Whistleblowing Portal
An internal reporting channel with its own address, where anyone can report without giving their name and then follow the case with a reference and a PIN.
EU whistleblower protection law requires companies above a certain size to have an internal channel, and that channel must guarantee the reporter's confidentiality. A mailbox does not guarantee it: email passes through servers, gets forwarded and leaves a trail with names on it, and anyone who doubts that simply does not use it.
Here the portal is a site of its own and the content never travels by email. On submitting, the reporter receives a reference and a PIN to come back, read any questions, reply and add information without ever identifying themselves.
Internally, each report arrives with its type, severity and location, and is handled with statuses and deadlines, which the law also sets. Only those with the right profile can access it, and attached evidence is stored apart from the rest of the company's documentation.
What the law requires
An internal channel that guarantees confidentiality
Whistleblower protection law requires companies above a certain size to have an internal reporting channel and sets out how it must work. The essentials come down to four points:
- Accepting anonymous reports, with the reporter able to follow the case afterwards.
- Guaranteeing confidentiality of the reporter's identity and of any third parties mentioned.
- Acknowledging receipt and resolving within the deadlines the law sets.
- Restricting access to the people designated to handle it.
A mailbox does not meet the second point no matter how good the intentions: email passes through servers, gets forwarded and leaves a trail with names on it. And anyone who doubts that simply does not use it, so the channel exists on paper but not in practice.
Reference and PIN
Anonymous and trackable at the same time
This is the part that sounds contradictory and is not. On submitting the report, the reporter receives a reference and a PIN to re-enter the portal at any time.
With those credentials they can read any questions put to them, reply, add further documentation and check the case status, without ever identifying themselves and without the content travelling by email.
That solves the practical problem with most anonymous channels: if the investigator needs a clarification and has no way to ask for it, the case goes unresolved for lack of information, and whoever reported it never finds out whether it made any difference.
Handling
Inside, it is a case file with deadlines
Each report arrives classified with its type, severity level and location, and is handled through statuses reflecting the real process: receipt, acknowledgement, investigation, resolution and closure.
Deadlines matter because the law sets them, and the system tracks them rather than leaving them to the investigator's memory. That tracking is also what proves the company acted in time when somebody questions it.
Who sees what
Only the profile designated to manage the channel has access, and submitted evidence is stored apart from the rest of the company's documentation, so it does not end up in a shared folder through carelessness.
When the report concerns workplace harassment, the specific protocol opens its own case file with the particularities that procedure requires.
Clearing things up
Frequently asked questions
Answers to what we get asked most.
Why is a mailbox not enough?
Because it does not guarantee the confidentiality the law requires: email passes through servers, gets forwarded and leaves a trail with names on it. And anyone who doubts that simply does not use it, so the channel exists on paper but not in practice.
Can somebody report anonymously and still follow up?
Yes. On submitting they receive a reference and a PIN to re-enter the portal, read any questions, reply and add documentation, without ever identifying themselves and without the content travelling by email.
Who can see the reports?
Only the profile designated to manage the channel. Attached evidence is stored apart from the rest of the company documentation, so it does not end up in a shared folder through carelessness.
Does it track the deadlines the law sets?
Yes. Each report is handled with statuses and deadlines, from acknowledgement through to resolution, and the tracking is recorded. It is what proves the company acted in time when somebody questions it.
Compliance and documents
An anonymous whistleblowing channel, a harassment protocol, coordination with your contractors, a document manager with expiry alerts, document signing and a visitor log.
Workplace Harassment Protocol
A structured, numbered case file for harassment reports, with the reporter's signature, submitted files stored separately and access restricted to administration.
View moduleCAE · Activity Coordination
Each contractor uploads their documentation to their own space (the company's, that of every worker who will access the site, machinery and vehicles) and the system tracks expiry dates and validations.
View moduleAnti-Fraud Law
Relevant operations are kept in a tamper-evident history with integrity sealing: who did what and when, with no way to change it afterwards.
View moduleDocument Manager
Company documentation classified by type and attached to what it belongs to (an employee, a customer, a vehicle, a site) with its expiry date, alerts and permissions.
View moduleDocument Signing
Documents are sent and signed digitally from the employee portal, with a record of who signed, which document and when.
View moduleVisitor Log
A digital record of who enters your premises, who they are visiting, why, and their entry and exit times.
View module