Yuliia Zahoruiko
· Published
· Last updated
Whistleblowing by email: a secure address for every channel #
From today, every EthicsPortal whistleblowing channel has its own email address, for example 7YK9QM2W@report.ethicsportal.eu. A report sent there becomes a case in the channel, next to the reports from the online reporting form. The case handlers never see the sender’s address. It is included in the single plan and active on every channel.
Many employees still reach for email first. They know how it works, they can attach a document, and they can write when it suits them. Until now, organizations had two options: send those people to a web form, or open a shared inbox such as compliance@company.com. The second option is where the Directive’s requirements usually fail.
Why a shared company mailbox falls short #
Article 9(1)(a) of Directive 2019/1937 requires internal channels to be “designed, established and operated in a secure manner” that protects the reporter’s identity and “prevents access thereto by non-authorised staff members”. A company inbox is rarely that closed. IT administrators can open it, assistants hold delegated access, and backup and archiving tools copy every message. When the person who manages the mail system is the person named in the report, the report is in the wrong hands from the moment it arrives.
The reporter’s side carries a second risk. A report sent from a work account is logged by the employer’s own mail system, with sender, recipient and time.
What national rules say about email #
The Directive does not ban email, and most national rules do not either. What they require is that only the designated people can read the reports.
- Italy. Legislative Decree 24/2023 requires channels that protect the reporter’s identity, “including through the use of encryption tools” (Art. 4). The anti-corruption authority ANAC goes further. Its 2025 guidelines on internal channels state that ordinary or certified email is “in itself inadequate” to protect the reporter’s identity, unless specific countermeasures are justified in the data protection impact assessment (Guidelines 1/2025, § 2.2). The reason ANAC gives is that mail systems log every message sent and received, and that the risk is higher when the reporter uses a mailbox the employer provides. The data protection authority, the Garante, takes the same position (opinion 581/2025).
- Germany. The HinSchG requires channels designed so that only the people responsible for receiving and handling reports can access them (§ 16(2)). The legislator’s explanatory memorandum names email threads among the documents that unauthorised colleagues must not be able to reach.
- Ireland. The statutory guidance for public bodies expects a dedicated email address, and adds that access to that inbox “must be restricted solely to persons designated to receive and handle reports” (2023 guidance, § 9.3).
- Denmark. The guidance for private workplaces accepts a secure mail solution, but reports must not be kept anywhere generally accessible, such as a shared drive (Vejledning nr. 9250).
The Netherlands, France and Poland accept email as a way to report. The test everywhere is the same: a dedicated address that only the people who handle reports can read. A shared company mailbox fails it. The national details are on our law pages.
How the EthicsPortal address works #
- A separate mail server. Reports are received by EthicsPortal’s own mail server in Germany, not by a mailbox in the organization’s mail system, so its administrators, delegates and archiving tools have nothing to open.
- A case, not an inbox. The email becomes a case with the same deadlines, access rules and audit trail as any other report. Only the people with access to the case can read it.
- The sender’s address stays hidden. EthicsPortal stores it encrypted and uses it only to send the reporter’s notices. It does not appear in the case, its PDF or exports.
- Follow-up without email. The reporter receives a Case ID and a one-time password for the secure inbox. Questions and answers continue there.
- Clean attachments. Files are stripped of metadata such as GPS location and author, and scanned for viruses, the same as uploads through the form.
The technical detail, including what is and is not encrypted in transit, is on the security page.
What email cannot do #
Email is not anonymous. The reporter’s mail provider keeps a copy, and so does the employer’s mail system if the message is sent from a work account. The receipt says this and links to the online reporting form, which remains the route for anyone who needs to stay anonymous. For a reporter who is comfortable being known to the system, the address removes the last reason to write to a shared inbox.
Where the address appears #
The address is shown in the channel settings and on the channel’s public page, and is included in the whistleblowing policy, the poster and the case handler manual that EthicsPortal generates. Organizations that already run a channel do not need to change anything. To tell staff, update the policy or reprint the poster.