# Can we build or host our own whistleblowing channel? > The Directive allows an in-house whistleblowing channel. But when your own servers receive the reports, your own logs record who sent them. Why building a form or self-hosting open-source software makes confidentiality hard to keep and impossible for a reporter to check. Canonical: https://ethicsportal.eu/blog/build-or-host-your-own-whistleblowing-channel/ Last updated: 2026-10-28 Yes. Article 8(5) of [Directive 2019/1937](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937) allows channels to be "operated internally by a person or department designated for that purpose". Organizations that take this route usually do one of three things: build a form on the company website, install open-source whistleblowing software on their own servers, or buy a licence for commercial software and run it on premises. All three share one weakness. The organization runs the servers that receive the reports, so the organization's own systems record who sent them. ## What the Directive requires Article 9(1)(a) requires channels that are "designed, established and operated in a secure manner that ensures that the confidentiality of the identity of the reporting person and any third party mentioned in the report is protected, and prevents access thereto by non-authorised staff members". Article 16(1) adds that the reporter's identity must not be disclosed "to anyone beyond the authorised staff members competent to receive or follow up on reports" without the reporter's explicit consent. Anonymity is a separate question. Article 6(2) leaves it to each Member State whether organizations must accept anonymous reports, and the national rules differ. They are on our [law pages](https://ethicsportal.eu/whistleblower-laws/). Where a channel offers anonymity, it has to hold. ## Where a self-hosted channel records the reporter A report sent through a web form passes through several systems before the application sees it. On a self-hosted channel, the organization's IT department runs every one of them. - **Web server and proxy logs.** By default they record the IP address, time, page and browser of every request. A request to submit or follow up on a report can be matched to the report by its time or its page. - **Central logging.** Security teams usually collect logs from all servers in one place for monitoring. A new server joins that collection unless someone excludes it. - **Backups.** Database and server backups copy reports and logs into systems that other administrators manage. - **Server access.** An administrator with full access to the server can read the database. Encryption helps only if the keys are kept away from the same people. The application can be written to store nothing about the reporter. The systems around it are configured by IT, often with logging on by default. Each one can be switched off for the channel, but this has to be done, checked and kept that way for years, by employees of the organization the reports are about. When the head of IT is the person named in a report, the evidence of who reported is on servers they control. ## Reporters cannot check it A reporter deciding whether to report their manager sees an address on the company domain, run by the company. Even if every log is off, they cannot verify it. People report when they believe their identity is safe, and a channel that relies on the employer's own promise is harder to believe. ## Open source does not change who runs the server With open-source software, anyone can read the code and see what the application stores. That is useful. It does not change who operates the server, the logs, the backups and the network around it. A self-hosted open-source channel has the same weakness as a form the organization built itself. Self-hosting also makes the organization responsible for security updates, virus scanning of uploaded files, removing location data from photos, the 7-day and 3-month deadlines, and deleting reports when the retention period ends. A licence for commercial software installed on your own servers is the same case. Where the developers of the software host it for you, the channel is operated by a third party, which is a different case. ## What an external provider changes An external provider has logs too. The difference is who holds them: a company with no interest in the case, bound by a data processing agreement, whose logs the organization's staff cannot open. EthicsPortal does not record a reporter's IP address with reports, messages or audit records, and the application's logs for the whistleblowing channel contain no IP addresses. The proxy in front of the application keeps a short request log that is overwritten as it fills, currently after about two days. The detail is on the [security page](https://ethicsportal.eu/security/#ip-addresses). No provider can protect a report sent from a work laptop or the company network, because the employer's own network logs that traffic. Tell staff they can report from a personal phone on mobile data. ## If you host it yourself anyway - Keep the channel's servers out of central logging and monitoring. - Turn off IP addresses in web server and proxy logs. - Keep the channel's backups separate, with access limited to the people who handle reports. - Name everyone who has administrator access, and record in the data protection impact assessment what happens when one of them is named in a report. [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/)