# Data boundaries

Source: https://ethicsportal.eu/developers/data-boundaries/

The API supports operational monitoring and explicitly authorised organisation and whistleblowing channel setup. It cannot read report content or submit or change reports. The [MCP server](https://ethicsportal.eu/developers/mcp/) offers the same operations as tools, so the same boundary applies to it.

## Included report fields

The [generated reference](https://ethicsportal.eu/developers/api/) is the field-by-field contract. Report responses contain:

* Obfuscated report and organisation IDs.
* Workflow status: `received`, `acknowledged`, `feedback_given` or `closed`.
* Whether an assignee exists, without their identity.
* Creation, acknowledgement, feedback and closure timestamps.
* Acknowledgement and feedback deadlines and overdue flags.
* API and authenticated web links.

Dates use UTC ISO-8601\. These timestamps describe recorded workflow state. Closing a report can fill missing acknowledgement and feedback timestamps; reopening can clear automatically filled values. They do not prove a message was delivered or a legal obligation was fulfilled.

## Always excluded

Excluded fields are omitted entirely. They are never returned as `REDACTED`, and there is no expansion option.

* Subject, description, summaries, translations and intake answers.
* Reporter identity, contact information and access credentials.
* Attachments, recordings and their metadata.
* Messages and notes, including their counts.
* Category, closure outcome and retaliation indicators.
* Priority, source, language, confirmation and assignee identities.
* Audit metadata, notification text, PDFs and exports.

There is no `updated_at` field or filter that reveals hidden content activity. Changes confined to excluded content do not emit webhook events.

## Handle metadata appropriately

Operational metadata can still identify a case inside your organisation. Restrict access to the receiving system and store only what the integration needs. Report links require a separate authenticated browser session.

## Audit trail

The [audit trail](https://ethicsportal.eu/developers/administration/#read-the-audit-trail) returns who did what and when, without change details, IP addresses or email addresses. It omits anything a reporter did and every entry about messages, notes or retaliation reports, so their existence, number and timing stay inside the application.

## Whistleblowing channel metadata

The channel endpoint returns its identifier, active state and public online reporting form URL. It does not expose handler identities or private settings. A separate [configuration resource](https://ethicsportal.eu/developers/organisation-setup/) requires the `channel:write` scope; it includes company details, settings and the compliance officer’s obfuscated membership ID. Those fields never appear in report metadata or webhook snapshots.