longer on the device can't be searched, can't be copied, can't be seized. Everything else — Wipe, burn, the drop with Léa — flows from this one idea. Travel Mode turns this principle into a single action, before the line, not under the flashlight. Try it at [ntilia.com](https://ntilia.com) — available starting with the Pro plan. ## Frequently asked questions ### What is Travel Mode? A Pro feature, used *before* getting in line: sensitive notes leave this device. A logistics Mission (hotel, permit) can stay. That's what gets opened at the barrier. Not the sources. ### What is a `.ntilia` file? An encrypted snapshot of the notebook, sent off of you — to the desk, to a colleague who doesn't go through a checkpoint. It's not a ZIP in the *Files* folder. To reopen it: the vault passphrase, not the account password. ### What's the difference between Wipe and Burn everything (BURN)? **Wipe** empties the device and leaves this account's cloud intact. Burn everything destroys both. You only burn if a copy already exists off of you. Otherwise, you kill the scoop. ### Why not use "Prepare for departure" before a checkpoint? Prepare for departure places a ZIP on the phone. It's meant for a network outage. At a checkpoint, this ZIP is still searchable. It's the opposite of Travel Mode. ### Does nTilia erase Signal, photos, maps? No. nTilia isn't the phone. IndexedDB isn't a forensic wipe. The phone's photo album, the Files or Downloads folder, maps: a checklist, to be done yourself, before finding yourself in a line before a checkpoint.