Yaroslav Shmarov · Published October 28, 2026 · Last updated October 29, 2026

Voice distortion does not keep whistleblowers anonymous #

Many whistleblowing channels let a reporter record a voice message and promise “voice distortion” to protect them. Few vendors explain what the distortion does. The simplest form, and the one we use, is a pitch shift: the voice is made higher or lower, and the case handler hears the changed version.

A pitch shift makes a voice harder to recognize. It does not make the reporter anonymous. We found this in our own product during a security audit in October 2026, changed every claim we make about it, and turned voice messages off by default.

A pitch shift can be undone #

A simple voice disguise multiplies every frequency in the recording by one number. If that number is the same for every recording, anyone who knows it can divide by it and get the original pitch back. In our audit, one reverse step on a downloaded recording restored the reporter’s pitch and almost all of the shape of their voice.

Using a different random number for each recording stops this exact attack. It does not stop the next two.

Software can still match the voice #

Speaker recognition software compares a voice with known samples, such as a recorded team meeting or a voicemail. Research in the VoicePrivacy Challenge has shown for years that simple signal changes (pitch, formants, speed) give weak protection once the attacker knows which method was used. On a whistleblowing platform it is usually the same method for every report.

Under the GDPR, a voice recording is personal data. Once it is used to identify a person through technical processing, it is biometric data under Art. 4(14).

A colleague can still recognize the speaker #

This is the most likely risk in a workplace, and no software is needed. A case handler who works with the reporter knows how they speak: their rhythm, accent, favorite words, the way they start a sentence. A pitch shift leaves all of that in place. So does the content: a reporter who describes a meeting only five people attended has narrowed the list to five.

For many reporters, the safest voice message is a written report.

Ways to take oral reports, compared #

There are three families of approach: a person takes the report, software disguises the voice, or software turns the voice into text. The only reliable way to remove the voice is not to keep it. Text removes the voice and the way a person speaks. The content risk stays, as it does for any written report.

A person takes the report #

Phone line answered by a case handler, without recording. This is the model in Art. 18(3) : the handler writes accurate minutes of the call, and the reporter checks, corrects and agrees them. No voice is stored.

• Good: no recording, no AI, and the reporter confirms every word.
• Watch out: someone has to answer the phone, and the handler hears the live voice, so a colleague may still recognize it. Phone systems log caller numbers unless the line is set up not to.

Recorded line or voicemail. The reporter leaves a message at any hour.

• Good: available 24/7 and simple for the reporter.
• Watch out: you now store a raw voice, and the telephone provider is one more processor. Recording needs the reporter’s consent under Art. 18(2) .

Meeting in person. The Directive requires it on request.

• Good: the reporter controls what is said and to whom.
• Watch out: the reporter is not anonymous. Under Art. 18(4) , write accurate minutes (or record, with consent) and let the reporter check them.

Software disguises the voice #

Pitch shift on the server. The simplest form of “voice distortion”, and what we use.

• Good: easy to build, works in every browser, no AI.
• Watch out: it can be undone, matched by software and recognized by a colleague. The raw recording reaches the server before it is disguised, so it also reaches the job queue, storage and backups unless the system is built to prevent that.

Stronger signal processing. A different random pitch for each recording, a shifted timbre, and flattened intonation.

• Good: still no AI, and much harder for a colleague to recognize.
• Watch out: speaker recognition software still partly works, and the voice sounds robotic. It is still a disguise.

Neural voice conversion. A model replaces the speaker’s voice with an invented one.

• Good: the strongest disguise that keeps a voice.
• Watch out: it is generative AI, it needs heavy computing power, and research still finds the original speaker in the output.

Software turns the voice into text #

Speech-to-text on the server, optionally read back by a synthetic voice.

• Good: removes the voice completely, works on every device and in most languages.
• Watch out: an AI model processes every report. Ask which one, where it runs, and whether it is a listed sub-processor. The raw audio still reaches the server and its backups unless it is processed in memory and never stored. We wrote about AI in whistleblowing products in Whistleblower reports do not belong inside an LLM.

Speech-to-text on the reporter’s device, with a model the vendor ships. Open-source speech models can run inside the browser.

• Good: the audio never leaves the phone or computer, it works on iPhones, and the reporter can correct the text before sending.
• Watch out: the first use downloads 40 to 250 MB, older phones are slow, and accuracy is weaker in smaller languages. The vendor still ships an AI model.

The browser’s own on-device speech recognition. Recent versions of Chrome and Edge can transcribe without sending audio anywhere, if the page asks for on-device processing.

• Good: the vendor ships no model, and the audio never leaves the device.
• Watch out: by default, Chrome sends the audio to Google, so the page must refuse to fall back to that mode. When we tested Chrome on macOS on 28 October 2026, on-device recognition offered German, English, Spanish, French, Italian, Polish and Portuguese, but not Dutch, Romanian, Croatian, Bulgarian, Slovenian or Greek. We found no way to require on-device recognition in Safari, so iPhone users get nothing.

If you build or configure it yourself #

• Process the recording before you store it. Every place the raw audio touches (upload storage, a job queue, a mirror, a versioned bucket, a database backup) is a place it can be recovered from.
• Fail closed: if processing fails, delete the raw recording and play nothing.
• Strip file metadata, and use a fixed file name.
• Let reporters play back their own recording, and tell them plainly what the case handler will hear.
• Offer a written report next to every voice option, and recommend it to anyone whose voice could identify them.

What whistleblowing vendors do #

Grouped by what happens to the reporter’s voice, based on each vendor’s public pages as checked in October 2026. Vendors change their products, so confirm with the vendor before you rely on this.

What the Directive requires #

Directive 2019/1937 does not require a voice recorder. Art. 9(2) says internal channels must allow reporting in writing, orally, or both. Where oral reporting is offered, it must be possible by telephone or another voice messaging system, and by a physical meeting on the reporter’s request. National laws can go further, so check yours.

When oral reports are recorded, Art. 18(2) allows two ways to document them: a recording, or a complete and accurate transcript prepared by the person handling the report. The reporter must be able to check, correct and agree the transcript. For an unrecorded phone line or a meeting, Art. 18(3) and Art. 18(4) ask for accurate minutes the reporter can check and agree. That meets the Directive without storing anyone’s voice.

Questions to ask your vendor #

• What exactly does the voice distortion do, and is it the same for every recording?
• Does the raw recording ever reach your storage, job queue or backups before it is disguised? For how long can it be restored?
• Does any AI system process the recording or a transcript of it? Which one, and where?
• Does the reporting form tell reporters that a disguised voice can still be recognized?

If the answer to the first question is “it makes the reporter anonymous”, treat the rest of the answers with care.

What EthicsPortal does #

Voice messages are off by default. An organization can turn them on in its whistleblowing channel settings, and the change is recorded in the audit trail. When they are on, the recording is pitch-shifted on our servers in the EU and no AI system processes it. The original is deleted after processing, including the earlier versions our backup storage would otherwise keep for 28 days. We describe the shift as reversible and do not call it anonymization. The setting warns the organization, and the form tells reporters whose voice could identify them to write instead.

The details are in our DPIA, risk 1.