Data boundaries
The API supports operational monitoring and explicitly authorised organisation and whistleblowing channel setup. It cannot read report content or submit or change reports. The MCP server offers the same operations as tools, so the same boundary applies to it.
Included report fields
Section titled “Included report fields”The generated reference is the field-by-field contract. Report responses contain:
- Obfuscated report and organisation IDs.
- Workflow status:
received,acknowledged,feedback_givenorclosed. - Whether an assignee exists, without their identity.
- Creation, acknowledgement, feedback and closure timestamps.
- Acknowledgement and feedback deadlines and overdue flags.
- API and authenticated web links.
Dates use UTC ISO-8601. These timestamps describe recorded workflow state. Closing a report can fill missing acknowledgement and feedback timestamps; reopening can clear automatically filled values. They do not prove a message was delivered or a legal obligation was fulfilled.
Always excluded
Section titled “Always excluded”Excluded fields are omitted entirely. They are never returned as REDACTED, and there is no expansion option.
- Subject, description, summaries, translations and intake answers.
- Reporter identity, contact information and access credentials.
- Attachments, recordings and their metadata.
- Messages and notes, including their counts.
- Category, closure outcome and retaliation indicators.
- Priority, source, language, confirmation and assignee identities.
- Audit metadata, notification text, PDFs and exports.
There is no updated_at field or filter that reveals hidden content activity. Changes confined to excluded content do not emit webhook events.
Handle metadata appropriately
Section titled “Handle metadata appropriately”Operational metadata can still identify a case inside your organisation. Restrict access to the receiving system and store only what the integration needs. Report links require a separate authenticated browser session.
Audit trail
Section titled “Audit trail”The audit trail returns who did what and when, without change details, IP addresses or email addresses. It omits anything a reporter did and every entry about messages, notes or retaliation reports, so their existence, number and timing stay inside the application.
Whistleblowing channel metadata
Section titled “Whistleblowing channel metadata”The channel endpoint returns its identifier, active state and public online reporting form URL. It does not expose handler identities or private settings. A separate configuration resource requires the channel:write scope; it includes company details, settings and the compliance officer’s obfuscated membership ID. Those fields never appear in report metadata or webhook snapshots.