Security
Built so the reporter stays protected
A whistleblowing channel is only worth using if the person reporting can trust it. Anonymity, access control and traceability are part of the architecture, not an add-on.
Anonymity by design
A report can be filed without an account, without an email address and without a name. We do not store IP addresses or browser fingerprints together with a report. The reporter receives a one-time case code that is the only key to the case, and the code is stored as a hash – we cannot recover it, and neither can the employer.
Access control
Every table enforces row level security. A case is only readable by the designated recipients in the organisation that owns it. Internal notes are never visible to the reporter, and dialogue messages are never visible to employees without a role on the case. Impartiality assessments are recorded before a handler starts work.
Storage and hosting
Data is stored inside the EEA, encrypted at rest and in transit. Attachments live in a private bucket and are only reachable through short-lived signed links issued to an authenticated handler.
Traceability
Every meaningful action – case opened, message sent, status changed, document downloaded, case deleted – is written to an append-only audit log with timestamp and actor. The log is what lets the employer document compliance with the Working Environment Act chapter 2 A if questioned.
Retention
Cases are subject to a scheduled retention review, by default five years after closure. Handlers can place a legal hold or document a formal decision to delete, in line with GDPR article 5(1)(e).