# EthicsPortal > EthicsPortal is a secure, anonymous whistleblower reporting platform that helps organizations comply with EU Directive 2019/1937. - [EthicsPortal API and webhooks](https://ethicsportal.eu/developers/llms.txt): Developer documentation for the EthicsPortal REST API and signed webhooks: report metadata and deadlines, whistleblowing channel setup, members, documents, billing links and the audit trail. Report content is never available through the API. An AI assistant can set up EthicsPortal for a person through the MCP server. # Secure whistleblower reporting for EU compliance > EthicsPortal gives your organization a secure whistleblowing channel that meets EU Directive 2019/1937 requirements. Canonical: https://ethicsportal.eu/ Last updated: 2026-09-30 Whistleblower software for EU organisations Meet your whistleblowing obligations and address misconduct before it escalates. ## How it works ### Configure your whistleblowing channel Set up the organization account, configure your whistleblowing channel's welcome text, report categories, and logo. No technical setup required. ### Share the link Give employees your whistleblowing channel link or QR code. They can submit anonymous reports from any browser. No app or account is required. ### Handle reports securely When a report comes in, communicate securely with the whistleblower, track your 7-day and 3-month deadlines, and export case files for auditors. [Can we host our own channel?](https://ethicsportal.eu/blog/build-or-host-your-own-whistleblowing-channel/) ## Built for EU compliance Understand your obligations under [Directive (EU) 2019/1937](https://eur-lex.europa.eu/eli/dir/2019/1937/oj/eng) and review the [penalties in your country](https://ethicsportal.eu/penalties/). ### Can reporters stay completely anonymous? Yes. No account, no IP logging, and file metadata is stripped on upload. Identifying yourself is optional. ### Does it track the Directive's statutory deadlines? Yes. The 7-day acknowledgement and 3-month feedback timers run automatically and flag overdue cases. ### Is access to reports limited to the people you authorize? Yes. Role-based access limits each case to administrators and assigned handlers. Reporters never see a handler’s name. ### Is report data encrypted and kept in the EU? Yes. Encrypted at rest and hosted in Nuremberg, Germany. Report data is never moved outside the EU. ### Can you take reports by email, phone or in person? Yes. Each whistleblowing channel has an email address that turns emails into cases. Display a phone number and log letters and in-person reports in the same place. ### Is there a tamper-evident record of every action? Yes. The append-only audit trail cannot be edited or deleted, so you can show a regulator what happened. ### Can you set how long data is kept and delete it automatically? Yes. Choose a retention period from 12 to 60 months. Closed cases are deleted automatically when it expires. ### Is there a DPA and a published sub-processor list? Yes. A public Data Processing Agreement, countersigned on request, plus the full Article 28 sub-processor list. [See the full article-by-article compliance reference](https://ethicsportal.eu/directive-coverage/) ## Evidence for auditors Four compliance documents to share with legal teams and auditors. ### Compliance report A Directive checklist, service metrics and audit summary. ### Compliance certificate A shareable certificate for your organisation’s whistleblowing channel. ### Whistleblower policy An internal policy for your organisation to review and adopt. ### Privacy notice A reporter-facing notice with your organisation’s controller details. ## No AI on report content. EthicsPortal does not transmit report content, reporter identity, or case messages to any large language model or AI inference provider. No AI categorisation, summarisation, or translation. No AI sub-processor on the GDPR Article 28 list. A deterministic audit trail records actor and action — not a probabilistic suggestion. ## Pricing 60 EUR / month; 500 EUR / year. [Pricing](https://ethicsportal.eu/pricing/) ## Pages - [Changelog](https://ethicsportal.eu/changelog/): New features and improvements in EthicsPortal, the whistleblowing software for EU organisations. Each entry shows what changed and why it matters. - [Whistleblowing video tutorials](https://ethicsportal.eu/tutorials/): Short English tutorials for case handlers and whistleblowers. Learn how to handle cases, report securely, save your access details, and track your case. - [Transposition: recorded conversations on national whistleblower law](https://ethicsportal.eu/transposition/): A recorded series on Directive 2019/1937, national transpositions, and neighbouring whistleblower laws, with the people who drafted them, run the authorities, or litigate under them. One jurisdiction at a time, published as audio and full transcript. - [About EthicsPortal](https://ethicsportal.eu/about/): EthicsPortal is whistleblower software for EU organisations — the secure whistleblowing channel Directive 2019/1937 requires, operated from Poland with report data hosted in Germany. - [Accessibility statement](https://ethicsportal.eu/accessibility/): Read the EthicsPortal accessibility statement: assessment scope, known limitations, outstanding verification and contacts for feedback or alternative formats. - [Blog](https://ethicsportal.eu/blog/): Read guides, checklists and comparisons on EU whistleblower protection laws, setting up a whistleblowing channel and managing reports in your organisation. - [CAIQ-aligned vendor security questionnaire](https://ethicsportal.eu/caiq/): Pre-filled answers to common vendor-security-assessment questions, structured against the CSA CAIQ v4 domain taxonomy. EthicsPortal's positions on the questions procurement teams most often ask. - [Careers](https://ethicsportal.eu/careers/): Open roles at EthicsPortal, the European standard for whistleblower compliance software under EU Directive 2019/1937. - [Compare whistleblower platforms](https://ethicsportal.eu/compare/): Compare whistleblower platforms by pricing, hosting, features and organisational needs. Review EthicsPortal alongside other providers serving the EU market. - [Contact](https://ethicsportal.eu/contact/): Contact EthicsPortal about whistleblower software, procurement or support. Find email contacts for privacy, security, legal and accessibility questions. - [Data Processing Agreement](https://ethicsportal.eu/dpa/): GDPR Article 28 Data Processing Agreement for EthicsPortal customers, with the Swiss FADP terms for controllers in Switzerland. Covers scope, security measures, sub-processors, and international transfers. - [Data Protection Impact Assessment (DPIA) for whistleblowing](https://ethicsportal.eu/dpia/): A pre-filled DPIA template for organizations deploying EthicsPortal, structured on GDPR Article 35(7) — processing description, necessity and proportionality, and a risk-and-measures table for whistleblower reporting. - [Directive 2019/1937 coverage map](https://ethicsportal.eu/directive-coverage/): Article-by-article map of how EthicsPortal meets every requirement of EU Directive 2019/1937 and GDPR for whistleblower protection. - [Directive 2019/1937 interpretations](https://ethicsportal.eu/directive-interpretations/): How EthicsPortal interprets the ambiguous provisions of EU Directive 2019/1937. A reference document for compliance officers, data protection officers, and legal counsel. - [DORA contracting template](https://ethicsportal.eu/dora-addendum/): Non-binding contracting template for financial entities procuring EthicsPortal under Regulation (EU) 2022/2554 (DORA). - [DORA ICT third-party map](https://ethicsportal.eu/dora/): Provider-side information for evaluating EthicsPortal under Regulation (EU) 2022/2554 (DORA) — Article 30 contracting topics, register of information data, subcontractor chain, and the withdrawn UKNF cloud communication. - [EN 301 549 conformance report](https://ethicsportal.eu/en-301-549-conformance/): Accessibility assessment scope and outstanding verification for EthicsPortal. - [EU Whistleblower Directive Penalties by Country](https://ethicsportal.eu/penalties/): Fines and penalties for non-compliance with EU Directive 2019/1937 in every member state. Updated regularly with enforcement actions. - [Frequently asked questions](https://ethicsportal.eu/faq/): Common questions about EthicsPortal — compliance, anonymity, data security, billing, and technical details. - [How EthicsPortal works](https://ethicsportal.eu/product/): Deploy a secure whistleblowing channel for EU Directive 2019/1937 compliance, with whistleblowing channel configuration, case management, and audit exports included. - [Incident register](https://ethicsportal.eu/incidents/): Public register of material incidents affecting personal data processed by EthicsPortal. Maintained in the spirit of Article 33 GDPR and as a matter of institutional transparency. - [ISO 37002 whistleblowing standard: can you be certified?](https://ethicsportal.eu/iso-37002/): ISO 37002:2021 gives guidelines for whistleblowing management, not certifiable requirements. What it covers, where to get it, and how EthicsPortal maps to each clause. - [ISO/IEC 27001:2022 self-assessment](https://ethicsportal.eu/iso-27001/): Self-assessment of EthicsPortal against ISO/IEC 27001:2022 --- the mandatory management-system requirements in Clauses 4-10 and all 93 Annex A controls, published as a Statement of Applicability. Not an accredited certification. - [National whistleblower authorities in the EU](https://ethicsportal.eu/authorities/): Reference pages on the national authorities that run each member state's external whistleblowing channel: what they are competent for, how to report to them, and the statutory deadlines. - [Policies](https://ethicsportal.eu/policies/): Read EthicsPortal policies on information security, business continuity and risk management, with links to internal audit and management review records. - [Pricing](https://ethicsportal.eu/pricing/): Review current EthicsPortal pricing for EU whistleblower software, including billing options, included features and the refund policy for new subscriptions. - [Privacy policy](https://ethicsportal.eu/privacy/): Privacy policy for EthicsPortal — how we collect, use, store, and protect your personal information. - [Refund policy](https://ethicsportal.eu/refunds/): Read the EthicsPortal refund policy for new subscriptions: eligibility for the 30-day money-back guarantee, how to request a refund and processing times. - [Security](https://ethicsportal.eu/security/): Technical security measures in EthicsPortal, including encryption, anonymity, access control, audit logging, and infrastructure details for compliance review. - [Self-conducted security testing](https://ethicsportal.eu/security-testing/): Scope, dates, findings, and remediation for the security testing EthicsPortal performs on itself. First-party testing, not an independent audit. - [Service level agreement](https://ethicsportal.eu/sla/): Monthly availability target for EthicsPortal's reporter and operator portals, how it is measured, and what is excluded. - [Subprocessors](https://ethicsportal.eu/subprocessors/): Third-party services that process personal data on behalf of EthicsPortal. Published per GDPR Article 28. - [Terms of service](https://ethicsportal.eu/terms/): Read the EthicsPortal terms of service, covering subscriptions, billing, customer responsibilities, data protection, service limits and contract termination. - [Trust](https://ethicsportal.eu/trust/): Review EthicsPortal’s contracting party, data locations, certification status and procurement documents for legal, security and data protection assessments. - [Whistleblower compliance by industry](https://ethicsportal.eu/industries/): Industry-specific whistleblower reporting requirements under EU Directive 2019/1937 and related regulations. - [Whistleblower laws in Europe: country guide](https://ethicsportal.eu/whistleblower-laws/): National whistleblower protection laws across the EU and the rest of Europe, with links to official texts, external authorities, and country-specific implementation notes. --- # About EthicsPortal > EthicsPortal is whistleblower software for EU organisations — the secure whistleblowing channel Directive 2019/1937 requires, operated from Poland with report data hosted in Germany. Canonical: https://ethicsportal.eu/about/ Last updated: 2026-11-10 Last updated: 2026-11-10. EthicsPortal is whistleblower software for EU organisations that operates the secure whistleblowing channel required by Directive 2019/1937 — for organizations that cross the 50-worker threshold, and for regulated entities that carry the same obligation irrespective of headcount. --- ## What EthicsPortal does ### Anonymous and confidential intake Employees submit reports from any browser, with no account, app, or company network. Identity disclosure is optional, reporter IP addresses are not stored, and file metadata (EXIF, GPS, author) is stripped before storage. The result is a channel people will actually use, which is the condition the Directive's internal-first design depends on. ### Deadline tracking Every report starts the Directive's two clocks automatically: 7 days to acknowledge receipt, 3 months to provide substantive feedback. Overdue cases are flagged in the dashboard and handlers are notified as deadlines approach, so the dates that carry sanctions are not tracked in a spreadsheet. ### Secure two-way communication Reporters return with a Case ID and a password generated by the system to read handler messages and reply. Handler identities are never shown, so follow-up questions can be asked and answered without either side losing protection. ### Case management and audit trail Handlers triage, assign, prioritize, and close cases in one view, and can log reports received by phone, email, or in person so every channel lands in the same case list. Every action is written to an append-only audit trail that cannot be modified after the fact. ### Export and retention Any case exports to PDF with its full message history, timeline, and audit trail, for counsel, auditors, or a supervisory authority. Retention is configurable at 12, 24, 36, 48, or 60 months after closure, after which records are deleted automatically. ### Identity and access integration SAML 2.0 single sign-on and SCIM 2.0 provisioning connect the channel to Okta, Microsoft Entra ID, or any standards-compliant provider. Handlers are provisioned from the directory and deprovisioned the moment they leave, which closes their access to reports without a manual step. --- ## What makes EthicsPortal different ### The price is published EthicsPortal costs €41.67/month billed annually (€500/year), or €60/month month-to-month, with every feature included and no per-employee fees. NAVEX, SpeakUp, Whispli, and FaceUp do not publish a price and quote through a sales process; EQS Integrity Line lists starting prices for its smaller packages in some markets and quotes Enterprise on request (checked October 2026). See [pricing](https://ethicsportal.eu/pricing/) and the [comparisons](https://ethicsportal.eu/compare/). ### Deployment is self-service An organization configures its whistleblowing channel and receives a live URL and QR code in the same session, without an implementation project. The enterprise platforms in this category route deployment through a sales engagement first, which is a difference in procurement time rather than in product quality. ### Report data stays in the EU Core report data — application, database, and file storage — runs on [Hetzner](https://www.hetzner.com) in Nuremberg, Germany (file attachment backup copy in Falkenstein), and transactional email through Mailjet in France. The whistleblowing channel and handler portal do not load Cloudflare. NAVEX is US-headquartered and offers EU hosting for its products (checked October 2026). See the [subprocessor list](https://ethicsportal.eu/subprocessors/) for EthicsPortal's full chain. ### Procurement evidence is published, including the gaps The [ISO/IEC 27001:2022 self-assessment](https://ethicsportal.eu/iso-27001/) covers Clauses 4–10 and all 93 Annex A controls, alongside an [ISO 37002 alignment map](https://ethicsportal.eu/iso-37002/), a [pre-filled CAIQ](https://ethicsportal.eu/caiq/), a [DORA third-party map](https://ethicsportal.eu/dora/), a [DPA](https://ethicsportal.eu/dpa/), an [SLA](https://ethicsportal.eu/sla/), and a [risk register](https://ethicsportal.eu/policies/risk-register/). Where a control is not in place, the same pages say so and date it, rather than leaving a reviewer to find out at questionnaire stage. The open items are listed on [trust](https://ethicsportal.eu/trust/). ### Report content is never processed by AI EthicsPortal does not transmit report content, reporter identity, handler messages, attachments, or audit entries to any large language model, generative AI service, or AI-based classifier. The API never returns report content, reporter identity, messages or attachments, so an AI assistant you connect to it cannot read them either. This is contractual, not a setting — [DPA §6.10](https://ethicsportal.eu/dpa/) — and introducing it would be a material change requiring notice under the sub-processor clause. --- ## Who EthicsPortal is for The 50-worker threshold in [Art. 8(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) is the best-known trigger, not the only one. [Art. 8(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) disapplies it for entities within the scope of the Union acts in Parts I.B and II of the Annex, and several member states extend the obligation to public entities of any size. - [Financial services firms](https://ethicsportal.eu/industries/financial-services/), [e-money and payment institutions](https://ethicsportal.eu/industries/e-money-and-payment-institutions/), insurers, and AML-obliged entities — **including those well under 50 workers**, which carry the obligation irrespective of headcount under [Art. 8(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937), often alongside DORA and sectoral reporting duties - [Public sector bodies and municipalities](https://ethicsportal.eu/industries/public-sector/), where several transpositions cover public entities regardless of size and [Art. 8(9)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) allows only small municipalities to share a channel - EU companies of 50–249 workers that crossed the [Art. 8(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) threshold and have no channel yet - EU companies of 250+ workers replacing an email inbox or a shared mailbox used as a channel - [Manufacturing groups](https://ethicsportal.eu/industries/manufacturing/) with multi-site, multi-language workforces - EU subsidiaries of non-EU parents that need an EU-operated channel of their own - Compliance consultancies and external DPOs operating channels on behalf of client organizations --- ## The organization behind EthicsPortal EthicsPortal is a trade name used by **Yaroslav Shmarov**, a sole proprietor (jednoosobowa działalność gospodarcza) registered in Warsaw, Poland, who is the authorized signatory for commercial agreements, DPAs, and security questionnaires. Continuity is addressed rather than assumed: organization administrators can export their cases at any time without operator involvement, and the [business continuity plan](https://ethicsportal.eu/policies/business-continuity/) states the operational dependencies, activation triggers, recovery objectives, and the current operator-incapacity limitations. The service exists because the obligation arrives long before a compliance department does — at 50 workers for most employers, and at any headcount for a supervised financial entity. The available options were an enterprise GRC suite priced and sold for a compliance department, or a shared mailbox that satisfies the letter of an obligation and none of its purpose. EthicsPortal was built for the organizations in between: a channel that meets each article of the Directive, priced and deployed like software rather than like a consulting engagement. - **Founder:** Yaroslav Shmarov — [LinkedIn](https://www.linkedin.com/in/yshmarov/) - **Company:** [LinkedIn](https://www.linkedin.com/company/ethicsportal) · [GitHub](https://github.com/ethicsportal) · [YouTube](https://www.youtube.com/@EthicsPortal) - **Contracting party, registry evidence, and procurement materials:** [trust](https://ethicsportal.eu/trust/) EthicsPortal operates a whistleblowing channel of its own, on its own product, under Directive 2019/1937: [secure.ethicsportal.eu/p/R8HXGNHO](https://secure.ethicsportal.eu/p/R8HXGNHO). --- ## How EthicsPortal works with customers ### Onboarding Create the organization account, set the name, logo, report categories, and retention period, and the whistleblowing channel is assigned its URL and QR code as soon as configuration is saved. Configuration takes minutes and the organization does it itself: there is no implementation project to schedule and no professional-services engagement to buy. See [how EthicsPortal works](https://ethicsportal.eu/product/) for the full deployment workflow. ### Who you work with Questions about the DPA, liability position, or a security questionnaire reach the authorized signatory directly — they are answered by someone who can sign the answer, not by a ticket queue that escalates toward one. Separate addresses exist for the matters that need them: [privacy@ethicsportal.eu](mailto:privacy@ethicsportal.eu) for GDPR and data protection, [security@ethicsportal.eu](mailto:security@ethicsportal.eu) for disclosures, [legal@ethicsportal.eu](mailto:legal@ethicsportal.eu) for the DPA, [accessibility@ethicsportal.eu](mailto:accessibility@ethicsportal.eu) for conformance questions. ### Response times Email is answered within one business day under normal conditions. Personal data breach notification to the controller is made without undue delay after becoming aware, as [Art. 33(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) GDPR requires of a processor ([DPA §6.6](https://ethicsportal.eu/dpa/)). Availability measurement and exclusions are in the [SLA](https://ethicsportal.eu/sla/); recovery objectives are RPO 24 hours and RTO 4 hours. ### Transparency during operation Live availability is published at [secure.ethicsportal.eu/up](https://secure.ethicsportal.eu/up), security incidents at [incidents](https://ethicsportal.eu/incidents/), and sub-processor changes are notified at least 30 days before they take effect, with a right to object and terminate ([DPA §6.4](https://ethicsportal.eu/dpa/)). --- ## Key facts | Field | Value | |---|---| | Service name | EthicsPortal (a trade name) | | Type | Whistleblower reporting and case management software (B2B SaaS) | | Business registered | 2023 | | Founder and operator | Yaroslav Shmarov, sole proprietor (jednoosobowa działalność gospodarcza) | | Headquarters | ul. Obrzeżna 1A, 02-691 Warsaw, Poland | | Tax identification number (NIP) | 5272755790 | | Website | [ethicsportal.eu](https://ethicsportal.eu) | | Core offering | Whistleblowing channel for EU Directive 2019/1937 | | Pricing | €41.67/month billed annually (€500/year), or €60/month month-to-month. All features included, no per-employee fees | | Contract terms | Monthly or annual subscription; cancellation takes effect at the end of the billing period; 30-day money-back guarantee on an organization's first paid subscription; no free trial | | Services | Anonymous and confidential intake, encrypted two-way messaging, 7-day and 3-month deadline tracking, case assignment and triage, append-only audit trail, PDF case export, configurable retention with automatic deletion, SAML SSO and SCIM provisioning | | Data residency | Hetzner, Nuremberg, Germany (report data; attachment backup copy in Falkenstein); Mailjet, France (transactional email) | | Languages | 14 — 13 official EU languages plus Luxembourgish | | Compliance basis | EU Directive 2019/1937; GDPR ([Art. 28](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) processor terms) | | AI processing | None. Report content is never sent to a large language model or AI classifier ([DPA §6.10](https://ethicsportal.eu/dpa/)) | | Certification status | [ISO/IEC 27001:2022 self-assessment](https://ethicsportal.eu/iso-27001/) (Clauses 4–10 and all 93 Annex A controls), [ISO 37002 alignment map](https://ethicsportal.eu/iso-37002/), [pre-filled CAIQ](https://ethicsportal.eu/caiq/). Self-assessment, not accredited certification; [independent external penetration test](https://ethicsportal.eu/trust/#certification-status) in October 2026 | | Recovery objectives | RPO 24 hours, RTO 4 hours ([SLA](https://ethicsportal.eu/sla/)) | | Continuity | Self-service case export at any time; [business continuity plan](https://ethicsportal.eu/policies/business-continuity/) states dependencies, activation triggers, and operator-incapacity limitations | | Competitors | NAVEX, EQS Integrity Line, SpeakUp, Whispli, FaceUp, Whistleblower Software by Formalize ([comparisons](https://ethicsportal.eu/compare/)) | | Governing law | Laws of Poland; courts of Warsaw ([Terms §13](https://ethicsportal.eu/terms/)) | | Communication | [support@ethicsportal.eu](mailto:support@ethicsportal.eu), typically answered within one business day | | Social | [LinkedIn](https://www.linkedin.com/company/ethicsportal) · [GitHub](https://github.com/ethicsportal) · [YouTube](https://www.youtube.com/@EthicsPortal) | --- ## Frequently asked questions ### Who operates EthicsPortal? EthicsPortal is a trade name used by Yaroslav Shmarov, a sole proprietor registered in Warsaw, Poland (NIP 5272755790). The same person is the authorized signatory for commercial agreements, DPAs, and security questionnaires. Registry evidence is published on the [trust](https://ethicsportal.eu/trust/) page and supplied on request during procurement. ### Where is report data stored? Core report data — the application, database, and file storage — is hosted on Hetzner infrastructure in Nuremberg, Germany, with a backup copy of file attachments in Falkenstein. Transactional email runs through Mailjet in France. The marketing site is delivered via Cloudflare; the whistleblowing channel and handler portal are not. ### What does EthicsPortal cost? €41.67/month billed annually (€500/year), or €60/month month-to-month. Every feature is included and there are no per-employee fees, so the price does not change as headcount does. See [pricing](https://ethicsportal.eu/pricing/). ### What security and compliance evidence does EthicsPortal publish? A full [ISO/IEC 27001:2022 self-assessment](https://ethicsportal.eu/iso-27001/) covering Clauses 4–10 and all 93 Annex A controls as a Statement of Applicability, an [ISO 37002 alignment map](https://ethicsportal.eu/iso-37002/), a [pre-filled CAIQ](https://ethicsportal.eu/caiq/), a [DORA third-party map](https://ethicsportal.eu/dora/), named policy documents, and a [risk register](https://ethicsportal.eu/policies/risk-register/). These are self-assessments against the control sets an external audit would evaluate, not accredited certification. Current certification status and open items are stated on [trust](https://ethicsportal.eu/trust/). ### Can an organization outside the EU use EthicsPortal? The entity operating the whistleblowing channel must be registered in the EU, Switzerland, Moldova or Montenegro. Where a group has an entity in one of those countries, that entity can operate one channel and open it to staff in any country, with every report reaching the same case list. A compliance report cites the national law of the operating entity; for a Swiss entity, which no general whistleblower statute covers, it cites the Directive as a voluntary standard and the Swiss Federal Act on Data Protection. ### How long does deployment take? The whistleblowing channel is live as soon as configuration is saved — name, logo, categories, and retention period. Distribution is the remaining work: the channel comes with a shareable link and a QR code for handbooks, onboarding packs, and notice boards. ### Does EthicsPortal use AI on report content? No. EthicsPortal never transmits report content, reporter identity, handler messages, attachments, or audit entries to a large language model, generative AI service, or AI-based classifier, and the service performs no AI categorisation, triage, summarisation, translation, or suggested replies on personal data. The commitment is contractual under [DPA §6.10](https://ethicsportal.eu/dpa/). ### How do I get procurement documents? The Terms, DPA, SLA, subprocessor list, security documentation, and self-assessments are published openly and require no request. Registry evidence, a countersigned DPA, and remaining procurement materials are available on request during review — see [trust](https://ethicsportal.eu/trust/). <a href="https://secure.ethicsportal.eu/session/new" class="btn btn-primary btn-lg">Deploy your whistleblowing channel →</a> --- # Accessibility statement > Read the EthicsPortal accessibility statement: assessment scope, known limitations, outstanding verification and contacts for feedback or alternative formats. Canonical: https://ethicsportal.eu/accessibility/ Last updated: 2026-10-27 Last reviewed: 2026-10-25. This accessibility information covers the EthicsPortal website, web application, public whistleblowing channels and downloadable documents. Our engineering target is WCAG 2.2 Level AA. ## Conformance status Full conformance with WCAG, EN 301 549 or RGAA has not been established. No complete RGAA audit or valid RGAA conformance percentage is available. ## Assessment and limitations The engineering review dated 25 October 2026 sampled mobile layouts, keyboard interactions and automated accessibility checks. It is not a complete accessibility assessment. Automated checks cannot establish screen-reader compatibility or conformance of every page and workflow. Outstanding assessment includes complete user journeys with assistive technologies, physical mobile devices, downloadable documents, customer attachments and third-party services. The website includes videos; captions alone do not establish that all media accessibility requirements are met. Accessible alternatives can be requested using the contact below. ## Public-sector procurement For a French public-sector deployment, agree the service scope and applicable EN 301 549 edition with the buyer. A complete RGAA assessment remains necessary to establish the deployed service’s status. The public body is responsible for its scoped declaration and accessibility programme; EthicsPortal supplies product evidence. This page does not replace that declaration. [EN 301 549 conformance report](https://ethicsportal.eu/en-301-549-conformance/) ## Feedback We welcome your feedback on the accessibility of EthicsPortal. If you encounter an accessibility barrier, cannot access content, or need information in an alternative format: - **Email:** [accessibility@ethicsportal.eu](mailto:accessibility@ethicsportal.eu) - **Also accepted:** [support@ethicsportal.eu](mailto:support@ethicsportal.eu) — please include "accessibility" in the subject line - We aim to acknowledge accessibility requests within **2 working days** and provide an alternative format or substantive response within **5 working days** ## Enforcement procedure If you are not satisfied with our response, you can refer the matter to the accessibility enforcement body in your country: - **France:** Défenseur des droits — [defenseurdesdroits.fr](https://www.defenseurdesdroits.fr) - **Poland:** Minister właściwy do spraw informatyzacji — via [gov.pl](https://www.gov.pl/), with the Rzecznik Praw Obywatelskich as the secondary recourse for unresolved complaints - **Germany:** Überwachungsstelle des Bundes für Barrierefreiheit von Informationstechnik — [bfit-bund.de](https://www.bfit-bund.de/) - **Other EU Member States:** see the list maintained by the European Commission at [digital-strategy.ec.europa.eu](https://digital-strategy.ec.europa.eu/en/policies/web-accessibility) ## Standards and references This statement is prepared with reference to: - [Directive (EU) 2016/2102](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016L2102) — accessibility of websites and mobile applications of public sector bodies - [Directive (EU) 2019/882](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L0882) — European Accessibility Act - [Implementing Decision (EU) 2018/1523](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32018D1523) — model accessibility statement - [EN 301 549 V4.1.1](https://www.etsi.org/deliver/etsi_en/301500_301599/301549/04.01.01_60/en_301549v040101p.pdf) - [EN 301 549 V3.2.1](https://www.etsi.org/deliver/etsi_en/301500_301599/301549/03.02.01_60/en_301549v030201p.pdf) — version listed in the harmonized standards under the Web Accessibility Directive - [WCAG 2.2 Level AA](https://www.w3.org/TR/WCAG22/) --- # National whistleblower authorities in the EU > Reference pages on the national authorities that run each member state's external whistleblowing channel: what they are competent for, how to report to them, and the statutory deadlines. Canonical: https://ethicsportal.eu/authorities/ Last updated: 2026-10-06 Every member state had to designate a competent authority to receive reports through an external channel under [Directive (EU) 2019/1937](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937). What those authorities can actually do differs sharply: some only forward reports, some investigate, some can fine an employer for having no internal reporting channel at all. These pages cover one authority each — its legal basis, the limits of its competence, how a report reaches it, the deadlines it works to, and what happens after. They are reference pages built from the national statute and the authority's own published material, not summaries of vendor guidance. For the underlying national transposition laws, see [whistleblower laws across the EU](https://ethicsportal.eu/whistleblower-laws/). Conversations with the people who run these authorities are recorded in [Transposition](https://ethicsportal.eu/transposition/). ## Pages - [France's whistleblower authority (Défenseur des droits): role, competence and how to report](https://ethicsportal.eu/authorities/france-defenseur-des-droits/): Reference on the Défenseur des droits under Loi Waserman: why France designated no single whistleblowing authority, what the institution can and cannot do, the schedule of competent external authorities, the statutory deadlines, and how a report reaches it. - [ANAC as Italy's external reporting authority: when you may report, deadlines and fines](https://ethicsportal.eu/authorities/italy-anac/): Reference on ANAC under D.Lgs. 24/2023: the conditions that make external reporting available at all, the channel and platform, the acknowledgment and feedback deadlines, how a case ends, and the administrative fines the Authority can impose. - [Germany's federal external reporting office (BfJ)](https://ethicsportal.eu/authorities/germany-bfj/): Reference on the externe Meldestelle des Bundes under the HinSchG: legal basis, how competence is split with BaFin, the Bundeskartellamt and the Länder offices, the reporting channels, the statutory deadlines, and what happens after a report. - [Poland's Ombudsman as external reporting authority: what the RPO does, deadlines and penalties](https://ethicsportal.eu/authorities/poland-rpo/): Reference on the Rzecznik Praw Obywatelskich under Poland's 2024 whistleblower act: how the role splits between the Ombudsman and the competent public authority, preliminary verification and referral, the acknowledgment and feedback deadlines, and the criminal penalties. - [Romania's National Integrity Agency as external reporting authority: competence, deadlines and fines](https://ethicsportal.eu/authorities/romania-ani/): Reference on ANI under Law 361/2022: how competence is shared between the Agency and the other competent authorities, the external reporting procedure, the acknowledgment and feedback deadlines, and the administrative fines the Agency itself imposes. - [Spain's whistleblower authority (AIPI): powers, competence and how to report](https://ethicsportal.eu/authorities/spain-aipi/): Reference on the Autoridad Independiente de Protección del Informante, A.A.I.: legal basis, how competence is split with the regional authorities, how to file a report through the external channel, the statutory deadlines, and what happens afterwards. --- # France's whistleblower authority (Défenseur des droits): role, competence and how to report > Reference on the Défenseur des droits under Loi Waserman: why France designated no single whistleblowing authority, what the institution can and cannot do, the schedule of competent external authorities, the statutory deadlines, and how a report reaches it. Canonical: https://ethicsportal.eu/authorities/france-defenseur-des-droits/ Last updated: 2026-09-21 The **Défenseur des droits** is the independent constitutional authority that orients whistleblowers, certifies their status and defends them against retaliation under the framework created by **Loi Waserman**. It is not France's external reporting channel. France is the outlier among the large member states: it designated **no single whistleblowing authority**. Understanding that distinction is the practical point of this page — for the duty to operate an internal channel, the thresholds and the penalties, see [whistleblower law in France](https://ethicsportal.eu/whistleblower-laws/france/). ## Why France has no single authority Spain built one body, the AIPI, to run a national external channel. Italy gave the job to ANAC. France did neither. Instead, **Décret n° 2022-1284 du 3 octobre 2022** publishes a schedule of **competent external authorities**, each receiving reports within its own sector — around twenty-three headings covering financial services, competition, the environment, health, and more. The Défenseur des droits sits alongside that schedule with a different job: it **orients** a whistleblower to the right authority, **certifies** their status, and **protects** them. It does not act as a general-purpose external channel for every subject matter. The consequence for an employer is concrete. There is no single regulator to name in an internal procedure. The procedure has to point a reporting person at the schedule, and at the Défenseur des droits as the route for anyone who does not know which authority applies. ## What the Défenseur des droits is | | | | --- | --- | | Legal nature | Independent constitutional authority (**art. 71-1 of the Constitution**), created in 2011 | | Governing statute | **Loi organique n° 2011-333 du 29 mars 2011**, as amended | | Whistleblower mandate from | **Loi organique n° 2022-400 du 21 mars 2022**, the organic law passed alongside Loi Waserman | | Current officeholder | **François-Noël Buffet**, since **23 July 2026** (décret du 22 juillet 2026), succeeding Claire Hédon | | Term | **Six years, neither renewable nor revocable**; the office may not be held alongside any other | | Deputy for whistleblowers | *Adjoint chargé de l'accompagnement des lanceurs d'alerte* — the post created by art. 2 of the organic law; **listed as awaiting appointment** following the July 2026 change of officeholder | A whistleblower framework depending on a deputy who is not currently in post is worth knowing before an internal procedure promises a reporting person that support exists. ## What the organic law actually changed Loi organique n° 2022-400 amended the 2011 statute in four places: 1. **Article 1** — the mission moves from *watching over* the rights of whistleblowers to **informing, advising and defending** them, and those protected within an alert procedure (amending art. 4(5)). 2. **Article 2** — creates the **adjoint chargé de l'accompagnement des lanceurs d'alerte** (art. 11). 3. **Article 3** — inserts **art. 35-1**: any whistleblower within the meaning of Loi n° 2016-1691 may address a report to the Défenseur des droits, which handles it under an **independent and autonomous procedure**, refers it onward where it is not competent, and may issue an **opinion on whistleblower status within six months** of the request. 4. **Article 4** — requires a **biennial report** on the overall functioning of whistleblower protection, presented to the President of the Republic and the presidents of both chambers, built from data supplied by all the competent authorities (art. 36 II). ## The three missions **Information and orientation.** It answers questions on the rules and directs a reporting person to the authority competent for the subject matter — the function that carries most of the load, given the schedule of authorities. **An opinion on whistleblower status.** Anyone may ask the Défenseur des droits to confirm that they meet the statutory definition. The opinion is issued **within six months**. It matters because the protections attach to the status, and a person who is unsure whether they qualify is otherwise deciding alone whether to rely on them. **Protection against retaliation.** The protection covers not only the whistleblower but **facilitators** — the people or bodies who helped them — and third parties connected to the report. ## What it cannot do This is where French practice most often goes wrong. - **It does not investigate most alerts.** As an investigating body it retains only its four historic domains: **children's rights, the rights of users of public services, the professional ethics of security personnel, and discrimination.** An alert about, say, accounting fraud or an environmental breach is oriented to the competent authority, not investigated here. - **It does not resolve the employment dispute or award compensation.** Retaliation claims go to the **Conseil de prud'hommes**. The institution's role is protection and status, not remedy. - **It does not replace the employer's internal procedure**, and using it is not conditional on having exhausted one — a reporting person may go external from the outset. ## Deadlines for external reporting The decree's external deadlines are not the same as the internal ones, which is the most common confusion. | | External authority | Employer's internal procedure | | --- | --- | --- | | Acknowledgment of receipt | **7 working days** from receipt | **7 working days** from receipt | | Feedback to the reporting person | **3 months** from the acknowledgment — or from the expiry of the seven working days where no acknowledgment was sent | **3 months** from the acknowledgment | | Extension | To **6 months** where the circumstances require further investigation, justified before the three months expire | — | The acknowledgment may be omitted where the reporting person expressly waived it, or where the authority has reasonable grounds to believe that acknowledging receipt would compromise the confidentiality of their identity. Where an authority finds a report falls outside its competence, or only partly within it, **art. 10(II) of the decree requires it to forward the report promptly** to the competent external authority or to the Défenseur des droits, preserving confidentiality. ## How a report reaches it | | | | --- | --- | | Telephone | **09 69 39 00 00**, Monday to Friday, 8.30–19.30 | | Online | [formulaire.defenseurdesdroits.fr](https://formulaire.defenseurdesdroits.fr) | | Post (free, no stamp) | Défenseur des droits, **Libre réponse 71120, 75342 Paris Cedex 07** | For postal reports the institution asks for a **double envelope**, the inner one marked **« SIGNALEMENT D'UNE ALERTE »** — the handling route that keeps the report away from ordinary correspondence. Disclosing elements that identify a whistleblower is punishable by **two years' imprisonment and a €30,000 fine**. ## What the 2026 biennial report found The second biennial report, *La protection des lanceurs d'alerte en France : un dispositif à l'épreuve de son appropriation*, was published on **28 May 2026** by Claire Hédon and her deputy Cécile Barrois de Sarigny, covering 2024–2025. Three findings bear on how an employer should run an internal procedure: - **External reporting has grown roughly fivefold.** More than **10,000 reports to external authorities in 2025**, against about **2,000 in 2023**. Requests to the Défenseur des droits itself have multiplied by ten since 2017. - **Retaliation, not intake, is the recurring failure** — most often in the employment relationship. - The report presses for **effective financial and psychological support** for whistleblowers, which the framework promises more readily than it delivers. The first of these is the one to act on. External reporting grows when internal channels are not trusted or not known, and a report that goes straight to a sectoral authority is one the employer learns about from the regulator. ## Official sources - [Loi organique n° 2022-400 du 21 mars 2022 — role of the Défenseur des droits](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000045388740) - [Loi n° 2022-401 du 21 mars 2022 (Loi Waserman)](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000045388745) - [Décret n° 2022-1284 du 3 octobre 2022 — procedures and the list of external authorities](https://www.legifrance.gouv.fr/loda/id/JORFTEXT000046357368) - [Défenseur des droits — orienting and protecting whistleblowers](https://www.defenseurdesdroits.fr/orienter-et-proteger-les-lanceurs-dalerte-180) - [Défenseur des droits — the institution and its deputies](https://www.defenseurdesdroits.fr/le-defenseur-des-droits-et-ses-adjoints-215) - [Biennial report, 28 May 2026](https://www.defenseurdesdroits.fr/rapport-bisannuel-la-protection-des-lanceurs-dalerte-en-france-un-dispositif-lepreuve-de-son-1150) --- # Germany's federal external reporting office (BfJ) > Reference on the externe Meldestelle des Bundes under the HinSchG: legal basis, how competence is split with BaFin, the Bundeskartellamt and the Länder offices, the reporting channels, the statutory deadlines, and what happens after a report. Canonical: https://ethicsportal.eu/authorities/germany-bfj/ Last updated: 2026-09-20 The **externe Meldestelle des Bundes** at the Bundesamt für Justiz is Germany's federal point of contact for external reports under the Hinweisgeberschutzgesetz. It receives reports, checks whether they are substantiated, and takes follow-up measures. This page is a reference on the office itself: what it is, what it is and is not competent for, how a report reaches it, which deadlines apply, and what happens next. For the duty to operate an internal reporting office, the thresholds and the fines, see [whistleblower law in Germany](https://ethicsportal.eu/whistleblower-laws/germany/). ## What the office is | | | | --- | --- | | Name | Externe Meldestelle des Bundes (§ 19(1) HinSchG) | | Legal basis | **Hinweisgeberschutzgesetz (HinSchG)**, in force since 2 July 2023 | | Host body | Established **at the Bundesamt für Justiz**, organisationally separated from the rest of that office (§ 19(1)) | | Independence | Its tasks are performed independently of the Bundesamt's other tasks; it is subject to administrative supervision only insofar as its independence is not impaired (§ 19(2)) | | Competence | **Residual** — competent unless an office under §§ 20 to 23 is competent (§ 19(4)) | One structural point matters more than any other here: Germany did **not** create a standalone independent authority. It created an organisationally separated unit **inside** an existing federal office. The independence comes from how its tasks are performed and from the limits on supervision, not from separate legal personality — a materially different design from, for example, [Spain's AIPI](https://ethicsportal.eu/authorities/spain-aipi/), which the law constitutes as an independent authority with its own legal personality. ## Functions § 24 HinSchG gives the external reporting offices three sets of duties: 1. **Establish and operate whistleblowing channels** under § 27, check whether a report is substantiated, and conduct the § 28 procedure (para. 1). 2. **Provide comprehensive and independent information and advice** on available remedies and on procedures for protection against retaliation — expressly including information about the option of reporting internally (para. 2). 3. **Publish specified information** in a separate, easily identifiable and easily accessible section of their website (para. 3): the conditions for protection, an explanation of the reporting procedure and the possible follow-up measures, the confidentiality regime and personal-data processing, available remedies and the availability of confidential advice, a plain explanation of when a reporting person cannot be held liable for breaching confidentiality obligations, and its contact details. ## Competence, and its limits The federal office is **not** competent for everything. The HinSchG divides it: | Office | Competent for | | --- | --- | | **Externe Meldestelle des Bundes** (§ 19) | Everything not assigned to one of the offices below | | **Länder external reporting offices** (§ 20) | Reports concerning that Land's administration and its municipal administrations — each Land **may** establish one | | **BaFin** (§ 21) | Reports covered by § 4d FinDAG, including the WpÜG; money laundering where BaFin is the competent authority under § 50(1) nos. 1 or 2 GwG; breaches under § 2(1) no. 3 lit. r to t | | **Bundeskartellamt** (§ 22) | Breaches under § 2(1) nos. 8 and 9 | | **Further external reporting office** (§ 23) | Reports concerning the federal office itself; conversely, the federal office is the further office for reports concerning the §§ 20 to 22 offices | Because establishing a Land office under § 20 is optional, reports about the administration of a Land that has not set one up fall back to the federal office under § 19(4). **Where the office is not competent**, or cannot pursue the reported breach within a reasonable time, it forwards the report without delay to the body responsible for investigating it, preserving the confidentiality of the reporting person's identity, and informs the reporting person of the transfer without delay (§ 31(2)). ### What the office is not The external reporting office is **not a prosecuting or supervisory authority**. Its follow-up measures are set out exhaustively in § 29(2): contact the employer concerned, refer the reporting person to other competent bodies, close the procedure for lack of evidence or on other grounds, or hand the case to a competent authority for further investigation. It may request information at its dutiful discretion where this is necessary to check whether a report is substantiated (§ 29(1)). The rights to refuse testimony under §§ 53 and 53a StPO and to refuse information under § 55 StPO apply accordingly, and compensation under the JVEG is granted on application for answering such a request. ## How to report External reporting channels must allow reports **orally and in text form** (§ 27(3)). Oral reporting must be possible by telephone or another form of voice transmission. At the reporting person's request, a **personal meeting** must be made possible within a reasonable time; with their consent it may be held by video and audio transmission. Federal reports go through the [reporting form of the federal external reporting office](https://formulare.bfj.bund.de/ffw/action/invoke.do?id=externeMeldestelle). ### Anonymity — the most frequently misstated point § 27(1) HinSchG says the external reporting office **should** also process anonymously submitted reports. But, subject to specific statutory rules, there is **no obligation to design the channels so that anonymous reports can be submitted**. § 16(1) uses the same formulation for internal reporting offices. Germany therefore requires an anonymous route neither internally nor externally: processing anonymous reports that do arrive is a "should" provision, and enabling anonymous submission is not a duty at all. ## Deadlines The external and internal deadlines are not the same. | | External reporting office | Internal reporting office | | --- | --- | --- | | Acknowledgment of receipt | Promptly, **at the latest seven days** after receipt (§ 28(1)) | **At the latest after seven days** (§ 17(1) no. 1) | | Feedback | Within a reasonable time, **at the latest after three months**; **six months** where processing is extensive, with the reasons for the extension communicated (§ 28(4)) | **Three months** from the acknowledgment, or where receipt was not acknowledged, at the latest **three months and seven days** after receipt (§ 17(2)) | The extension to six months is available only to the **external** office; the internal deadline has no extension. This is the mirror image of Spain, where the internal deadline extends and the external one is hard. An acknowledgment is not sent where the reporting person has expressly waived it, or where there is sufficient reason to assume it would impair the protection of their identity (§ 28(1)). Reports about breaches of particular gravity may be handled as a priority, which does not affect the deadlines (§ 28(5)). ## What happens after a report 1. **Acknowledgment** within seven days. In cases suitable for an internal reporting procedure, the office points out the option of reporting internally together with the acknowledgment (§ 28(1)). 2. **Scope check**: does the reported breach fall within § 2, and does no exception under § 5 apply? If it does fall within scope, the office checks whether the report is substantiated and takes appropriate follow-up measures under § 29 (§ 28(2)). 3. **Follow-up measures** under § 29(2), as above. 4. **Closure** under § 31(1), once the office has checked whether the report is substantiated and conducted the § 28 procedure. Access to the file is governed by § 29 VwVfG; existing confidentiality and secrecy obligations must be observed, and the rights of the people who are the subject of a report must not be impaired (§ 28(3)). ## How internal and external reporting interact § 7(1) gives reporting people a **choice**: they may turn to an internal reporting office (§ 12) or directly to an external one (§§ 19 to 24). The Act expresses a preference — where the breach can be dealt with effectively internally and no retaliation is to be feared, the person **should** prefer the internal route — but does not make it a precondition. Where an internally reported breach was not remedied, the route to the external office remains expressly open. Employers obliged to establish internal reporting offices under § 12 **should create incentives** for reporting internally first (§ 7(3)). Obstructing a report, or the communication that follows one, is prohibited (§ 7(2)) and carries a fine. **Public disclosure** is protected (§ 32(1)) where the person first reported externally and either no appropriate follow-up measures were taken within the § 28(4) feedback deadlines or they received no feedback about such measures; or where they had sufficient reason to believe the breach posed an immediate or manifest danger to the public interest, that retaliation was to be feared, or that evidence might be suppressed or destroyed, that the external office might be colluding with the perpetrator, or that for other reasons the prospects of effective follow-up were slim. ## Protection against retaliation The protections in §§ 35 to 37 apply where the person reported internally under § 17 or externally under § 28, or disclosed under § 32; had sufficient reason at the time to believe the information was true; and the information concerns breaches within the Act's scope, or they had sufficient reason to believe it did (§ 33(1)). Retaliation is prohibited, as is threatening or attempting it (§ 36(1)). The operative provision is the **reversal of the burden of proof** in § 36(2): where a reporting person suffers a detriment in connection with their professional activity and asserts that it followed a report, the detriment is presumed to be retaliation, and the person who caused it must prove that it rested on sufficiently justified grounds or was not based on the report. ## Fines § 40(6) HinSchG sets three tiers: | Amount | Conduct | | --- | --- | | up to **€50,000** | Obstructing a report (§ 40(2) no. 1), retaliation (no. 3), intentional or reckless breach of confidentiality (para. 3), attempt (para. 5) | | up to **€20,000** | Knowingly disclosing false information (para. 1) and **failing to establish or operate an internal reporting office** (para. 2 no. 2) | | up to **€10,000** | The remaining cases, in particular negligent breach of confidentiality (para. 4) | The ceiling for having no internal reporting office is widely reported as €50,000. The Act sets **€20,000**; the €50,000 tier covers obstruction, retaliation and confidentiality breaches. Application of § 30(2) sentence 3 OWiG — which multiplies the ceiling for legal persons — is expressly confined to § 40(2) nos. 1 and 3 and paras. 3 and 4, and so does not reach the missing-internal-office offence. ## Official sources - [Hinweisgeberschutzgesetz (HinSchG) — official text](https://www.gesetze-im-internet.de/hinschg/BJNR08C0B0023.html) - [Federal external reporting office — reporting form](https://formulare.bfj.bund.de/ffw/action/invoke.do?id=externeMeldestelle) - [Directive (EU) 2019/1937 — EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937) --- # ANAC as Italy's external reporting authority: when you may report, deadlines and fines > Reference on ANAC under D.Lgs. 24/2023: the conditions that make external reporting available at all, the channel and platform, the acknowledgment and feedback deadlines, how a case ends, and the administrative fines the Authority can impose. Canonical: https://ethicsportal.eu/authorities/italy-anac/ Last updated: 2026-09-20 The **Autorità nazionale anticorruzione (ANAC)** operates the external reporting channel established by Legislative Decree no. 24 of 10 March 2023. It receives reports, investigates, gives feedback to the reporting person, and imposes the administrative fines the decree provides for. This page is a reference on the Authority: when a person may turn to it at all, how a report is filed, which deadlines apply, what happens next, and what ANAC can fine. For the internal-channel duty, thresholds and personal scope, see [whistleblower law in Italy](https://ethicsportal.eu/whistleblower-laws/italy/). ## What ANAC is for the purposes of the decree | | | | --- | --- | | Authority | Autorità nazionale anticorruzione (ANAC) | | Source | **Legislative Decree no. 24 of 10 March 2023**, arts. 6–9 and 21 | | Role | Operator of the **external reporting channel** (art. 7(1)) | | Effective from | **15 July 2023**; for private entities with up to 249 workers the internal-channel duty runs from **17 December 2023** (art. 24(1) and (2)) | | Sanctioning power | Administrative fines from **€500 to €50,000** (art. 21) | ## When external reporting is available at all This is what sets Italy apart from most other member states, and it is also the point most often reported incorrectly. **External reporting is not a free alternative to internal reporting.** Article 6(1) allows it only where, *at the time it is submitted*, **one** of these conditions applies: - **(a)** the reporting person's work context provides **no mandatory internal channel**, or the channel, though mandatory, is **not active**, or, though activated, **does not comply** with art. 4; - **(b)** the reporting person **already made an internal report** under art. 4 and **it was not followed up**; - **(c)** the reporting person has **well-founded reasons to believe** that an internal report would not be effectively followed up, or that making one could create **a risk of retaliation**; - **(d)** the reporting person has well-founded reason to believe the breach may constitute an **imminent or manifest danger to the public interest**. In Spain and Germany the choice between the internal and external route is free. In Italy it is not: someone who goes to ANAC without one of those four conditions is outside the perimeter of art. 6. ## The external channel ANAC operates a channel that guarantees, **including through the use of encryption**, the confidentiality of the identity of the reporting person, the person concerned and any person mentioned in the report, as well as of the content of the report and its documentation (art. 7(1)). The same confidentiality applies where a report arrives through other channels or reaches staff not assigned to handling reports, to whom it must in any case be transmitted without delay. External reports are made (art. 7(2)): - **in writing** through the **online platform**; - **orally** by telephone line or voice-messaging system; - **at an in-person meeting**, at the reporting person's request, arranged within a reasonable time. The Authority's platform is at [whistleblowing.anticorruzione.it](https://whistleblowing.anticorruzione.it/). An external report submitted to a body other than ANAC **must be transmitted to ANAC within seven days** of receipt, with simultaneous notice to the reporting person (art. 7(3)). ### Anonymous reports The decree does **not** require the channel to accept anonymous submissions. The operative rule is art. 16(4): the protections apply **also** to anonymous reports, complaints to the judicial or accounting authorities, and public disclosures **where the reporting person was subsequently identified and suffered retaliation**. Protection therefore does not depend on having given a name when reporting; it engages once the identity surfaces and retaliation follows. ## Deadlines The external and internal deadlines are not the same. | | External channel — ANAC | Entity's internal channel | | --- | --- | --- | | Acknowledgment of receipt | **Seven days** from receipt, unless the reporting person requests otherwise or the acknowledgment would prejudice the confidentiality of their identity (art. 8(1)(b)) | **Seven days** from receipt (art. 5(1)(a)) | | Feedback | **Three months**, or **six months where justified and reasoned grounds exist**, from the acknowledgment or, failing that, from the expiry of the seven days (art. 8(1)(f)) | **Three months** from the acknowledgment or, failing that, from the expiry of the seven days (art. 5(1)(d)) | The extension to six months is available **only on the external channel**; the internal deadline cannot be extended. That is the same shape as Germany and the opposite of Spain, where the internal deadline extends and the external one is hard. ## What ANAC does after a report The Authority designates specifically trained staff and carries out the activities listed in art. 8(1): 1. **Inform** any interested person about the use of the external and internal channels and about the Chapter III protection measures. 2. **Acknowledge receipt** within seven days. 3. **Maintain contact** with the reporting person and request further material if needed. 4. **Diligently follow up** the reports received. 5. **Carry out the investigation**, including by **hearings and obtaining documents**. 6. **Give feedback** within the deadlines above. 7. **Communicate the final outcome**, which may be **archiving**, **transmission to the competent authorities**, a **recommendation**, or an **administrative fine**. ### Limits on what it will do - **Lack of competence.** Reports outside ANAC's competence are sent to the competent administrative or judicial authority, including EU institutions and bodies, with simultaneous notice to the reporting person. The receiving authority performs the activities under letters (c), (d), (e), (f) and (g) and guarantees the same confidentiality (art. 8(2)). - **Prioritisation.** Where there is a significant influx, ANAC **may give priority** to reports concerning breaches involving serious harm to the public interest or harm to principles of constitutional or EU-law rank (art. 8(4)). - **Minor breaches.** ANAC **may decline to follow up** reports of minor breaches and archive them (art. 8(5)). ANAC also transmits annually to the European Commission the number of external reports received, the number and types of proceedings opened and their outcome, and, where established, the financial damage caused and the amounts recovered (art. 8(3)). ## Fines Unlike several of its counterparts, **ANAC imposes administrative fines directly** (art. 21(1)): | Amount | Conduct established | | --- | --- | | **€10,000–50,000** | Retaliation; a report obstructed or an attempt to obstruct it; breach of the confidentiality obligation under art. 12 (lit. a) | | **€10,000–50,000** | **Failure to establish whistleblowing channels**; failure to adopt procedures for making and managing reports, or adoption of procedures that do not comply with arts. 4 and 5; **failure to carry out the verification and analysis** of the reports received (lit. b) | | **€500–2,500** | The case under art. 16(3), unless the reporting person has been convicted, including at first instance, of defamation or malicious accusation (lit. c) | Two features deserve attention. First, letter (b) does not only penalise the absence of a channel: **non-compliant procedures** and **failure to verify and analyse** the reports received sit in the same band — operating a channel nobody investigates is the same offence as having none. Second, the fines are applied **to the person responsible**, and private-sector entities under art. 2(1)(q)(3) must provide for sanctions in the disciplinary system adopted under art. 6(2)(e) of Legislative Decree 231/2001 (art. 21(2)). ## Protection against retaliation The protections operate where the person made an internal report, an external report or a public disclosure on the decree's terms. Retaliation is prohibited (art. 17), and **waivers and settlements**, whole or partial, concerning the rights and protections the decree provides **are invalid** unless made in the forms of art. 2113, fourth paragraph, of the Civil Code (art. 22). The protections are not guaranteed, and a disciplinary sanction is imposed on the reporting person, in the cases of intent or gross negligence established under art. 16(3). ## The Authority's contact points | | | | --- | --- | | Reporting platform | [whistleblowing.anticorruzione.it](https://whistleblowing.anticorruzione.it/) | | Offices | Palazzo Sciarra, Via Minghetti 10, 00187 Rome | | Institutional site | [anticorruzione.it](https://www.anticorruzione.it/) | Article 9 requires ANAC to publish, in a dedicated, easily identifiable and accessible section, the protection measures, its own contact details (stating whether telephone conversations are recorded), instructions on using the channels, the confidentiality regime, the feedback deadlines and the types of follow-up it can give, and the list of third-sector bodies it has agreements with. ## Official sources - [Legislative Decree no. 24 of 10 March 2023 — Gazzetta Ufficiale no. 63 of 15 March 2023](https://www.gazzettaufficiale.it/eli/id/2023/03/15/23G00032/sg) - [ANAC — whistleblowing](https://www.anticorruzione.it/-/whistleblowing) - [ANAC — external reporting platform](https://whistleblowing.anticorruzione.it/) - [Directive (EU) 2019/1937 — EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937) --- # Poland's Ombudsman as external reporting authority: what the RPO does, deadlines and penalties > Reference on the Rzecznik Praw Obywatelskich under Poland's 2024 whistleblower act: how the role splits between the Ombudsman and the competent public authority, preliminary verification and referral, the acknowledgment and feedback deadlines, and the criminal penalties. Canonical: https://ethicsportal.eu/authorities/poland-rpo/ Last updated: 2026-09-20 The **Rzecznik Praw Obywatelskich (RPO)**, Poland's Commissioner for Human Rights, receives external reports under the Act of 14 June 2024 on the Protection of Whistleblowers. In most cases it does not investigate them: it carries out a preliminary verification and passes the report to the public authority competent to take follow-up action. This page is a reference on the authority: what the RPO does and does not do, how a report is filed, which deadlines apply, and what happens next. For the internal-procedure duty and the thresholds, see [whistleblower law in Poland](https://ethicsportal.eu/whistleblower-laws/poland/). ## What the RPO is in this system | | | | --- | --- | | Authority | Rzecznik Praw Obywatelskich (Commissioner for Human Rights) | | Legal basis | **Act of 14 June 2024 on the Protection of Whistleblowers** (Dz.U. 2024 item 928), Chapter 4 | | Role | Receiving external reports, **preliminary verification**, and referral to the competent public authority (art. 31(1)) | | External reporting since | **25 December 2024** — Chapter 4 entered into force six months after publication, the rest of the Act after three (art. 64) | | Sanctions | The RPO **imposes no penalties** — the Chapter 6 offences are tried by the courts | ## Choosing between internal and external reporting The Act leaves the choice open. Under art. 30(1), **a whistleblower may make an external report without first making an internal one**. That differs from Italy, where the external channel only opens once one of four statutory conditions is met, and matches the Spanish and German position. An external report is received by **the Ombudsman or by a public authority** (art. 30(2)). Each is a separate controller for the personal data in the reports it receives (art. 30(3)). ## What the RPO does — and does not do Article 31(1) lists the Ombudsman's tasks: 1. **Establishes the procedure** for receiving external reports, specifying in particular how **anonymous** reports are handled. 2. **Receives reports** about breaches in the fields listed in art. 3(1)(1)–(16), carries out a **preliminary verification**, and **passes them to the public authority** competent for follow-up. 3. **Receives and examines** reports itself **only** where the report concerns the field in art. 3(1)(17) and **no other public authority is competent**. 4. Ensures general access to information on whistleblowers' rights and remedies, in particular through its Public Information Bulletin. 5. Advises whistleblowers, people assisting them, and people the report concerns. 6. Informs about bodies able to protect against retaliation and, where appropriate, supports contact with them. **This is the core of the Polish model.** The RPO is primarily an entry point and routing hub, not an investigating body. It handles a case itself only in the narrow residual field under point 17. ### Preliminary verification and referral Preliminary verification means establishing whether the report concerns information about a breach of law, and identifying the competent public authority (art. 32(1)). - If it **does** — the RPO refers the report without delay and **no later than 14 days** from the date it was made, telling the whistleblower which authority received it and when (art. 32(2)–(3)). - If it **does not** — the RPO declines to refer it and informs the whistleblower of the verification findings (art. 32(4)–(5)). It may point to another route: a civil claim, a notification of suspected crime, a complaint to an administrative court, or a complaint, request or petition. That information does not affect the admissibility of any later remedy or the running of time limits (art. 32(6)). A public authority that receives a report outside its own field refers it to the competent authority **within 14 days, or 30 days in justified cases**, and informs the whistleblower (art. 34(1)(4)). ## How to file an external report A report may be made **orally or in writing** (art. 36(1)). In documentary form: - **on paper** — to the correspondence address indicated by the RPO or the public authority; - **electronically** — to the email address, electronic inbox or e-delivery address indicated, or through a dedicated web form or an application designated by the public authority. The RPO's information for whistleblowers is published in its [Public Information Bulletin](https://bip.brpo.gov.pl/pl/sygnalisci). **A contact address is required.** So that follow-up and feedback are possible, the whistleblower gives a contact address. Where none is given and none can be established, the RPO and the public authority do not perform several of their information duties (art. 35). Communication channels used for external reports must be **independent of the authority's ordinary channels**, ensure the completeness, confidentiality and integrity of the data, and allow information to be stored durably (art. 42(1)). ## Deadlines | | External report | Internal report | | --- | --- | --- | | Acknowledgment | **7 days** from receipt, unless the whistleblower expressly asked otherwise or the acknowledgment would threaten the confidentiality of their identity (art. 37) | 7 days (Chapter 3) | | Referral to the competent authority | **14 days** from the date of the report (RPO, art. 32(2)); a public authority — **14 days, or 30 in justified cases** (art. 34(1)(4)) | — | | Feedback | **3 months** from receipt of the external report; **6 months** in justified cases, after telling the whistleblower before the three months expire (art. 41) | 3 months | The public authority also informs the whistleblower of the **final outcome** of any explanatory proceedings opened as a result of the report (art. 41(3)). ## The protection certificate A feature distinctive to the Polish act: **at the whistleblower's request**, the public authority competent for follow-up issues, **within one month** of receiving the request, a **certificate confirming that the whistleblower is protected** under Chapter 2 (art. 38). It is a document the whistleblower can put in front of an employer or use in proceedings. Spanish, German and Italian law contain no equivalent instrument. ## When a report can be left unexamined The RPO may leave a report unexamined where it previously declined to refer an earlier report, or where the report concerns a matter already covered by an earlier report and **contains no significant new information**. It tells the whistleblower, with reasons; on any further such report it does not (art. 40(1)). A public authority has the same power (art. 40(2)). The fact is recorded in the register (art. 40(3)). ## Criminal liability Poland does not use administrative fines here. Chapter 6 creates **criminal offences**: | Conduct | Penalty | | --- | --- | | Preventing or substantially hindering a report (art. 54(1)) | fine, restriction of liberty, or **up to 1 year's imprisonment** | | — using violence, unlawful threat or deception (art. 54(2)) | **up to 3 years' imprisonment** | | Retaliation against a whistleblower, a person assisting, or a related person (art. 55(1)) | fine, restriction of liberty, or **up to 2 years**; if persistent — **up to 3 years** | | Disclosing the identity of a whistleblower, assisting or related person (art. 56) | fine, restriction of liberty, or **up to 1 year** | | Reporting or publicly disclosing while knowing no breach occurred (art. 57) | fine, restriction of liberty, or **up to 2 years** | | **Failing to establish the internal reporting procedure**, or establishing it in significant breach of the Act's requirements (art. 58) | **a fine** — imposed under the Code of Procedure in Petty Offence Cases (art. 59) | Having no internal procedure is therefore a **petty offence tried by a court** in Poland, not an administrative breach penalised by a supervisory body. The Ombudsman does not impose these penalties. ## Free legal aid The Act extended free legal aid and free civic counselling to **a person intending to report** a breach within the meaning of the Act, disapplying the usual eligibility criteria (art. 61). ## Official sources - [Act of 14 June 2024 on the Protection of Whistleblowers (Dz.U. 2024 item 928)](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20240000928) - [Text of the Act — Sejm API](https://api.sejm.gov.pl/eli/acts/DU/2024/928/text.pdf) - [RPO — whistleblowers (BIP)](https://bip.brpo.gov.pl/pl/sygnalisci) - [Directive (EU) 2019/1937 — EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937) --- # Romania's National Integrity Agency as external reporting authority: competence, deadlines and fines > Reference on ANI under Law 361/2022: how competence is shared between the Agency and the other competent authorities, the external reporting procedure, the acknowledgment and feedback deadlines, and the administrative fines the Agency itself imposes. Canonical: https://ethicsportal.eu/authorities/romania-ani/ Last updated: 2026-09-20 The **Agenția Națională de Integritate (ANI)**, the National Integrity Agency, is one of the authorities competent to receive reports of breaches of the law under Law no. 361/2022. It receives reports, examines them, redirects what falls outside its competence, and establishes and penalises the offences the Law creates. This page is a reference on the authority: what it does and does not do, how a report is filed, which deadlines apply, and what it can fine. For the internal-channel duty and the thresholds, see [whistleblower law in Romania](https://ethicsportal.eu/whistleblower-laws/romania/). ## What ANI is in this system | | | | --- | --- | | Authority | Agenția Națională de Integritate (the "Agency") | | Legal basis | **Law no. 361/2022** on the protection of public-interest whistleblowers, Chapters IV and VII | | Role | External reporting channel, alongside the other competent authorities (art. 3(15) and art. 12(1)) | | Structure | A **distinct specialised structure** within the Agency; integrity inspectors designated as responsible persons (art. 16) | | Sanctions | **Establishes and penalises** the offences in arts. 28 and 29 (art. 30(1)) | ## Who counts as a "competent authority" The Law does not designate a single authority. Under art. 3(15) the competent authorities are: - **(a)** public authorities and institutions that, under special legislation, receive and resolve reports in their own field of competence; - **(b)** the **National Integrity Agency**; - **(c)** other public authorities and institutions to which the Agency transmits reports for resolution. That architecture creates mutual redirection duties (art. 12): - reports the Agency receives that belong to the (a) authorities are **redirected immediately** to them, preserving confidentiality and integrity guarantees; - the (a) authorities must **immediately redirect** to the Agency any report within its competence; - the Agency immediately redirects to the (c) authorities where it lacks competence to examine and take follow-up action; - the (c) authorities immediately redirect misdirected reports back to the Agency. **The whistleblower must be notified of a redirection within 3 working days** of it happening (art. 12(5)). ## The Agency's tasks Article 14 lists them: - **resolves** the reports within its competence; - **forwards** a report to the competent authority according to its subject matter; - transmits information in good time to the competent EU institutions, bodies, offices or agencies; - organises periodic **public information activities** on the reporting procedure and the protection measures; - provides **advice to employers**, on request, in drafting and revising internal procedures; - provides **training for the persons designated** to resolve reports; - provides **confidential advice, on request**, to people intending to make a report; - proposes legislative amendments and cooperates with similar institutions. Two are worth drawing out: ANI **advises employers** on request when they write their internal procedures, and offers **confidential pre-reporting advice** to people considering coming forward. ## Powers and duties when resolving a report In resolving a report, the Agency and the art. 3(15)(c) authorities **may** (art. 13(1)) request documents held by any public authority, public institution, or public- or private-law legal person and receive copies, and request information from the whistleblower, the person concerned and anyone else who can help — including by inviting them to their premises. They **must** (art. 13(2)) receive, examine and answer reports through designated persons; take follow-up action; ensure confidentiality; **retain reports for 5 years** from registration; maintain contact with the whistleblower; and inform them how the report was resolved. ## The external procedure and its deadlines | Stage | Deadline | | --- | --- | | Acknowledgment of receipt | **Immediately, and no later than 7 calendar days** from receipt — unless the whistleblower expressly asked otherwise or the Agency reasonably considers the acknowledgment would endanger the protection of their identity (art. 17(1)) | | Notice of redirection | **3 working days** from the redirection (art. 12(5)) | | Responses to the Agency's requests | Those asked must reply within **no more than 15 working days** of receiving the request (art. 17(5)) | | Informing the whistleblower | A reasonable time **not exceeding 3 months or, in justified cases, 6 months** from receipt of the report, and whenever there are developments (art. 17(6)) | After registration, the designated person carries out a first examination of whether the conditions in art. 2, art. 5(3) and art. 6 are met. Where there are indications that a breach exists, the substantive examination follows (art. 17(2) and (4)). At the end, a **report** is drawn up setting out the situation, the information brought to the Agency's attention and the outcome of the examination (art. 17(7)). ## Offences — ANI both establishes and penalises them Unlike Poland, where liability is criminal, Romania uses an administrative-offence regime, and **the Agency's own specialised structure establishes and penalises** the offences (art. 30(1)). | Conduct | Fine | | --- | --- | | Preventing a report by any means, by the person designated to receive and register reports (art. 28(2)(a)) | **RON 2,000–20,000** | | Unjustified refusal to answer the Agency's requests under art. 17(5) (lit. b) | **RON 3,000–30,000** | | **Failure to establish the internal reporting channels** required by art. 9(1) (lit. c) | **RON 3,000–30,000** | | Failure to comply with the obligations in art. 10(1)(a) (lit. d) | **RON 4,000–40,000** | | Breach by a natural person of the duty to keep confidential the identity of the whistleblower, the person concerned or third parties (arts. 8 and 25) (lit. e) | **RON 4,000–40,000** | | **False reporting** — reporting information while knowing it is untrue (art. 29) | **RON 2,500–30,000** | These are offences only where the conduct was not committed in circumstances making it a crime under criminal law (art. 28(2)). Breach of the Law attracts, as the case may be, **civil, disciplinary, administrative-offence or criminal liability** (art. 28(1)). ## Rights cannot be waived The rights and measures the Law provides **cannot be waived or limited** by contract, by the form or conditions of employment, or by an arbitration agreement concluded before a dispute. Any settlement seeking to limit or waive them is **void by operation of law** (art. 27). ## The Agency's information duty Article 15 requires the Agency to publish on its website, in a separate, easily identifiable and accessible section, at least the conditions for qualifying for protection and the other information the Law specifies. ## Official sources - [Law no. 361/2022 on the protection of public-interest whistleblowers — Portal Legislativ](https://legislatie.just.ro/public/DetaliiDocument/262872) - [ANI — public-interest whistleblowers](https://integritate.eu/competente/avertizori-in-interes-public/) - [Directive (EU) 2019/1937 — EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937) --- # Spain's whistleblower authority (AIPI): powers, competence and how to report > Reference on the Autoridad Independiente de Protección del Informante, A.A.I.: legal basis, how competence is split with the regional authorities, how to file a report through the external channel, the statutory deadlines, and what happens afterwards. Canonical: https://ethicsportal.eu/authorities/spain-aipi/ Last updated: 2026-09-20 The **Autoridad Independiente de Protección del Informante, A.A.I.** (AIPI) is the Spanish state body that operates the national **external reporting channel**, grants protection against retaliation, and exercises the power to sanction under Ley 2/2023. This page is a reference on the authority itself: what it is, what it can and cannot do, how a report is filed, which deadlines apply, and what happens next. For the duty to operate an internal reporting system, the thresholds and the penalties, see [whistleblower law in Spain](https://ethicsportal.eu/whistleblower-laws/spain/). ## What the AIPI is | | | | --- | --- | | Official name | Autoridad Independiente de Protección del Informante, A.A.I. (art. 42.1) | | Legal nature | Independent administrative authority; a state public-law entity with its own legal personality | | Created by | **Ley 2/2023, de 20 de febrero**, Title VIII (arts. 42 onwards) | | Statute | **Real Decreto 1101/2024, de 29 de octubre** | | Attached to | Relates to the Government **through the Ministry of Justice** (art. 42.2), today the Ministerio de la Presidencia, Justicia y Relaciones con las Cortes | | Operating since | **1 September 2025** (Orden PJC/908/2025, de 8 de agosto) | | President | Manuel Villoria Mendieta, appointed by Real Decreto 328/2025, de 15 de abril | The law gives it **full autonomy and organic and functional independence** from the Government, the public sector and other public powers (art. 42.1). The president holds the rank of *subsecretario*, is appointed by royal decree on the proposal of the Ministry of Justice for a **five-year, non-renewable term that cannot be extended**, and the appointment must be ratified by an absolute majority of the relevant committee of the Congreso de los Diputados within one month (art. 53.2). The president is advised by a **Comisión Consultiva** that includes representatives of the Tribunal de Cuentas and the Consejo de Transparencia y Buen Gobierno, among others (art. 54). One feature of its funding is worth knowing: its resources include **a percentage — set in the State Budget Act — of the fines it itself imposes** (art. 47.2.c). ## Functions Article 43 gives it five functions: 1. **Operating the external channel** governed by Title III. 2. **Adopting protection measures** for reporting persons within its competence (art. 41). 3. Issuing a **mandatory opinion** on draft general provisions affecting its remit. 4. **Conducting sanctioning procedures** and imposing penalties for the infringements in Title IX. 5. **Promoting a culture of reporting.** The president may also issue **circulars and recommendations**; circulars are binding once published in the BOE (art. 51). ## What it can and cannot do ### Material scope Ley 2/2023 protects people who report (art. 2): - Acts or omissions that may constitute **breaches of EU law** within the annex to Directive (EU) 2019/1937, that affect the EU's financial interests (art. 325 TFEU), or that concern the internal market (art. 26(2) TFEU), including competition, State aid and corporate-tax avoidance practices. - Acts or omissions that may constitute a **criminal offence or a serious or very serious administrative infringement**. The second limb is broader than the Directive's minimum: in Spain the external channel covers any criminal offence or serious/very serious administrative infringement, not only the annex subject matters. ### How competence is split with the regional authorities The AIPI is **not** competent for everything. Article 24 divides it: | AIPI (art. 24.1) | Regional authority (art. 24.2) | | --- | --- | | General State Administration and the state public sector | The regional and local public sector of its own territory | | Other public-sector entities, constitutional bodies and bodies of constitutional relevance (art. 13) | The regional institutions referred to in art. 13.2 | | Private sector **where the breach affects or has effects in more than one autonomous community** | Private sector **where the breach is confined to that community's territory** | | Regional or local administrations **where an agreement (convenio) has been signed** | | In practice: a breach at a company operating in a single autonomous community that has its own authority belongs to that authority, not the AIPI. Ten autonomous communities have their own legislation — among them Andalusia, Asturias, Catalonia, Castilla-La Mancha, Castilla y León, Galicia, Madrid, Navarre, the Basque Country and the Valencian Community — with bodies such as the Oficina Antifrau de Catalunya and the Oficina Andaluza contra el Fraude y la Corrupción. Any authority that receives a report it is not competent for **must forward it to the AIPI within ten days** and tell the reporting person within that same period (art. 23). ### Limits - **Its decisions on a report cannot be appealed**, either administratively or before the contentious-administrative courts (art. 20.4). Only the decision closing any sanctioning procedure that follows can be challenged. - **Filing a report does not by itself make someone an interested party** in the procedure (art. 20.5). - The AIPI **does not resolve the employment dispute or award compensation**: it adopts protection measures and, where appropriate, sanctions. Individual claims go to the competent courts. ## How to report through the external channel Any natural person may report to the AIPI **directly, or after using the internal channel** (art. 16.1). There is no obligation to exhaust the internal channel first. A report may be filed (art. 17.2): - **In writing**, by post or by any electronic means provided for the purpose. - **Orally**, by telephone or through a voice-messaging system. - **At an in-person meeting**, at the reporting person's request, **within a maximum of seven days**. For oral reports the reporting person is warned that the communication will be recorded and informed about the processing of their data. **Reports may be anonymous** (art. 17.1). Where they are not, the reporting person's identity is withheld and is not disclosed to third parties or to the person concerned (arts. 21 and 33). Article 21 also gives the reporting person the right to designate an address, email or safe place for notifications, to waive receiving communications, to appear assisted by a lawyer, and to ask that any appearance be held by videoconference or other secure electronic means. The AIPI states that the **secure external channel reachable from its electronic office is the recommended route**; ordinary email and post do not carry the same confidentiality guarantees. ## Deadlines The external-channel deadlines are not the same as the internal ones. This is the most common confusion. | | External channel — AIPI | Entity's internal channel | | --- | --- | --- | | Acknowledgment of receipt | **5 working days** from receipt (art. 17.4) | **7 calendar days** from receipt (art. 9.2.c) | | Admissibility decision | **Maximum 10 working days** from entry in the register (art. 18.2) | — | | Notice of admission or inadmission | Within the **5 working days** following the decision (art. 18.2) | — | | Maximum time to conclude and respond | **3 months** from entry in the register (art. 20.3) | **3 months**, extendable by up to **3 further months** in especially complex cases (art. 9.2.d) | The external channel's three-month deadline **cannot be extended**. The internal one can, up to six months in total. The acknowledgment may be omitted where the reporting person has expressly waived communications, or where the AIPI reasonably considers that acknowledging receipt would compromise protection of their identity (art. 17.4). ## What happens after a report ### 1. Registration and admissibility Once registered, the AIPI checks whether the facts fall within the scope of article 2 and decides, within no more than **ten working days**, whether to reject the report, admit it, refer it to the public prosecutor, or transfer it to the competent authority (art. 18.2). Grounds for **inadmission** (art. 18.2.a): 1. The facts reported are **wholly implausible**. 2. The facts **do not constitute an infringement** within the scope of the law. 3. The report is **manifestly unfounded**, or there are reasonable indications it was obtained through a criminal offence — in which case a reasoned account is also sent to the public prosecutor. 4. It contains **no new and significant information** compared with an earlier report whose procedures have concluded, absent new circumstances of fact or law. Inadmission is notified with reasons, unless the report was anonymous or the reporting person waived communications. ### 2. Investigation The investigation covers the steps needed to verify the plausibility of the facts (art. 19). The person concerned is told of the facts in summary form and of their right to submit written submissions, although that notice may be deferred to the hearing stage where giving it earlier could help conceal, destroy or alter evidence. **The reporting person's identity is never disclosed to the person concerned, who is also given no access to the report itself.** ### 3. Closure Once the steps are complete, the AIPI issues a report and takes one of the following decisions (art. 20.2): - **Closing the file.** The reporting person keeps the law's protection, unless the investigation shows the report should have been rejected on one of the art. 18.2.a) grounds. - **Referral to the public prosecutor**, or to the **European Public Prosecutor's Office** where the EU's financial interests are affected. - **Transfer to the competent authority.** - **Opening a sanctioning procedure** under Title IX. The decision is communicated to the reporting person, unless they waived it or the report was anonymous. ## How internal and external reporting interact - The reporting person **may choose** the external channel from the outset (art. 16.1). - Obliged entities must give clear, accessible information about their internal channel **and about the external channels** before the competent authorities. Where they have a website, that information must appear on the home page in a separate, easily identifiable section (art. 25). - **Public disclosure** is protected (art. 28) where the matter was first reported internally and externally, or directly externally, without appropriate action being taken in time; or where there are reasonable grounds to believe the breach is an imminent or manifest danger to the public interest, that there is a risk of irreversible harm, a risk of retaliation, or little prospect of the report being handled effectively. ## Protection against retaliation The AIPI provides the Title VII support measures for breaches committed in the **private sector and the state public sector**; the regional bodies do so within their own scope (art. 41). A person who reports or discloses information in accordance with the law **incurs no liability** for that report, provided they had reasonable grounds to believe it was necessary to reveal the act or omission, without prejudice to criminal liability (art. 38). The protection extends to the acquisition of, or access to, the information reported. The person concerned retains the presumption of innocence, the right of defence, access to the file, and the same confidentiality protection as the reporting person (art. 39). Someone who took part in the infringement and reports it before being notified that proceedings have been opened may be **exempted from, or have their administrative penalty reduced**, provided they ceased the conduct, cooperated fully and diligently, and supplied truthful and relevant information (art. 40). ## Sanctioning powers The AIPI exercises the power to sanction the infringements in Title IX (art. 52). The fines in article 65 reach **€1,000,000 for legal persons** for very serious infringements — a category that includes failing to have an internal reporting system (art. 63.1.g) — with the possible addition of a public reprimand, a ban on obtaining subsidies or tax benefits for up to 4 years, and a ban on contracting with the public sector for up to 3 years (art. 65.2). Very serious infringements **become time-barred after three years**, serious ones after two, and minor ones after six months (art. 64). Thresholds, implementation deadlines and the real state of enforcement are covered on [the Ley 2/2023 page](https://ethicsportal.eu/whistleblower-laws/spain/). ## Official contact details | | | | --- | --- | | Address | C/ Luis Cabrera 9, 28002 Madrid | | External channel | Reachable from [AIPI — cómo informar](https://www.proteccioninformante.gob.es/nuestro-trabajo/investigacion/como-informar) | | General enquiries | info@aipi.gob.es | | Communications | comunicacion@aipi.gob.es | To file a report or request protection, the AIPI directs people to the **secure external channel** on its website, not to the general email address. ## Official sources - [Ley 2/2023, de 20 de febrero — consolidated BOE text](https://www.boe.es/buscar/act.php?id=BOE-A-2023-4513) - [Real Decreto 1101/2024, de 29 de octubre — AIPI Statute](https://www.boe.es/eli/es/rd/2024/10/29/1101/con) - [Orden PJC/908/2025, de 8 de agosto — date the AIPI began operating](https://www.boe.es/eli/es/o/2025/08/08/pjc908) - [Real Decreto 328/2025, de 15 de abril — appointment of the president](https://www.boe.es/diario_boe/txt.php?id=BOE-A-2025-7673) - [AIPI — what it is](https://www.proteccioninformante.gob.es/AIPI/que-es) - [AIPI — functions](https://www.proteccioninformante.gob.es/AIPI/funciones) - [AIPI — competence](https://www.proteccioninformante.gob.es/nuestro-trabajo/competencias) - [AIPI — how to report](https://www.proteccioninformante.gob.es/nuestro-trabajo/investigacion/como-informar) - [AIPI — report-handling procedure](https://www.proteccioninformante.gob.es/nuestro-trabajo/investigacion/procedimiento) - [AIPI — sanctioning procedure](https://www.proteccioninformante.gob.es/nuestro-trabajo/potestad-sancionadora/procedimiento) - [AIPI — president](https://www.proteccioninformante.gob.es/AIPI/equipo/presidencia) - [AIPI — contact](https://www.proteccioninformante.gob.es/contacto) --- # Blog > Read guides, checklists and comparisons on EU whistleblower protection laws, setting up a whistleblowing channel and managing reports in your organisation. Canonical: https://ethicsportal.eu/blog/ Last updated: 2026-10-27 ## Pages - [How to switch whistleblowing software without a gap](https://ethicsportal.eu/blog/switch-whistleblowing-software/): Open cases cannot move between tools, so a switch needs an overlap. How to move new reports first, finish open cases in the old tool, and pay once. - [Can we build or host our own whistleblowing channel?](https://ethicsportal.eu/blog/build-or-host-your-own-whistleblowing-channel/): The Directive allows an in-house whistleblowing channel. But when your own servers receive the reports, your own logs record who sent them. Why building a form or self-hosting open-source software makes confidentiality hard to keep and impossible for a reporter to check. - [Whistleblowing software penetration test: what to check](https://ethicsportal.eu/blog/whistleblowing-software-penetration-test/): How to read a vendor's penetration test evidence, which whistleblowing risks the test must cover, and four checks you can run yourself during a trial. - [Voice distortion does not keep whistleblowers anonymous](https://ethicsportal.eu/blog/voice-distortion-whistleblowing/): A pitch shift is the simplest way to disguise a whistleblower's voice message. It can be undone, and a colleague can still recognize the speaker. What actually removes the voice, and what the Directive requires. - [A false name on a report exposes an innocent colleague](https://ethicsportal.eu/blog/someone-elses-name-on-a-report/): A reporting form accepts any name. One employee can file a report signed with a colleague's name and contact details. What that does to the named colleague, and how case handlers confirm who wrote a report without exposing anyone. - [Whistleblowing by email: a secure address for every channel](https://ethicsportal.eu/blog/whistleblowing-by-email/): Every EthicsPortal whistleblowing channel now has its own email address. Emails become confidential cases, and case handlers never see the sender's address. Why a shared company mailbox does not meet the Directive's access rule, and what Italy, Germany, Ireland and Denmark say about email. - [How to report anonymously through a whistleblowing channel](https://ethicsportal.eu/blog/how-to-report-anonymously/): Five steps with screenshots, from the link your organization shared to the case handler's reply. No account and no email address needed. - [Switzerland has no whistleblower law. Swiss companies still need a whistleblowing channel](https://ethicsportal.eu/blog/whistleblowing-channel-switzerland/): Switzerland never adopted a whistleblower protection statute, and in 2024 Parliament declined to try again. Swiss case law, corporate criminal liability and EU subsidiaries make an internal whistleblowing channel necessary anyway. What a Swiss channel has to get right. - [Whistleblower or leaker? Under EU law, the route decides](https://ethicsportal.eu/blog/whistleblower-or-leaker-ai-act/): OpenAI's dismissal of three safety researchers revived an old question for AI companies. Since 2 August 2026, Article 87 of the AI Act gives the EU's answer: Directive 2019/1937 applies, and the route a report takes decides whether the reporter is protected. - [Eight questions for your whistleblowing vendor, taken from enforcement cases](https://ethicsportal.eu/blog/whistleblowing-vendor-questions-from-enforcement-cases/): Regulators and courts have already ruled on how whistleblowing channels fail. Each decision below becomes one procurement question, with the primary source linked. - [How whistleblowers actually get identified](https://ethicsportal.eu/blog/how-whistleblowers-get-identified/): In the published enforcement cases, the threat to the reporter came from inside: a CEO, a general counsel, a hospital firewall. What Barclays, Halliburton and an Italian hospital show about confidentiality. - [ISO 27001 and whistleblowing: is certification required?](https://ethicsportal.eu/blog/do-you-need-iso-27001-whistleblowing-tool/): No. EU Directive 2019/1937 does not require an ISO 27001 certified whistleblower tool. What the law requires, and six security questions to ask any vendor. - [EU Whistleblower Directive: statistics for 2026](https://ethicsportal.eu/blog/eu-whistleblower-directive-statistics/): A sourced reference of statistics on EU Directive 2019/1937 — how many organizations it covers, the €38.9 million in fines the Court of Justice has already issued, transposition status across all 27 member states, and the evidence on why whistleblowing channels reduce fraud and litigation risk. - [Whistleblowing or grievance: key differences](https://ethicsportal.eu/blog/whistleblowing-vs-grievance/): A whistleblowing concern and an HR grievance follow different legal routes under EU Directive 2019/1937. This guide explains how a case handler tells them apart, the grey areas that trip people up, and why misclassifying a report is a compliance risk. - [Whistleblower reports do not belong inside an LLM](https://ethicsportal.eu/blog/whistleblower-reports-do-not-belong-inside-an-llm/): Seven whistleblower platforms sold into the EU now process report content through large language models. Six of them won't tell you whose. EthicsPortal does neither. Screenshots and sources inside. - [Best whistleblower software in 2026: the buyer's shortlist](https://ethicsportal.eu/blog/best-whistleblower-software/): 16 whistleblower platforms for EU Directive 2019/1937 ranked by published price, pricing model, EU hosting and setup time, from €29/month to quote-only enterprise plans. - [What to look for in whistleblower compliance software](https://ethicsportal.eu/blog/what-to-look-for-in-whistleblower-compliance-software/): What a whistleblower reporting tool actually needs to do under EU Directive 2019/1937 — and what features matter vs. what's just marketing. - [If employees have to ask where the whistleblowing channel is, you don't have one](https://ethicsportal.eu/blog/if-employees-have-to-ask-you-dont-have-a-channel/): EU law requires employers to inform workers about their whistleblowing channel. But if finding it requires asking someone, the channel is already compromised. - [GDPR and whistleblower reporting: what you need to know](https://ethicsportal.eu/blog/gdpr-and-whistleblower-reporting/): How GDPR applies to whistleblower reports. Legal basis for processing, anonymous vs. pseudonymous data, retention periods, and the right to erasure. - [Whistleblower policy template for EU organisations](https://ethicsportal.eu/blog/whistleblower-policy-template/): A ready-to-use whistleblower policy template that meets EU Directive 2019/1937 requirements. Copy, adapt, and implement in your organization. - [Who must comply with the EU Whistleblower Directive?](https://ethicsportal.eu/blog/who-must-comply-eu-whistleblower-directive/): Which companies need a whistleblowing channel under EU Directive 2019/1937? The 50-employee threshold, the regulated-sector entities it does not apply to, who counts as a worker, deadlines, and what "comply" actually means in practice. - [Anonymous vs confidential reporting: the difference](https://ethicsportal.eu/blog/anonymous-vs-confidential-reporting/): Anonymous reports omit the reporter’s identity. Confidential reports restrict who knows it. Compare the safeguards, follow-up and EU legal requirements. - [How to deploy a whistleblowing channel](https://ethicsportal.eu/blog/how-to-implement-whistleblower-channel/): A step-by-step guide to deploying a compliant internal reporting channel without adopting a broad enterprise GRC suite. - [EU whistleblower directive compliance checklist for companies](https://ethicsportal.eu/blog/compliance-checklist/): A practical 12-step checklist to comply with EU Directive 2019/1937 and national transposition laws, with article references, tips, and implementation guidance. - [EU Directive 2019/1937 on whistleblower protection adopted](https://ethicsportal.eu/blog/eu-whistleblower-directive-2019-1937-adopted/): The European Parliament and the Council formally adopt Directive (EU) 2019/1937, establishing EU-wide protection for persons who report breaches of Union law. --- # Anonymous vs confidential reporting: the difference > Anonymous reports omit the reporter’s identity. Confidential reports restrict who knows it. Compare the safeguards, follow-up and EU legal requirements. Canonical: https://ethicsportal.eu/blog/anonymous-vs-confidential-reporting/ Last updated: 2026-10-25 An **anonymous report** does not disclose the reporter's identity. In a **confidential report**, authorized handlers know the identity and must protect it. Both require secure handling: anonymity does not remove confidentiality duties or make identification impossible. ## Anonymous and confidential reporting compared | Question | Anonymous report | Confidential report | | --- | --- | --- | | Does the handler know the reporter's name? | Not provided | Known to authorized handlers | | Can there be follow-up? | Yes, if a secure return route is available | Yes, through the agreed contact route | | What can reveal the identity? | Details in the report, attachments or surrounding circumstances | Unauthorized disclosure or a legally required disclosure | ![Who knows the reporter's identity. Anonymous report: nobody, not even the case handlers; follow-up continues through an access code. Confidential report: authorized case handlers know the name; managers, colleagues and the person reported learn it only with the reporter's explicit consent; authorities and courts only where EU or national law requires it.](https://ethicsportal.eu/images/anonymous-vs-confidential/en.svg) Source: Directive (EU) 2019/1937, Art. 16 and Art. 6(3). [Open full size](https://ethicsportal.eu/images/anonymous-vs-confidential/en.svg) ## What EU Directive 2019/1937 requires [Article 16](https://eur-lex.europa.eu/eli/dir/2019/1937/oj?locale=en) protects the reporter's identity and information that could reveal it indirectly. Disclosure beyond authorized staff normally requires explicit consent. Article 16(2) allows a necessary and proportionate disclosure required by EU or national law in investigations or judicial proceedings, with the safeguards in Article 16(3). Article 6(2) leaves national legislatures to decide whether anonymous reports must be accepted and followed up, without affecting existing EU-law obligations. It does **not** impose one EU-wide anonymity requirement. Under Article 6(3), an initially anonymous reporter who is later identified and suffers retaliation may qualify for protection if Article 6(1)'s conditions are met. Check the [country-law guide](https://ethicsportal.eu/whistleblower-laws/) before setting the organization's procedure. ## How can handlers communicate with an anonymous reporter? An anonymous report can include a secure way to return to the case. The reporter keeps the access credentials and checks for questions or feedback. The handler can request evidence without asking for a name. If no return route is available, follow-up with the reporter may be impossible. Before sending a report, consider whether its wording or attachments identify you. A description of a meeting attended by only two people can reveal who reported it even when no name is entered. ![The reporter's view of an anonymous case after entering the Case ID and password: acknowledgment and feedback deadlines, their answers, and a reply form, with no identity required](https://ethicsportal.eu/images/screenshots/en-public-report-desktop.webp) ## Choosing the procedure for your organization Decide who may receive and handle reports, how access is restricted, whether anonymous reports are accepted, and how reporters can receive follow-up. Explain these choices before someone submits a report. Do not promise that identity can never be inferred or lawfully disclosed. For the product workflow, see [how EthicsPortal works](https://ethicsportal.eu/product/). Review the [security information](https://ethicsportal.eu/security/) and [pricing](https://ethicsportal.eu/pricing/) when evaluating a whistleblowing channel. **See EthicsPortal in a live demo** A short online call: you see the whistleblowing channel your workers would use and the case handling behind it, and get answers to your questions. - [Book a demo](https://calendar.zoho.com/zc/view/slot-booking/zz08011220cdfa69864e9cefc2ca0e49dffa95e504c0265f6717484ebe19cbe7f6f38d5c7a) - [Deploy](https://secure.ethicsportal.eu/session/new?intent=start) - or email yaro@ethicsportal.eu --- # Best whistleblower software in 2026: the buyer's shortlist > 16 whistleblower platforms for EU Directive 2019/1937 ranked by published price, pricing model, EU hosting and setup time, from €29/month to quote-only enterprise plans. Canonical: https://ethicsportal.eu/blog/best-whistleblower-software/ Last updated: 2026-10-27 The best whistleblower software in 2026 for a company with 50 to 1,000 employees and a Directive 2019/1937 obligation is **EthicsPortal**: €41.67/month billed annually, flat regardless of headcount, hosted in Germany, and operational in minutes. It is not the best fit for everyone. Hintbox and LegalTegrity lead for German SMEs, DigitalPA and ithikios have the lowest published entry price, and EQS Integrity Line and NAVEX Global serve large regulated enterprises. This shortlist ranks 16 platforms on the same published criteria and says where each one wins. **Published by EthicsPortal, one of the vendors compared below.** Evaluating EthicsPortal? Review the [annual price](https://ethicsportal.eu/pricing/), [product walkthrough](https://ethicsportal.eu/product/) and [procurement documents](https://ethicsportal.eu/trust/) alongside the comparison. Replacing an existing provider? Start with the [switching checklist](https://ethicsportal.eu/blog/best-whistleblower-software/#switching-whistleblower-software-before-renewal). **See EthicsPortal in a live demo** A short online call: you see the whistleblowing channel your workers would use and the case handling behind it, and get answers to your questions. - [Book a demo](https://calendar.zoho.com/zc/view/slot-booking/zz08011220cdfa69864e9cefc2ca0e49dffa95e504c0265f6717484ebe19cbe7f6f38d5c7a) - [Deploy](https://secure.ethicsportal.eu/session/new?intent=start) - or email yaro@ethicsportal.eu ## Key takeaways - **Published pricing separates the market in two.** SME-focused platforms publish entry prices from €29 to €99 per month on flat or tiered plans. NAVEX, SpeakUp, Whispli and FaceUp quote on request. Formalize publishes €99 to €529 per month by employee band, and EQS Integrity Line publishes a starting price for its Essential plan on some country pages. - **Flat pricing is rare.** Only EthicsPortal and Canal Etico App (€96/month) publish one price for any headcount. Most other published prices scale with employee bands, so a growing company re-prices on renewal. - **EU hosting is the default among EU-native vendors.** Germany, Sweden and Ireland are named as hosting countries; some vendors state EU hosting without naming the country. Other platforms treat the region as an option, so confirm it in writing. - **Setup ranges from minutes to weeks.** Self-service platforms are operational the same day. Sales-led platforms take longer: EQS states 4 to 8 weeks for a custom setup, and NAVEX says most WhistleB customers are live in 4 to 6 weeks. - **Phone intake narrows the field.** If an oral reporting line is mandatory for you, LegalTegrity, NAVEX, SpeakUp and DigitalPA include one; EQS Integrity Line includes one on its Professional and Enterprise plans, and Formalize and FaceUp sell one as an add-on. Most flat-rate SME tools, EthicsPortal included, are web-only. Preparing the rest of the programme in parallel? The [whistleblower policy template](https://ethicsportal.eu/blog/whistleblower-policy-template/) and the [Directive compliance checklist](https://ethicsportal.eu/blog/compliance-checklist/) cover the documents your whistleblowing channel needs next to it. ## What whistleblower software actually is (and what it is not) Whistleblower software operates an organisation's whistleblowing channel: an "internal reporting channel" in the sense of Article 8 of Directive 2019/1937. A worker submits a report in writing or orally, with or without revealing their identity. A designated handler receives it, acknowledges receipt within 7 days, communicates with the reporter (including an anonymous one) and provides feedback within 3 months. The system restricts access to authorised staff, keeps a record of the case and deletes it when retention ends. Everything on this list does that core job. Where the platforms differ is how much they wrap around it: some sell only the whistleblowing channel, others place it inside a broader governance, risk and compliance suite covering policy management, NIS2, DORA, supply-chain due diligence or training. Whistleblower software is not: - **A generic form builder.** A survey or ticket form lacks the encrypted anonymous channel, the deadline tracking and the confidentiality controls the Directive requires. - **An HR grievance tool.** Grievances concern a worker's own employment; whistleblowing concerns breaches of law in the public interest. See [whistleblowing vs grievance](https://ethicsportal.eu/blog/whistleblowing-vs-grievance/). - **An outsourced investigation.** Software routes and records cases. Investigating them is still the organisation's job, unless the vendor also sells managed case handling. - **A substitute for the policy.** The Directive expects documented procedures alongside the whistleblowing channel itself. The practical question is therefore not "which tool is compliant", since all of these can be, but which commercial model, hosting location and feature depth fit your organisation's size. ## How we ranked these platforms The ranking is written for the most common buyer: a company with 50 to 1,000 employees that must operate a Directive-compliant whistleblowing channel. Each platform was compared on six measurable criteria: 1. **Published entry price** in euros per month, as listed on the vendor's own website. "Custom" where the vendor publishes no number. 2. **Pricing model:** flat (same price at any headcount), tiered by employee band, or quoted. 3. **EU hosting:** whether the hosting country is disclosed and inside the EU. 4. **Time to a working whistleblowing channel:** minutes, hours, days or weeks from account activation, based on whether setup is self-service or runs through sales and onboarding. 5. **Free trial length** in days, where one is offered. 6. **Intake channels:** online reporting form only, or phone and in-person reporting included. Platforms with a published price, predictable scaling and same-day setup rank higher for this buyer. Enterprise platforms rank lower here because their strengths (GRC integration, benchmarking, hotlines, managed services) mostly matter to organisations several times larger, not because they do the core job worse. Prices are from vendors' public pages as of Q1 2026 and may vary by region, contract length and negotiation; where pricing was not published, we asked the vendor. No affiliate links, no sponsorships. EthicsPortal is our product, and it is scored on the same six criteria as everyone else, including the ones where it loses (no phone line, no free trial). ## The best whistleblower software in 2026 Sixteen platforms, ranked for a company with 50 to 1,000 employees with a Directive obligation. Each entry names the buyer it suits best, so the right choice for your organisation may sit lower on the list. Every entry ends with who it is best suited for. ### 1. EthicsPortal, best for a flat-rate Directive whistleblowing channel at 50 to 1,000 employees EthicsPortal is whistleblower software for EU organisations built around one job: operating a Directive 2019/1937 whistleblowing channel. ![EthicsPortal case view: the report, secure messaging with the reporter, the seven-day acknowledgment deadline, the assignee and the intake answers](https://ethicsportal.eu/images/screenshots/en-report.webp) - **Price:** €41.67/month billed annually (€500/year), flat regardless of employee count - **Hosting:** EU, in Germany - **Setup:** self-service, operational in minutes - **Languages:** 14 locales - **Free trial:** none It covers the core Directive requirements: encrypted anonymous reporting, two-way messaging with anonymous reporters, who sign in with a Case ID and password, case management, tracking of the 7-day acknowledgment and 3-month feedback deadlines, QR code generation for posters, and multilingual whistleblowing channels. Pricing is published in full, so procurement can start without a sales call. **Where it falls short:** no phone hotline, no outsourced case handling, limited integrations (no HRIS connectors yet), and no broader GRC suite. **Best suited for:** SMEs and mid-sized companies (50--1,000 employees) that need Directive compliance with a fixed annual cost that does not move as headcount grows. Organisations that need a phone line or a single vendor for their whole compliance programme should look further down this list. ### 2. Hintbox, best for German-speaking SMEs that want an established local vendor Hintbox is a German platform from lawcode GmbH, part of the lawcode Suite. SAI360, a US compliance software company, bought lawcode in July 2025; Hintbox keeps its brand. It states 1,000+ companies and public authorities as customers, including REWE and the s.Oliver Group. - **Price:** €99 to €249+/month billed annually, plus 19% VAT, tiered by employee band (€99 for 1--49, €129 for 50--99, €149 for 100--249, from €249 for 250+) - **Hosting:** Germany (Hetzner) - **Certification:** ISO 27001 - **Languages:** 30, with AI translation between handler and reporter - **Free trial:** yes Two-factor authentication, metadata removal and virus scanning are included, and handler accounts are unlimited. Add-ons are priced separately, billed annually: telephone voice bot from €49/month, email intake from €29/month and own domain from €29/month; onboarding is €390 once and training €199/hour. The lawcode Suite also covers LkSG (Supply Chain Act) and sustainability reporting. **Best suited for:** German and Austrian companies that want a local vendor with ISO 27001 certification, deep HinSchG expertise and a long customer list. Larger companies should price the add-ons and the upper employee tiers before comparing it to flat-rate options. ### 3. LegalTegrity, best for phone reporting on every plan LegalTegrity is a Frankfurt-based platform founded by Dr. Thomas Altenbach and hosted on Deutsche Telekom's Open Telekom Cloud (ISO 27001-certified infrastructure). - **Price:** €49 to €165.83/month billed annually (€588 to €1,990/year), tiered by employee count; Enterprise on request above 1,000 - **Hosting:** Germany - **Languages:** 40+; Professional 250 lists two languages, Professional 1,000 includes translation in 40+ - **Guarantee:** 3-month money-back - **Free trial:** no self-service trial; a test environment by arrangement Its distinguishing feature is a phone reporting channel on every plan, including the €49/month Essential tier. Essential includes two administrator accounts; Professional tiers include three. The OmbuTegrity add-on provides an external ombudsperson for companies that need an independent reporting office. There is no public API. **Best suited for:** German and DACH-region SMEs under 1,000 employees that need oral reporting by phone at an entry-level price. It publishes phone intake on its €49/month entry plan. ### 4. Vispato, now part of HRworks Vispato GmbH was merged into HRworks GmbH, and the standalone Vispato brand has been discontinued. The former product pages no longer resolve. The whistleblowing product continues for existing customers under HRworks branding, so a new buyer should evaluate the current HRworks Hinweisgebersystem instead. The last facts Vispato published before the merger, kept for the record and not a current offer: - **Price:** €79/month flat, unlimited users, cases and storage; Enterprise on quote - **Hosting:** Germany (DATEV-hosted servers) - **Languages:** 18 - **Term:** 12-month minimum; no free trial, a demo preceded signup **Best suited for:** existing Vispato customers now served by HRworks. It is not ranked against the other platforms here. ### 5. Whistlelink, best for Nordic companies and the longest free trial Whistlelink is a Swedish platform with a strong Nordic presence. - **Price:** €79 to €299/month billed annually, tiered by employee count; sales contact above 1,000 employees - **Hosting:** Sweden - **Languages:** 50 - **Certification:** ISO 27001 - **Free trial:** 30 days, no credit card required, the longest on this list The annual subscription includes one standard feature set at every employee band, so a smaller company does not lose functionality on the entry plan. Hotline Live and Intake Management are add-ons on request. **Best suited for:** Nordic and Northern European companies that want a regional vendor with broad language support. The 30-day trial suits buyers who want to test with their own team before committing. ### 6. Formalize (whistleblowersoftware.com), best for mid-market buyers who need audited assurance Formalize, marketed as WhistleblowerSoftware.com, is a Danish platform backed by a €15M Series A (2024) and a €30M Series B (2025). It says it works with 850+ consultancies and law firms. - **Price:** €99 to €529/month by employee band, billed annually; sales contact above 1,000 employees - **Hosting:** Germany (AWS Frankfurt) - **Certification:** ISO 27001 and ISAE 3000 - **Languages:** 80+ available; 10 included in a standard setup - **Free trial:** 14 days, no card required Formalize has expanded beyond whistleblowing into NIS2, DORA and ISO 27001 compliance. Buyers can start the trial themselves or book a demo. A phone hotline is available as an add-on. **Best suited for:** mid-sized EU companies (50--500 employees) whose procurement requires both ISO 27001 and an ISAE 3000 report, or that buy through a consultancy partner. It also suits buyers planning to consolidate NIS2 or DORA work with the same vendor. ### 7. FaceUp, best for language coverage and a mobile reporting app FaceUp is a Czech-founded platform that serves companies and schools in 70+ countries. - **Price:** custom quote (platform fee plus add-ons, priced on headcount) - **Hosting:** AWS, region selectable (EU: Ireland; also US, UAE and Australia) - **Certification:** ISO 27001 - **Languages:** 113 - **Free trial:** by agreement only A mobile app for reporters sets it apart from most web-only competitors. FaceUp states that it removes metadata, does not log IP addresses and alters voice messages. Phone hotlines are sold as add-ons. **Best suited for:** organisations with a highly multilingual workforce, those that want a reporter mobile app, and groups that operate in both education and the corporate sector. ### 8. DigitalPA (Legality Whistleblowing), best for Italian organisations under D.Lgs. 24/2023 DigitalPA operates from Cagliari, Milan, Rome, Sulmona and Barcelona and states 1,000+ customers across its products. - **Price:** from €29/month (Standard) or €41/month (Premium) for under 50 employees; custom above that; excludes VAT and activation and service fees - **Hosting:** EU (country not stated on public pages) - **Certification:** ISO 9001, 27001, 27017, 27018 and 22301; ISO 37001, 37002 and 37301 are presented as alignment standards, not certifications - **Billing:** annual only Intake includes phone reports and in-person meeting requests, plus a mobile app and AI translation between handler and reporter. There is no public API. A note on terminology: [ISO 37002](https://ethicsportal.eu/iso-37002/) is a guidelines standard, so no organisation can be certified against it; alignment is the accurate claim for any vendor. The platform is free of charge for Italian public administrations. **Best suited for:** Italian companies and public-sector entities subject to D.Lgs. 24/2023 that want a local vendor with several ISO certifications. It shares the lowest published entry price on this list. ### 9. ithikios, best for Spanish SMEs building a modular compliance stack ithikios is a Spanish suite from Digital Products Development SL, with whistleblowing as one of six modules alongside policy, incident, rights, third-party and trust-centre management. - **Price:** Basic €29/month for up to 50 employees, Premium €49/month for up to 500; Business on quote; excluding VAT - **Hosting:** Germany - **Certification:** ISO 27001 - **Customers:** 1,000+ companies across 10 countries - **Languages:** 7 (ES, EN, FR, DE, IT, PT, CA) - **Free trial:** yes; the privacy policy describes a 15-day trial account Voice communications are an optional Premium feature, and the vendor states setup in hours. A partner programme serves lawyers and consultants. No public API is documented. **Best suited for:** Spanish SMEs that need Ley 2/2023 compliance and may add NIS2, DORA, policy or third-party risk modules later. Multi-market groups should check that 7 languages cover their workforce. ### 10. Canal Etico App, best for flat-rate Ley 2/2023 compliance Canal Etico App is a Spanish platform from Smart Dev Technology. - **Price:** €96/month flat, unlimited reports - **Hosting:** not disclosed on public pages - **Setup:** 1--2 business days - **Languages:** Spanish It offers written and voice reporting, anonymous two-way communication, no IP storage and encrypted content. No ISO 27001 certification is published, and no public API is listed. **Best suited for:** Spanish companies that want one flat price for Ley 2/2023 compliance without per-employee scaling. Buyers who need ISO 27001 or several languages should compare ithikios. ### 11. Sygnanet, best for Polish organisations under the 2024 Act Sygnanet is a Polish platform from SpecFile Project Sp. z o.o., built for the Polish Act on the Protection of Whistleblowers of 14 June 2024 (in force 25 September 2024). - **Price:** 4,000 to 10,000 zł/year net of VAT, tiered by number of report recipients (2, 4 or 6); each further recipient 1,000 zł/year - **Hosting:** EU (country not named on public pages) - **Languages:** 12-language reporting form; admin panel in 4 (PL, EN, DE, FR) - **Free trial:** yes End-to-end encryption means the vendor has no access to report content, and the platform is penetration-tested periodically. Public bodies buying the internal reporting licence receive an external reporting channel bundled free. No ISO 27001 certification is published, and there is no public API. **Best suited for:** Polish companies and public bodies that want a local vendor, zloty invoicing and a product built around the Polish Act. ### 12. Trusty Compliance, best for Swiss companies bundling whistleblowing with EUDR and training Trusty Compliance is from Trusty AG in Hünenberg, Zug, and states 4,000+ companies in 80+ countries as customers. - **Price:** LITE €49, STANDARD €69, ADVANCED €99 per month, billed annually, excluding VAT; Premium on quote - **Hosting:** Germany by default (Hetzner data centre); US or Swiss hosting on request - **Languages:** 6; LITE includes 1, STANDARD 2, ADVANCED all - **Free trial:** 7 days; the yearly plan starts only after confirmation - **Setup:** vendor states minutes LITE includes secure two-way dialogue with the reporter and basic case handling for one user; unlimited users, roles and workflows require ADVANCED. Trusty's other products, such as screening, EUDR, policy management and training, run on credits; whistleblowing is a fixed yearly subscription. The ISO 27001 certificate belongs to the hosting data centre, not to Trusty. **Best suited for:** Swiss and DACH companies that want whistleblowing and other compliance tools from one vendor. Buyers with strict data-residency requirements should confirm the contracted hosting region, since US and Swiss hosting are also offered. ### 13. SpeakUp (People Intouch), best for multi-channel intake at 500+ employees SpeakUp is a Dutch platform, founded in Amsterdam in 2004, that operated whistleblowing channels before the Directive made them mandatory. - **Price:** not published; quoted on company size and features - **Hosting:** not stated on public pages - **Intake:** web, mobile app, phone and AI voice agent - **Certification:** ISO 27001; ISO 27701 is called a certification on some pages and followed guidelines on others - **Languages:** 100+ SpeakUp says it serves 750+ organisations, and its pricing page addresses organisations from 500 employees. Every quote runs through a sales conversation. **Best suited for:** mid-to-large EU companies that want web, app, phone and voice intake from one vendor, and Dutch organisations with a Wbk obligation that want an established domestic vendor. Ask where report data is hosted, since the public pages do not say. ### 14. Whispli, best for configurable workflows and an AI voice hotline Whispli is an Australian-founded company that has expanded into Europe, with an office in Paris. - **Price:** quote only (3-year contract, paid annually) - **Hosting:** region selectable from the Plus package (France and Germany among the standard regions) - **Setup:** sold by quote; the entry package lists self on-boarding Whispli emphasises an anonymous two-way Safe Inbox, mobile apps, a Voice AI hotline and a configurable workflow builder. It states ISO 27001 and SOC 2 Type II, and customer-managed encryption keys are part of the Enterprise package. **Best suited for:** organisations that want configurable case workflows and a voice hotline from one vendor and can commit to a three-year contract. Confirm EU hosting is selected in the contract, as the region is a choice rather than a default. ### 15. EQS Integrity Line, best for listed companies in regulated sectors EQS is a major European compliance software vendor, and [Integrity Line](https://ethicsportal.eu/compare/eqs-integrity-line/) is used by banks, insurers and listed companies across the EU. - **Price:** from €99/month for Essential on the French and Spanish pages (£85/month in the UK); Enterprise on request - **Hosting:** Germany (Munich data centre) - **Languages:** 80+; machine translation on Professional and Enterprise only - **Free trial:** yes, on the Essential plan - **Setup:** EQS states a few days for standard setups and 4 to 8 weeks for custom ones Integrity Line integrates with the wider EQS governance, risk and compliance suite and keeps a revision log for each case and activity. A telephone reporting channel is included on the Professional and Enterprise plans. **Best suited for:** large enterprises (500+ employees) in heavily regulated sectors that need a full GRC ecosystem and a vendor their auditors already recognise. ### 16. NAVEX Global, best for multinationals running one global ethics programme NAVEX is the incumbent in ethics and compliance in North America and increasingly in Europe; its EthicsPoint product has operated for decades. - **Price:** quote only, for both EthicsPoint and WhistleB - **Hosting:** EU hosting available (WhistleB: EU storage on Azure; EthicsPoint EU: Germany and the Netherlands) - **Intake:** online and phone hotline - **Languages:** 60+ for web and mobile reporting, 40 for phone (WhistleB) - **Setup:** weeks; NAVEX says most WhistleB customers are live in 4 to 6 weeks NAVEX offers a very broad feature set, analytics, and benchmarking data drawn from thousands of clients. EU Directive requirements are one part of a global platform rather than its sole focus. **Best suited for:** multinationals with 1,000+ employees that want a single vendor for their entire ethics and compliance programme, including staffed hotlines, across jurisdictions. ## Side-by-side comparison The table restates the ranking criteria: published entry price, pricing model, free trial, EU hosting and time to a working whistleblowing channel. "Not listed" and "Not stated" mean the vendor's public pages did not say when checked in October 2026. | Platform | Starting price | Free trial | EU hosting | Setup time | Best for | |---|---|---|---|---|---| | EthicsPortal | €41.67/mo billed annually, flat | No | Yes (Germany) | Minutes | SMEs, Directive channel | | Hintbox | €99--€249+/mo billed annually (+VAT) | Yes | Yes (Germany) | Not stated | German-speaking markets | | LegalTegrity | €49--€165.83/mo billed annually | Test environment by arrangement | Yes (Germany) | Not stated | German SMEs, phone included | | Vispato (now HRworks) | Brand discontinued | -- | -- | -- | Existing customers only | | Whistlelink | €79--€299/mo billed annually | Yes (30 days) | Yes (Sweden) | Minutes | Nordic companies, mid-market | | Formalize (whistleblowersoftware.com) | €99--€529/mo billed annually | Yes (14 days) | Yes (Germany) | Days | Mid-market EU companies | | FaceUp | Quote only | By agreement | Yes (AWS, Ireland) | Not stated | Multilingual orgs, schools | | DigitalPA (Legality Whistleblowing) | From €29/mo billed annually (+ fees) | No | Yes (country not stated) | Not stated | Italian market, ISO 27001/22301 | | ithikios | From €29/mo | Yes (15 days) | Yes (Germany) | Hours | Spanish SMEs, modular compliance | | Canal Etico App | €96/mo flat | No | Not disclosed | Days | Spanish Ley 2/2023 compliance | | Sygnanet | 4,000--10,000 zł/yr | Yes | Yes (country not named) | Not stated | Polish market | | Trusty Compliance | €49/mo billed annually | Yes (7 days) | Selectable (Germany by default) | Minutes | Swiss/DACH, broader compliance | | SpeakUp (People Intouch) | Not public | Not listed | Not stated | Days | Mid-to-large EU companies | | Whispli | Quote only (3-year contract) | Not listed | Yes (optional) | Not stated | Enterprises, complex workflows | | EQS Integrity Line | From €99/mo (Essential); Enterprise on request | Yes (Essential) | Yes (Germany) | Days to weeks | Large enterprises | | NAVEX Global | Quote only | Not listed | Selectable (Germany, Netherlands) | Weeks | Large US/EU enterprises | ## Which whistleblower software fits your use case | Your situation | Start with | Why | Also consider | |---|---|---|---| | 50--249 employees, first whistleblowing channel | EthicsPortal | Lowest flat rate that does not scale with headcount; operational in minutes | Canal Etico App | | Lowest published entry price | DigitalPA or ithikios | €29/month on tiered plans | LegalTegrity, Trusty Compliance (€49/month) | | Germany, Austria or Switzerland | Hintbox | ISO 27001, 1,000+ customers, HinSchG focus | LegalTegrity, Trusty Compliance | | Phone reporting line required | LegalTegrity | Phone channel on every plan from €49/month | NAVEX, SpeakUp, DigitalPA | | Nordic company, wants to trial first | Whistlelink | 30-day trial, one standard feature set at every band | Formalize | | Italy (D.Lgs. 24/2023) | DigitalPA | Local vendor, ISO 9001/27001/22301 | ithikios | | Spain (Ley 2/2023) | ithikios | ISO 27001, modular add-ons | Canal Etico App | | Poland (Act of 14 June 2024) | Sygnanet | Built for the Polish Act, zloty pricing | EthicsPortal (Polish locale) | | 100+ languages or a reporter mobile app | FaceUp | 113 languages, mobile app | SpeakUp (100+), Formalize (80+) | | Listed company or regulated financial sector | EQS Integrity Line | GRC integration, detailed audit trail | NAVEX, Formalize, Hintbox | | Multinational, one global ethics programme | NAVEX Global | Global hotlines, benchmarking data | EQS Integrity Line | Smaller listed companies that need a defensible audit trail without enterprise cost can start with the [ISO 27001-certified](https://ethicsportal.eu/blog/do-you-need-iso-27001-whistleblowing-tool/) mid-market vendors: Formalize, Hintbox and Whistlelink. ## What a deployed whistleblowing channel looks like Comparison tables describe features; the useful test is what a worker sees on the day they report. EthicsPortal publishes a live demonstration whistleblowing channel at [secure.ethicsportal.eu/p/JK51E0TE](https://secure.ethicsportal.eu/p/JK51E0TE), so a buyer can submit a test report and check the experience before any procurement step. In operation, a Directive-compliant whistleblowing channel produces a predictable sequence for every report: 1. The reporter submits through the online reporting form, anonymously or by name, and receives a Case ID and a password. 2. A handler acknowledges receipt within 7 days; the system records when. 3. Handler and reporter exchange messages through the secure inbox, with no identity disclosed unless the reporter chooses to. 4. The handler provides feedback within 3 months, and the case history shows that the deadline was met. Whichever vendor you shortlist, ask to see these four steps live, not in slides. For the deployment side, see [how to implement a whistleblowing channel](https://ethicsportal.eu/blog/how-to-implement-whistleblower-channel/). ## Switching whistleblower software before renewal A lower subscription price is only useful if the replacement meets your requirements. Before changing providers: 1. **Compare the full annual cost.** Include employee bands, extra languages, telephone intake, setup fees and the minimum contract term. Check your current renewal date and notice period. 2. **Test the workflow with fictional data.** Submit a report, send a handler reply and return as the anonymous reporter. Check the languages and access roles your team needs. 3. **Plan how open cases will continue.** Confirm export formats, attachments, case history and ongoing anonymous conversations with both vendors. Do not assume that a reporter's existing login or inbox can transfer. 4. **Agree the changeover before cancelling.** Assign responsibility for open cases, records and retention. Update the published whistleblowing channel link and employee instructions when the replacement is ready. Considering EthicsPortal for the replacement? [Contact us about your requirements](https://ethicsportal.eu/contact/) with your employee count, countries, renewal date and required intake channels. Use fictional examples for the evaluation; do not send report contents or reporter identities. Confirm any migration scope before committing. ## Frequently asked questions ### What is the best whistleblower software for small and mid-sized companies? For a company with 50 to 1,000 employees, EthicsPortal is the lowest flat rate on this list at €41.67/month billed annually, hosted in Germany and operational in minutes. If you need a phone line, LegalTegrity includes one from €49/month; if you are in Germany and want an established local vendor, Hintbox starts at €99/month billed annually. ### How much does whistleblower software cost in the EU? Entry and flat-rate plans for small and mid-sized companies run from €29 to €99 per month. NAVEX, SpeakUp, Whispli and FaceUp quote on request. Formalize publishes €99 to €529 per month by employee band, billed annually, and EQS Integrity Line's Essential plan starts at €99 per month on its French and Spanish pages. Flat-rate options such as EthicsPortal and Canal Etico App do not scale with employee count, which keeps budgeting predictable. ### Is there free whistleblower software? There is no credible free tier for EU Directive 2019/1937 compliance. Several vendors offer free trials of 7 to 30 days, including Whistlelink (30 days), ithikios (15), Formalize (14) and Trusty Compliance (7); Hintbox and Sygnanet also offer a free trial. Free form builders lack the encrypted anonymous channel, deadline tracking and confidentiality controls the Directive requires. ### What whistleblower software includes a phone hotline? LegalTegrity includes a phone channel on every plan, and NAVEX Global, SpeakUp and DigitalPA also support phone reporting. EQS Integrity Line includes one on its Professional and Enterprise plans, Formalize and FaceUp sell phone hotlines as add-ons, Whispli offers a Voice AI hotline, Hintbox sells a telephone voice bot from €49/month, and Whistlelink offers Hotline Live on request. Most flat-rate SME tools, including EthicsPortal, are web-only. If oral reporting by phone is mandatory for you, start with these vendors and check which plan includes it. ### What is the best whistleblower software for listed companies? EQS Integrity Line and NAVEX Global are built for listed and heavily regulated companies, with GRC integration, detailed audit logging and benchmarking data. Expect quote-based pricing for the larger plans and several weeks of onboarding for a custom setup. Smaller listed companies can look at ISO 27001-certified mid-market vendors such as Formalize, Hintbox and Whistlelink. ### Where is whistleblower report data hosted? Most EU-native vendors host in the EU by default, in Germany or Sweden where the country is named; DigitalPA and Sygnanet state EU hosting without naming the country. FaceUp lets the customer choose an AWS region, with Ireland as its EU option. Whispli and NAVEX offer EU hosting as an option, and Trusty Compliance hosts in Germany by default with US or Swiss hosting on request. SpeakUp and Canal Etico App do not state their hosting location on their public pages. Confirm data residency in writing before you buy. ### Which whistleblower tools provide an audit trail? A complete audit trail is a core Directive expectation, so most compliance-grade platforms provide one. EQS Integrity Line keeps a revision log for each case and activity, and EthicsPortal records the 7-day acknowledgment and 3-month feedback deadlines alongside case activity. Free form builders generally do not offer a tamper-evident trail. ### How long does it take to set up a whistleblowing channel? Self-service platforms are operational the same day: EthicsPortal, Whistlelink and Trusty Compliance in minutes, ithikios in hours. Sales-led platforms vary: EQS states a few days for a standard setup and 4 to 8 weeks for a custom one, NAVEX says most WhistleB customers are live in 4 to 6 weeks, and Whispli sells by quote with self on-boarding listed in its entry package. To have a whistleblowing channel live today, [deploy EthicsPortal](https://secure.ethicsportal.eu/session/new?intent=start) and publish its link to your workers. --- # Can we build or host our own whistleblowing channel? > The Directive allows an in-house whistleblowing channel. But when your own servers receive the reports, your own logs record who sent them. Why building a form or self-hosting open-source software makes confidentiality hard to keep and impossible for a reporter to check. Canonical: https://ethicsportal.eu/blog/build-or-host-your-own-whistleblowing-channel/ Last updated: 2026-10-28 Yes. Article 8(5) of [Directive 2019/1937](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937) allows channels to be "operated internally by a person or department designated for that purpose". Organizations that take this route usually do one of three things: build a form on the company website, install open-source whistleblowing software on their own servers, or buy a licence for commercial software and run it on premises. All three share one weakness. The organization runs the servers that receive the reports, so the organization's own systems record who sent them. ## What the Directive requires Article 9(1)(a) requires channels that are "designed, established and operated in a secure manner that ensures that the confidentiality of the identity of the reporting person and any third party mentioned in the report is protected, and prevents access thereto by non-authorised staff members". Article 16(1) adds that the reporter's identity must not be disclosed "to anyone beyond the authorised staff members competent to receive or follow up on reports" without the reporter's explicit consent. Anonymity is a separate question. Article 6(2) leaves it to each Member State whether organizations must accept anonymous reports, and the national rules differ. They are on our [law pages](https://ethicsportal.eu/whistleblower-laws/). Where a channel offers anonymity, it has to hold. ## Where a self-hosted channel records the reporter A report sent through a web form passes through several systems before the application sees it. On a self-hosted channel, the organization's IT department runs every one of them. - **Web server and proxy logs.** By default they record the IP address, time, page and browser of every request. A request to submit or follow up on a report can be matched to the report by its time or its page. - **Central logging.** Security teams usually collect logs from all servers in one place for monitoring. A new server joins that collection unless someone excludes it. - **Backups.** Database and server backups copy reports and logs into systems that other administrators manage. - **Server access.** An administrator with full access to the server can read the database. Encryption helps only if the keys are kept away from the same people. The application can be written to store nothing about the reporter. The systems around it are configured by IT, often with logging on by default. Each one can be switched off for the channel, but this has to be done, checked and kept that way for years, by employees of the organization the reports are about. When the head of IT is the person named in a report, the evidence of who reported is on servers they control. ## Reporters cannot check it A reporter deciding whether to report their manager sees an address on the company domain, run by the company. Even if every log is off, they cannot verify it. People report when they believe their identity is safe, and a channel that relies on the employer's own promise is harder to believe. ## Open source does not change who runs the server With open-source software, anyone can read the code and see what the application stores. That is useful. It does not change who operates the server, the logs, the backups and the network around it. A self-hosted open-source channel has the same weakness as a form the organization built itself. Self-hosting also makes the organization responsible for security updates, virus scanning of uploaded files, removing location data from photos, the 7-day and 3-month deadlines, and deleting reports when the retention period ends. A licence for commercial software installed on your own servers is the same case. Where the developers of the software host it for you, the channel is operated by a third party, which is a different case. ## What an external provider changes An external provider has logs too. The difference is who holds them: a company with no interest in the case, bound by a data processing agreement, whose logs the organization's staff cannot open. EthicsPortal does not record a reporter's IP address with reports, messages or audit records, and the application's logs for the whistleblowing channel contain no IP addresses. The proxy in front of the application keeps a short request log that is overwritten as it fills, currently after about two days. The detail is on the [security page](https://ethicsportal.eu/security/#ip-addresses). No provider can protect a report sent from a work laptop or the company network, because the employer's own network logs that traffic. Tell staff they can report from a personal phone on mobile data. ## If you host it yourself anyway - Keep the channel's servers out of central logging and monitoring. - Turn off IP addresses in web server and proxy logs. - Keep the channel's backups separate, with access limited to the people who handle reports. - Name everyone who has administrator access, and record in the data protection impact assessment what happens when one of them is named in a report. [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # EU whistleblower directive compliance checklist for companies > A practical 12-step checklist to comply with EU Directive 2019/1937 and national transposition laws, with article references, tips, and implementation guidance. Canonical: https://ethicsportal.eu/blog/compliance-checklist/ Last updated: 2026-10-19 All 27 EU member states have transposed EU Directive 2019/1937 into national law --- including [Loi Waserman](https://ethicsportal.eu/whistleblower-laws/france/) (France), [HinSchG](https://ethicsportal.eu/whistleblower-laws/germany/) (Germany), [Ley 2/2023](https://ethicsportal.eu/whistleblower-laws/spain/) (Spain), [D.Lgs. 24/2023](https://ethicsportal.eu/whistleblower-laws/italy/) (Italy), and the [Act of 14 June 2024](https://ethicsportal.eu/whistleblower-laws/poland/) (Poland). Your organization must comply with the national law in your country of operation, and enforcement is active. This checklist walks you through the twelve steps to full compliance. For each item, we cite the relevant Directive article, share practical tips, and note where tooling can help. See our [whistleblower laws by country](https://ethicsportal.eu/whistleblower-laws/) reference for your country's specific requirements. --- ## The checklist ### 1. Determine if your organization is in scope **Directive reference:** Article 8(3--4) All legal entities in the private sector with 50 or more workers must establish whistleblowing channels. [Public sector](https://ethicsportal.eu/industries/public-sector/) entities, municipalities, and entities in certain regulated sectors ([financial services](https://ethicsportal.eu/industries/financial-services/), aviation safety, maritime, etc.) are in scope regardless of size. **Practical tip:** Count all workers, not just full-time employees. Part-time staff, contractors working on-site, and temporary agency workers may count toward the threshold depending on your national law. Some countries go further --- [Italy](https://ethicsportal.eu/whistleblower-laws/italy/) requires a channel for all companies with a Model 231 compliance program regardless of size, and [Spain](https://ethicsportal.eu/whistleblower-laws/spain/) covers all public entities. --- ### 2. Establish a whistleblowing channel **Directive reference:** Article 8(1), Article 9(1)(a) The channel must allow reporting in writing (online form, email, postal) or orally (phone, voice messaging system), or both. On request, it must also allow in-person meetings within a reasonable timeframe. **Practical tip:** An online reporting form is the most practical option --- it is accessible 24/7, creates an automatic record, and supports anonymous two-way communication. Avoid using generic email addresses; they lack encryption, anonymity, and audit trails. **How EthicsPortal helps:** Provides a branded online reporting form with encrypted anonymous reporting and two-way messaging. --- ### 3. Designate an impartial person or department to handle reports **Directive reference:** Article 9(1)(c) You must designate a person or department competent to follow up on reports. This person must be impartial --- they should not have a conflict of interest with the subject matter of reports. **Practical tip:** Common choices include a compliance officer, a legal counsel, an HR director, or an external ombudsperson. For smaller organizations, the managing director can serve this role if they are not likely to be the subject of reports. Consider designating a backup handler. --- ### 4. Set up the acknowledgment process (7-day deadline) **Directive reference:** Article 9(1)(b) You must acknowledge receipt of a report within seven calendar days. This applies to all reports, including anonymous ones. **Practical tip:** Automate this. A manual process risks missing the seven-day window during holidays or absences. **How EthicsPortal helps:** Tracks the acknowledgment deadline for each report and shows case handlers which reports need attention. --- ### 5. Define the feedback process (3-month deadline) **Directive reference:** Article 9(1)(f) You must provide feedback to the reporting person within three months of the acknowledgment. Feedback includes: whether the report is being assessed, is under investigation, or has been closed, and the outcome of any investigation. **Practical tip:** "Feedback" does not require disclosing the full investigation outcome. Informing the reporter that the matter was investigated and appropriate action was taken is sufficient. For anonymous reporters, feedback must be available through the whistleblowing channel (for example, via an access code). **How EthicsPortal helps:** Tracks the three-month feedback deadline per case and supports two-way messaging with anonymous reporters, who sign in with a Case ID and password. --- ### 6. Implement confidentiality measures **Directive reference:** Article 16 The identity of the reporting person must not be disclosed to anyone beyond authorized case handlers without the reporter's explicit consent. This also covers information from which the reporter's identity could be indirectly deduced. **Practical tip:** Limit access to reports strictly. Do not share report details in meetings where unauthorized persons are present. When referring cases internally, redact identifying information about the reporter. Ensure your IT systems enforce access controls. **How EthicsPortal helps:** Role-based access ensures only designated case handlers can view reports. Reporter identity is never exposed unless the reporter voluntarily shares it. --- ### 7. Establish anti-retaliation protections **Directive reference:** Articles 19, 20, 21 Reporting persons, facilitators, and connected third parties must be protected from retaliation. The Directive defines retaliation broadly: dismissal, demotion, intimidation, blacklisting, and more. The burden of proof is reversed --- if a reporter suffers a detriment after reporting, the employer must prove the detriment was unrelated to the report. **Practical tip:** Document this protection in your whistleblower policy. Train managers on what constitutes retaliation. Track personnel actions involving anyone who has made a report, so you can demonstrate that decisions were made on legitimate grounds. --- ### 8. Train case handlers **Directive reference:** Article 9(1)(c--f) (implied) The Directive does not prescribe specific training, but case handlers must be competent to fulfill the obligations it creates: maintaining confidentiality, providing acknowledgment within seven days, conducting diligent follow-up, and providing feedback within three months. **Practical tip:** At a minimum, train case handlers on: how to use the whistleblowing channel, confidentiality obligations, investigation basics, anti-retaliation rules, and data protection. Document the training. Refresh annually. --- ### 9. Inform employees about the whistleblowing channel **Directive reference:** Article 9(1)(g) You must provide clear and easily accessible information about how to use the whistleblowing channel. You must also inform employees about their right to report externally to competent authorities. **Practical tip:** Publish the information on your intranet, include it in onboarding materials, and display it in common areas. A QR code linking to the whistleblowing channel is an effective way to make the channel discoverable. **How EthicsPortal helps:** Generates a QR code and shareable link for your whistleblowing channel that you can print and distribute. --- ### 10. Set up data retention and deletion **Directive reference:** Article 17(1--3) Personal data in reports must not be kept longer than necessary. Data that is manifestly not relevant must be deleted promptly. Specific retention periods depend on your member state's law, but the principle is: retain as long as needed for the investigation and any resulting proceedings, then delete. **Practical tip:** Define a retention period in your policy. National laws vary --- for example, [France](https://ethicsportal.eu/whistleblower-laws/france/) [requires 5 years](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000046357368), [Germany](https://ethicsportal.eu/whistleblower-laws/germany/) [requires 3 years](https://www.gesetze-im-internet.de/englisch_hinschg/englisch_hinschg.html) (HinSchG §11), and [Italy](https://ethicsportal.eu/whistleblower-laws/italy/) [requires 5 years](https://www.gazzettaufficiale.it/eli/id/2023/03/15/23G00032/sg) (D.Lgs. 24/2023). See our [GDPR and whistleblower reporting guide](https://ethicsportal.eu/blog/gdpr-and-whistleblower-reporting/) for a full comparison. Set calendar reminders to review and delete closed cases. --- ### 11. Prepare a written whistleblower policy **Directive reference:** Articles 8, 9 (implied), plus most national transposition laws While the Directive does not explicitly mandate a standalone policy document, most national transposition laws do, and it is practically necessary to fulfill the information obligations in Article 9(1)(g). **Practical tip:** Your policy should cover: scope, who can report, what can be reported, how to report, confidentiality, anti-retaliation, investigation process, feedback timelines, and data protection. See our [free whistleblower policy template](https://ethicsportal.eu/blog/whistleblower-policy-template/) for a ready-to-use document. --- ### 12. Document compliance for regulatory review **Directive reference:** Article 11(2) (external channels), national transposition laws (internal) Several member states require organizations to document that they have fulfilled their obligations and to make this documentation available to regulators on request. **Practical tip:** Keep records of: when the whistleblowing channel was established, who the designated case handlers are, training records, the whistleblower policy (with version history), and aggregate statistics on reports received and handled. Do not store individual case details longer than your retention period allows. **See EthicsPortal in a live demo** A short online call: you see the whistleblowing channel your workers would use and the case handling behind it, and get answers to your questions. - [Book a demo](https://calendar.zoho.com/zc/view/slot-booking/zz08011220cdfa69864e9cefc2ca0e49dffa95e504c0265f6717484ebe19cbe7f6f38d5c7a) - [Deploy](https://secure.ethicsportal.eu/session/new?intent=start) - or email yaro@ethicsportal.eu --- ## Next steps If you have checked every box above, your organization is compliant with the core requirements of the Directive and its national transposition. Compliance is not a one-time event --- review your setup annually, retrain handlers, and update your policy as national law evolves. Check our [whistleblower laws by country](https://ethicsportal.eu/whistleblower-laws/) reference for country-specific requirements that may go beyond the Directive's baseline. Need a whistleblowing channel? [EthicsPortal](https://ethicsportal.eu/) provides a compliant anonymous whistleblowing channel at €41.67/month billed annually, with no per-employee pricing. [Deploy your whistleblowing channel](https://ethicsportal.eu/pricing/). --- # ISO 27001 and whistleblowing: is certification required? > No. EU Directive 2019/1937 does not require an ISO 27001 certified whistleblower tool. What the law requires, and six security questions to ask any vendor. Canonical: https://ethicsportal.eu/blog/do-you-need-iso-27001-whistleblowing-tool/ Last updated: 2026-10-17 **Short answer: no.** EU Directive 2019/1937 does not require ISO/IEC 27001, and neither does any national transposition of it. ISO 27001 is a voluntary information-security management standard. It is useful evidence that a vendor takes security seriously, but it is not a legal prerequisite for operating a compliant whistleblowing channel. This matters because several procurement checklists treat "ISO 27001 certified" as a hard gate. For a whistleblowing channel, that gate filters on the wrong thing. What the Directive actually requires is **confidentiality and security of processing** --- and those can be met, and verified, independently of any certificate. ## What does the Directive actually require? The Directive's security obligations are specific and functional: - **Confidentiality of the reporter's identity** (Article 16). The identity of the reporting person must not be disclosed to anyone beyond authorized staff, without consent. - **Secure channels** (Article 9). Internal reporting channels must be designed, established, and operated in a secure manner that protects the confidentiality of the reporter and any third party mentioned. - **Security of processing** under the GDPR (Article 32). Because reports contain personal data, the channel inherits the GDPR's requirement for technical and organizational measures appropriate to the risk --- encryption, access control, confidentiality, integrity, and resilience. None of these name a certification. They describe outcomes. A tool either protects reporter identity and secures the data, or it does not. ## What is ISO 27001, and when does it help? ISO 27001 certifies that an organization runs an information-security management system (ISMS) against a defined set of controls, audited by an accredited body. It is genuinely meaningful --- but two distinctions decide whether a given certificate is relevant to you: - **Scope.** A certificate covers a defined boundary. A vendor whose *hosting infrastructure* is ISO 27001 certified is not the same as a vendor whose *application and operations* are certified. Always read the scope statement. - **Certified vs aligned.** "Certified" means an accredited body audited and issued the certificate. "Aligned with" or "built to" means the vendor self-assesses against the controls. Both can be reasonable; they are not the same claim. ISO 27001 is most worth insisting on when you are a large or heavily regulated organization whose own ISMS requires certified suppliers, or when your risk assessment specifically calls for it. For most SMEs meeting a Directive obligation, it is a useful signal --- not a legal requirement. ## How to evaluate whistleblowing-tool security without relying on a certificate Ask for evidence of the outcomes the Directive and GDPR require: - **Where is the data hosted?** A named EU data center keeps processing inside the EU and avoids third-country transfer questions under GDPR Chapter V. - **Is report content encrypted?** Encryption in transit (TLS) is table stakes; ask whether sensitive fields are also encrypted at rest. - **Can reporters stay anonymous?** Check that no reporter account or identifying field is mandatory, and that follow-up works without revealing identity. - **Are reporter IP addresses stored?** They should not be. Ask how the tool prevents re-identification via metadata and uploaded files. - **Is there a tamper-resistant audit trail?** An append-only log of who accessed what, when, is both a security control and an accountability record. - **Is there a Data Processing Agreement, and who are the sub-processors?** A published DPA and sub-processor list let you verify the data chain --- including whether any AI provider is in it. A vendor that answers these clearly gives you more assurance than a certificate logo with an unread scope statement. ## How EthicsPortal approaches this EthicsPortal is direct about its certification posture. The hosting infrastructure (Hetzner, Nuremberg, Germany) holds ISO/IEC 27001 certification; **the EthicsPortal application is not separately ISO 27001 certified**, and we say so rather than implying otherwise. Our [ISO/IEC 27001:2022 self-assessment](https://ethicsportal.eu/iso-27001/) is published in full: the mandatory Clause 4--10 requirements, and a control-by-control Statement of Applicability against the same 93 Annex A controls an external auditor would evaluate. What the platform does provide against the Directive's actual requirements: EU hosting, encryption of sensitive fields at rest plus TLS in transit, fully anonymous reporting with no required reporter account, no storage of reporter IP addresses, automatic stripping of metadata from uploads, an append-only audit log, and a published Data Processing Agreement and sub-processor list. Report content is never sent to any AI or LLM provider. If your organization's policy genuinely requires a certified application, a vendor with an in-scope application certificate is the right call. If your requirement is a secure, confidential, Directive-compliant channel, evaluate the outcomes above --- and treat ISO 27001 as a signal, not a substitute for them. --- Need a compliant whistleblowing channel? [EthicsPortal](https://ethicsportal.eu/) is €41.67/month billed annually with no per-employee pricing, EU-hosted, and anonymous by default. [Deploy your whistleblowing channel](https://ethicsportal.eu/pricing/). --- # EU Directive 2019/1937 on whistleblower protection adopted > The European Parliament and the Council formally adopt Directive (EU) 2019/1937, establishing EU-wide protection for persons who report breaches of Union law. Canonical: https://ethicsportal.eu/blog/eu-whistleblower-directive-2019-1937-adopted/ Last updated: 2026-09-30 On 23 October 2019, the European Parliament and the Council formally adopted [Directive (EU) 2019/1937](https://eur-lex.europa.eu/eli/dir/2019/1937/oj/eng) on the protection of persons who report breaches of Union law. The plenary vote passed with 591 votes in favour, 29 against, and 33 abstentions. The Directive requires every organization with 50 or more employees to establish secure whistleblowing channels, protect reporters from retaliation, and provide feedback within three months. Member states had until 17 December 2021 to transpose it into national law. <a href="https://multimedia.europarl.europa.eu/en/video/protecting-democracy-by-protecting-whistleblowers_N01-PUB-190408-BLOW" style="display: block; padding: 1.5rem; border: 1px solid #ddd; border-radius: 0.5rem; text-decoration: none; color: inherit; margin: 2rem 0;"> <strong>&#9654; Watch: Protecting democracy by protecting whistleblowers</strong><br> <span style="color: #666; font-size: 0.875rem;">European Parliament Multimedia Centre · 1:28</span> </a> ## What the directive requires - **Internal reporting channels** (Art. 8) --- secure, confidential channels accessible to all workers, including contractors and suppliers - **7-day acknowledgment** (Art. 9) --- organizations must confirm receipt of a report within seven calendar days - **3-month feedback deadline** (Art. 9) --- reporters must receive feedback on actions taken within three months - **Anti-retaliation protection** (Art. 19--21) --- dismissal, demotion, intimidation, and other forms of retaliation are prohibited - **Reversed burden of proof** (Art. 21(5)) --- once a reporter shows they made a report and suffered a detriment, the employer must prove the measure was unrelated - **External and public reporting** (Art. 10, 15) --- reporters retain protection when reporting to competent authorities or, as a last resort, making public disclosures --- ## Plenary debate The European Parliament debated the directive during its plenary session in Strasbourg. Extracts from the debate are available on the European Parliament Multimedia Centre: [Watch the plenary debate on whistleblower protection](https://multimedia.europarl.europa.eu/en/video/protection-of-whistle-blowers-extracts-from-the-debate_I123987) --- ## Official resources - [Full text of Directive (EU) 2019/1937](https://eur-lex.europa.eu/eli/dir/2019/1937/oj/eng) --- EUR-Lex - [Protection for whistleblowers](https://commission.europa.eu/aid-development-cooperation-fundamental-rights/your-fundamental-rights-eu/protection-whistleblowers_en) --- European Commission - [New EU-wide rules approved](https://www.europarl.europa.eu/news/en/press-room/20190410IPR37529/protecting-whistle-blowers-new-eu-wide-rules-approved) --- European Parliament press release - [All whistleblower protection multimedia](https://multimedia.europarl.europa.eu/en/topic/protection-of-whistleblowers-8th-parliamentary-term_9901) --- European Parliament Multimedia Centre - [Legislative train schedule](https://www.europarl.europa.eu/legislative-train/theme-area-of-justice-and-fundamental-rights/file-whistle-blower-protection-proposal) --- European Parliament --- # EU Whistleblower Directive: statistics for 2026 > A sourced reference of statistics on EU Directive 2019/1937 — how many organizations it covers, the €38.9 million in fines the Court of Justice has already issued, transposition status across all 27 member states, and the evidence on why whistleblowing channels reduce fraud and litigation risk. Canonical: https://ethicsportal.eu/blog/eu-whistleblower-directive-statistics/ Last updated: 2026-11-06 A reference page of checked statistics on EU Directive 2019/1937 — the EU Whistleblower Directive. Every number below links to its original source: the Court of Justice of the EU, the European Commission, Eurostat, the ACFE's annual fraud report, and peer-reviewed academic research. Each figure has a date, so you can see how recent it is. If you are a journalist, analyst, or compliance officer who needs a number you can quote, this page is built for that. See [Methodology and sources](https://ethicsportal.eu/blog/eu-whistleblower-directive-statistics/#methodology-and-sources) at the end for how it is put together and kept up to date. --- ## Key statistics at a glance - **~306,000** organizations in the EU meet the Directive's 50-employee threshold — 55,000 large enterprises (250+) plus roughly 251,000 medium ones (50–249). [Eurostat, 2024](https://ec.europa.eu/eurostat/web/products-eurostat-news/w/ddn-20251209-2) - **€38.9 million** in fines was ordered by the Court of Justice of the EU on 6 March 2025 against five member states for being late to put the Directive into national law. [CJEU, March 2025](https://curia.europa.eu/site/upload/docs/application/pdf/2025-03/cp250029en.pdf) - **3 of 27** member states had fully put the Directive into national law by the first deadline of 17 December 2021. [eucrim](https://eucrim.eu/news/ecj-ordered-several-member-states-to-financial-penalties-for-failing-to-transpose-whistleblowers-directive/) - **43%** of occupational frauds are first detected by a tip — more than three times any other detection method. [ACFE, 2024](https://legacy.acfe.com/report-to-the-nations/2024/) - **52%** of fraud tips come from employees — the people a whistleblowing channel exists to reach. [ACFE, 2024](https://legacy.acfe.com/report-to-the-nations/2024/) - **€1,000,000** is the highest fine for not running a whistleblowing channel. It is in Spain, which has the strictest rules in the EU. [Law 2/2023](https://www.boe.es/buscar/act.php?id=BOE-A-2023-4513) - **€5.8–9.6 billion** a year is the European Commission's estimate of what the EU loses in public procurement *alone* for the lack of whistleblower protection. [European Commission, 2017](https://op.europa.eu/en/publication-detail/-/publication/8d5955bd-9378-11e7-b92d-01aa75ed71a1/language-en) --- ## The scale of the obligation The Directive requires every organization with **50 or more employees** operating in the EU to run a whistleblowing channel, plus all financial-services firms and many public bodies regardless of size ([who must comply](https://ethicsportal.eu/blog/who-must-comply-eu-whistleblower-directive/)). | Organization size | Count in the EU | Employment | |---|---|---| | Large (250+ employees) | 55,000 | 59.7 million | | Medium (50–249 employees) | 251,000 | 24.9 million | | **Covered by the 50+ threshold** | **~306,000** | **~84.6 million** | Source: [Eurostat structural business statistics, 2024 reference year](https://ec.europa.eu/eurostat/web/products-eurostat-news/w/ddn-20251209-2) (published December 2025). The ~306,000 figure counts private businesses only. It leaves out most public-sector bodies and financial firms, which must comply no matter how many employees they have — so the real number of organizations that must comply is higher. --- ## How the law was adopted: a timeline *To "transpose" a directive means to turn the EU law into a country's own national law. Every member state had to do this for the Whistleblower Directive.* - **23 October 2019:** Directive (EU) 2019/1937 adopted. [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937) - **17 December 2021:** First deadline, for organizations with 250+ employees. Only **3 of 27** member states had fully put it into national law. [eucrim](https://eucrim.eu/news/ecj-ordered-several-member-states-to-financial-penalties-for-failing-to-transpose-whistleblowers-directive/) - **17 December 2023:** Extended deadline, for organizations with 50–249 employees ([Art. 26(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937)). - **3 July 2024:** The European Commission's review finds gaps in protection, whistleblowing channels, and safeguards against retaliation. [COM(2024) 269](https://commission.europa.eu/document/download/7cc63350-88c9-4c0b-a46e-04fc11e673e7_en?filename=COM_2024_269_1_EN_ACT_part1_v6.pdf) - **6 March 2025:** The Court of Justice fines five member states **€38.9 million** for being late. [CJEU](https://curia.europa.eu/site/upload/docs/application/pdf/2025-03/cp250029en.pdf) By mid-2024 all 27 member states had adopted transposing laws — Estonia and Poland were the last, in May 2024. [European Commission](https://commission.europa.eu/topics/human-rights/your-fundamental-rights-eu/protection-whistleblowers_en) --- ## €38.9 million in fines for being late Each EU country had to turn the Directive into its own national law by a set deadline. Some countries were late. On **6 March 2025**, the Court of Justice of the EU made five of them pay fines for the delay (cases C-149/23, C-150/23, C-152/23, C-154/23 and C-155/23): | Member state | Lump-sum penalty | Notes | |---|---|---| | Germany | €34,000,000 | The largest penalty | | Czech Republic | €2,300,000 | | | Hungary | €1,750,000 | | | Estonia | €500,000 | Plus **€1,500 per day** until it transposes | | Luxembourg | €375,000 | | | **Total** | **€38,925,000** | | Source: [Court of Justice of the EU, press release 29/25](https://curia.europa.eu/site/upload/docs/application/pdf/2025-03/cp250029en.pdf) and [eucrim](https://eucrim.eu/news/ecj-ordered-several-member-states-to-financial-penalties-for-failing-to-transpose-whistleblowers-directive/). ### CJEU transposition fines, March 2025 | Label | million € | | --- | --- | | Germany | €34M | | Czech Republic | €2.3M | | Hungary | €1.75M | | Estonia | €500k | | Luxembourg | €375k | Source: Court of Justice of the EU, press release 29/25 Germany's fine is so much larger than the others that the rest are barely visible on the same scale — which is the point. These fines were paid by countries, not by companies. Companies face their own fines under each country's national law — and those can be high too. ### Company penalties: highest national maximums | Country | Maximum fine for no whistleblowing channel | Law | |---|---|---| | Spain | €1,000,000 | [Law 2/2023](https://www.boe.es/buscar/act.php?id=BOE-A-2023-4513) | | Germany | up to €500,000 (legal entities) | [HinSchG](https://www.gesetze-im-internet.de/hinschg/) | | Poland | ~€250,000 (obstruction) | [Act of 14 June 2024](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20240000928) | | [Portugal](https://ethicsportal.eu/whistleblower-laws/portugal/) | €125,000 | [Law 93/2021](https://diariodarepublica.pt/dr/detalhe/lei/93-2021-175659849) | | Italy | €50,000 | [D.Lgs. 24/2023](https://www.gazzettaufficiale.it/eli/id/2023/03/15/23G00032/sg) | France and Poland attach **criminal liability**, including prison time, for retaliating against or obstructing a whistleblower. See the full [penalties by country](https://ethicsportal.eu/penalties/) page for all 27 member states. --- ## A working internal channel lowers litigation risk The largest academic study of internal reporting — Stubben and Welch's analysis of close to **2 million reports** across more than **1,000 US-listed companies** — found that the more actively a firm used its internal whistleblowing system, the **fewer material lawsuits** it faced and the **lower the settlement amounts** it paid in later years. Heavier users were also more profitable. The mechanism is simple: an internal report surfaces a problem early, while management can still fix it, instead of surfacing later as a lawsuit or a press story. [Stubben & Welch, *Journal of Accounting Research*, 2020](https://doi.org/10.1111/1475-679X.12303) This is the business case behind the legal obligation: the channel is not only a compliance requirement but a risk-reduction control. --- ## Why the channel matters: the fraud-detection evidence The Association of Certified Fraud Examiners studies occupational fraud worldwide. Its 2024 *Report to the Nations* makes the case for whistleblowing channels in numbers: - **43%** of frauds are first detected by a **tip** — more than three times any other method. [ACFE 2024](https://legacy.acfe.com/report-to-the-nations/2024/) - Of those tips, **52% come from employees**, 21% from customers, and 11% from vendors — all categories the Directive defines as protected reporting persons. - The next-best detection methods trail far behind: internal audit (**14%**) and management (**13%**). - **71%** of victim organizations had an anonymous fraud-reporting hotline in place — yet fraud still ran a median of **~12 months** before detection. ### How occupational fraud is first detected | Label | % of cases | | --- | --- | | Tip (whistleblower) | 43% | | Internal audit | 14% | | Management review | 13% | Source: ACFE Report to the Nations, 2024 The data shows the same thing again and again: the best way to catch fraud is to give people a safe way to report it. The Directive makes that a legal requirement. --- ## Methodology and sources This page is **proof of work**. Every number can be traced back to its original, official source — not a second-hand summary. **Sources used, and what each supports:** - **[Court of Justice of the EU, press release 29/25 (6 March 2025)](https://curia.europa.eu/site/upload/docs/application/pdf/2025-03/cp250029en.pdf)** — the €38.9 million in transposition fines and the per-country breakdown. - **[European Commission — Protection of whistleblowers](https://commission.europa.eu/topics/human-rights/your-fundamental-rights-eu/protection-whistleblowers_en)** and **[COM(2024) 269](https://commission.europa.eu/document/download/7cc63350-88c9-4c0b-a46e-04fc11e673e7_en?filename=COM_2024_269_1_EN_ACT_part1_v6.pdf)** — transposition status and the 2024 implementation review. - **[EUR-Lex — Directive (EU) 2019/1937](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937)** — the legal text, deadlines, and article references. - **[Eurostat](https://ec.europa.eu/eurostat/web/products-eurostat-news/w/ddn-20251209-2)** — enterprise counts and employment by size class (2024 reference year). - **[ACFE Report to the Nations 2024](https://legacy.acfe.com/report-to-the-nations/2024/)** — fraud detection methods and tip sources. - **[Stubben & Welch, *Journal of Accounting Research* (2020)](https://doi.org/10.1111/1475-679X.12303)** — peer-reviewed evidence linking active internal reporting to fewer lawsuits, lower settlements, and higher profitability. - **[European Commission — economic benefits of whistleblower protection in public procurement (2017)](https://op.europa.eu/en/publication-detail/-/publication/8d5955bd-9378-11e7-b92d-01aa75ed71a1/language-en)** — the €5.8–9.6 billion annual EU procurement-loss estimate. - National laws (linked inline) — company-level penalty figures, cross-checked against our maintained [penalties by country](https://ethicsportal.eu/penalties/) page. **How to read the figures.** EU institutional and Eurostat numbers are authoritative for the EU. The ACFE fraud figures and the Stubben & Welch study are global and US datasets, flagged as such. Currency conversions are approximate and noted with `~`. **Last reviewed:** 14 June 2026. Spotted a figure that has moved? [Tell us](https://ethicsportal.eu/contact/) — corrections are welcome and we update the source links when laws or reports change. --- *EthicsPortal is whistleblower software for EU organisations: secure intake, deadline tracking under Article 9, confidentiality controls under Article 16, and audit-ready records under Article 18. See the [Directive 2019/1937 coverage map](https://ethicsportal.eu/directive-coverage/) for an article-by-article breakdown, or [set up your whistleblowing channel](https://secure.ethicsportal.eu/session/new).* --- # GDPR and whistleblower reporting: what you need to know > How GDPR applies to whistleblower reports. Legal basis for processing, anonymous vs. pseudonymous data, retention periods, and the right to erasure. Canonical: https://ethicsportal.eu/blog/gdpr-and-whistleblower-reporting/ Last updated: 2026-10-19 Every whistleblower report contains personal data. The reporter may include their name. The report will likely name the person accused of wrongdoing. The handler's actions are logged. All of this is personal data under GDPR. This creates a tension that compliance officers deal with every day: the Whistleblower Directive (2019/1937) requires you to collect and store reports, and GDPR requires you to have a lawful basis for doing so, minimize what you collect, and delete it when you no longer need it. Here is how the two frameworks interact, and what it means in practice. --- ## What personal data does a whistleblower report contain? More than you might think: | Data | Source | GDPR category | |---|---|---| | Reporter's name (if provided) | Voluntary | Personal data | | Reporter's contact details (if provided) | Voluntary | Personal data | | Name of the accused person | Report content | Personal data (third party) | | Details of the alleged misconduct | Report content | May include special category data (Art. 9) or criminal offence data (Art. 10) | | Uploaded files (documents, photos) | Reporter | May contain metadata (GPS, author, timestamps) | | Handler actions and notes | Case management | Personal data (handler) | | Timestamps and audit trail | System | Personal data | If a report describes harassment, discrimination, or health issues, it may contain **special category data** under GDPR Article 9 --- which triggers stricter processing conditions. Reports involving criminal allegations fall under **Article 10** (criminal convictions and offences), which has its own restrictions. --- ## What is the legal basis for processing? You need a lawful basis under GDPR Article 6 to process personal data in whistleblower reports. The most commonly used bases: ### Article 6(1)(c) --- Legal obligation This is the primary basis. EU Directive 2019/1937 and its national transpositions impose a legal obligation to operate a whistleblowing channel. Processing personal data is necessary to comply with that obligation. This covers: - Receiving the report - Storing it securely - Investigating the allegations - Communicating with the reporter - Maintaining an audit trail ### Article 6(1)(f) --- Legitimate interest Some organizations use legitimate interest as a secondary basis, particularly for processing that goes beyond the Directive's minimum requirements (e.g., internal analysis, trend reporting). This requires a legitimate interest assessment (LIA) and balancing test. ### Article 6(1)(e) --- Public interest (public sector) Public sector organizations may rely on the public interest basis, particularly where national law explicitly authorizes processing for whistleblower protection. ### What about consent? **Do not rely on consent.** The reporter-employer power imbalance means consent is unlikely to be freely given (GDPR Recital 43). A reporter cannot meaningfully consent when their job may depend on the outcome. Use legal obligation (Art. 6(1)(c)) instead. --- ## Anonymous reports and GDPR This is the question compliance officers ask most: if a report is truly anonymous, does GDPR apply? ### If the reporter is unidentifiable: GDPR does not apply to them GDPR applies to personal data relating to an identified or identifiable person (Art. 4(1)). If a reporter submits without providing a name, email, or any identifying information --- and the system does not log their IP address or any other identifier --- the report content is not personal data *with respect to the reporter*. However: - The **accused person** named in the report is still identifiable. GDPR fully applies to their data. - If the report content contains details that could indirectly identify the reporter ("I am the only woman on the third floor"), it may still constitute personal data. ### What "anonymous" requires technically For anonymity to hold up under GDPR scrutiny, your reporting tool must: - **Not log IP addresses.** Any IP logging makes the reporter pseudonymous, not anonymous. - **Not require an account or email.** If the reporter authenticates, they are identifiable. - **Strip file metadata.** Uploaded photos and documents contain EXIF data (GPS coordinates, author name, device information) that can identify the reporter. - **Not use analytics or tracking cookies** on the whistleblowing channel. If your tool does any of these things, you are collecting pseudonymous data, not anonymous data, and GDPR applies in full. --- ## Data minimization (Art. 5(1)(c)) The Directive requires a whistleblowing channel. It does not require collecting more data than necessary. In practice: - **Reporter identity must be optional.** The reporter should be able to submit without providing their name or contact details. - **Intake forms should collect only what is needed.** A description of the misconduct, the category, and optional supporting files. Do not require department, employee ID, or other identifiers unless the reporter chooses to provide them. - **Handler notes should be relevant to the investigation.** Do not log extraneous personal details about the reporter or accused. --- ## The accused person's rights This is where it gets complicated. The person accused in a whistleblower report has GDPR rights --- including the right to be informed (Art. 14), the right of access (Art. 15), and the right to erasure (Art. 17). But exercising those rights cannot compromise the reporter's confidentiality (Directive Art. 16). ### Right to be informed (Art. 14) Under GDPR, you must inform people when you process their data. But Directive Art. 16(1) requires protecting the reporter's identity. The solution: - You **may** inform the accused person that a report has been made --- but only when doing so does not risk identifying the reporter. - **Timing matters.** Many member states allow delaying notification until it would no longer jeopardize the investigation. Germany's HinSchG explicitly restricts disclosure during the investigation period. - National data protection authorities generally accept that the Directive's confidentiality requirements override the immediate notification obligation. ### Right of access (Art. 15) The accused person can request access to data held about them. You must provide it --- but you must redact any information that would identify the reporter. This includes the reporter's name, but also contextual details that could reveal them indirectly. ### Right to erasure (Art. 17) The accused person cannot demand deletion of a report that is part of an ongoing investigation or that must be retained under legal obligations. GDPR Art. 17(3)(b) and (e) provide exceptions for legal obligations and legal claims. --- ## Retention periods The Directive (Art. 18) requires maintaining records of reports. GDPR (Art. 5(1)(e)) requires not keeping personal data longer than necessary. ### How long should you retain reports? The Directive does not prescribe a specific retention period. National transpositions vary: | Country | Retention period | Source | |---|---|---| | [France](https://ethicsportal.eu/whistleblower-laws/france/) | 5 years after case closure | [Decree 2022-1284](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000046357368) | | [Italy](https://ethicsportal.eu/whistleblower-laws/italy/) | 5 years from date of report | [D.Lgs. 24/2023, Art. 14](https://www.gazzettaufficiale.it/eli/id/2023/03/15/23G00032/sg) | | [Germany](https://ethicsportal.eu/whistleblower-laws/germany/) | 3 years after case closure (unless ongoing proceedings) | [HinSchG §11](https://www.gesetze-im-internet.de/englisch_hinschg/englisch_hinschg.html) | | [Spain](https://ethicsportal.eu/whistleblower-laws/spain/) | Not specified (general GDPR minimization applies) | [Law 2/2023](https://www.boe.es/buscar/act.php?id=BOE-A-2023-4513) | ### Best practice - Set a configurable retention period (e.g., 12, 24, 36, 48, or 60 months after case closure). - Automatically delete closed cases when the retention period expires. - Allow manual deletion by admins for cases where retention is no longer necessary. - Document your retention policy and be prepared to justify it to a regulator. --- ## International data transfers Whistleblower data must stay in the EU unless you have a valid transfer mechanism under GDPR Chapter V. This matters when choosing a reporting tool: - **EU-hosted platforms** (data stored in Germany, France, Netherlands, etc.): no transfer issue. - **US-hosted platforms** or platforms using US cloud providers (AWS US, Azure US, Google Cloud US): require reliance on Standard Contractual Clauses (SCCs) or the [EU-US Data Privacy Framework](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en) --- both of which have been [legally challenged](https://curia.europa.eu/juris/liste.jsf?num=C-311/18). The simplest path: choose a platform that hosts all data in the EU. This eliminates the transfer question entirely. --- ## Data Protection Impact Assessment (DPIA) GDPR Article 35 requires a DPIA when processing is "likely to result in a high risk to the rights and freedoms of natural persons." Whistleblower reporting likely qualifies because: - It involves sensitive allegations about identified individuals - Reports may contain special category data (Art. 9) - There is an inherent power imbalance between reporter and organization - Confidentiality failures could lead to retaliation Most data protection authorities recommend conducting a DPIA before implementing a whistleblower reporting system. --- ## What your reporting tool must do Based on the GDPR requirements above, your whistleblower software should: | Requirement | Why | |---|---| | Optional reporter identity | Data minimization (Art. 5(1)(c)) | | No IP logging | Preserve anonymity, avoid creating pseudonymous data | | File metadata stripping | Prevent accidental identification via EXIF/GPS data | | Encryption at rest | Integrity and confidentiality (Art. 5(1)(f)) | | Configurable retention periods | Storage limitation (Art. 5(1)(e)) | | Automatic deletion of expired cases | Storage limitation enforcement | | Role-based access controls | Confidentiality (Directive Art. 16) | | Append-only audit trail | Accountability (Art. 5(2)) | | EU data hosting | Avoid international transfer complications (Chapter V) | | Privacy notice on the reporting form | Transparency (Art. 13/14) | --- ## How EthicsPortal handles GDPR EthicsPortal was designed with both the Directive and GDPR as constraints from day one: - **Legal basis:** Processing is based on legal obligation (Art. 6(1)(c)) --- compliance with EU Directive 2019/1937. - **Anonymity by default:** No reporter IP addresses stored with reports or in application logs, no accounts, no tracking. File metadata (EXIF, GPS, author) stripped automatically. - **Data minimization:** Reporter name and contact are optional fields. Only essential data is collected. - **Encryption at rest:** All report descriptions, names, contact details, and messages encrypted in the database. - **Configurable retention:** Organizations set their own retention period (12, 24, 36, 48, or 60 months). Expired closed cases are deleted automatically. - **EU hosting for core report data:** Report content and attachments are stored on Hetzner servers in Nuremberg, Germany. The marketing site is delivered via Cloudflare (CDN, United States); the whistleblowing channel and handler portal are not. Separate public-site processing and transfer information are documented in the [Privacy Notice](https://ethicsportal.eu/privacy/), outside the customer DPA chain. - **Access controls:** Only admins and assigned handlers can view reports. Handler names are never revealed to reporters. - **Audit trail:** Append-only log of every action for accountability and regulatory review. - **DPA available:** GDPR Article 28 [Data Processing Agreement](https://ethicsportal.eu/dpa/) available for all customers. For the full article-by-article breakdown, see our [Directive 2019/1937 coverage map](https://ethicsportal.eu/directive-coverage/). --- # How to deploy a whistleblowing channel > A step-by-step guide to deploying a compliant internal reporting channel without adopting a broad enterprise GRC suite. Canonical: https://ethicsportal.eu/blog/how-to-implement-whistleblower-channel/ Last updated: 2026-11-10 Every EU member state now requires organizations with 50 or more employees to operate a whistleblowing channel --- through national laws like [Loi Waserman](https://ethicsportal.eu/whistleblower-laws/france/) (France), [HinSchG](https://ethicsportal.eu/whistleblower-laws/germany/) (Germany), [Ley 2/2023](https://ethicsportal.eu/whistleblower-laws/spain/) (Spain), and the [Act of 14 June 2024](https://ethicsportal.eu/whistleblower-laws/poland/) (Poland), all transposing EU Directive 2019/1937. The requirement is clear, but most implementations take far longer than they should. This guide explains what the law actually requires from the channel itself, why broad enterprise tools can slow deployment, and what a compliant channel needs before it is put into operation. --- ## What the Directive requires Article 8 and Article 9 specify what an internal reporting channel must do: - Accept reports in writing or orally - Allow anonymous reporting (required in some member states, strongly recommended everywhere) - Enable two-way communication with the reporter, even if they are anonymous - Ensure only authorized persons can access reports - Acknowledge receipt within seven calendar days - Provide feedback within three months That is the legal minimum. No specific technology is mandated --- the Directive is technology-neutral. An online reporting form, a phone line, or even a locked physical mailbox can qualify, as long as the requirements above are met. **See EthicsPortal in a live demo** A short online call: you see the whistleblowing channel your workers would use and the case handling behind it, and get answers to your questions. - [Book a demo](https://calendar.zoho.com/zc/view/slot-booking/zz08011220cdfa69864e9cefc2ca0e49dffa95e504c0265f6717484ebe19cbe7f6f38d5c7a) - [Deploy](https://secure.ethicsportal.eu/session/new?intent=start) - or email yaro@ethicsportal.eu --- ## Why most implementations take weeks Enterprise whistleblower platforms are designed for large organizations with complex procurement processes. A typical implementation looks like this: 1. **Request a vendor presentation** --- fill out a form and wait for a sales representative to call back 2. **Attend the presentation** --- a 30--60 minute call where the vendor walks through features you may not need 3. **Receive a proposal** --- custom pricing based on employee count, modules, and add-ons 4. **Negotiate the contract** --- legal review, DPA signing, procurement approval 5. **Onboarding kickoff** --- a project manager is assigned, another call is scheduled 6. **Configuration** --- the vendor configures your whistleblowing channel, categories, and branding (or trains you to do it) 7. **Testing and launch** --- review, approve, and go live For a 100-person company that just needs a compliant channel, this process is weeks of elapsed time and hours of meetings. It is designed for enterprises where a six-week procurement cycle is normal. For an SME, it is friction that delays compliance. --- ## Operational in minutes with EthicsPortal EthicsPortal is built for a narrower scenario: your organization needs a compliant Directive channel without a broader GRC implementation. ### Step 1: Activate the whistleblowing channel Go to [ethicsportal.eu](https://ethicsportal.eu/), create the organization account, choose a plan, and open the whistleblowing channel settings. ### Step 2: Configure your whistleblowing channel From the dashboard, set up your whistleblowing channel: - **Organization name** --- appears on the whistleblowing channel so reporters know they are in the right place - **Logo and brand color** --- match your organization's visual identity - **Language** --- reporters choose their own language on the whistleblowing channel The whistleblowing channel has a unique URL as soon as you save the configuration. ![EthicsPortal whistleblowing channel settings: the active channel, its shareable URL and QR code, and the company details reporters see](https://ethicsportal.eu/images/screenshots/en-portal-edit.webp) ### Step 3: Share the whistleblowing channel with employees Every whistleblowing channel gets a shareable link and a QR code. You can: - Email the link to all employees - Print the QR code and post it in break rooms, offices, or common areas - Add the link to your intranet or employee handbook - Include it in your written whistleblower policy ![The public whistleblowing channel page employees open from the shared link: make an anonymous report, follow up through the secure inbox, or report by phone](https://ethicsportal.eu/images/screenshots/en-portal-public-desktop.webp) ### Step 4: Start receiving and managing reports When someone submits a report through the online reporting form, you receive a notification. From the dashboard, you can: - Read the report - Communicate with the reporter via secure two-way messaging (even if they are anonymous --- they sign in with a Case ID and password) - Track the seven-day acknowledgment deadline - Track the three-month feedback deadline - Update the case status and add internal notes - Close the case with a documented outcome At this point, the whistleblowing channel is configured and ready to receive reports. ![Case list in EthicsPortal with each report's status, category, retaliation flags and the acknowledgment or feedback deadline remaining](https://ethicsportal.eu/images/screenshots/en-reports.webp) --- ## What to do after setup A whistleblowing channel is the technical foundation, but compliance requires organizational steps too: ### Designate a case handler Appoint one or more persons to receive and investigate reports. This person should be impartial and not likely to be the subject of reports. A compliance officer, legal counsel, or senior HR person typically fills this role. For small organizations, the managing director can serve as handler. ### Train your handlers Case handlers need to understand: how to use the platform, confidentiality obligations, the seven-day and three-month deadlines, basics of conducting an internal investigation, and anti-retaliation rules. ### Write a whistleblower policy Document how your organization handles reports. Cover scope, who can report, confidentiality, anti-retaliation, and the investigation process. See our [free policy template](https://ethicsportal.eu/blog/whistleblower-policy-template/) for a ready-to-use document. ### Inform employees The Directive requires you to proactively tell employees about the channel. Send an email, post on the intranet, mention it in team meetings, and include it in onboarding. The QR code makes this easy --- print it and put it where people will see it. --- ## Common mistakes to avoid **Using a shared company mailbox.** The Directive requires that staff who are not authorised cannot access reports (Art. 9(1)(a)). A compliance@company.com inbox is usually readable by IT administrators, delegates and backup tools, offers no anonymous route, and cannot keep a conversation going with a reporter who gave no name. Several national authorities accept email only through a dedicated address that just the designated handlers can open; see [whistleblowing by email](https://ethicsportal.eu/blog/whistleblowing-by-email/). **Requiring reporters to identify themselves.** While the Directive does not uniformly require anonymous reporting, several national laws do (e.g., [Belgium](https://ethicsportal.eu/whistleblower-laws/belgium/) mandates anonymous reporting for companies with 250+ employees). Making identification mandatory discourages reporting. Allow anonymity by default. **Forgetting the deadlines.** Seven days for acknowledgment, three months for feedback. These are not suggestions --- they are legal requirements. Missing them is a compliance failure. Use a system that tracks these deadlines automatically. **Not designating a handler.** The channel is a mailbox. Someone needs to open it, read the reports, and act on them. If no one is designated, reports go unanswered and deadlines pass. **Over-engineering the setup.** You do not need a full GRC suite, custom integrations, or a six-month rollout to comply. A working channel with anonymous reporting, two-way communication, and deadline tracking covers the legal requirements. Start simple, add complexity only if you need it. --- ## Deploy the channel [EthicsPortal](https://ethicsportal.eu/) is €41.67/month billed annually with no per-employee pricing. Deploy the whistleblowing channel, assign handlers, publish the link, and keep the focus on protecting the people who speak up. --- # How to report anonymously through a whistleblowing channel > Five steps with screenshots, from the link your organization shared to the case handler's reply. No account and no email address needed. Canonical: https://ethicsportal.eu/blog/how-to-report-anonymously/ Last updated: 2026-11-06 This guide follows one report from start to finish in a whistleblowing channel that runs on EthicsPortal. You need the link your organization shared and something to write on. You do not create an account or give an email address. The numbers in each screenshot match the numbered points under that step. ## Before you start - Use a personal device, not one your employer provided, and not the work Wi-Fi. The whistleblowing channel cannot hide your activity from your employer's network monitoring. - Open the link in a private window, or in the Tor Browser. - Before you attach files, remove anything that could identify you or another person. ## Step 1: Open the link your organization shared Organizations share the link by email, on the intranet, or as a QR code on a poster. The page names the organization and the law that protects you. 1. Select **Make a report**. If the page shows an email address or a phone number, you can also report by email or by phone. [Email is not anonymous](https://ethicsportal.eu/blog/anonymous-vs-confidential-reporting/): your mail provider keeps a copy, and so does your employer's mail system if you write from a work account. ![Home page of a company's confidential whistleblowing channel, with the Make a report button marked 1, the channel's email address, a phone number for oral reports, a link to follow up through the secure inbox, and the external reporting authority](https://ethicsportal.eu/images/screenshots/en-guide-home.webp) ## Step 2: Write the report While **Submit anonymously** stays on, the form asks for no name or phone number. 1. **Description.** Say what happened. Give dates, names, amounts and places. 2. **Attachments.** Optional. PDFs, photos, audio or video, up to 5 files. 3. **Privacy notice.** Confirm that you have read it. 4. **Submit report.** **Email for updates** is optional. If you give one, you get an email when there is news on your report, and nothing else. The case handlers do not see the address. Use a personal address, not a work one. Prefer to speak? You can also record a voice message of up to 10 minutes. Your voice is automatically pitch-shifted, which makes it harder to recognize but does not hide it completely. If your voice could identify you, type instead. ![The report form with the description field marked 1, attachments marked 2, the privacy notice checkbox marked 3 and the Submit report button marked 4, with Submit anonymously switched on](https://ethicsportal.eu/images/screenshots/en-guide-new-report.webp) ## Step 3: Save your Case ID and password The next page shows three things. You need all three to read the case handler's replies. 1. **Where to come back.** The address of the secure inbox. 2. **Case ID.** In the form WB-XXXX-XXXX. It identifies your case. 3. **Password.** 16 digits, generated by the system. You do not choose it. Write them down now. Nobody can recover or reset the password: not the case handler, and not EthicsPortal. Keep them on paper away from your workplace, or in a password manager on a personal device. Never on a work computer or in work email. This page stays available on this browser until you select **Exit**, or until 30 minutes pass without activity. ![Report submitted page showing the secure inbox address marked 1, the Case ID marked 2 and the 16-digit password marked 3, each with a copy button](https://ethicsportal.eu/images/screenshots/en-guide-receipt.webp) ## Step 4: Come back and sign in Open the address from step 3, or select **Follow-up on your report** on the home page of the whistleblowing channel. 1. **Case ID.** 2. **Password.** Pasting works, and spaces are ignored. Then select **Open inbox**. If you lose the password, submit a new report and mention your Case ID. ![Secure inbox sign-in page with the Case ID field marked 1 and the password field marked 2](https://ethicsportal.eu/images/screenshots/en-guide-sign-in.webp) ## Step 5: Read replies and answer 1. **Messages.** Your report, the case handler's replies and status updates, oldest first. 2. **Message.** Write your answer. You can attach more files, then select **Send message**. 3. **Exit.** Locks the inbox at once. If you face retaliation for having reported, switch on **I'm facing retaliation for having reported this** before you send. The inbox also locks after 30 minutes without activity. If you gave an email for updates, you get an email when the case handler writes. If not, nothing tells you that a reply has arrived, so sign in again from time to time. ![A reporter's case view: the timeline from Received to Closed, the message thread with the report and the case handler's reply marked 1, the message box marked 2 and the Exit button marked 3](https://ethicsportal.eu/images/screenshots/en-guide-report.webp) ## What happens next Under EU Directive 2019/1937, the organization must acknowledge your report within 7 days and give you feedback within 3 months of the acknowledgment. The timeline at the top of your case shows each stage: Received, Acknowledged, Feedback provided, Closed. ## For organizations Already operating EthicsPortal? Send this page to your staff together with the link to your whistleblowing channel. How the Case ID and password are protected is set out on the [security page](https://ethicsportal.eu/security/#reporter-sign-in). Set up your whistleblowing channel The whistleblowing channel in this guide is EthicsPortal, available in 14 languages. [Deploy EthicsPortal](https://secure.ethicsportal.eu/session/new?intent=start) --- # How whistleblowers actually get identified > In the published enforcement cases, the threat to the reporter came from inside: a CEO, a general counsel, a hospital firewall. What Barclays, Halliburton and an Italian hospital show about confidentiality. Canonical: https://ethicsportal.eu/blog/how-whistleblowers-get-identified/ Last updated: 2026-09-27 Discussions of whistleblowing confidentiality usually start with encryption and external attackers. The published enforcement cases tell a different story. In each of them, the threat to the reporter came from inside the organisation, from people and systems doing what they normally do. Three cases show three different routes. ## The CEO who asked security to find the writer In June 2016 members of the Barclays board received anonymous letters raising concerns about a senior executive the chief executive, Jes Staley, had recruited. On 28 June Staley instructed the bank's Group Security function to identify the author of the first letter. The bank's whistleblowing team told Group Security that tracing the author of an anonymous letter was not acceptable. Staley told Group Security to continue. In May 2018 the UK's Financial Conduct Authority and Prudential Regulation Authority fined Staley £642,430, the first case either regulator brought under the Senior Managers Regime. Barclays cut his bonus by £500,000. In December 2018 the New York Department of Financial Services fined the bank itself $15 million, finding that Staley had gone ahead despite advice from the Group Chief Compliance Officer and the General Counsel. ([FCA final notice](https://www.fca.org.uk/publication/final-notices/mr-james-edward-staley-2018.pdf), [NYDFS](https://www.dfs.ny.gov/reports_and_publications/press_releases/pr1812181)) The bank had a whistleblowing policy and a team that applied it correctly. It could not stop the most senior person in the organisation from overriding it. That is a structural question, and it is answered by who can see a case, and who cannot. ## The legal hold that named the reporter Anthony Menendez worked in Halliburton's accounting function. He raised concerns about revenue recognition internally, under his own name, and filed a confidential complaint with the SEC. When the SEC told Halliburton to preserve documents, the general counsel concluded that Menendez was the source. He emailed Menendez's manager and others that "the SEC has opened an inquiry into the allegations of Mr. Menendez." The manager forwarded it to fifteen people in Menendez's team. Colleagues stopped working with him. In November 2014 the US Court of Appeals for the Fifth Circuit upheld the finding that this disclosure was unlawful retaliation under the Sarbanes-Oxley Act. ([Fifth Circuit opinion](https://www.ca5.uscourts.gov/Opinions/pub/13/13-60323-CV0.pdf)) The disclosure happened in a routine legal email. His internal report had carried his name and arrived from his work account, and once the case moved around the organisation, his identity moved with it. ## The firewall that logged every visit The Azienda Ospedaliera di Perugia in Italy ran a web-based whistleblowing application. Access to it went through the hospital's firewall, which, as firewalls do, logged connections: the IP address of the device and the username of the person. The logs were kept until the file reached 150 GB. In April 2022 Italy's data protection authority fined the hospital €40,000, and fined the vendor that supplied the application another €40,000 for hosting it with a third party the hospital had never authorised. The vendor's application used HTTPS and encrypted report content. None of that helped, because the identifying record was made before any request reached it. ([Garante order against the hospital](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9768363), [against the vendor](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9768387)) ## What the three have in common In each case the organisation had a whistleblowing channel. In each case the risk came from something ordinary: an instruction from the top, a forwarded email, a network log. The Directive's confidentiality requirement in Article 16 covers the reporter's identity and "any other information from which the identity of the reporting person may be directly or indirectly deduced." That includes logs, case files and access rights, along with the report itself. For an organisation assessing its own channel, three questions follow from these cases: - **Who can see a case?** Can access be restricted so that the people named in a report, including senior management, cannot open it? - **Where does identity travel?** Is the reporter's identity held apart from the case content that investigators share? - **What records the connection?** Which systems between the reporter and the channel log IP addresses or accounts, including your own network if the channel is reachable only from inside it? A longer version of these questions, one per enforcement case, is in [eight questions for your whistleblowing vendor](https://ethicsportal.eu/blog/whistleblowing-vendor-questions-from-enforcement-cases/). All published decisions we track are in the [whistleblowing failures register](https://whistleblowertools.eu/guide/whistleblowing-failures-register/). --- # If employees have to ask where the whistleblowing channel is, you don't have one > EU law requires employers to inform workers about their whistleblowing channel. But if finding it requires asking someone, the channel is already compromised. Canonical: https://ethicsportal.eu/blog/if-employees-have-to-ask-you-dont-have-a-channel/ Last updated: 2026-10-18 An employee suspects fraud. They want to report it. Their first step should not be walking up to HR and asking "do we have a whistleblowing channel?" The act of asking is itself a signal. In the exact kind of workplace the Directive exists to address --- where misconduct is happening and someone wants to report it --- asking around about a whistleblowing channel tells people that you are thinking about reporting something. Before you have typed a single word, you are exposed. --- ## The law is clear: you must inform employees EU Directive 2019/1937 and its national transpositions ([Loi Waserman](https://ethicsportal.eu/whistleblower-laws/france/) in France, [HinSchG](https://ethicsportal.eu/whistleblower-laws/germany/) in Germany, the [Act of 14 June 2024](https://ethicsportal.eu/whistleblower-laws/poland/) in Poland, and others) do not just require organizations to set up a whistleblowing channel. They require them to make sure workers know about it. **Article 9(1)(g)** mandates "clear and easily accessible information" about reporting procedures --- both internal and external. This is not optional. If you have a whistleblowing channel but your employees do not know it exists, you are not compliant with your national law. National transpositions go further: - **[Germany](https://ethicsportal.eu/whistleblower-laws/germany/) ([HinSchG](https://www.gesetze-im-internet.de/englisch_hinschg/englisch_hinschg.html) §7(3), §13(2)):** Employers must provide "clear and easily accessible information" about both internal reporting procedures (§7(3)) and external reporting options (§13(2)). - **[France](https://ethicsportal.eu/whistleblower-laws/france/) ([Loi Waserman, 2022-401](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000045388745)):** Companies must inform employees about reporting procedures and publish this information via accessible means. - **[Poland](https://ethicsportal.eu/whistleblower-laws/poland/) ([Ustawa o ochronie sygnalistów](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20240000928)):** Employers must establish internal reporting procedures and publish them to all employees. The procedure takes effect 7 days after publication. The pattern is the same everywhere: setting up the channel is half the job. Making employees aware of it is the other half. --- ## The design problem nobody talks about Most compliance discussions stop at "inform employees" and assume a company-wide email or an intranet page solves it. It does not. Think about what actually happens: **Scenario 1: The channel is on the company intranet.** The employee has to use their work computer, log into the corporate network, navigate to the compliance section, and click through to the whistleblowing channel. Every step leaves a digital trail on a device their employer controls. The IT department can see what pages you visit on the intranet. **Scenario 2: The channel requires a company app.** The employee has to download an app, possibly through a corporate MDM (mobile device management) system, and create an account. The act of installing a whistleblower app on your work phone is itself a statement. **Scenario 3: The channel is mentioned once in the employee handbook.** Page 47, section 12.3, between the parking policy and the dress code. Nobody remembers it exists. When someone needs it, they have to ask. And asking is the problem. --- ## What "easily accessible" actually means If you take the Directive's intent seriously --- protecting people who report wrongdoing --- then "easily accessible" means: **The employee should be able to access the channel without:** - Using a company device - Being on the company network - Installing an app - Creating an account - Asking anyone where to find it - Leaving any trace that they looked for it This narrows the options considerably. The channel needs to be a **public URL** that works in any browser on any device --- including a personal phone on mobile data, completely outside the employer's infrastructure. --- ## How to make the channel truly accessible **1. A public URL, not an intranet page.** The whistleblowing channel should be accessible from any browser, on any device, without authentication. An employee at home, on their personal phone, at 11pm, should be able to type in a URL and start a report. No VPN, no login, no company email required. **2. QR codes in private spaces.** Print the QR code and put it where people can scan it without being watched: bathroom stalls, break rooms, locker rooms, the back of elevator doors. An employee scanning a QR code on a bathroom wall leaves no digital trail and draws no attention. **3. Physical posters, not just emails.** A company-wide email about the whistleblowing channel is easily missed and hard to find six months later. A poster on the wall of every office kitchen with a QR code and a URL is always there when someone needs it. **4. Mention it during onboarding --- every time.** New employee orientation should include the whistleblowing channel URL and a printed card with the QR code. Not buried in a handbook. Handed to them directly. **5. No account required.** If the reporting tool requires the employee to create an account with their email address to file a report, it is not anonymous and it is not safe. The reporter should be able to submit without providing any identifying information and receive an access code to check back later. --- ## This is how EthicsPortal works Every EthicsPortal organization gets a public reporting URL. It works on any browser, any device. No app, no account, no company network. EthicsPortal generates a **QR code** that can be printed and posted anywhere. Scan it, and you are on the reporting page. No login, no trail. Reporters submit anonymously --- no name, no email, no IP address stored with the report. They receive a Case ID and a password to check back for updates. The entire interaction happens in a browser window that can be closed and leaves nothing behind. The handler never sees the reporter's identity. The reporter never sees the handler's name. The system counts to 7 days, counts to 3 months, and logs everything. That is what "easily accessible" looks like when you take the Directive seriously. --- *If your organization's whistleblowing channel requires employees to ask someone where to find it, you have a compliance checkbox. You do not have a whistleblowing channel. [Set up a real one in ten minutes.](https://secure.ethicsportal.eu/session/new)* --- # A false name on a report exposes an innocent colleague > A reporting form accepts any name. One employee can file a report signed with a colleague's name and contact details. What that does to the named colleague, and how case handlers confirm who wrote a report without exposing anyone. Canonical: https://ethicsportal.eu/blog/someone-elses-name-on-a-report/ Last updated: 2026-10-24 A whistleblowing channel lets reporters give their name if they want to. It cannot check that the name is theirs. Anyone can type a colleague's name, work email and phone number into a form, an email or a voicemail, and the report arrives signed by that colleague. We know of no published enforcement case built on this. It is a scenario. Case handlers should plan for it anyway, because it costs the person who does it almost nothing. ## How it plays out Anna wants to hurt Ben. She files a report accusing their manager of falsifying expenses and signs it with Ben's name and work email. The handler sees a named, confidential report and does what feels correct. They write to Ben at his work address to confirm receipt and ask for details. Ben has never heard of the report, so he asks a colleague what it means, or forwards it to IT as suspected phishing. Now other people know a report exists, and they believe Ben made it. Even without that email, a name in a case file travels. It is in the notes shared with the investigator and behind the questions the investigator asks. The manager works out who "complained" and starts treating Ben accordingly. If the report is false, Ben is in a worse position. Article 23(2) of Directive 2019/1937 requires Member States to penalise reporting persons who knowingly report false information, and to provide for compensation of the damage it causes. The signature on the report points at Ben. ## Ben fits neither role The Directive's protections are written for two people. The reporting person gets confidentiality of identity (Article 16) and protection from retaliation. The person concerned, the one the report is about, gets the presumption of innocence and protection of identity while the investigation runs (Article 22). Ben was cast as the reporter without being one. Few whistleblowing procedures say what to do with him. ## Confirm through the channel first The safeguard costs a genuine reporter nothing. - **Treat the name as a claim.** Record what the reporter typed, and act on it only once it is confirmed. - **Ask the first questions in the channel's own secure inbox.** The reply reaches whoever submitted the report. If that was Ben, he confirms. If it was Anna, Ben is never involved. - **Never contact a named reporter about the report through work email, phone or chat**, or in person, unless they have asked for that through the channel. Before an investigator interviews the named reporter or the organisation puts protective measures in place, the confirmation should be in the case file. If it turns out the report was filed in someone else's name, that becomes part of the investigation: knowingly false information, and possibly harassment of the colleague who was named. In EthicsPortal, reporter contact details in the case file are labelled as given by the reporter and not verified, and the case handler manual includes the rule above. Other routes by which reporters get exposed are in [how whistleblowers actually get identified](https://ethicsportal.eu/blog/how-whistleblowers-get-identified/). --- # How to switch whistleblowing software without a gap > Open cases cannot move between tools, so a switch needs an overlap. How to move new reports first, finish open cases in the old tool, and pay once. Canonical: https://ethicsportal.eu/blog/switch-whistleblowing-software/ Last updated: 2026-11-12 Most organisations plan to change whistleblowing software on the day the old contract ends. That plan has a problem. On that day, the old tool still holds open cases, and the people who reported them still use it to send messages. The new tool cannot take those cases over. So a switch needs an **overlap period**. New reports go to the new whistleblowing channel. Open cases finish in the old one. This guide explains how to plan that period, and how EthicsPortal makes it free. --- ## Why open cases cannot move A report is more than a text. It is a conversation with a reporter, often an anonymous one, who returns with a case ID and a password that only the old system knows. The case also has a history: the date of receipt, the acknowledgement, the messages, the decisions and the audit trail. You can export that history as a record. You cannot move the conversation. The reporter's login does not exist in the new tool, and you cannot contact an anonymous reporter outside the channel to give them a new one. The legal deadlines also continue. Under Article 9 of Directive 2019/1937, you must acknowledge each report within 7 days and give feedback within 3 months. For an open case, the old tool is where you meet those deadlines. ## The switch, step by step ![Timeline of a switch with two bars. The old tool receives all reports until day 1, when intake moves. From then until the old contract ends, it keeps only open cases until they close, and EthicsPortal receives all new reports free of charge. After the old contract ends, EthicsPortal receives all reports.](https://ethicsportal.eu/images/switch-overlap/en.svg) Two tools run in parallel, but you pay for one at a time. [Open full size](https://ethicsportal.eu/images/switch-overlap/en.svg) ### 1. Check the old contract Find four facts before you plan: - **The end date and the notice period.** Many contracts renew automatically if you do not give notice in time. - **The export.** Ask in which format you get case records, messages, attachments and audit logs. - **Access after the end date.** Some vendors keep read-only access for a period. Others delete the data. - **Intake.** Ask whether the vendor can close the form for new reports and keep existing cases open. This makes the overlap cleaner. ### 2. Move intake on day 1 Set up EthicsPortal: case handlers, report categories, languages and your whistleblowing policy. Then replace the old link in every place where people find it: - the website footer and the whistleblowing policy page - the intranet, the employee handbook and posters - instructions for phone and in-person reporting, if you offer them - supplier and partner documents, if external persons can report From this day, new reports go to EthicsPortal. The old tool receives only messages about open cases. ### 3. Run both tools during the overlap Assign one person to check the old tool on a fixed schedule, for example every two working days. Reporters with open cases will continue to use it. Every deadline that started in the old tool ends in the old tool. If a reporter submits a new matter in the old tool by mistake, answer there and tell them where to report new matters. ### 4. Close down the old tool Before the contract ends: - **Close the cases you can.** Give feedback and record the outcome. - **Document the cases you cannot close.** Export the full record. In the old tool, tell the reporter that the channel will close on a fixed date, and how to continue: a new report in the new channel that refers to the old case ID. - **Export everything for retention.** Keep the case records and audit trails for the period your policy and national law require. ### 5. Update your records A new vendor is a new data processor. Sign the data processing agreement, update your record of processing activities and the privacy notice for reporters. Where national law requires it, inform or consult employee representatives before you change the system. --- ## Free until your current contract ends The overlap period is the reason many organisations wait. Nobody wants to pay two vendors for the same months, so the switch moves to the last possible day, and the open cases have nowhere to go. **EthicsPortal is free for your organisation from the day you move intake until your current contract ends, for up to 12 months.** Billing starts the day after. You pay one vendor at a time, and you can start the overlap up to a year before your current contract ends. To use this, tell us the end date of your current contract when you set up EthicsPortal. We do not need the contract itself, and we do not need any report data from the old tool. Plan your switch Send us your current contract end date, your number of employees and the countries you operate in. We will set up your whistleblowing channel so that new reports can start in EthicsPortal now. [Contact us](https://ethicsportal.eu/contact/) ## If you leave EthicsPortal later The same rules apply in the other direction. Every report exports to PDF with its full message history, timeline and audit trail, and administrators can export all organisation data as a ZIP file at any time. See the [FAQ](https://ethicsportal.eu/faq/) for details. --- # Voice distortion does not keep whistleblowers anonymous > A pitch shift is the simplest way to disguise a whistleblower's voice message. It can be undone, and a colleague can still recognize the speaker. What actually removes the voice, and what the Directive requires. Canonical: https://ethicsportal.eu/blog/voice-distortion-whistleblowing/ Last updated: 2026-10-29 Many whistleblowing channels let a reporter record a voice message and promise "voice distortion" to protect them. Few vendors explain what the distortion does. The simplest form, and the one we use, is a pitch shift: the voice is made higher or lower, and the case handler hears the changed version. A pitch shift makes a voice harder to recognize. It does not make the reporter anonymous. We found this in our own product during a security audit in October 2026, changed every claim we make about it, and turned voice messages off by default. ## A pitch shift can be undone A simple voice disguise multiplies every frequency in the recording by one number. If that number is the same for every recording, anyone who knows it can divide by it and get the original pitch back. In our audit, one reverse step on a downloaded recording restored the reporter's pitch and almost all of the shape of their voice. Using a different random number for each recording stops this exact attack. It does not stop the next two. ## Software can still match the voice Speaker recognition software compares a voice with known samples, such as a recorded team meeting or a voicemail. Research in the [VoicePrivacy Challenge](https://www.voiceprivacychallenge.org/) has shown for years that simple signal changes (pitch, formants, speed) give weak protection once the attacker knows which method was used. On a whistleblowing platform it is usually the same method for every report. Under the GDPR, a voice recording is personal data. Once it is used to identify a person through technical processing, it is biometric data under Art. 4(14). ## A colleague can still recognize the speaker This is the most likely risk in a workplace, and no software is needed. A case handler who works with the reporter knows how they speak: their rhythm, accent, favorite words, the way they start a sentence. A pitch shift leaves all of that in place. So does the content: a reporter who describes a meeting only five people attended has narrowed the list to five. For many reporters, the safest voice message is a written report. ## Ways to take oral reports, compared There are three families of approach: a person takes the report, software disguises the voice, or software turns the voice into text. The only reliable way to remove the voice is not to keep it. Text removes the voice and the way a person speaks. The content risk stays, as it does for any written report. ### A person takes the report **Phone line answered by a case handler, without recording.** This is the model in [Art. 18(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937): the handler writes accurate minutes of the call, and the reporter checks, corrects and agrees them. No voice is stored. - Good: no recording, no AI, and the reporter confirms every word. - Watch out: someone has to answer the phone, and the handler hears the live voice, so a colleague may still recognize it. Phone systems log caller numbers unless the line is set up not to. **Recorded line or voicemail.** The reporter leaves a message at any hour. - Good: available 24/7 and simple for the reporter. - Watch out: you now store a raw voice, and the telephone provider is one more processor. Recording needs the reporter's consent under [Art. 18(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937). **Meeting in person.** The Directive requires it on request. - Good: the reporter controls what is said and to whom. - Watch out: the reporter is not anonymous. Under [Art. 18(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937), write accurate minutes (or record, with consent) and let the reporter check them. ### Software disguises the voice **Pitch shift on the server.** The simplest form of "voice distortion", and what we use. - Good: easy to build, works in every browser, no AI. - Watch out: it can be undone, matched by software and recognized by a colleague. The raw recording reaches the server before it is disguised, so it also reaches the job queue, storage and backups unless the system is built to prevent that. **Stronger signal processing.** A different random pitch for each recording, a shifted timbre, and flattened intonation. - Good: still no AI, and much harder for a colleague to recognize. - Watch out: speaker recognition software still partly works, and the voice sounds robotic. It is still a disguise. **Neural voice conversion.** A model replaces the speaker's voice with an invented one. - Good: the strongest disguise that keeps a voice. - Watch out: it is generative AI, it needs heavy computing power, and research still finds the original speaker in the output. ### Software turns the voice into text **Speech-to-text on the server, optionally read back by a synthetic voice.** - Good: removes the voice completely, works on every device and in most languages. - Watch out: an AI model processes every report. Ask which one, where it runs, and whether it is a listed sub-processor. The raw audio still reaches the server and its backups unless it is processed in memory and never stored. We wrote about AI in whistleblowing products in [Whistleblower reports do not belong inside an LLM](https://ethicsportal.eu/blog/whistleblower-reports-do-not-belong-inside-an-llm/). **Speech-to-text on the reporter's device, with a model the vendor ships.** Open-source speech models can run inside the browser. - Good: the audio never leaves the phone or computer, it works on iPhones, and the reporter can correct the text before sending. - Watch out: the first use downloads 40 to 250 MB, older phones are slow, and accuracy is weaker in smaller languages. The vendor still ships an AI model. **The browser's own on-device speech recognition.** Recent versions of Chrome and Edge can transcribe without sending audio anywhere, if the page asks for on-device processing. - Good: the vendor ships no model, and the audio never leaves the device. - Watch out: by default, Chrome sends the audio to Google, so the page must refuse to fall back to that mode. When we tested Chrome on macOS on 28 October 2026, on-device recognition offered German, English, Spanish, French, Italian, Polish and Portuguese, but not Dutch, Romanian, Croatian, Bulgarian, Slovenian or Greek. We found no way to require on-device recognition in Safari, so iPhone users get nothing. ### If you build or configure it yourself - Process the recording before you store it. Every place the raw audio touches (upload storage, a job queue, a mirror, a versioned bucket, a database backup) is a place it can be recovered from. - Fail closed: if processing fails, delete the raw recording and play nothing. - Strip file metadata, and use a fixed file name. - Let reporters play back their own recording, and tell them plainly what the case handler will hear. - Offer a written report next to every voice option, and recommend it to anyone whose voice could identify them. ## What whistleblowing vendors do Grouped by what happens to the reporter's voice, based on each vendor's public pages as checked in October 2026. Vendors change their products, so confirm with the vendor before you rely on this. | What happens to the voice | Main risk | Vendors that say so publicly | |---|---|---| | Kept as a recording, in disguised form | The disguise can be undone, matched by software or recognized by a colleague | FaceUp ("altered voice messages"), Whistleblower Software by Formalize ("voice distortion"), NorthWhistle ("voice scrambling"), EthicsPortal (off by default) | | Processed by an AI system: voice agents, AI hotlines or AI transcription | The report passes through an AI model, which may come from a third party | SpeakUp (AI voice agent), Whispli (Voice AI hotline), FaceUp (AI-powered hotline), Sygnali (AI audio-to-text on its phone line), WhistleOn (AI-assisted voice intake) | | Turned into text on the reporter's device, with no recording kept | The device must run a speech model, and the content can still identify the reporter | Ashio | | Taken by a person, who types the report and reads it back | The person hears the live voice | IntegrityCounts (live agent on its phone line) | ## What the Directive requires Directive 2019/1937 does not require a voice recorder. [Art. 9(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) says internal channels must allow reporting in writing, orally, or both. Where oral reporting is offered, it must be possible by telephone or another voice messaging system, and by a physical meeting on the reporter's request. National laws can go further, so check yours. When oral reports are recorded, [Art. 18(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) allows two ways to document them: a recording, or a complete and accurate transcript prepared by the person handling the report. The reporter must be able to check, correct and agree the transcript. For an unrecorded phone line or a meeting, [Art. 18(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) and [Art. 18(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) ask for accurate minutes the reporter can check and agree. That meets the Directive without storing anyone's voice. ## Questions to ask your vendor - What exactly does the voice distortion do, and is it the same for every recording? - Does the raw recording ever reach your storage, job queue or backups before it is disguised? For how long can it be restored? - Does any AI system process the recording or a transcript of it? Which one, and where? - Does the reporting form tell reporters that a disguised voice can still be recognized? If the answer to the first question is "it makes the reporter anonymous", treat the rest of the answers with care. ## What EthicsPortal does Voice messages are off by default. An organization can turn them on in its whistleblowing channel settings, and the change is recorded in the audit trail. When they are on, the recording is pitch-shifted on our servers in the EU and no AI system processes it. The original is deleted after processing, including the earlier versions our backup storage would otherwise keep for 28 days. We describe the shift as reversible and do not call it anonymization. The setting warns the organization, and the form tells reporters whose voice could identify them to write instead. The details are in our [DPIA](https://ethicsportal.eu/dpia/), risk 1. --- # What to look for in whistleblower compliance software > What a whistleblower reporting tool actually needs to do under EU Directive 2019/1937 — and what features matter vs. what's just marketing. Canonical: https://ethicsportal.eu/blog/what-to-look-for-in-whistleblower-compliance-software/ Last updated: 2026-10-28 The EU Whistleblower Protection Directive requires your organization to operate a secure whistleblowing channel. But not all tools that claim Directive compliance actually deliver it. Here's how to evaluate what matters. --- ## What a whistleblower reporting tool actually needs to do The Directive's requirements translate into five core functions: 1. A reporter submits a report through a secure channel. 2. The report is stored confidentially in an encrypted system. 3. A designated case handler reviews it and responds. 4. The system tracks the 7-day acknowledgment and 3-month feedback deadlines. 5. Every action is recorded in an append-only audit trail. These five functions are the compliance baseline. Any tool you evaluate should demonstrate how it handles each one. --- ## Features that matter for compliance When evaluating platforms, focus on what the Directive actually requires: - **Anonymous reporting** — Article 6(1) requires confidentiality. The strongest implementation means no IP logging, no tracking, and automatic stripping of file metadata (EXIF, GPS, author info) that could reveal identity. - **Two-way communication** — Article 9(1)(b) requires follow-up with the reporter. This means secure messaging without requiring the reporter to create an account or reveal their identity. - **Deadline tracking** — Articles 9(1)(b) and 9(1)(f) set the 7-day acknowledgment and 3-month feedback deadlines. Automated tracking with notifications prevents compliance failures. - **Audit trail** — Article 18 requires documentation. A tamper-resistant log of defined case events helps demonstrate what happened without implying that every read or action is recorded. - **EU data residency** — GDPR applies to all report data. Hosting within the EU simplifies compliance and avoids cross-border transfer questions. - **Data retention controls** — Article 17(1)(d) requires defined retention periods. Configurable auto-deletion ensures data isn't kept longer than necessary. ![EthicsPortal case view: the report text, secure messaging with the reporter, the 7-day acknowledgment deadline, the assignee and the intake answers, with the retaliation concern flagged](https://ethicsportal.eu/images/screenshots/en-report.webp) **See EthicsPortal in a live demo** A short online call: you see the whistleblowing channel your workers would use and the case handling behind it, and get answers to your questions. - [Book a demo](https://calendar.zoho.com/zc/view/slot-booking/zz08011220cdfa69864e9cefc2ca0e49dffa95e504c0265f6717484ebe19cbe7f6f38d5c7a) - [Deploy](https://secure.ethicsportal.eu/session/new?intent=start) - or email yaro@ethicsportal.eu --- ## Features that sound impressive but aren't in the Directive Some platforms emphasize capabilities that go beyond what compliance requires: - "AI-powered risk scoring" - "Sentiment analysis" - "Predictive analytics dashboards" - "Benchmarking against 10,000+ organizations" These features may serve larger organizations with mature compliance programs. But they are not Directive requirements, and their presence doesn't make a tool more compliant. Evaluate whether they serve your actual needs before paying for them. --- ## Pricing transparency as a signal The Directive applies to organizations of very different sizes — from 50-person companies to multinational enterprises. The tool you choose should match your scale. Some platforms publish their pricing openly. Others require a sales process to learn the cost. Neither approach is inherently better, but transparent pricing lets you evaluate fit faster and avoids committing time to demos before knowing whether the budget works. --- ## What to ask during evaluation When reviewing any whistleblower platform, ask: 1. **Where is data stored?** Confirm EU hosting and data residency. 2. **How are reporters protected?** Verify IP anonymization and metadata stripping. 3. **How are deadlines tracked?** Confirm automatic 7-day and 3-month tracking with notifications. 4. **Is the audit trail append-only?** Ensure entries cannot be edited after creation. 5. **What happens when we cancel?** Understand data export and deletion policies. 6. **Is a DPA available?** Required for GDPR compliance as a data processor relationship. --- ## How EthicsPortal addresses these requirements [EthicsPortal](https://ethicsportal.eu) is built specifically for EU Directive 2019/1937 compliance: - €41.67/month billed annually (€500/year), all features included - Anonymous reporting with IP anonymization and file metadata stripping - Secure two-way messaging, opened with a Case ID and password - Automatic deadline tracking with overdue notifications - Append-only audit trail and PDF case export - Hosted on Hetzner in Nuremberg, Germany — all data stays in the EU ![The reporter's view of an anonymous case after entering the Case ID and password: acknowledgment and feedback deadlines, their answers, and a reply form, with no identity required](https://ethicsportal.eu/images/screenshots/en-public-report-desktop.webp) See our [Directive 2019/1937 coverage map](https://ethicsportal.eu/directive-coverage/) for an article-by-article breakdown of how each requirement is met. --- # Whistleblower or leaker? Under EU law, the route decides > OpenAI's dismissal of three safety researchers revived an old question for AI companies. Since 2 August 2026, Article 87 of the AI Act gives the EU's answer: Directive 2019/1937 applies, and the route a report takes decides whether the reporter is protected. Canonical: https://ethicsportal.eu/blog/whistleblower-or-leaker-ai-act/ Last updated: 2026-11-10 In late September, OpenAI parted ways with three AI safety researchers. As [reported by the Wall Street Journal and Common Dreams](https://www.commondreams.org/news/openai-firing-whistleblowers), the company said the three had shared "confidential company information" with a third-party AI safety organisation, and that its investigation found they "mishandled sensitive information outside established company procedures." The company did not name the organisation or describe the information. Rep. Greg Casar, chair of the Congressional Progressive Caucus, responded: "Looks like they're firing whistleblowers." Both descriptions can be sincere. One side sees a breach of confidentiality, the other sees protected disclosure. Which one it is depends on facts that have not been published, and nothing here is a judgment on this case. The researchers' location, what they shared and the governing law are all unknown. What the case does show is a question every AI company will face. When an insider is worried about what the company is building, where are they supposed to take that concern? For AI providers and deployers in the EU, that question now has a statutory answer. ![The Berlaymont building in Brussels, headquarters of the European Commission, whose AI Office supervises general-purpose AI models under the AI Act](https://ethicsportal.eu/images/blog/ai-act-whistleblowing/berlaymont.jpg) The Berlaymont, Brussels. The Commission's AI Office, which supervises general-purpose AI models, runs its own whistleblower tool for AI Act reports. Photo: KenSwe72, [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), via [Wikimedia Commons](https://commons.wikimedia.org/wiki/File:Berlaymont_building_Brussels.jpg). Resized and cropped. --- ## Article 87: the AI Act plugs into the Whistleblower Directive Article 87 of the AI Act (Regulation 2024/1689) is a single sentence: > "Directive (EU) 2019/1937 shall apply to the reporting of infringements of this Regulation and the protection of persons reporting such infringements." It has applied since **2 August 2026**. From that date, reporting an AI Act infringement is a protected disclosure under the EU Whistleblower Directive, with everything that comes with it: the ban on retaliation (Art. 19), immunity from liability for the disclosure itself (Art. 21(2) and 21(7)), and a reversed burden of proof once a reporter shows they reported and then suffered a detriment (Art. 21(5)). The Commission had prepared for this. In November 2025 the AI Office launched a [whistleblower tool](https://digital-strategy.ec.europa.eu/en/policies/ai-act-whistleblower-tool) for people professionally connected to providers of general-purpose AI models: employees, contractors, shareholders and board members. It accepts confidential or anonymous reports in any official EU language and offers a secure inbox for follow-up. At launch the AI Office said that until 2 August 2026 confidentiality was the main safeguard. That interim period is over. The AI Act is one of several EU acts that have extended the Directive's scope since 2019. The [interpretations page](https://ethicsportal.eu/directive-interpretations/) lists them with their dates (§12). --- ## The Directive protects routes, not intentions The Directive does not protect anyone who discloses something for a good reason. Under Article 6, a reporter qualifies for protection if they had reasonable grounds to believe the information was true and within scope, **and** they reported through one of three routes: 1. **Internally**, through the organisation's own whistleblowing channel (an "internal reporting channel" under Art. 7–9). 2. **Externally**, to a competent authority (Art. 10–14). For AI Act infringements, that means the national market surveillance authority or, for general-purpose AI models, the AI Office. 3. **By public disclosure**, under the conditions in Art. 15: either after an internal or external report produced no appropriate action in time, or where there is imminent danger to the public interest, a risk of retaliation, or little prospect that an external report would be dealt with. A private research organisation, a think tank or an advocacy group is not on that list. At the Directive's minimum standard, sharing information with one of them is not a protected route. Member States may offer more (Art. 25), but a reporter cannot count on it. This is the uncomfortable part of the "whistleblower or leaker" debate. The same information, with the same motive, can lead to two different legal outcomes depending only on where it was sent. --- ## The route that exists determines the route that gets used The Directive is not neutral about which route comes first. Article 7(2) asks Member States to encourage internal reporting **where the breach can be addressed effectively internally and the reporter considers there is no risk of retaliation**. That is a condition, not a preference. If the people with the concern don't trust the internal channel, the Directive itself expects them to go elsewhere. That puts much of the outcome back on the employer. A safety researcher who believes something is wrong will take the concern somewhere. If the company offers a channel they trust, with confidentiality, a deadline for a response and a record that cannot be quietly closed, the concern goes there and the company gets to deal with it first. If the company offers nothing credible, the concern goes to an authority, the press or a third party. Whether that last step is protected or not, the company has already lost the chance to act on it. An AI company does not need to win the "whistleblower or leaker" argument after the fact. It needs to make the protected internal route the obvious one before the fact. --- ## What changes for AI providers and deployers in the EU Any legal entity with 50 or more workers already had to run a whistleblowing channel under Article 8. Article 87 doesn't create a new channel. It widens what the existing one has to accept. In practice: - **Update the scope of your whistleblowing policy.** Policies list the areas of Union law they cover. If yours predates August 2026, it probably doesn't mention the AI Act. Add it, together with the external routes: your national market surveillance authority and, if you provide general-purpose AI models, the AI Office's tool. - **Check your confidentiality agreements.** Article 24 provides that the Directive's rights "cannot be waived or limited by any agreement, policy, form or condition of employment." A confidentiality clause can protect trade secrets. It cannot prevent someone from making a protected report. - **Make the channel credible to technical staff.** Researchers and engineers will judge a channel by its design: whether it can be used anonymously, whether it is separate from the company's own systems, and whether it requires a login that ties the report to an employee account. A channel that only legal knows about doesn't meet the Directive's expectation that it be effective. See [If employees have to ask where the whistleblowing channel is, you don't have one](https://ethicsportal.eu/blog/if-employees-have-to-ask-you-dont-have-a-channel/). - **Keep the clocks.** Acknowledge receipt within 7 days and give feedback within 3 months (Art. 9(1)(b) and (f)). A report about an AI system is subject to the same deadlines as a report about procurement fraud. - **Document the handling.** If a dismissal is ever challenged, the reversed burden of proof means the employer must show the decision had nothing to do with the report. That is far easier with a complete, timestamped case record than with an email thread. --- ## The question to ask before the next case When a dispute like this one becomes public, it is usually too late to decide what kind of disclosure it was. The facts are contested, the motives are disputed and the people involved have already been let go. The useful question for an AI company comes earlier: **if one of our researchers were worried tomorrow, would they report to us first?** If the honest answer is no, the problem is not their judgment. The company has no whistleblowing channel they trust. *EthicsPortal is whistleblower software for EU organisations: anonymous intake from any browser, two-way communication without revealing identity, and tracking of the Article 9 deadlines on every case. [Set up your whistleblowing channel](https://secure.ethicsportal.eu/session/new).* --- # Whistleblower policy template for EU organisations > A ready-to-use whistleblower policy template that meets EU Directive 2019/1937 requirements. Copy, adapt, and implement in your organization. Canonical: https://ethicsportal.eu/blog/whistleblower-policy-template/ Last updated: 2026-10-27 Every organization with 50 or more employees in the EU needs a written whistleblower policy. This is not optional --- it is required under national transposition laws like [Loi Waserman](https://ethicsportal.eu/whistleblower-laws/france/) (France), [HinSchG](https://ethicsportal.eu/whistleblower-laws/germany/) (Germany), [Ley 2/2023](https://ethicsportal.eu/whistleblower-laws/spain/) (Spain), and the [Act of 14 June 2024](https://ethicsportal.eu/whistleblower-laws/poland/) (Poland), all implementing EU Directive 2019/1937. Penalties for non-compliance vary by country --- see our [penalties page](https://ethicsportal.eu/penalties/) for details. A whistleblower policy does two things: it tells employees how to report wrongdoing, and it tells your organization how to handle those reports. Without a clear policy, reports fall through the cracks, handlers improvise, and your organization risks both legal exposure and reputational damage. Below is a complete policy template you can copy and adapt. Replace the bracketed placeholders with your organization's details. The template covers every element the Directive requires. --- ## Whistleblower policy template --- **[ORGANIZATION NAME]** **Whistleblower protection policy** **Effective date:** [DATE] **Approved by:** [NAME / TITLE] **Version:** 1.0 --- ### 1. Purpose and scope This policy establishes a framework for reporting suspected breaches of law, regulation, or internal rules within [ORGANIZATION NAME]. It implements the requirements of EU Directive 2019/1937 on the protection of persons who report breaches of Union law, as transposed into [MEMBER STATE] national law. This policy applies to all operations, subsidiaries, and business units of [ORGANIZATION NAME] within the European Union. ### 2. Who can report In accordance with Article 4 of the Directive, the following persons may submit a report through the channels described in this policy: - Current and former employees, including those on probation or notice periods - Job applicants who obtained information during the recruitment process - Contractors, subcontractors, and suppliers - Shareholders and members of the administrative, management, or supervisory body - Volunteers and trainees, whether paid or unpaid - Any person working under the supervision and direction of contractors, subcontractors, or suppliers - Persons whose work-based relationship has not yet begun, where information on breaches was acquired during the recruitment process or pre-contractual negotiations Protection also extends to facilitators, third persons connected with the reporting person (such as colleagues or relatives), and legal entities that the reporting person owns, works for, or is otherwise connected with in a work-related context (Article 4(4)). ### 3. What can be reported Reports may concern breaches of Union law in the areas covered by the Directive (Article 2), including but not limited to: - Public procurement irregularities - Financial services, anti-money laundering, and counter-terrorist financing violations - Product safety and compliance breaches - Transport safety violations - Environmental protection breaches - Radiation protection and nuclear safety issues - Food and feed safety, animal health and welfare concerns - Public health violations - Consumer protection breaches - Privacy and personal data protection violations - Security of network and information systems - Competition and state aid rule breaches - Corporate tax arrangements that undermine the object or purpose of applicable tax law - Fraud, corruption, or other criminal offenses affecting the financial interests of the EU Reports may also concern breaches of internal company policies, codes of conduct, and applicable national law, provided [MEMBER STATE] national transposition law extends protection to such reports. ### 4. How to report #### Whistleblowing channel [ORGANIZATION NAME] provides a secure, confidential whistleblowing channel: - **Online form:** [URL OF REPORTING FORM] - **Designated person:** [NAME / TITLE OF DESIGNATED PERSON OR DEPARTMENT] - **Alternative methods:** [POSTAL ADDRESS / EMAIL / IN-PERSON MEETING REQUEST PROCESS, as applicable] Reports can be submitted anonymously. Reporters who choose to remain anonymous will receive a Case ID and a password to check the status of their report and communicate securely with the case handler. [ORGANIZATION NAME] encourages the use of the whistleblowing channel as a first step, as this allows the organization to investigate and address breaches promptly. #### External reporting to competent authorities Reporting persons have the right to report externally to the relevant competent authority at any time, as provided under Article 10 of the Directive. Reporting persons are not required to use the internal channel before reporting externally. The competent authority in [MEMBER STATE] is: [NAME AND CONTACT DETAILS OF NATIONAL AUTHORITY]. #### Public disclosure In exceptional circumstances defined in Article 15 of the Directive, reporting persons may make a public disclosure and still receive protection --- for example, where they have reasonable grounds to believe that the breach constitutes an imminent or manifest danger to the public interest, or where there is a risk of retaliation. ### 5. Confidentiality The identity of the reporting person will not be disclosed to anyone beyond the authorized staff members competent to receive or follow up on reports, without the explicit consent of the reporting person (Article 16). This confidentiality obligation applies to all information from which the identity of the reporting person may be directly or indirectly deduced. The identity of the reporting person may only be disclosed where this is a necessary and proportionate obligation imposed under Union or national law in the context of investigations by national authorities or judicial proceedings, including with a view to safeguarding the rights of defense of the person concerned. Any person who discloses the identity of a reporting person in violation of this policy will be subject to disciplinary action. ### 6. Prohibition of retaliation [ORGANIZATION NAME] strictly prohibits any form of retaliation against reporting persons, in accordance with Articles 19 to 21 of the Directive. Retaliation includes, but is not limited to: - Suspension, dismissal, or equivalent measures - Demotion, withholding of promotion, or change of duties or work location - Reduction of wages or changes to working hours - Withholding of training - Negative performance assessment or employment reference - Coercion, intimidation, harassment, or ostracism - Discrimination or unfavorable treatment - Failure to convert a temporary employment contract into a permanent one - Non-renewal or early termination of a temporary employment contract - Harm, including to reputation or financial loss - Blacklisting - Early termination or cancellation of a contract for goods or services - Cancellation of a license or permit - Psychiatric or medical referrals The burden of proof in retaliation proceedings is reversed: where a reporting person establishes that they made a report and subsequently suffered a detriment, it is presumed that the detriment was made in retaliation. The person who took the detrimental action must prove it was based on duly justified grounds unrelated to the report (Article 21(5)). Any employee found to have engaged in retaliation will be subject to disciplinary action, up to and including termination. ### 7. Investigation process Upon receipt of a report, [ORGANIZATION NAME] will: 1. **Acknowledge receipt** within seven calendar days of receiving the report (Article 9(1)(b)). 2. **Assess the report** to determine whether it falls within the scope of this policy and warrants investigation. 3. **Investigate diligently** by gathering relevant information, interviewing witnesses as necessary, and reviewing documents, while maintaining confidentiality throughout. 4. **Provide feedback** to the reporting person within three months of acknowledgment. Feedback will include information on the status of the investigation and, where possible, the outcome and any measures taken or envisaged (Article 9(1)(f)). 5. **Close the case** with documented findings and, where appropriate, recommend corrective actions, disciplinary measures, or referral to competent authorities. Where a report is assessed as falling outside the scope of this policy, the reporting person will be informed and, where appropriate, redirected to the relevant procedure. ### 8. Data protection Reports and all related data will be processed in accordance with Regulation (EU) 2016/679 (GDPR) and applicable national data protection law. Personal data that is manifestly not relevant to the handling of a specific report will not be collected or, if accidentally collected, will be deleted without undue delay (Article 17(3)). Report data will be retained for no longer than is necessary and proportionate to comply with the requirements of this policy and applicable law. [ORGANIZATION NAME] will define and document specific retention periods in accordance with national transposition law. ### 9. Training and awareness [ORGANIZATION NAME] will: - Train all designated case handlers on their obligations under this policy and applicable law - Inform all employees and other persons covered by Section 2 about the availability and use of the whistleblowing channel - Make this policy easily accessible, including on the company intranet and as part of the onboarding process for new employees ### 10. Review This policy will be reviewed at least annually and updated as necessary to reflect changes in applicable law, organizational structure, or best practices. ### 11. Contact For questions about this policy or the whistleblowing channel: - **Designated person:** [NAME / TITLE] - **Email:** [EMAIL ADDRESS] - **Online reporting form:** [URL] --- *End of policy document.* **See EthicsPortal in a live demo** A short online call: you see the whistleblowing channel your workers would use and the case handling behind it, and get answers to your questions. - [Book a demo](https://calendar.zoho.com/zc/view/slot-booking/zz08011220cdfa69864e9cefc2ca0e49dffa95e504c0265f6717484ebe19cbe7f6f38d5c7a) - [Deploy](https://secure.ethicsportal.eu/session/new?intent=start) - or email yaro@ethicsportal.eu --- ## Using this template Copy the text above into your company's document format, replace every bracketed placeholder, and have it reviewed by your legal team. The template covers the requirements of Directive 2019/1937, but national transposition laws in your member state may impose additional obligations --- check with local counsel. Once your policy is in place, you need a technical channel to receive reports. [EthicsPortal](https://ethicsportal.eu/) provides a secure whistleblowing channel that meets the Directive's requirements, starting at €41.67/month billed annually. --- # Whistleblower reports do not belong inside an LLM > Seven whistleblower platforms sold into the EU now process report content through large language models. Six of them won't tell you whose. EthicsPortal does neither. Screenshots and sources inside. Canonical: https://ethicsportal.eu/blog/whistleblower-reports-do-not-belong-inside-an-llm/ Last updated: 2026-10-24 Seven whistleblower platforms sold into the EU run report content through large language models. They summarise reports, transcribe voice intake, run AI agents that talk to whistleblowers, and produce "insights" across case archives. Only one of the seven names which AI provider does the work. EthicsPortal does none of this. Our [DPA §6.10](https://ethicsportal.eu/dpa/#610-no-ai-or-llm-processing-of-report-content) and our [sub-processor list](https://ethicsportal.eu/subprocessors/) say so. Every claim below is quoted from the vendor's own live page or public DPA, captured 24 May 2026. Translation and categorisation can run on-prem, so we did not include vendors whose only AI claim is "AI translation" or "AI categorisation". The seven below claim more than that. ## NAVEX — "AI-supported case briefs and suggested rewrites" NAVEX reports more than 13,000 customers, including 77% of the Fortune 500, on its own figures. EthicsPoint is its whistleblowing hotline. From the whistleblowing platform page: > "Summarize complex cases with **AI-supported case briefs and suggested rewrites**" > > "Spot recurring themes earlier through higher-level insights and analytics" ![NAVEX whistleblowing platform — "Summarize complex cases with AI-supported case briefs and suggested rewrites"](https://ethicsportal.eu/images/blog/no-ai-commitment/navex-ai-case-briefs-rewrites.png) To suggest a rewrite, the model has to read the original report. NAVEX does not name the model on any public page. ## EQS Integrity Line — "AI-powered summaries and transcription" in 80+ languages EQS Group, based in Munich and owned by Thoma Bravo since 2024, sells Integrity Line. From their Integrity Line page, as captured in May 2026: > "**AI that works for you.** Handle reports in over 80 languages with AI-powered summaries and transcription, and transform voice recordings into searchable texts. Get helpful insights from past cases for faster resolution including suggestions for case categories and priorities." ![EQS Integrity Line — "AI that works for you": AI-powered summaries, transcription of voice recordings, case-category suggestions](https://ethicsportal.eu/images/blog/no-ai-commitment/eqs-integrity-line-ai-summaries-transcription.png) Summaries, voice transcription, and cross-case insights. 4,000+ organisations on the platform. Provider not named. ## SpeakUp — "Sienna AI": a whole AI product line SpeakUp's Sienna AI is not a feature, it is a sub-brand: > "**Sienna AI. Compliance reimagined.** The intelligence layer behind the future of compliance and ethics." ![SpeakUp Sienna AI hero — "Compliance reimagined. The intelligence layer behind the future of compliance and ethics."](https://ethicsportal.eu/images/blog/no-ai-commitment/speakup-sienna-ai-compliance-reimagined.png) The page markets an **AI Voice Agent** that has reporters "speak freely and safely" through a "guided, conversational intake", **Sienna Insights** ("AI does the digging. You get the insight."), and AI translation, transcription, and routing of submissions into the case management system. Reporters in SpeakUp's flow are talking to a model. Provider not named. ## Whispli — "Use AI to capture clearer, more complete hotline reports" From Whispli's Voice AI hotline page (the page title is literally "AI Whistleblowing Hotline"): > "**Use AI to capture clearer, more complete hotline reports.** Manage global whistleblowing hotline reporting with an AI-powered voice intake agent that captures, structures and routes cases securely across jurisdictions." ![Whispli hotline hero — "Use AI to capture clearer, more complete hotline reports" with a Voice transcribed / Case created flow](https://ethicsportal.eu/images/blog/no-ai-commitment/whispli-voice-ai-hotline.png) The flow diagram on the page shows it plainly: Incoming Voice Report → Voice transcribed → Case created. The most exposed reporter, the one who picked up a phone, is talking to an AI agent. Provider not named. ## FaceUp — "Voice-based AI conducts natural conversations" with whistleblowers FaceUp is a Czech-EU platform with 3,500+ organisations across 70+ countries. Their whistleblower hotline page offers three tiers: a Live Hotline staffed by human agents, an Automated Hotline with a scripted flow, and the new AI-Powered Hotline in the middle: > "**Voice-based AI conducts natural conversations, asks follow-ups, and converts calls into structured, actionable reports.** Multilingual, 24/7." ![FaceUp three-tier hotline comparison — "AI-Powered Hotline" (centre, marked "new") with "Voice-based AI conducts natural conversations, asks follow-ups, and converts calls into structured, actionable reports"](https://ethicsportal.eu/images/blog/no-ai-commitment/faceup-ai-powered-hotline.png) > "The AI agent guides the reporter and follows up where needed to capture complete and accurate information." FaceUp's three-card layout is the clearest framing of the choice in the category: a human handles the call, a scripted flow handles the call, or an AI handles the call. They sell all three and mark the AI option "new". Provider not named. ## Whistlelink — Mistral AI (France) and DeepL (Germany) named in the public DPA Whistlelink is the only vendor of the seven that publicly names its AI providers. Their Romanian DPA, Section 5.5: > "Sub-Imputerniciți: Swerolab AB (Suedia), SMSAPI (Polonia), Brevo (Franța), OPSWAT (Germania), Glesys (Suedia), T-Systems International (Germania), Friendly Captcha (Germania), **DeepL (Germania), Mistral AI (Franța)**." ![Whistlelink DPA Section 5.5 — sub-processor list naming DeepL (Germany) and Mistral AI (France)](https://ethicsportal.eu/images/blog/no-ai-commitment/whistlelink-dpa-mistral-deepl.png) The product page explains what the AI Assistant does: "AI Assistant automatically generates concise case summaries." Mistral is the only LLM provider on the sub-processor list above. The Article 16 confidentiality concern still applies. But an operator signing this DPA knows what they are signing. Operators signing the other six don't. ## Ethicontrol — "ai intake agent" on the pricing page Ethicontrol's pricing page lists `+ ai intake agent for web portal and WhatsApp` as a paid feature starting at the Standard tier (€174/month): ![Ethicontrol pricing — Standard tier includes "+ ai intake agent for web portal and WhatsApp"](https://ethicsportal.eu/images/blog/no-ai-commitment/ethicontrol-pricing-ai-intake-agent.png) In 2026, an "intake agent" for whistleblower reports is a conversational LLM. The privacy policy and Trust Center do not name the provider. ## Six of the seven won't tell you whose AI Of the seven above, only Whistlelink names the AI providers (Mistral, DeepL). The other six say "AI", "AI-powered", "Sienna AI", or "Voice-based AI" without naming the model, the provider, the jurisdiction, or whether the inference call leaves the operator's encryption boundary. We searched every vendor's privacy policy, DPA, sub-processor page, and trust center we could reach on 24 May 2026. For six, the provider is not disclosed. The feature is in the marketing copy. The disclosure is not in the legal pages. ![The Big Short meme — "I don't get it. Why are they confessing?" / "They're not confessing. They're bragging."](https://ethicsportal.eu/images/blog/no-ai-commitment/big-short-bragging-not-confessing.jpg) That is the harder problem. An operator running a Data Protection Impact Assessment cannot disclose a sub-processor they cannot name, cannot assess GDPR Chapter V transfer mechanisms for a provider that has not been disclosed to them, and cannot offer the reporter a meaningful privacy notice when the architecture has a box labelled "AI" and no further detail. ## Why a whistleblowing channel is the wrong place for AI Article 16 of Directive 2019/1937 says the identity of the reporting person, and information from which it can be deduced, must not be disclosed to anyone beyond authorised case-handling staff. Member-state laws (HinSchG, Sapin II / Loi Waserman, Law 361/2022, the 2024 Polish Act) lift that into criminal or administrative penalties. An LLM API provider is not authorised case-handling staff. Their engineers can read prompts. Their abuse-detection systems are designed to read prompts. The Directive has no "but it was just for a summary" carve-out. [Art. 22](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) of the GDPR sits on top of that. AI categorisation, "suggested rewrites" of a report body, AI case briefs that an investigator reads instead of the original, and "insights" that decide investigative priority are exactly the automated decision-making the article is written about. Disclosure, DPIA, sub-processor listing with notice and objection rights, and reporter-facing transparency all attach. A no-AI commitment removes the entire disclosure tree. The privacy notice is shorter, the DPIA is shorter, the sub-processor list is shorter, and the reporter's expectation matches the architecture. ## Our commitment [DPA §6.10](https://ethicsportal.eu/dpa/#610-no-ai-or-llm-processing-of-report-content): report content, reporter identity, handler messages, attachments, and audit logs are not transmitted to any large language model, generative AI service, or AI-based classifier, whether operated by us or by a third party. OpenAI, Anthropic, Google, and Mistral are named in the DPA as examples of providers we do not transmit to. A change to this would be a material change to the service, notified 30 days in advance with an objection right. Our [sub-processor list](https://ethicsportal.eu/subprocessors/) names the three providers in the customer-instructed reporting-service chain: Hetzner (EU hosting), Mailjet (email), and AppSignal (handler-side error monitoring). Cloudflare (public-site delivery) and Stripe (billing) operate outside that chain and are disclosed separately in the [Privacy Notice](https://ethicsportal.eu/privacy/), including Stripe's processor and independent-controller roles. No AI sub-processor appears. ## If you are evaluating a vendor Ask in writing: is any large language model, generative AI service, or AI-based classifier — operated by you or by a third party — a sub-processor of report content, reporter identity, handler messages, attachments, or audit logs? Name the provider, the jurisdiction, the function, and whether it is on by default. And will you contractually commit that this answer cannot change without 30 days' notice and an objection right? We answered both in our DPA before anyone had to ask. --- # Whistleblowing by email: a secure address for every channel > Every EthicsPortal whistleblowing channel now has its own email address. Emails become confidential cases, and case handlers never see the sender's address. Why a shared company mailbox does not meet the Directive's access rule, and what Italy, Germany, Ireland and Denmark say about email. Canonical: https://ethicsportal.eu/blog/whistleblowing-by-email/ Last updated: 2026-11-06 From today, every EthicsPortal whistleblowing channel has its own email address, for example `7YK9QM2W@report.ethicsportal.eu`. A report sent there becomes a case in the channel, next to the reports from the online reporting form. The case handlers never see the sender's address. It is included in the single plan and active on every channel. [Why a shared compliance inbox is not secure, and how a report sent by email becomes a confidential case in EthicsPortal](https://ethicsportal.eu/videos/email-intake.mp4) Many employees still reach for email first. They know how it works, they can attach a document, and they can write when it suits them. Until now, organizations had two options: send those people to a web form, or open a shared inbox such as compliance@company.com. The second option is where the Directive's requirements usually fail. ## Why a shared company mailbox falls short Article 9(1)(a) of Directive 2019/1937 requires internal channels to be "designed, established and operated in a secure manner" that protects the reporter's identity and "prevents access thereto by non-authorised staff members". A company inbox is rarely that closed. IT administrators can open it, assistants hold delegated access, and backup and archiving tools copy every message. When the person who manages the mail system is the person named in the report, the report is in the wrong hands from the moment it arrives. The reporter's side carries a second risk. A report sent from a work account is logged by the employer's own mail system, with sender, recipient and time. ## What national rules say about email The Directive does not ban email, and most national rules do not either. What they require is that only the designated people can read the reports. - **Italy.** Legislative Decree 24/2023 requires channels that protect the reporter's identity, "including through the use of encryption tools" ([Art. 4](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2023-03-10;24~art4)). The anti-corruption authority ANAC goes further. Its 2025 guidelines on internal channels state that ordinary or certified email is "in itself inadequate" to protect the reporter's identity, unless specific countermeasures are justified in the data protection impact assessment ([Guidelines 1/2025, § 2.2](https://www.anticorruzione.it/documents/91439/359218474/Linee+Guida+n.+1.2025+-+whistleblowing+canali+interni+di+segnalazione+-+del.478-26.11.2025.pdf/29b5c33c-e760-84f4-9ddc-8e5bdb0af6ed)). The reason ANAC gives is that mail systems log every message sent and received, and that the risk is higher when the reporter uses a mailbox the employer provides. The data protection authority, the Garante, takes the same position ([opinion 581/2025](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10184673)). - **Germany.** The HinSchG requires channels designed so that only the people responsible for receiving and handling reports can access them ([§ 16(2)](https://www.gesetze-im-internet.de/hinschg/__16.html)). The legislator's explanatory memorandum names email threads among the documents that unauthorised colleagues must not be able to reach. - **Ireland.** The statutory guidance for public bodies expects a dedicated email address, and adds that access to that inbox "must be restricted solely to persons designated to receive and handle reports" ([2023 guidance, § 9.3](https://www.ipoi.gov.ie/en/about-us/protected-disclosures-act-2014/2023-statutory-guidance-final.pdf)). - **[Denmark](https://ethicsportal.eu/whistleblower-laws/denmark/).** The guidance for private workplaces accepts a secure mail solution, but reports must not be kept anywhere generally accessible, such as a shared drive ([Vejledning nr. 9250](https://www.datatilsynet.dk/Media/638745245322495792/Vejledning%20nr.%209250%20af%2016.%20december%202021%20for%20whistleblowerordninger%20p%C3%A5%20private%20arbejdspladser.pdf)). The Netherlands, France and Poland accept email as a way to report. The test everywhere is the same: a dedicated address that only the people who handle reports can read. A shared company mailbox fails it. The national details are on our [law pages](https://ethicsportal.eu/whistleblower-laws/). ## How the EthicsPortal address works - **A separate mail server.** Reports are received by EthicsPortal's own mail server in Germany, not by a mailbox in the organization's mail system, so its administrators, delegates and archiving tools have nothing to open. - **A case, not an inbox.** The email becomes a case with the same deadlines, access rules and audit trail as any other report. Only the people with access to the case can read it. - **The sender's address stays hidden.** EthicsPortal stores it encrypted and uses it only to send the reporter's notices. It does not appear in the case, its PDF or exports. - **Follow-up without email.** The reporter receives a Case ID and a one-time password for the secure inbox. Questions and answers continue there. - **Clean attachments.** Files are stripped of metadata such as GPS location and author, and scanned for viruses, the same as uploads through the form. The technical detail, including what is and is not encrypted in transit, is on the [security page](https://ethicsportal.eu/security/#reports-by-email). ## What email cannot do [Email is not anonymous](https://ethicsportal.eu/blog/anonymous-vs-confidential-reporting/). The reporter's mail provider keeps a copy, and so does the employer's mail system if the message is sent from a work account. The receipt says this and links to the online reporting form, which remains the route for anyone who needs to stay anonymous. For a reporter who is comfortable being known to the system, the address removes the last reason to write to a shared inbox. ## Where the address appears The address is shown in the channel settings and on the channel's public page, and is included in the whistleblowing policy, the poster and the case handler manual that EthicsPortal generates. Organizations that already run a channel do not need to change anything. To tell staff, update the policy or reprint the poster. [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Switzerland has no whistleblower law. Swiss companies still need a whistleblowing channel > Switzerland never adopted a whistleblower protection statute, and in 2024 Parliament declined to try again. Swiss case law, corporate criminal liability and EU subsidiaries make an internal whistleblowing channel necessary anyway. What a Swiss channel has to get right. Canonical: https://ethicsportal.eu/blog/whistleblowing-channel-switzerland/ Last updated: 2026-10-24 Switzerland has no whistleblower protection statute. The Federal Council's revision of the Code of Obligations was rejected by the National Council on 5 March 2020, 147 votes to 42. A motion asking for a new private-sector framework was rejected on 27 February 2024, with the Federal Council opposed. EU Directive 2019/1937 does not reach Switzerland through the bilateral agreements. For most Swiss companies, no law requires a whistleblowing channel. Case law and the criminal code still make one necessary, and some companies are required to run one. The statutory detail is on our [Switzerland law page](https://ethicsportal.eu/whistleblower-laws/switzerland/). --- ## Swiss case law expects reports to go inside first Without a statute, the Federal Supreme Court decides when a report is lawful. It applies a cascade. An employee must first raise the matter inside the company. A report to an authority is justified only when the internal attempt fails or would plainly be futile. Going public comes last. FINMA states the rule in its own guidance for reporters: "you are fundamentally required first of all to attempt to report the suspected irregularity within the institution concerned." It warns that a reporter who skips that step risks prosecution for breach of confidentiality. A company with a working internal channel is where reports arrive. A company without one has made the internal step futile, which is the condition that justifies going to an authority or the press. The company then learns about the matter last. For the employee, Article 321a of the Code of Obligations binds them to loyalty and confidentiality. If they are dismissed for a report, Article 336a caps the compensation at six months' salary, and the dismissal stands. A channel that visibly works is what makes reporting inside worth the risk. ## The criminal law asks what the company organised Article 102 paragraph 2 of the Swiss Criminal Code punishes the company itself for bribery, money laundering, terrorist financing and criminal-organisation offences when it "failed to take all the reasonable organisational measures that are required in order to prevent such an offence". The fine can reach CHF 5 million, whether or not any individual is convicted. Swiss law does not list the measures. A company that had no way for staff to tell it about a bribe is arguing from a weak position about the measures it did take. The 2023 Swiss Code of Best Practice for Corporate Governance puts it in one line for boards: employees should be able to report suspected irregularities "to an independent internal or external body without expecting disadvantages." ## Two cases where a channel is mandatory **Supply-chain due diligence.** Companies that import or process tin, tantalum, tungsten or gold above the ordinance's thresholds, or that offer products or services with a reasonable suspicion of child labour, must run a reporting procedure under Article 14 of the due diligence ordinance (SR 221.433). It must be open to "all interested persons", so people outside the company can use it too. The reports must be documented. **EU subsidiaries.** The Directive's 50-worker threshold applies to each legal entity. A Swiss group with a 120-person subsidiary in Germany owes that subsidiary a channel under the German HinSchG, whatever the parent does. The group can serve several entities from one system, but each in-scope EU entity carries its own national obligations. The country-by-country detail is on the [law pages](https://ethicsportal.eu/whistleblower-laws/). ## What a Swiss channel has to get right An EU template adopted as it stands gives Swiss staff wrong advice in four places. - **The external route.** EU policies tell reporters they may go to the competent authority at any time, with no duty to report internally first. That reverses the Swiss cascade and could expose an employee who relies on it. A Swiss policy explains the cascade. Switzerland has no general external authority: FINMA receives reports on financial market law, the Swiss Federal Audit Office on the federal administration, and the prosecution authorities on crimes. - **Retaliation.** The Directive's reversed burden of proof and its liability shield do not exist in Swiss law. A Swiss policy can still prohibit retaliation as the company's own commitment, and it should say that this is what it is. - **Data protection.** The governing law is the Federal Act on Data Protection (FADP), and the supervisory authority is the FDPIC. Article 19(4) FADP requires the privacy notice to name every state the data is disclosed to, so "hosted in the EU" is not enough. - **Where reports go.** Article 273 of the Criminal Code punishes making a trade secret available to a foreign official agency or a foreign private enterprise. A group that routes reports about a Swiss entity to an intake team abroad needs to answer that question before it chooses a system. The Directive is still the best available benchmark for the parts Swiss law leaves open. Acknowledging a report within seven days and giving feedback within three months is what makes an internal channel credible to the people the cascade sends to it. ## EthicsPortal for Swiss entities EthicsPortal now operates whistleblowing channels for organizations registered in Switzerland. When the operating entity is Swiss, the generated documents follow Swiss law: - The whistleblower policy explains the cascade and the sector authorities, and presents retaliation protection as the organization's own commitment. - The privacy notice is written under the FADP, names the FDPIC, and names Germany as the state where reports are stored, along with France and the Netherlands, where the email and monitoring suppliers sit. All three are recognised by the Federal Council as providing adequate data protection. - The compliance certificate and report describe the Directive as a voluntarily applied standard and do not claim compliance with a Swiss whistleblower law. - The [data processing agreement](https://ethicsportal.eu/dpa/) includes the terms the FADP requires for processors. Reports are stored by [Hetzner in Germany](https://ethicsportal.eu/subprocessors/) under a processing contract, and report text, reporter details, intake answers and attachments are encrypted in the application. We know of no court decision on whether storage by a contracted processor abroad is "making a secret available" under Article 273. The Federal Supreme Court treats a secret as made available once the recipient could learn it, but requires a connection to Switzerland and notes that prevailing doctrine applies Article 273 with restraint ([BGE 141 IV 155](https://www.bger.ch/ext/eurospider/live/de/php/clir/http/index.php?highlight_docid=atf%3A%2F%2F141-IV-155%3Ade&lang=de&type=show_document)). The part the organization controls is who reads the reports: only the people it adds can open them, so a Swiss entity can keep case handling in Switzerland. Reporters can submit in any of the 14 interface languages, including German, French and Italian, anonymously and without an account, and follow up with a Case ID and password. [Set up your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblowing software penetration test: what to check > How to read a vendor's penetration test evidence, which whistleblowing risks the test must cover, and four checks you can run yourself during a trial. Canonical: https://ethicsportal.eu/blog/whistleblowing-software-penetration-test/ Last updated: 2026-11-08 Most security questionnaires ask one question about penetration testing: "Is the application tested?" Almost every vendor answers yes. The answer only has value when you can see who tested, when, what was in scope, and whether the findings were fixed. This guide explains how to read that evidence for a whistleblowing channel. It does not replace your security questionnaire. It covers the points where a whistleblowing tool differs from other business software. ![A letter of attestation with five numbered parts. 1. Who tested: a named testing company, because a third party without a name cannot be verified. 2. When: the test window or date, within the last 12 months. 3. What was in scope: the application you will use, not only the website or the host. 4. How: a known method, such as the OWASP Web Security Testing Guide. 5. Were the findings fixed: a retest by the same company confirms the fixes. If one is missing, record it as an open item in your vendor assessment.](https://ethicsportal.eu/images/whistleblowing-software-penetration-test/en.svg) The five checks in this guide. [Open full size](https://ethicsportal.eu/images/whistleblowing-software-penetration-test/en.svg) ## Ask for the letter of attestation Vendors rarely share the full test report. It describes weaknesses in detail, and it is usually confidential. The normal document for customers is a **letter of attestation**: a signed statement from the testing company that the test happened and that the findings were handled. A useful letter, or the summary a vendor publishes, answers five questions: 1. **Who tested?** A named company. "An independent auditor" or "a third party" without a name cannot be verified. 2. **When?** The test window or the date of the letter. Most security questionnaires expect a test in the last 12 months. 3. **What was in scope?** The letter must name the application you will use. A test of the marketing website, or of the hosting provider's network, says nothing about the whistleblowing channel. 4. **How was it tested?** A recognised method, such as the OWASP Web Security Testing Guide. Testing with access to the source code (white-box) finds more than testing from outside only. 5. **Were the findings fixed?** A list of findings proves little. A retest by the same company proves that the fixes work. If a vendor says "we test regularly" but cannot name the tester or the date, record it as no evidence. ## The whistleblowing risks the test must cover A general web application test checks for common weaknesses. A whistleblowing channel has some risks that a tester only finds if they test for them. Ask the vendor whether the scope included these: - **Access between customers.** On a shared platform, a user of one organisation must never open another organisation's reports. This needs testing with accounts in two organisations. - **Access between roles.** A read-only role must not act on a case. A case handler must not open cases that are not assigned to them. This needs testing at each role, with accounts at each level. - **The reporter's follow-up access.** Reporters usually return with a case number and a password. Ask how the test checked guessing of passwords and case numbers, and the limits on failed attempts. - **Uploaded files.** Photos and documents carry hidden data: GPS position, device, the author's name. Ask whether the test checked that this data is removed, and that it cannot be restored from the stored file. - **Single sign-on.** If handlers sign in through your identity provider, ask whether the sign-in flow and automatic account creation were in scope. A test that covered only the login page and the network does not answer these questions. ## Four checks you can run during a trial Some evidence you can collect yourself in less than an hour. Use test data only. **1. File metadata.** Take a phone photo with location services on. Submit it as a reporter. Download it as a case handler and open it in a local metadata viewer such as [ExifTool](https://exiftool.org/). Location, device model and date should be gone. Repeat with a PDF exported from Word: the author's name should be gone. Do not use an online viewer for this check. It uploads the file to another company. **2. Third-party scripts on the reporting form.** Open the reporting form in your browser, open the developer tools (F12), and select the Network tab. Reload the page. Every request to another company's domain, for example analytics, chat widgets or fonts, can record the reporter's IP address and browser. **3. Notification emails.** Submit a test report and read the email the case handler receives. It should say that a new report exists. It should not contain the report text or anything that identifies the reporter. Email systems keep copies. **4. Failed sign-in attempts.** Open the reporter's follow-up page and enter a wrong password fifteen times. The system should block further attempts for some minutes. If it accepts unlimited attempts, a short password can be guessed. ## Warning signs - The vendor shows the hosting provider's certificate or test as its own. - The test date is older than 12 months, and no new test is planned. - The scope does not name the application. - The vendor refuses to share even a letter of attestation. - Findings are listed, but there is no retest. None of these proves that the software is insecure. Each one means that you have a claim without evidence. Record it as an open point in your vendor assessment. ## EthicsPortal's evidence EthicsPortal publishes the summary of its independent penetration test on the [Trust page](https://ethicsportal.eu/trust/#certification-status), with the tester, test window, method and remediation. The letter of attestation is available on request. Our own testing is recorded separately on [Self-conducted security testing](https://ethicsportal.eu/security-testing/). --- # Eight questions for your whistleblowing vendor, taken from enforcement cases > Regulators and courts have already ruled on how whistleblowing channels fail. Each decision below becomes one procurement question, with the primary source linked. Canonical: https://ethicsportal.eu/blog/whistleblowing-vendor-questions-from-enforcement-cases/ Last updated: 2026-09-30 Most vendor questionnaires ask whether reports are encrypted. The decisions below show that encryption is rarely where confidentiality breaks. In each case the reporter was exposed by something around the whistleblowing channel: a firewall, a hosting contract, a forwarded email, a security team acting on instructions. Each question below comes from a published decision by a regulator or court. The full set of cases, with fines and primary sources, is kept in the [whistleblowing failures register](https://whistleblowertools.eu/guide/whistleblowing-failures-register/). ## 1. Does anything in the request path record who connected? **The case:** In April 2022 Italy's data protection authority fined the Azienda Ospedaliera di Perugia €40,000. The hospital's whistleblowing app was reached through its firewall, and the firewall logged the IP address and username of every connection. The logs were kept until the file reached 150 GB. Anyone with access could see who had opened the channel. ([Garante order](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9768363)) **Ask the vendor:** Which layers between the reporter's browser and your application (CDN, load balancer, reverse proxy, web server, application logs, error tracking) record IP addresses or user agents on the reporter-facing pages? For how long? **Ask yourself:** Is the online reporting form reachable only through your corporate network or VPN? If so, your own firewall and proxy logs are part of the channel, whatever the vendor does. ## 2. Who hosts the data, and did we authorise them in writing? **The case:** The same decision fined the hospital's vendor, ISWEB S.p.A., €40,000. ISWEB had moved hosting to a third party without the hospital's written authorisation and without a data processing agreement. The hospital did not know where its whistleblowing data was. ([Garante order](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9768387)) **Ask the vendor:** Send the complete sub-processor list for the whistleblowing service, including hosting, email delivery, backups and support tooling. Does the contract require our prior written authorisation before a sub-processor is added or replaced? ## 3. Do you offer email as a whistleblowing channel? **The case:** In October 2025 the Italian data protection authority stated that email, ordinary or certified, is "in itself inadequate" to protect a reporter's identity, because mail systems keep transmission logs that can identify the sender. ([Garante opinion](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/10184673)) **Ask the vendor:** Is email offered as an intake route? Do notifications to handlers contain report content or anything that identifies the reporter? ## 4. Can a named report leak when the case file is shared? **The case:** Anthony Menendez reported accounting concerns to Halliburton under his own name, from his work email. When the SEC opened an inquiry, the general counsel emailed colleagues to preserve documents because "the SEC has opened an inquiry into the allegations of Mr. Menendez." His manager forwarded it to fifteen people in his team. In 2014 the US Court of Appeals for the Fifth Circuit upheld the finding that this disclosure was unlawful retaliation. ([Fifth Circuit opinion](https://www.ca5.uscourts.gov/Opinions/pub/13/13-60323-CV0.pdf)) **Ask the vendor:** Can handlers work a case without seeing the reporter's identity? Is identity held separately from the case content, and visible only to named roles? ## 5. Can a senior executive see or influence who reported? **The case:** In 2016 Barclays CEO Jes Staley told the bank's security team to identify the author of an anonymous letter. The whistleblowing team objected, and he told security to carry on. UK regulators fined him £642,430 in 2018, and New York's financial regulator fined Barclays $15 million. ([FCA final notice](https://www.fca.org.uk/publication/final-notices/mr-james-edward-staley-2018.pdf), [NYDFS](https://www.dfs.ny.gov/reports_and_publications/press_releases/pr1812181)) **Ask the vendor:** Can access to a case be restricted so that a person named in a report, however senior, cannot see it? Can an administrator grant themselves access to a case without leaving a record? ## 6. Is every access to a report logged, and can we read that log? **Why it matters:** Regulators needed almost two years, from the June 2016 letters to the May 2018 final notices, to establish what happened at Barclays. When an organisation needs to show who accessed a report, and when, the only reliable evidence is a log that the people it records cannot edit. **Ask the vendor:** Is every view, download and export of a case recorded with who and when? Can a case handler edit or delete those records? ## 7. Are former handlers' accounts removed? **The case:** The Perugia decision also found that a department head's credentials stayed active for two months after they resigned in May 2019. ([Garante order](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9768363)) **Ask the vendor:** Can handler access be tied to our identity provider (SSO, SCIM) so that it ends when someone leaves? If not, who is responsible for removing it, and how would we notice a stale account? ## 8. Has the vendor documented the processing for a DPIA? **The case:** The Perugia hospital had carried out no data protection impact assessment and had not given staff a privacy notice for the whistleblowing channel. Both were separate findings in the fine. ([Garante order](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9768363)) **Ask the vendor:** Do you supply a DPIA template or the technical description we need to complete one? Is there a privacy notice for reporters we can publish? ## Using the list These questions do not replace a security questionnaire. They cover the specific ways whistleblowing channels have failed in published decisions, which general security questionnaires tend to miss. EthicsPortal publishes its own answers on the [security](https://ethicsportal.eu/security/#ip-addresses), [sub-processors](https://ethicsportal.eu/subprocessors/), [DPA](https://ethicsportal.eu/dpa/) and [DPIA](https://ethicsportal.eu/dpia/) pages. --- # Whistleblowing or grievance: key differences > A whistleblowing concern and an HR grievance follow different legal routes under EU Directive 2019/1937. This guide explains how a case handler tells them apart, the grey areas that trip people up, and why misclassifying a report is a compliance risk. Canonical: https://ethicsportal.eu/blog/whistleblowing-vs-grievance/ Last updated: 2026-10-27 Most reports that reach an internal channel are easy to categorise. Some are not. An employee says a manager is bullying them — but the bullying is aimed at covering up falsified safety records. A finance clerk complains about their workload — and mentions, in passing, invoices that do not add up. For the person receiving the report, the first decision is the most consequential one: **is this a whistleblowing concern, or an ordinary grievance?** The two follow different routes and carry different legal duties. Getting it wrong is not a filing error: under [EU Directive 2019/1937](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937), a whistleblowing report triggers obligations a grievance does not — statutory deadlines, strict confidentiality, and protection from retaliation. Fail to recognise the report for what it is, and you fail to meet them. This guide is written for the designated case handler who has to make that call. --- ## The core distinction A **grievance** is a personal complaint about the reporter's own employment — pay, workload, a manager, a missed promotion. The person wants redress *for themselves*. A **whistleblowing concern** is information about wrongdoing that affects *others* — fraud, safety risks, environmental breaches, data-protection failures, corruption. The person is acting as a **witness**, not a claimant. They want the wrongdoing stopped. | Grievance | Whistleblowing concern | |---|---| | A personal concern | Others or the public interest are affected | | Seeks redress for the individual | The reporter is a witness to wrongdoing | | Open, transparent process | Information-sharing may be limited to protect confidentiality | | Investigation establishes the facts | May begin from suspicion alone | | Full feedback to the individual | Feedback as far as confidentiality allows | | Internal appeal usually available | External reporting routes (a regulator) also available | The shorthand: **a grievance is "this happened to me"; a whistleblowing concern is "this is happening, and it's wrong."** --- ## Why the classification matters legally The Directive attaches a specific set of obligations to a whistleblowing report that do not apply to a grievance: - **Deadlines.** You must acknowledge a whistleblowing report within **seven days** and provide feedback within **three months** ([Article 9](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937)). A grievance follows your ordinary HR timetable. - **Confidentiality.** The reporter's identity must be kept confidential and may not be disclosed without their consent, except where EU or national law requires it ([Article 16](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937)). A standard grievance process is usually open. For how that plays out in practice, see [anonymous vs confidential reporting](https://ethicsportal.eu/blog/anonymous-vs-confidential-reporting/). - **Anti-retaliation.** A whistleblower is protected against dismissal, demotion, and other detriment ([Article 19](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937)); and if they suffer a detriment after reporting, the burden falls on the employer to prove it was not retaliation ([Article 21(5)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937)). Handle the same facts as a routine grievance and those safeguards may never be triggered. This is why "we treated it as an HR matter" is not a safe default. If a report contains a genuine public-interest concern, handling it purely as a grievance can itself become the compliance failure. See [penalties by country](https://ethicsportal.eu/penalties/) for what that exposure looks like across the 27 member states. --- ## The grey areas The hard cases sit between the two categories. A few rules of thumb: - **Bullying or harassment that affects others.** A single personal complaint is a grievance. But widespread bullying, or misconduct by a senior person that puts customers, patients, or colleagues at risk, is often better handled as whistleblowing. - **A grievance with a concern buried inside it.** People frequently raise a public-interest concern only once it has affected them personally. Look past the personal framing to the underlying issue. - **When in doubt, treat it as whistleblowing.** The protections are stronger and the deadlines are tighter. It is safer to apply the higher standard and step down than to under-protect a reporter and discover later that you should not have. You do not have to resolve the ambiguity alone or instantly. Acknowledge the report, tell the reporter which process you intend to use, and explain that you may revisit that decision as the facts develop. --- ## What a good case handler does on intake Whichever route applies, the handling discipline is the same: 1. **Acknowledge promptly** and tell the reporter how you will treat the matter. 2. **Assume confidentiality.** Never reveal the reporter's identity without explicit consent; set out any legal limits in writing before you act on them. 3. **Do not ask the reporter to investigate.** Coming forward is hard enough; turning the reporter into your investigator increases their exposure. 4. **Separate the message from the messenger.** Whether the reporter has a personal axe to grind does not change whether the concern has substance. Act on the substance. 5. **Keep the reporter informed**, and deliver feedback within three months — even if you can only confirm that the matter was investigated and acted on. For the full operating procedure, our case handler manual — generated automatically for every EthicsPortal channel — walks designated handlers through intake, the triage decision above, confidentiality, escalation, and the statutory deadlines. --- ## How EthicsPortal helps you get the routing right A purpose-built whistleblowing channel makes the distinction operational rather than a judgment call made under pressure: - **Report categories** prompt the reporter to frame the issue, so a public-interest concern is less likely to arrive disguised as a personal complaint. - **Secure two-way messaging** lets you ask clarifying questions — even of an anonymous reporter — before you decide the route. - **Automatic deadline tracking** holds the 7-day and 3-month clocks the moment a report is treated as whistleblowing, so the classification decision is enforced, not just recorded. - **A documented policy and case handler manual** give your handlers a written basis for the call and an audit trail for the outcome. --- ## Deploy a channel that handles this correctly [EthicsPortal](https://secure.ethicsportal.eu/session/new) is whistleblower software for EU organisations: secure intake, confidentiality controls under Article 16, deadline tracking under Article 9, and audit-ready records under Article 18 — €41.67/month billed annually. Deploy the channel, designate a handler, and give the people who speak up a process that protects them from the first day. For the broader setup, see [how to deploy a whistleblowing channel](https://ethicsportal.eu/blog/how-to-implement-whistleblower-channel/) and our [free whistleblower policy template](https://ethicsportal.eu/blog/whistleblower-policy-template/). --- # Who must comply with the EU Whistleblower Directive? > Which companies need a whistleblowing channel under EU Directive 2019/1937? The 50-employee threshold, the regulated-sector entities it does not apply to, who counts as a worker, deadlines, and what "comply" actually means in practice. Canonical: https://ethicsportal.eu/blog/who-must-comply-eu-whistleblower-directive/ Last updated: 2026-11-07 Short answer: if your organization has 50 or more employees and operates in the EU, you almost certainly need a whistleblowing channel. If you are a regulated financial entity, you need one **at any size** --- five employees is enough --- because [the threshold does not apply to you](https://ethicsportal.eu/blog/who-must-comply-eu-whistleblower-directive/#who-is-covered-beyond-headcount). This is not optional. It is law in all 27 EU member states. Here is everything you need to know to determine whether you must comply, what compliance actually requires, and what happens if you do not. ![Flowchart of Article 8 of Directive (EU) 2019/1937. A public-sector entity needs a whistleblowing channel. A private entity covered by the EU acts on financial services, money laundering, transport safety or the environment in Annex Parts I.B and II needs one at any size. Any other private entity needs one from 50 workers. Below that the Directive does not require one, but a Member State may.](https://ethicsportal.eu/images/channel-obligation/en.svg) Source: Directive (EU) 2019/1937, Art. 8 and Art. 26. [Open full size](https://ethicsportal.eu/images/channel-obligation/en.svg) --- ## The threshold: 50 employees EU Directive 2019/1937, Article 8(3), establishes the obligation: - **250+ employees:** Member States had to bring their laws into force by December 17, 2021 ([Art. 26(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937)). - **50--249 employees:** for these, the channel obligation could wait until December 17, 2023 ([Art. 26(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937)). These are deadlines for national laws. Most Member States transposed late, so the date your own obligation began is set by [your national law](https://ethicsportal.eu/whistleblower-laws/). Every national law is now in force: with 50 or more employees in the EU, you should have a channel in place now. Fewer than 50 employees does not mean exempt. Article 8(4) removes the threshold outright for regulated financial entities, and several member states extend the obligation further --- see [who is covered beyond headcount](https://ethicsportal.eu/blog/who-must-comply-eu-whistleblower-directive/#who-is-covered-beyond-headcount) below. ### How employees are counted The Directive does not define "employee" narrowly. Member states count: - Full-time and part-time employees (part-time may be counted proportionally in some countries) - Fixed-term and temporary workers - In some member states: posted workers, trainees, and apprentices The count is based on your legal entity, not your group. If you are part of a corporate group, each entity with 50+ employees needs its own channel --- though entities of 50--249 employees may share resources for receiving and investigating reports (Art. 8(6)). --- ## Who is covered beyond headcount {#who-is-covered-beyond-headcount} Several categories of organizations must comply regardless of employee count: ### [Financial services](https://ethicsportal.eu/industries/financial-services/) (Art. 8(4)) All entities operating in financial services --- banks, investment firms, insurance companies, payment institutions, crypto-asset providers --- must have a whistleblowing channel irrespective of size. This applies even if you have 5 employees. The Directive defers to the sector-specific EU legislation listed in Part I.B and Part II of the Annex. ### [Public sector](https://ethicsportal.eu/industries/public-sector/) (Art. 8(9)) Every public-sector legal entity must have a whistleblowing channel, including entities it owns or controls. A Member State may exempt municipalities with fewer than 10,000 inhabitants or fewer than 50 workers, and other public entities with fewer than 50 workers. Whether those exemptions apply depends on your national law. ### National extensions Some member states go beyond the Directive's minimum: - **[Italy](https://ethicsportal.eu/whistleblower-laws/italy/):** Organizations with a "Model 231" compliance program must comply regardless of size. [Source: Norton Rose Fulbright](https://www.nortonrosefulbright.com/en-it/knowledge/publications/5ff4d59b/whistleblowing-i-nuovi-obblighi-per-le-imprese) - **[Belgium](https://ethicsportal.eu/whistleblower-laws/belgium/):** Companies with 250+ employees must accept anonymous reports (stricter than the Directive's baseline). [Source: Act of 28 November 2022, art. 8 §2](https://www.ejustice.just.fgov.be/eli/loi/2022/11/28/2022042980/justel) - **[France](https://ethicsportal.eu/whistleblower-laws/france/):** The [Loi Waserman (2022-401)](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000045388745) transposing the Directive removed the requirement to use internal channels before going to external authorities --- reporters can now choose either path. [Sapin II's](https://www.legifrance.gouv.fr/loda/id/JORFTEXT000033558528) broader anti-corruption compliance obligations (separate from the whistleblowing channel) still apply to companies with 500+ employees and €100M+ revenue. **See EthicsPortal in a live demo** A short online call: you see the whistleblowing channel your workers would use and the case handling behind it, and get answers to your questions. - [Book a demo](https://calendar.zoho.com/zc/view/slot-booking/zz08011220cdfa69864e9cefc2ca0e49dffa95e504c0265f6717484ebe19cbe7f6f38d5c7a) - [Deploy](https://secure.ethicsportal.eu/session/new?intent=start) - or email yaro@ethicsportal.eu --- ## Who can report The Directive protects a broad category of "reporting persons" --- not just employees. Under Article 4, the following people are protected when they report through your channel: - **Workers** (employees, civil servants, interns, trainees) - **Self-employed persons** (contractors, freelancers) - **Shareholders and board members** - **Volunteers** - **Suppliers and their workers** (anyone in your supply chain) - **Job applicants** (people who learned of wrongdoing during the recruitment process) - **Former workers** (people who learned of wrongdoing during a previous employment) Your whistleblowing channel must be accessible to all of these groups, not just current employees. --- ## What compliance actually requires Having a channel means meeting the requirements in Articles 8, 9, and 16 of the Directive. Here is the minimum: ### 1. A secure internal reporting channel (Art. 8) An internal channel that allows reporting in writing (and optionally orally). It must: - Be accessible to all persons covered by the Directive (employees, contractors, suppliers, etc.) - Protect the confidentiality of the reporter's identity - Not require the reporter to identify themselves (anonymous reporting is permitted in most member states) ### 2. A documented procedure (Art. 9) The channel must follow a defined procedure: | Requirement | Deadline | Article | |---|---|---| | Acknowledge receipt of the report | Within 7 days | Art. 9(1)(b) | | Assign an impartial person or department to handle it | Upon receipt | Art. 9(1)(a) | | Follow up diligently | Ongoing | Art. 9(1)(c) | | Provide feedback to the reporter | Within 3 months | Art. 9(1)(f) | | Inform the reporter of external reporting options | At submission | Art. 9(1)(g) | ### 3. Confidentiality protections (Art. 16) The reporter's identity must not be disclosed to anyone beyond the staff handling the report, without the reporter's explicit consent. This means: - Access controls: only authorized handlers see reports - No IP logging or tracking that could identify anonymous reporters - Data encrypted at rest ### 4. Record-keeping (Art. 18) Reports must be stored securely and retained in compliance with national law. You need an audit trail that can demonstrate compliance to regulators. ### 5. Anti-retaliation measures (Art. 19--21) You must not retaliate against reporters. This includes dismissal, demotion, withholding promotion, changing duties, or any other form of disadvantage. Reporters must be informed of this protection. --- ## What does NOT count as compliance Some things organizations try that do not meet the Directive's requirements: - **A generic email address** (e.g., compliance@company.com). This does not protect confidentiality, does not track deadlines, and does not create an audit trail. - **An anonymous suggestion box.** No two-way communication, no acknowledgment, no feedback mechanism. - **A page in the employee handbook.** The channel must be operational, not just documented. - **A third-party hotline with no case management.** If reports come in by phone but are not tracked through a system with deadlines and audit trails, you are not compliant with Art. 9. --- ## What happens if you do not comply Every member state has defined penalties. They vary widely: | Country | No whistleblowing channel | Retaliation | Criminal liability | Law | | --- | --- | --- | --- | --- | | [Spain](https://ethicsportal.eu/whistleblower-laws/spain/) | Up to €1,000,000 | Up to €1,000,000 | No | [Ley 2/2023](https://www.boe.es/buscar/act.php?id=BOE-A-2023-4513) | | [Poland](https://ethicsportal.eu/whistleblower-laws/poland/) | Fine up to PLN 5,000 (~€1,200), imposed by a court | Obstruction: fine, restriction of liberty or up to 1 year prison (3 with violence/threats). Retaliation: up to 2 years (3 if persistent) | Yes | [Ustawa z dnia 14 czerwca 2024](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20240000928) | | [Italy](https://ethicsportal.eu/whistleblower-laws/italy/) | €10,000--€50,000 | €10,000--€50,000 | No | [D.Lgs. 24/2023](https://www.gazzettaufficiale.it/eli/id/2023/03/15/23G00032/sg) | | [Germany](https://ethicsportal.eu/whistleblower-laws/germany/) | Up to €20,000 | Up to €50,000 (×10 for legal entities, up to €500,000) | No | [HinSchG](https://www.gesetze-im-internet.de/hinschg/) | | [Belgium](https://ethicsportal.eu/whistleblower-laws/belgium/) | Companies: criminal fine €24,000–€576,000 or administrative fine €2,400–€28,000, both +25% surcharge | Obstruction, retaliation or breach of confidentiality: 6 months–3 years prison and/or fine €4,800–€48,000 | Yes | [Loi du 28 novembre 2022](https://www.ejustice.just.fgov.be/eli/loi/2022/11/28/2022042980/justel) | Enforcement is not theoretical. In March 2025, the [EU Court of Justice fined five member states a combined €38.9 million](https://curia.europa.eu/site/upload/docs/application/pdf/2025-03/cp250029en.pdf) for being late to transpose the Directive. National enforcement authorities are now operational in most countries and actively issuing fines. See our full [penalties by country](https://ethicsportal.eu/penalties/) page for all 27 member states. --- ## The fastest path to compliance If your organization has 50+ employees, the deadline has passed. Here is how to get compliant: 1. **Deploy a whistleblowing channel.** [EthicsPortal](https://secure.ethicsportal.eu/session/new) provides whistleblowing channel configuration, secure intake, deadline tracking, and audit exports at €41.67/month billed annually. 2. **Designate a handler.** Assign at least one impartial person to receive and investigate reports. 3. **Inform employees.** Share the whistleblowing channel URL and QR code via posters, onboarding materials, and internal communications. 4. **Document your procedure.** Adopt an internal whistleblower protection policy that describes the process, deadlines, and anti-retaliation protections. The technical channel can be deployed quickly. The organizational steps — handler designation, policy, training, and internal communication — take longer but are straightforward. For an article-by-article breakdown of how EthicsPortal meets the Directive's requirements, see our [Directive 2019/1937 coverage map](https://ethicsportal.eu/directive-coverage/). --- # CAIQ-aligned vendor security questionnaire > Pre-filled answers to common vendor-security-assessment questions, structured against the CSA CAIQ v4 domain taxonomy. EthicsPortal's positions on the questions procurement teams most often ask. Canonical: https://ethicsportal.eu/caiq/ Last updated: 2026-11-11 EthicsPortal publishes pre-filled answers to the questions procurement teams most often ask. The questionnaire is organized by the Cloud Security Alliance's [CAIQ v4](https://cloudsecurityalliance.org/research/cloud-controls-matrix/) domain taxonomy --- the framework most EU enterprise procurement teams use --- so an evaluator can place each answer in the domain their own assessment template expects. Where a CCM v4 control statement covers a question, the control is cited alongside it. This is a vendor-authored answer set, not an attestation by the CSA. The substance is what an external auditor would evaluate; the structure makes it easy to compare against vendors who have been audited. A downloadable CSV is published at **[caiq-ethicsportal.csv](https://ethicsportal.eu/caiq-ethicsportal.csv)** for ingestion into procurement tools. Last updated: 2026-10-18. --- ## How to read this page | Field | Meaning | |---|---| | ID | An EthicsPortal row identifier, stable across revisions. The code before the number is the CAIQ v4 domain; the number is our own sequence within that domain and is **not** a CCM v4 control number | | Related CCM v4 | The CCM v4 control whose published control statement covers this question, where one does. This is a cross-reference, not a control-level compliance claim: a row answers only the question stated, not the whole control. Blank where no v4 control statement directly covers the question. Some rows map to a control in a different domain, and more than one row may map to the same control | | Question | EthicsPortal's restatement of the question in the CAIQ domain | | Answer | **Yes**, **No**, **Partially**, or **N/A**, with qualifiers where the substance is more useful than a binary --- for example **No (in treatment)** when a control is on the operator's roadmap, **Yes (inherited)** when a sub-processor's certification carries the control, **Yes (negative)** when the affirmative answer to a "does the Service do X?" question is "no, by design", or a specific value (24 hours, 99.5% monthly, Nuremberg) where one applies | | Evidence | Link to the page or document that contains the substantive answer | Retired rows: `EP-AIS-03` and `EP-AIS-04` were withdrawn on 2026-10-06 as duplicates of `EP-CEK-01` and `EP-CEK-02`, which answer encryption at rest and in transit. Row IDs are never reused. Where a question's answer is operationally sensitive (privileged-access mechanics, incident-response escalation contacts, infrastructure detail beyond what is on [/security/](https://ethicsportal.eu/security/)), the answer here is **Available under NDA** and is shared during procurement review. This mirrors the posture published on [/trust/](https://ethicsportal.eu/trust/#available-during-procurement-review). --- ## A&A --- Audit & Assurance | ID | Related CCM v4 | Question | Answer | Evidence | |---|---|---|---|---| | EP-A&A-01 | A&A-02 | Are independent audit or assurance assessments performed on the Service? | Partially | An independent penetration test by Spektr Security LLC, 26–30 October 2026; summary on [/trust/](https://ethicsportal.eu/trust/#certification-status). No independent audit or certification of the management system is on record. The [ISO 27001 self-assessment](https://ethicsportal.eu/iso-27001/) and [first-party security testing](https://ethicsportal.eu/security-testing/) are published and are not independent | | EP-A&A-02 | | Are audit reports available to customers? | Yes | The penetration test's scope, dates and remediation summary are published on [/trust/](https://ethicsportal.eu/trust/#certification-status); the assessor's letter of attestation is available on request | | EP-A&A-03 | A&A-05 | Does the organization conduct internal information security reviews? | Yes | Annual internal audit against ISO/IEC 27001:2022 with every finding published at [Internal audit record](https://ethicsportal.eu/policies/internal-audit/); outcomes reviewed and decided at [Management review record](https://ethicsportal.eu/policies/management-review/). The [ISO 27001 self-assessment](https://ethicsportal.eu/iso-27001/) is the audited artifact; security testing passes with findings and remediation are at [Self-conducted security testing](https://ethicsportal.eu/security-testing/). Self-performed --- a single-operator organization cannot produce an impartial internal audit, and both pages say so | | EP-A&A-04 | | Are compliance certifications listed publicly? | Yes | Certification status disclosed on [/trust/](https://ethicsportal.eu/trust/#certification-status) (none currently held; structured self-assessment in place) | --- ## AIS --- Application & Interface Security | ID | Related CCM v4 | Question | Answer | Evidence | |---|---|---|---|---| | EP-AIS-01 | AIS-05 | Is application security testing performed? | Yes | Brakeman, bundler-audit, importmap audit on every change ([Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle)) | | EP-AIS-02 | AIS-04 | Is input validation enforced on all external inputs? | Yes | Rails framework defaults (strong parameters, output escaping); application-level checks at every controller boundary ([Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle)) | | EP-AIS-05 | AIS-02 | Is the application protected against OWASP Top 10 risks? | Yes | Framework-level defenses (parameterized queries, CSRF, output escaping, strong parameters, encrypted attributes); static analysis ([Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle)) | --- ## BCR --- Business Continuity & Operational Resilience | ID | Related CCM v4 | Question | Answer | Evidence | |---|---|---|---|---| | EP-BCR-01 | BCR-04 | Is a documented business continuity plan in place? | Yes | [Business continuity plan](https://ethicsportal.eu/policies/business-continuity/) | | EP-BCR-02 | BCR-08 | Are backups encrypted? | Partial | Daily database dumps are encrypted with GnuPG AES-256 on the host before upload, and the monthly restore drill decrypts one and reads an encrypted column back. The 7-day server snapshots are not encrypted by EthicsPortal; application-encrypted fields remain encrypted in both ([Security#backups-and-restore](https://ethicsportal.eu/security/#backups-and-restore)) | | EP-BCR-03 | BCR-08 | Are backup restores tested? | Yes | Monthly database restore into a scratch environment. The drill does not demonstrate end-to-end RTO; last date is on [Security#backups-and-restore](https://ethicsportal.eu/security/#backups-and-restore) | | EP-BCR-04 | BCR-03 | What is the recovery point objective (RPO)? | 24 hours | [SLA#recovery-objectives](https://ethicsportal.eu/sla/#recovery-objectives) | | EP-BCR-05 | BCR-03 | What is the recovery time objective (RTO)? | 4 hours | [SLA#recovery-objectives](https://ethicsportal.eu/sla/#recovery-objectives) | | EP-BCR-06 | | Is an availability target published? | Yes | 99.5% monthly for covered surfaces ([SLA](https://ethicsportal.eu/sla/)) | | EP-BCR-07 | BCR-11 | Is geographic redundancy in place across providers? | No | Backups are stored separately from compute within Hetzner; cross-provider redundancy not in place. Trade-off stated in [Risk register R-02](https://ethicsportal.eu/policies/risk-register/) | --- ## CCC --- Change Control & Configuration Management | ID | Related CCM v4 | Question | Answer | Evidence | |---|---|---|---|---| | EP-CCC-01 | CCC-01, CCC-02 | Are changes managed through a documented process? | Yes | [Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle) --- every change is checked against a written pre-deploy checklist, and the automated suite plus static analysis block the deploy on failure | | EP-CCC-02 | CCC-04 | Is infrastructure managed as code? | Yes | Kamal deployment configuration version-controlled; no out-of-band production changes | | EP-CCC-03 | IVS-05 | Are production and non-production environments separated? | Yes | Production is isolated; non-production environments use synthetic fixtures only ([Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle)) | | EP-CCC-04 | TVM-03 | Is there a documented vulnerability response timeline? | Yes | Critical 7 days, high 30 days, medium 90 days ([Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle)) | --- ## CEK --- Cryptography, Encryption & Key Management | ID | Related CCM v4 | Question | Answer | Evidence | |---|---|---|---|---| | EP-CEK-01 | CEK-03 | Is data at rest encrypted? | Partial | Non-deterministic Rails ActiveRecord Encryption on defined report, identity and communication fields; daily database dumps encrypted with GnuPG AES-256 before upload; file attachments encrypted with AES-256 under a separate key per file. The server disk is not volume-encrypted, so database fields outside the encrypted set are stored unencrypted on the host ([Security#data-encryption](https://ethicsportal.eu/security/#data-encryption)) | | EP-CEK-02 | CEK-03 | Is data in transit encrypted? | Yes | HTTPS/TLS for all connections; unencrypted HTTP redirected ([Security#data-encryption](https://ethicsportal.eu/security/#data-encryption)) | | EP-CEK-03 | CEK-08 | Are customer-managed encryption keys (BYOK) supported? | No | Processor-managed keys support the current reporter--handler encryption design. Deletion follows the production and backup lifecycle stated in DPA §§6.8 and 6.11; no instantaneous deletion from every backup copy is claimed. | | EP-CEK-04 | IAM-15 | Are passwords stored using a one-way hash? | Yes | Reporter passwords generated by the system, bcrypt-hashed and non-recoverable; handler/admin authentication via magic-link plus TOTP, no plaintext password storage | | EP-CEK-05 | CEK-01 | Is encryption key management documented? | Partial | Application field-encryption keys are processor-managed. Account-specific key storage, rotation and supplier access evidence requires procurement review ([Security#data-encryption](https://ethicsportal.eu/security/#data-encryption)) | --- ## DCS --- Datacenter Security | ID | Related CCM v4 | Question | Answer | Evidence | |---|---|---|---|---| | EP-DCS-01 | DSP-19 | Where are data centers located? | Nuremberg, Germany (EU); file attachment backup copy in Falkenstein, Germany (EU) | [Security#infrastructure](https://ethicsportal.eu/security/#infrastructure) | | EP-DCS-02 | DCS-07, DCS-09 | Are data centers under recognized physical-security certification? | Yes (inherited) | Hetzner data centers under Hetzner's certification scope ([ISO 27001 control map A.7](https://ethicsportal.eu/iso-27001/#a7-physical-controls)) | | EP-DCS-03 | DSP-19 | Is data residency limited to the EU/EEA? | Yes for reporting-service data | Core application data, database, and file storage are in Germany. The public marketing site uses Cloudflare in a separate controller context disclosed in the [Privacy Notice](https://ethicsportal.eu/privacy/); it is not part of the whistleblowing channel or the customer DPA processing chain. | --- ## DSP --- Data Security & Privacy | ID | Related CCM v4 | Question | Answer | Evidence | |---|---|---|---|---| | EP-DSP-01 | | Is a Data Processing Agreement (DPA) available? | Yes | [DPA](https://ethicsportal.eu/dpa/); signed countersigned copy on request to [legal@ethicsportal.eu](mailto:legal@ethicsportal.eu) | | EP-DSP-02 | GRC-07 | Is the Service GDPR-compliant? | Yes | Processor under GDPR Art. 28; full coverage on [/directive-coverage/](https://ethicsportal.eu/directive-coverage/) and [/dpa/](https://ethicsportal.eu/dpa/) | | EP-DSP-03 | DSP-14 | Are sub-processors publicly disclosed? | Yes | [Subprocessors](https://ethicsportal.eu/subprocessors/) page lists each, with jurisdiction, purpose, and data categories | | EP-DSP-04 | DSP-16 | How long is personal data retained? | Customer-configurable | 12, 24, 36, 48, or 60 months after report closure, with automatic deletion ([Security#audit-and-compliance](https://ethicsportal.eu/security/#audit-and-compliance)) | | EP-DSP-05 | DSP-11, DSP-16 | Is personal data deleted on customer instruction? | Yes | After the Service ends, personal data is returned or deleted at the Controller's choice; production deletion and backup expiry follow the documented lifecycle ([DPA §6.8](https://ethicsportal.eu/dpa/)) | | EP-DSP-06 | DSP-12 | Is personal data minimization practiced? | Yes | Only essential fields are collected; reporter name and contact are optional. [Art. 5(1)(c)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) GDPR ([Coverage map §7](https://ethicsportal.eu/directive-coverage/#7-gdpr-compliance)) | | EP-DSP-07 | DSP-10, DSP-13 | Is PII transmitted to any third party for processing? | Only to disclosed sub-processors | [Subprocessors](https://ethicsportal.eu/subprocessors/) lists every recipient with the data category. No LLM or AI service is a sub-processor ([DPA §6.10](https://ethicsportal.eu/dpa/)) | | EP-DSP-08 | DSP-11 | Are data subjects' rights supported? | Yes | Access, rectification, erasure, restriction, portability, objection ([DPA §6.5](https://ethicsportal.eu/dpa/)) | --- ## GRC --- Governance, Risk & Compliance | ID | Related CCM v4 | Question | Answer | Evidence | |---|---|---|---|---| | EP-GRC-01 | GRC-01, GRC-05 | Is there a published information security policy? | Yes | [Information security policy](https://ethicsportal.eu/policies/information-security/) | | EP-GRC-02 | GRC-02 | Is there a documented risk register? | Yes | [Risk register](https://ethicsportal.eu/policies/risk-register/) | | EP-GRC-03 | GRC-02 | Is risk assessed periodically? | Yes | Annually and on material change ([Risk register §Review-cadence](https://ethicsportal.eu/policies/risk-register/)) | | EP-GRC-04 | GRC-06 | Who owns information security at the organization? | Operator (named individual) | [IS policy §4](https://ethicsportal.eu/policies/information-security/), [Trust#contracting-party](https://ethicsportal.eu/trust/#contracting-party) | | EP-GRC-05 | GRC-07 | Is regulatory compliance tracked? | Yes | GDPR, Directive 2019/1937, EAA / EN 301 549 ([Directive coverage map](https://ethicsportal.eu/directive-coverage/), [Directive interpretations](https://ethicsportal.eu/directive-interpretations/), [Accessibility](https://ethicsportal.eu/accessibility/)) | --- ## HRS --- Human Resources Security EthicsPortal has no employees or contractors. Personnel controls below are answered **N/A** with the compensating arrangements --- privileged-access summary available during procurement review, operator self-directed security awareness via subscribed feeds --- documented on [/trust/](https://ethicsportal.eu/trust/#continuity-and-personnel) and in [ISO 27001 control map A.6](https://ethicsportal.eu/iso-27001/#a6-people-controls). | ID | Related CCM v4 | Question | Answer | Evidence | |---|---|---|---|---| | EP-HRS-01 | HRS-01 | Are background checks performed on personnel with access to customer data? | N/A | No employees. Operator screening is verifiable through published registry information ([Trust#contracting-party](https://ethicsportal.eu/trust/#contracting-party)) | | EP-HRS-02 | HRS-11 | Is security awareness training provided to personnel? | N/A | No employees. Operator self-directed via Rails security mailing list, CVE feeds, advisory subscriptions | | EP-HRS-03 | HRS-10 | Are confidentiality agreements in place for personnel? | N/A | No employees. Customer-side confidentiality is in [DPA §6.2](https://ethicsportal.eu/dpa/) | | EP-HRS-04 | HRS-05, IAM-07 | Is there a documented offboarding procedure for personnel with system access? | N/A | No employees. Customer offboarding is governed by [DPA §6.8](https://ethicsportal.eu/dpa/) | --- ## IAM --- Identity & Access Management | ID | Related CCM v4 | Question | Answer | Evidence | |---|---|---|---|---| | EP-IAM-01 | IAM-14 | Is multi-factor authentication available for customer accounts? | Yes | TOTP-based 2FA for handler/admin accounts; reporters have no account and sign in with a Case ID and a password generated by the system, stored as a bcrypt hash ([Security#access-control](https://ethicsportal.eu/security/#access-control)) | | EP-IAM-02 | IAM-09, IAM-14 | Is multi-factor authentication enforced on operator accounts with production access? | Yes | Hardware-key 2FA on all operator accounts with production access ([ISO 27001 A.8.2](https://ethicsportal.eu/iso-27001/#a8-technological-controls)) | | EP-IAM-03 | IAM-05, IAM-16 | Is role-based access control enforced? | Yes | Pundit policies enforced at every controller action; least-privilege defaults ([Security#access-control](https://ethicsportal.eu/security/#access-control)) | | EP-IAM-04 | IAM-08 | Are access rights reviewed periodically? | Yes | Member-deactivation lifecycle and audit-log review ([Security#member-access-and-offboarding](https://ethicsportal.eu/security/#member-access-and-offboarding)) | | EP-IAM-05 | IAM-01 | Is session management documented? | Yes | 14-day idle timeout; nightly sweep; per-session revocation ([Security#session-lifecycle](https://ethicsportal.eu/security/#session-lifecycle)) | | EP-IAM-06 | IAM-15 | Are passwords stored in plaintext? | No | Bcrypt for reporter passwords; magic-link primary for handlers ([Security#access-control](https://ethicsportal.eu/security/#access-control)) | --- ## IPY --- Interoperability & Portability | ID | Related CCM v4 | Question | Answer | Evidence | |---|---|---|---|---| | EP-IPY-01 | IPY-02, IPY-04 | Can customers export their data? | Yes | Self-service PDF case export and self-service machine-readable export of the full organization data set (ZIP of JSON files and attachments), both in-product ([DPA §6.8](https://ethicsportal.eu/dpa/)) | | EP-IPY-02 | IPY-04 | Are open data formats used for export? | Yes | PDF for case exports; JSON with the original attachments for the full data export | | EP-IPY-03 | IPY-02 | Is API access available for portability? | Partial | The metadata API is available to every organisation and excludes report content. Full content portability uses the self-service PDF and full data exports; see [Developers](https://ethicsportal.eu/developers/) | --- ## IVS --- Infrastructure & Virtualization Security | ID | Related CCM v4 | Question | Answer | Evidence | |---|---|---|---|---| | EP-IVS-01 | IVS-06 | Is the Service multi-tenant? | Yes | Multi-tenant at the application layer; isolation enforced by Pundit policies and per-organization scoping at every controller action ([Security#access-control](https://ethicsportal.eu/security/#access-control)) | | EP-IVS-02 | IVS-03, IVS-06 | Is network segmentation in place? | Yes | Production isolated from operator workstation by network boundary; non-production environments hold no production personal data ([Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle)) | | EP-IVS-03 | TVM-02 | Is malware protection in place for uploaded content? | Yes | ClamAV virus scanning on all uploads before delivery ([Security#virus-scanning](https://ethicsportal.eu/security/#virus-scanning)) | --- ## LOG --- Logging and Monitoring | ID | Related CCM v4 | Question | Answer | Evidence | |---|---|---|---|---| | EP-LOG-01 | LOG-07, LOG-08 | Are user actions logged? | Yes | Append-only audit trail with timestamp, actor, and action type ([Security#audit-and-compliance](https://ethicsportal.eu/security/#audit-and-compliance)) | | EP-LOG-02 | IAM-12, LOG-09 | Are logs tamper-evident? | Partially | PostgreSQL triggers reject changes to core audit content and table truncation, and application users cannot edit or selectively delete individual entries. The trail is not hash-chained or WORM-backed, so privileged database intervention remains a documented residual risk ([Risk register R-08](https://ethicsportal.eu/policies/risk-register/#r-08-audit-log-integrity-compromise)) | | EP-LOG-03 | LOG-02 | How long are audit logs retained? | Customer-configurable | Matches case retention (12/24/36/48/60 months); included in PDF case exports for regulatory review | | EP-LOG-04 | LOG-03, LOG-05 | Is application monitoring in place? | Yes | AppSignal instruments the application with session-data transmission disabled and request parameters filtered to preserve reporter anonymity ([Subprocessors](https://ethicsportal.eu/subprocessors/)) | | EP-LOG-05 | LOG-06 | Are clocks synchronized? | Yes | NTP via host OS; all timestamps recorded in UTC | --- ## SEF --- Security Incident Management | ID | Related CCM v4 | Question | Answer | Evidence | |---|---|---|---|---| | EP-SEF-01 | SEF-03 | Is a documented incident response plan in place? | Yes | [Business continuity plan §3--5](https://ethicsportal.eu/policies/business-continuity/) and the [Incident register](https://ethicsportal.eu/incidents/) disclosure timeline | | EP-SEF-02 | SEF-07 | Are customers notified of personal data breaches? | Yes | Without undue delay after awareness ([DPA §6.6](https://ethicsportal.eu/dpa/)) | | EP-SEF-03 | | Is a public incident register maintained? | Yes | [Incident register](https://ethicsportal.eu/incidents/) | | EP-SEF-04 | SEF-02, SEF-07 | What is the timeline for incident disclosure? | Tiered | Affected controllers: without undue delay after awareness; preliminary register entry: 7d post-containment; final entry: 30d post-containment ([Incident register](https://ethicsportal.eu/incidents/)) | | EP-SEF-05 | | Is there a responsible-disclosure inbox? | Yes | [security@ethicsportal.eu](mailto:security@ethicsportal.eu) ([Security#responsible-disclosure](https://ethicsportal.eu/security/#responsible-disclosure)) | --- ## STA --- Supply Chain Management, Transparency & Accountability | ID | Related CCM v4 | Question | Answer | Evidence | |---|---|---|---|---| | EP-STA-01 | DSP-14, STA-07 | Is a sub-processor list published? | Yes | [Subprocessors](https://ethicsportal.eu/subprocessors/) with per-row data category, jurisdiction, purpose | | EP-STA-02 | DSP-14 | Are customers notified before sub-processors are added or replaced? | Yes | At least 30 days advance notice ([DPA §6.4](https://ethicsportal.eu/dpa/)) | | EP-STA-03 | STA-09 | Can customers object to a sub-processor change? | Yes | Right to terminate if no resolution is reached ([DPA §6.4](https://ethicsportal.eu/dpa/)) | | EP-STA-04 | DSP-13, STA-12 | Are sub-processors bound by data-protection agreements? | Yes | Written DPA in place with each sub-processor under GDPR Art. 28 | | EP-STA-05 | | Is AI or LLM processing of customer data disclosed? | Yes (negative) | No LLM, generative-AI, or AI-classifier service is engaged as a sub-processor or used to process report content ([DPA §6.10](https://ethicsportal.eu/dpa/), [Coverage map §5](https://ethicsportal.eu/directive-coverage/#5-confidentiality-of-identity-art-16)) | | EP-STA-06 | DSP-10, DSP-19 | Are international data transfers documented? | Yes | Standard Contractual Clauses + safeguards for the single named non-EU sub-processor ([Subprocessors](https://ethicsportal.eu/subprocessors/), [DPA §7](https://ethicsportal.eu/dpa/)) | --- ## TVM --- Threat & Vulnerability Management | ID | Related CCM v4 | Question | Answer | Evidence | |---|---|---|---|---| | EP-TVM-01 | TVM-05, TVM-07 | Are dependencies scanned for vulnerabilities? | Yes | Brakeman (Rails), bundler-audit (Ruby), importmap audit (JavaScript) on every change ([Security#dependency-and-patch-management](https://ethicsportal.eu/security/#dependency-and-patch-management)) | | EP-TVM-02 | TVM-01 | Is a vulnerability disclosure program in place? | Yes | [Responsible disclosure](https://ethicsportal.eu/security/#responsible-disclosure) with documented acknowledgement and remediation SLAs | | EP-TVM-03 | TVM-03, TVM-08 | What is the remediation SLA for vulnerabilities? | Tiered | Critical 7 days, high 30 days, medium 90 days ([Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle)) | | EP-TVM-04 | TVM-06 | Are penetration tests performed? | Yes | An independent penetration test by Spektr Security LLC, 26–30 October 2026: code audit and penetration test following the OWASP Web Security Testing Guide, plus a network exposure scan of the production host. 3 medium and 2 low issues, none high or critical; all fixed and confirmed by the assessor's retest ([Trust#certification-status](https://ethicsportal.eu/trust/#certification-status), [ISO 27001 A.5.35](https://ethicsportal.eu/iso-27001/#a5-organizational-controls)). Letter of attestation available on request | --- ## UEM --- Universal Endpoint Management | ID | Related CCM v4 | Question | Answer | Evidence | |---|---|---|---|---| | EP-UEM-01 | UEM-05 | Are operator endpoints hardened? | Yes | Operator workstation: full-disk encryption, screen-lock, OS auto-update, hardware-key 2FA on production-access accounts ([ISO 27001 A.8.1](https://ethicsportal.eu/iso-27001/#a8-technological-controls)) | | EP-UEM-02 | UEM-04 | Are mobile devices used for production access? | No | Production access is restricted to the operator's primary workstation | | EP-UEM-03 | HRS-03, UEM-06 | Is a clear-desk and clear-screen policy in place? | Self-assessed | Operator workstation has automatic screen-lock; clear-desk practice for any printed materials ([ISO 27001 A.7.7](https://ethicsportal.eu/iso-27001/#a7-physical-controls)) | --- ## Available under NDA during procurement review The following operational topics are not in this public questionnaire because they contain infrastructure and response detail that is more appropriate for controlled disclosure. They are shared on request during procurement review: - Privileged production-access mechanics (specific accounts, hardware-key type, escalation paths) - Incident-response escalation contacts and on-call rotation - Business-continuity contact tree - Internal vulnerability-response tracker contents - Restore-drill artefacts and timing detail beyond the date To request these materials, contact [support@ethicsportal.eu](mailto:support@ethicsportal.eu). --- ## Document control | Field | Value | |---|---| | Document title | EthicsPortal CAIQ-aligned vendor security questionnaire | | Structure | CSA CAIQ v4 domain taxonomy (Audit & Assurance through Universal Endpoint Management); row IDs are EthicsPortal's own, with CCM v4 controls cross-referenced per row where a control statement covers the question | | Version | 1.3 | | Effective date | 2026-05-21 | | Last reviewed | 2026-10-06 | | Next scheduled review | 2027-05-21 | | Owner | Yaroslav Shmarov, operator | | Machine-readable copy | [caiq-ethicsportal.csv](https://ethicsportal.eu/caiq-ethicsportal.csv) | --- # Careers > Open roles at EthicsPortal, the European standard for whistleblower compliance software under EU Directive 2019/1937. Canonical: https://ethicsportal.eu/careers/ Last updated: 2026-10-25 EU Directive 2019/1937 requires every organization with 50+ employees to operate a confidential whistleblowing channel. Most still do not. EthicsPortal is that channel, and we are building the team that puts it in front of the companies that need it. Open roles are listed below. ## Pages - [Business development representative](https://ethicsportal.eu/careers/business-development-representative/): Help companies across the EU deploy a compliant whistleblowing channel under Directive 2019/1937. Remote, results-based, co-selling with the founder. --- # Business development representative > Help companies across the EU deploy a compliant whistleblowing channel under Directive 2019/1937. Remote, results-based, co-selling with the founder. Canonical: https://ethicsportal.eu/careers/business-development-representative/ Last updated: 2026-09-30 - **Location:** Remote, within the EU - **Type:** Contract, part-time - **Compensation:** Base for an initial ramp period, plus uncapped, results-based commission EU Directive 2019/1937 requires every organization with 50+ employees to operate a confidential whistleblowing channel. Most still have none. EthicsPortal is that channel, built and operating. The job is to put it in front of the companies that are legally required to have it. ## What you would do - **Book meetings.** Reach compliance officers, HR and legal leads, and managing directors at in-scope companies by email, phone, and LinkedIn. We give you a list of real targets with verified contacts. This is the main work. - **Build partnerships.** Get compliance consultants, accountants, and law firms to offer EthicsPortal to their clients. One good partner brings many customers, so this is the highest-value work. - **Co-sell.** The founder joins every customer meeting for product and pricing and helps close. You lead in your local language. - **Report what you learn.** A clear "no" with its reason is worth as much as a "yes." We measure results, not hours. You decide where and when you work. ## What we are looking for - Fluent in your market's business language, plus working English. - Based in the EU market you would sell into. - Able to reach the right person, book the meeting, and lead the conversation. - Comfortable talking to owners and senior managers about a legal obligation. Sales experience is a plus, not a requirement. You do not need to be a finished closer on day one. We assess every applicant on the same job-related criteria and welcome applicants from any background. ## Compensation - Base during a short, paid initial period. - Activity payments for qualified meetings and a bounty per partner you activate. - Uncapped commission on every customer you bring in, paid as long as they stay. - We share the specific pay range before the first interview, and we never ask what you earned before. ## How to apply Email [careers@ethicsportal.eu](mailto:careers@ethicsportal.eu) with: - The market you would sell into. - How you would reach the first ten companies. - One thing you have sold that was hard to sell. A CV is welcome but not required. We process your application under our [privacy policy](https://ethicsportal.eu/privacy/) and keep it only as long as needed for this role. --- # Changelog > New features and improvements in EthicsPortal, the whistleblowing software for EU organisations. Each entry shows what changed and why it matters. Canonical: https://ethicsportal.eu/changelog/ Last updated: 2026-11-11 ## Pages - [Connect an AI assistant to EthicsPortal with MCP](https://ethicsportal.eu/changelog/connect-an-ai-assistant/): EthicsPortal has an MCP server. An AI assistant can check cases, configure your whistleblowing channel and invite members, without access to report content. - [API and webhooks for your whistleblowing channel](https://ethicsportal.eu/changelog/api-and-webhooks/): Connect EthicsPortal to your GRC, ticketing or reporting tools. The API gives report status and deadlines, and webhooks report changes. Report content never leaves EthicsPortal. - [Reports by email, without showing the reporter's address](https://ethicsportal.eu/changelog/reports-by-email/): Every whistleblowing channel has its own email address. An email becomes a case, and handlers never see the sender's address. - [Tagged PDF documents for screen readers](https://ethicsportal.eu/changelog/tagged-pdf-documents/): The compliance report, certificate, poster, handler manual and case exports are now generated as tagged PDF/UA-1 documents that screen readers can follow. - [EthicsPortal launches in Switzerland](https://ethicsportal.eu/changelog/switzerland/): Organisations in Switzerland can operate a whistleblowing channel with EthicsPortal, with documents written for the Swiss FADP. - [EthicsPortal launches in Slovenia](https://ethicsportal.eu/changelog/slovenia/): Organisations in Slovenia can operate a whistleblowing channel with EthicsPortal in Slovenian, set up for the Whistleblower Protection Act (ZZPri). - [SAML single sign-on with Okta and Microsoft Entra ID](https://ethicsportal.eu/changelog/saml-single-sign-on/): Your team signs in to EthicsPortal through your identity provider over SAML 2.0. Administrators can require it for your verified email domains. - [SCIM provisioning: add and remove members automatically](https://ethicsportal.eu/changelog/scim-provisioning/): Connect Okta, Microsoft Entra ID or another SCIM 2.0 directory. People join and leave EthicsPortal when they join and leave your directory. - [EthicsPortal in Italy, Spain, the Netherlands and Portugal](https://ethicsportal.eu/changelog/italy-spain-netherlands-portugal/): Organisations in four more countries can operate their whistleblowing channel in their own language, set up for their national whistleblower law. - [Reporters can flag retaliation after they report](https://ethicsportal.eu/changelog/reporter-retaliation-flag/): A reporter can mark a follow-up message as being about retaliation. The case gets an urgency badge, so handlers see it at once. - [Guided questions on the online reporting form](https://ethicsportal.eu/changelog/guided-questions/): Five optional questions help reporters give the facts that handlers need to assess a case. Every question can be skipped. - [Export all of your organisation's data](https://ethicsportal.eu/changelog/data-export/): Administrators can download a ZIP of all organisation data, with every report, message, note and attachment, in a machine-readable format. - [Read-only access for auditors and legal counsel](https://ethicsportal.eu/changelog/auditor-role/): The viewer role can read every case and the audit trail, but cannot change anything. --- # API and webhooks for your whistleblowing channel > Connect EthicsPortal to your GRC, ticketing or reporting tools. The API gives report status and deadlines, and webhooks report changes. Report content never leaves EthicsPortal. Canonical: https://ethicsportal.eu/changelog/api-and-webhooks/ Last updated: 2026-11-11 You can now connect EthicsPortal to your GRC, ticketing or reporting tools. The REST API gives the status and deadlines of reports, and webhooks tell your systems when a case changes. Report content, messages, notes and attachments are never available through the API. ![Webhook settings in EthicsPortal, with the destination address and buttons to send a test event and rotate the signing secret](https://ethicsportal.eu/images/screenshots/en-changelog-api-and-webhooks.webp) Administrators create organisation tokens and webhook endpoints in the organisation settings. Each webhook shows its delivery history. You can retry a delivery, rotate the signing secret and send a test event. API access starts when the organisation has accepted the current Data Processing Agreement. Start with the [quickstart](https://ethicsportal.eu/developers/quickstart/) or read about [webhooks](https://ethicsportal.eu/developers/webhooks/) in the developer documentation. --- # Read-only access for auditors and legal counsel > The viewer role can read every case and the audit trail, but cannot change anything. Canonical: https://ethicsportal.eu/changelog/auditor-role/ Last updated: 2026-11-11 You can now invite people with the viewer role. A viewer can read every case and the audit trail, but cannot change a case, the channel settings, billing or team members. Use it for internal auditors, external reviewers or legal counsel. ![Invitation form in EthicsPortal with the viewer role, for read-only access to every report and the audit trail](https://ethicsportal.eu/images/screenshots/en-changelog-auditor-role.webp) Viewers can also download the compliance documents, including the compliance report and the compliance certificate. Read how [access control](https://ethicsportal.eu/security/#access-control) works in EthicsPortal. --- # Connect an AI assistant to EthicsPortal with MCP > EthicsPortal has an MCP server. An AI assistant can check cases, configure your whistleblowing channel and invite members, without access to report content. Canonical: https://ethicsportal.eu/changelog/connect-an-ai-assistant/ Last updated: 2026-11-11 EthicsPortal now has an MCP server. An AI assistant that supports remote MCP servers, such as Claude Code, can use it to work with EthicsPortal for you. It can check case status and deadlines, configure your whistleblowing channel, invite members and read the audit trail. ![Connected apps page in EthicsPortal, with the MCP server address to add to an AI assistant](https://ethicsportal.eu/images/screenshots/en-changelog-connect-an-ai-assistant.webp) The assistant acts as you, with your current role, and only in the organisations you choose on the consent screen. It never sees report content, reporter identity, messages, notes or attachments. Its actions appear in the audit trail, marked as made by an AI assistant. Administrators see every connection under **Connected apps** and can remove it. To start, add `https://secure.ethicsportal.eu/mcp` to your assistant. A person without an account can create one during the connection and let the assistant set up the first organisation. Read the [MCP server documentation](https://ethicsportal.eu/developers/mcp/). --- # Export all of your organisation's data > Administrators can download a ZIP of all organisation data, with every report, message, note and attachment, in a machine-readable format. Canonical: https://ethicsportal.eu/changelog/data-export/ Last updated: 2026-11-11 Administrators can now export all of the organisation’s data themselves, at any time. The ZIP file contains JSON files for the organisation, its members, the channel settings and every report with its messages and notes, plus all attachments. You can move your data to another system or archive it without asking us. This supports the right to data portability in Article 20 of the GDPR. ![Data export page in EthicsPortal with a completed export ready to download](https://ethicsportal.eu/images/screenshots/en-changelog-data-export.webp) The export is generated in the background. Downloading it requires a fresh identity confirmation and is recorded in the audit trail, and the file is deleted after 7 days. Read about [export and deletion](https://ethicsportal.eu/trust/). --- # Guided questions on the online reporting form > Five optional questions help reporters give the facts that handlers need to assess a case. Every question can be skipped. Canonical: https://ethicsportal.eu/changelog/guided-questions/ Last updated: 2026-11-11 The online reporting form now has five optional questions: the reporter’s relationship to the organisation, how they know about the issue, when it happened, whether they reported it before, and whether they fear or face retaliation. Handlers get the facts they need to assess the case at the start. ![The online reporting form with the five optional guided questions opened](https://ethicsportal.eu/images/screenshots/en-changelog-guided-questions.webp) The questions are collapsed by default and every one can be skipped, so a reporter who wants to stay anonymous never has to give identifying details. Handlers see the answers on the case page and in the case PDF, and the reporter sees their own answers in the secure inbox. --- # EthicsPortal in Italy, Spain, the Netherlands and Portugal > Organisations in four more countries can operate their whistleblowing channel in their own language, set up for their national whistleblower law. Canonical: https://ethicsportal.eu/changelog/italy-spain-netherlands-portugal/ Last updated: 2026-11-11 Organisations in Italy, Spain, the Netherlands and Portugal can now operate their whistleblowing channel with EthicsPortal in their own language. The online reporting form, the secure inbox, the case handling screens, the emails and the generated documents are available in Italian, Spanish, Dutch and Portuguese. ![Public page of an Italian whistleblowing channel in EthicsPortal, in Italian](https://ethicsportal.eu/images/screenshots/it-portal-public-desktop.webp) Each channel is set up for its national law and names the external reporting authority: - **Italy:** Legislative Decree 24/2023, with ANAC - **Spain:** Law 2/2023, with the Independent Authority for Whistleblower Protection (AAI) - **The Netherlands:** Whistleblowers Protection Act (Wet bescherming klokkenluiders), with the Huis voor Klokkenluiders - **Portugal:** Law 93/2021, with MENAC Read the [whistleblower laws by country](https://ethicsportal.eu/whistleblower-laws/). --- # Reporters can flag retaliation after they report > A reporter can mark a follow-up message as being about retaliation. The case gets an urgency badge, so handlers see it at once. Canonical: https://ethicsportal.eu/changelog/reporter-retaliation-flag/ Last updated: 2026-11-11 Retaliation often starts after a report is made. A reporter can now mark a follow-up message in the secure inbox as being about retaliation. The case then gets an urgency badge in the case list and on the case page, and the conversation shows that the message was flagged, so both sides can see it. ![The reply form in the reporter’s secure inbox, with a switch to say that the reporter is facing retaliation](https://ethicsportal.eu/images/screenshots/en-changelog-reporter-retaliation-flag.webp) The same badge appears when a reporter says on the reporting form that they fear or face retaliation. This helps you act on the protection against retaliation in Article 19 of [Directive (EU) 2019/1937](https://eur-lex.europa.eu/eli/dir/2019/1937/oj/eng). --- # Reports by email, without showing the reporter's address > Every whistleblowing channel has its own email address. An email becomes a case, and handlers never see the sender's address. Canonical: https://ethicsportal.eu/changelog/reports-by-email/ Last updated: 2026-11-11 Every whistleblowing channel now has its own email address. An email sent to it becomes a case, the same as a report through the online reporting form. The reporter receives a Case ID and a one-time password for the secure inbox, where the conversation continues. ![Public page of a whistleblowing channel with its own email address, next to the online reporting form and the phone number](https://ethicsportal.eu/images/screenshots/en-changelog-reports-by-email.webp) Handlers never see the sender's address. It is stored encrypted and used only to send the receipt and notices of new messages. The online reporting form also has an optional email field for updates, with the same protection, so anonymous reporters can be told when a handler writes. Email reports are on by default. An administrator can switch them off in the channel settings. Read how [reports by email](https://ethicsportal.eu/security/#reports-by-email) are received and protected. --- # SAML single sign-on with Okta and Microsoft Entra ID > Your team signs in to EthicsPortal through your identity provider over SAML 2.0. Administrators can require it for your verified email domains. Canonical: https://ethicsportal.eu/changelog/saml-single-sign-on/ Last updated: 2026-11-11 Your team can now sign in to EthicsPortal through your company's identity provider. EthicsPortal supports SAML 2.0, so it works with Okta, Microsoft Entra ID and other SAML 2.0 providers. ![Single sign-on settings in EthicsPortal, with the service provider details to copy into the identity provider](https://ethicsportal.eu/images/screenshots/en-changelog-saml-single-sign-on.webp) An administrator connects the provider in the organisation settings. After you prove that you own an email domain with a DNS record, you can require single sign-on for everyone with an address at that domain. You can also let the provider create accounts at the first sign-in. When the provider renews its signing certificate, paste the new certificate below the old one, and sign-in keeps working during the change. Use it together with [SCIM provisioning](https://ethicsportal.eu/changelog/scim-provisioning/), so that people who leave the company lose access automatically. Read the [identity integration guide](https://ethicsportal.eu/developers/identity-integrations/). --- # SCIM provisioning: add and remove members automatically > Connect Okta, Microsoft Entra ID or another SCIM 2.0 directory. People join and leave EthicsPortal when they join and leave your directory. Canonical: https://ethicsportal.eu/changelog/scim-provisioning/ Last updated: 2026-11-11 EthicsPortal now supports SCIM 2.0. Okta, Microsoft Entra ID or another SCIM directory can create, update and deactivate the members of your organisation. When someone leaves the company and the directory deactivates them, their access to cases ends. ![SCIM provisioning settings in EthicsPortal, with an active connection, the SCIM base URL and the role for new members](https://ethicsportal.eu/images/screenshots/en-changelog-scim-provisioning.webp) An administrator generates the SCIM token in the organisation settings and chooses the role that new members get: handler, admin or viewer. Read the [identity integration guide](https://ethicsportal.eu/developers/identity-integrations/). --- # EthicsPortal launches in Slovenia > Organisations in Slovenia can operate a whistleblowing channel with EthicsPortal in Slovenian, set up for the Whistleblower Protection Act (ZZPri). Canonical: https://ethicsportal.eu/changelog/slovenia/ Last updated: 2026-11-11 Organisations in Slovenia can now operate their whistleblowing channel with EthicsPortal. The online reporting form, the secure inbox and the case handling screens are available in Slovenian, the 14th language of EthicsPortal. ![Public page of a Slovenian whistleblowing channel in EthicsPortal, in Slovenian](https://ethicsportal.eu/images/screenshots/sl-portal-public-desktop.webp) Slovenian channels and documents are set up for the Whistleblower Protection Act (ZZPri). They name the Commission for the Prevention of Corruption (KPK) as the external reporting authority. Read the [overview of the whistleblower law in Slovenia](https://ethicsportal.eu/whistleblower-laws/slovenia/) or visit [EthicsPortal in Slovenian](https://ethicsportal.eu/sl/). --- # EthicsPortal launches in Switzerland > Organisations in Switzerland can operate a whistleblowing channel with EthicsPortal, with documents written for the Swiss FADP. Canonical: https://ethicsportal.eu/changelog/switzerland/ Last updated: 2026-11-11 Organisations in Switzerland can now operate their whistleblowing channel with EthicsPortal. Switzerland has no general whistleblower law, so Swiss channels apply the standard of the EU Whistleblowing Directive voluntarily, with Swiss wording. The documents cite the Swiss Federal Act on Data Protection (FADP) instead of the GDPR, and they name the country where the data is hosted. The Data Processing Agreement has a section for the FADP. Swiss teams can use EthicsPortal in German, French, Italian or English. Read the [overview of whistleblowing rules in Switzerland](https://ethicsportal.eu/whistleblower-laws/switzerland/) and our article on [setting up a whistleblowing channel in Switzerland](https://ethicsportal.eu/blog/whistleblowing-channel-switzerland/). --- # Tagged PDF documents for screen readers > The compliance report, certificate, poster, handler manual and case exports are now generated as tagged PDF/UA-1 documents that screen readers can follow. Canonical: https://ethicsportal.eu/changelog/tagged-pdf-documents/ Last updated: 2026-11-11 EthicsPortal now generates its PDF documents as tagged PDF/UA-1. This covers the compliance report, the compliance certificate, the channel poster, the case handler manual and case exports. Each file has a title, a document language and a tagged structure, so screen readers can follow its headings and tables. ![Documents page in EthicsPortal with the compliance report, compliance certificate, employee poster and case handler manual](https://ethicsportal.eu/images/screenshots/en-changelog-tagged-pdf-documents.webp) Public bodies and many companies must buy accessible documents. Read the [accessibility statement](https://ethicsportal.eu/accessibility/) for the current status of EthicsPortal. --- # Compare whistleblower platforms > Compare whistleblower platforms by pricing, hosting, features and organisational needs. Review EthicsPortal alongside other providers serving the EU market. Canonical: https://ethicsportal.eu/compare/ Last updated: 2026-10-27 ## Pages - [EthicsPortal vs. EQS Integrity Line — 2026 comparison](https://ethicsportal.eu/compare/eqs-integrity-line/): Compare EthicsPortal and EQS Integrity Line for EU whistleblower compliance. See how the established EQS product compares to a focused EU alternative. - [EthicsPortal vs. FaceUp — 2026 comparison](https://ethicsportal.eu/compare/faceup/): Compare EthicsPortal and FaceUp for EU whistleblower compliance. Pricing, features, and privacy compared side by side for businesses. - [EthicsPortal vs. NAVEX — 2026 comparison](https://ethicsportal.eu/compare/navex/): Compare EthicsPortal and NAVEX for EU whistleblower compliance. See how a US-headquartered GRC suite compares with a focused EU alternative. - [EthicsPortal vs. SpeakUp — 2026 comparison](https://ethicsportal.eu/compare/speakup/): Compare EthicsPortal and SpeakUp for EU whistleblower compliance. Pricing, privacy features, and setup compared side by side. - [EthicsPortal vs. Whispli — 2026 comparison](https://ethicsportal.eu/compare/whispli/): Compare EthicsPortal and Whispli for EU whistleblower compliance. SME flat pricing vs. enterprise case management compared side by side. - [EthicsPortal vs. Whistleblower Software (Formalize): 2026 comparison](https://ethicsportal.eu/compare/whistleblower-software-formalize/): Compare EthicsPortal and Whistleblower Software (Formalize) for EU whistleblower compliance. Pricing, hosting, languages, and who each tool fits. --- # EthicsPortal vs. EQS Integrity Line — 2026 comparison > Compare EthicsPortal and EQS Integrity Line for EU whistleblower compliance. See how the established EQS product compares to a focused EU alternative. Canonical: https://ethicsportal.eu/compare/eqs-integrity-line/ Last updated: 2026-10-28 EQS Integrity Line is the whistleblower reporting product from EQS Group, a compliance software company founded in Munich in 2000 and owned by private equity firm Thoma Bravo since 2024. EQS Group reports 600+ employees, 14,000+ customers and 80+ operating countries across its whole product range, of which Integrity Line is one (checked October 2026). Integrity Line comes in three packages: Essential, Professional and Enterprise. Some country pages publish starting prices; Enterprise is quoted on request. ## Quick comparison | Feature | EthicsPortal | EQS Integrity Line | |---|---|---| | **Pricing** | €41.67/mo billed annually | Essential from €99/month (French and Spanish pages) or £85/month (UK page); billing basis and tax not stated. German page shows no prices. Enterprise on request | | **Whistleblowing channel activation** | Self-service, minutes | Free trial on request (Essential); demo for Professional and Enterprise. Vendor states standard setups can be ready within a few days, custom setups in 4 to 8 weeks | | **Encryption** | Sensitive fields at rest + TLS in transit | Yes (end-to-end, vendor claim) | | **EU hosting** | Yes (Hetzner, Germany) | Yes (Germany, Munich data centre) | | **File metadata stripping** | Yes (EXIF, GPS, author info) | Not listed on their public pages (as of Oct 2026) | | **IP anonymization** | Yes (one-way hash, no storage) | No IP, location or device data stored (vendor claim) | | **Audit trail** | Yes, append-only | Yes (revision log per case and activity, vendor claim) | | **Deadline tracking** | Yes (7-day and 3-month with notifications) | Yes | | **PDF export** | Yes | Not listed (Excel export listed) | | **Oral / voice reporting** | Yes (in-browser voice recording, voice automatically disguised) | Yes (telephone channel, Professional and Enterprise) | | **Reports by email** | Included: own address per channel; sender hidden from handlers | Handlers can create a case from an email; no dedicated inbox listed (as of Oct 2026) | | **Data export (GDPR Art. 20)** | Yes (full-tenant ZIP, audit-logged) | Yes (Excel download, scope not stated) | | **Structured intake** | Yes — 5 built-in Directive-aligned questions, all optional | Template questionnaires and reporting forms, adaptable per organization | | **Languages** | 14 (13 EU official + Luxembourgish) | 80+ reporting languages; machine translation in Professional and Enterprise | ## Where EQS Integrity Line is strong - **Scale and brand.** EQS Group reports 14,000+ customers across all its products and operations in 80+ countries. Its Integrity Line pages cite between 2,500 and 4,000 customers for the product itself (checked October 2026). For organizations that want a vendor with a long track record, that matters. - **Built-in machine translation.** Reports and the dialogue with the reporter can be translated automatically inside the system, across 80+ reporting languages (Professional and Enterprise packages). ## Where EthicsPortal is different - **One published price, one plan.** EthicsPortal is €41.67/month billed annually, with every feature in that plan. EQS publishes "from" prices for its Essential and Professional packages on some country pages, the German page shows none, and Enterprise is quoted on request (checked October 2026). For an SME, a single flat rate makes the compliance budget predictable from day one. - **Operational in minutes.** Configure your whistleblowing channel, publish the reporting link, and operate the channel without an implementation project. EQS states that its standard setup can be ready within a few days and custom setups usually take 4 to 8 weeks. - **Privacy features as standard.** File metadata stripping and IP anonymization are built into every EthicsPortal account. Oral reports recorded in the online reporting form are disguised automatically — the audio is pitch-shifted and the original recording deleted. - **Directive features in the single plan.** Oral reporting (Art. 9(2)(b)), a read-only auditor/legal-counsel role, report categories mapped to Directive Art. 2(1), structured intake questions mapped to Art. 4 and Art. 19, and a full GDPR Art. 20 data export ship in the flat €41.67/month plan (billed annually). At EQS, the telephone channel and machine translation start at the Professional package. - **Built-in structured intake.** EthicsPortal ships five optional, Directive-aligned intake questions (relationship to the organization, source of knowledge, timing, prior reporting, retaliation concern) as a default guided step, with retaliation surfaced to handlers as an urgency badge. EQS ships template questionnaires and reporting forms that an organization can adopt or adapt; its public pages do not describe them as mapped to Directive articles (checked October 2026). - **Focused workflow.** EthicsPortal keeps the operating surface limited to reporting, case handling, deadlines, and exports. ![EthicsPortal case view: the report text, secure messaging with the reporter, the 7-day acknowledgment deadline, the assignee and the intake answers, with the retaliation concern flagged](https://ethicsportal.eu/images/screenshots/en-report.webp) ## Who should choose EQS Integrity Line EQS Integrity Line makes sense for organizations that want a whistleblowing module inside the wider EQS compliance suite, 80+ reporting languages with built-in machine translation, and a vendor with ISAE 3000 audits. EQS states that it is ISO 27001 certified, but the certificate its security page links expired on 8 May 2025, and no current certificate was published (checked October 2026); ask EQS for the current one. Its three packages run from a ready-to-use Essential package to a custom Enterprise setup, so it also fits organizations that expect to need more customization later. ## Who should choose EthicsPortal EthicsPortal is for SMEs that need EU Directive 2019/1937 compliance without adopting an enterprise GRC platform. If the requirement is a whistleblowing channel with deadline tracking, privacy protections, and audit exports, EthicsPortal is the practical choice at a published €41.67/month price (billed annually). --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # EthicsPortal vs. FaceUp — 2026 comparison > Compare EthicsPortal and FaceUp for EU whistleblower compliance. Pricing, features, and privacy compared side by side for businesses. Canonical: https://ethicsportal.eu/compare/faceup/ Last updated: 2026-10-28 FaceUp is a whistleblower platform whose homepage reports 3,800+ organizations in over 70 countries (checked October 2026). It serves companies and has a dedicated solution for schools and universities. It supports 113 reporting languages and runs referral and reseller partner programs. FaceUp does not publish prices: it quotes a platform fee plus the capabilities you choose, priced on headcount. ## Quick comparison | Feature | EthicsPortal | FaceUp | |---|---|---| | **Pricing** | €41.67/mo billed annually (EUR) | Not published: platform fee plus add-ons, priced on headcount (quote or demo, checked October 2026) | | **Whistleblowing channel activation** | Self-service, minutes | Quote required | | **Encryption** | Sensitive fields at rest + TLS in transit | Yes (standard by default, optional end-to-end) | | **EU hosting** | Yes (Hetzner, Germany) | Selectable (AWS: Ireland, or US, UAE, Australia) | | **File metadata stripping** | Yes (EXIF, GPS, author info) | Yes (attachment metadata stripped) | | **IP anonymization** | Yes (one-way hash, no storage) | Yes (IP addresses not logged) | | **Audit trail** | Yes, append-only | Yes | | **Deadline tracking** | Yes (7-day and 3-month with notifications) | Case due dates; Directive deadline reminders not listed on their public pages (as of Oct 2026) | | **PDF export** | Yes | Not listed on their public pages (as of Oct 2026) | | **Oral / voice reporting** | Yes (in-browser voice recording, voice automatically disguised) | Yes (voice messages, voice altered) | | **Reports by email** | Included: own address per channel; sender hidden from handlers | Not listed on their public pages (as of Oct 2026) | | **Data export (GDPR Art. 20)** | Yes (full-tenant ZIP, audit-logged) | Not listed on their public pages (as of Oct 2026) | | **Structured intake** | Yes — 5 built-in Directive-aligned questions, all optional | Admin-built reporting forms and categories | | **Languages** | 14 (13 EU official + Luxembourgish) | 113 languages | ## Where FaceUp is strong - **Language support.** All 113 reporting languages are included on every account. This helps organizations that operate in countries with less common languages. - **Education market.** FaceUp has a dedicated solution for schools and universities, and for schools its headcount pricing counts students and staff. - **Reporter privacy.** FaceUp states that attachment metadata is stripped, reporters' IP addresses are not logged and voice messages are altered (checked October 2026). - **Mobile app.** FaceUp offers a mobile application, which EthicsPortal does not currently have. ## Where EthicsPortal is different - **Euro pricing, published.** EthicsPortal is €41.67/month billed annually and published before procurement starts. FaceUp does not publish prices: its pricing page describes a platform fee plus the capabilities you choose, priced on headcount, and leads to a quote or a demo (checked October 2026). With EthicsPortal, there is one plan at one price, in euros. - **Directive features in the single plan.** Oral reporting (Art. 9(2)(b)), a read-only auditor/legal-counsel role, report categories mapped to Directive Art. 2(1), structured intake questions mapped to Art. 4 and Art. 19, and a full GDPR Art. 20 data export are part of the flat €41.67/month plan (billed annually) — not a tier upgrade. - **Built-in structured intake.** EthicsPortal ships five optional, Directive-aligned intake questions (relationship to the organization, source of knowledge, timing, prior reporting, retaliation concern) as a default guided step, with retaliation surfaced to handlers as an urgency badge. FaceUp lets an organization build its own reporting forms and categories; a Directive-aligned question set is not listed on its public pages (checked October 2026). - **Focused on whistleblowing compliance.** EthicsPortal is built specifically for EU Directive 2019/1937 compliance. FaceUp is a broader ethics and compliance platform that also sells investigations, hotlines, disclosures and surveys as add-ons. - **EU-hosted on Hetzner in Germany.** Your data is stored on specific, verifiable German infrastructure — important for organizations that need to demonstrate GDPR-compliant data residency. ![The EthicsPortal online reporting form: category, description, five optional intake questions, attachments, an in-browser voice message with the voice automatically altered, and anonymous submission](https://ethicsportal.eu/images/screenshots/en-new-report-desktop.webp) ## Who should choose FaceUp FaceUp is a good fit for organizations that need 113 languages, want a mobile app for reporters, or operate in the education sector. It also suits organizations that want a broader compliance platform with add-ons, or hosting outside the EU, and are comfortable with a quote-based purchase. ## Who should choose EthicsPortal EthicsPortal is built for European SMEs that want straightforward EU Directive compliance in euros, at a published price with no separately priced add-ons. If you want a product focused only on whistleblower compliance, EthicsPortal is the more direct fit. --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # EthicsPortal vs. NAVEX — 2026 comparison > Compare EthicsPortal and NAVEX for EU whistleblower compliance. See how a US-headquartered GRC suite compares with a focused EU alternative. Canonical: https://ethicsportal.eu/compare/navex/ Last updated: 2026-10-28 NAVEX is a US-headquartered governance, risk, and compliance (GRC) vendor. A consortium led by Goldman Sachs Alternatives, including Blackstone, holds a majority stake. On its own figures, NAVEX has 13,000+ customers, including 77% of the Fortune 100 and 500 (checked October 2026). Its whistleblowing products, EthicsPoint and WhistleB, are one part of a much broader GRC suite covering policy management, third-party risk, and ethics training. ## Quick comparison | Feature | EthicsPortal | NAVEX | |---|---|---| | **Pricing** | €41.67/mo billed annually | Quote only; no price on their public pages (checked October 2026) | | **Whistleblowing channel activation** | Self-service, minutes | Sales-led; NAVEX says most WhistleB customers go live in 4–6 weeks | | **Encryption** | Sensitive fields at rest + TLS in transit | Yes (WhistleB: customer-controlled encryption keys) | | **EU hosting** | Yes (Hetzner, Germany) | Optional: WhistleB stores data in the EU (Microsoft Azure); EthicsPoint EU services list data centers in Germany and the Netherlands | | **File metadata stripping** | Yes (EXIF, GPS, author info) | Not listed on their public pages (as of October 2026) | | **IP anonymization** | Yes (one-way hash, no storage) | Not listed on their public pages (as of October 2026) | | **Audit trail** | Yes, append-only | Yes | | **Deadline tracking** | Yes (7-day and 3-month with notifications) | Yes (WhistleB: reminders for 7-day acknowledgment and 3-month feedback) | | **PDF export** | Yes | Record export; format not stated on their public pages | | **Oral / voice reporting** | Yes (in-browser voice recording, voice automatically disguised) | Yes (phone: IVR and live operators; add-ons on WhistleB; IVR voice anonymized) | | **Reports by email** | Included: own address per channel; sender hidden from handlers | Not listed on their public pages (as of October 2026) | | **Read-only auditor role** | Yes (viewer role) | Role-based permissions; a read-only role is not listed on their public pages | | **Data export (GDPR Art. 20)** | Yes (full-tenant ZIP, audit-logged) | Record export for audits; a full-account export is not listed on their public pages | | **Structured intake** | Yes — 5 built-in Directive-aligned questions, all optional | Configurable forms and questionnaires (admin-built) | | **Languages** | 14 (13 EU official + Luxembourgish) | WhistleB: web and mobile in 60+, phone (IVR) in 40 (checked October 2026) | ## Where NAVEX is strong - **Market reach.** On its own figures, NAVEX serves 77% of the Fortune 100 and 500. It is a vendor that procurement teams already know. - **Wide language coverage.** WhistleB offers web and mobile reporting in 60+ languages and phone reporting in 40, with machine or human translation for case teams. - **Comprehensive GRC platform.** If you need whistleblowing, policy management, ethics training, and third-party risk in a single vendor, NAVEX covers it all. ## Where EthicsPortal is different - **Published price.** EthicsPortal is €41.67/month billed annually, published up front. NAVEX does not publish prices; you get a quote through its sales process. For an SME, a flat published rate keeps the compliance budget predictable. - **EU-hosted, EU-focused.** EthicsPortal is hosted on Hetzner in Germany, built specifically for EU Directive 2019/1937 compliance. NAVEX is US-headquartered and offers EU hosting as an option: WhistleB stores data in the EU, and EthicsPoint has a separate EU service. - **Privacy by default.** File metadata stripping and IP anonymization are built into every account. Oral reports submitted as in-browser voice recordings are disguised automatically --- the audio is pitch-shifted and the original recording deleted after processing. - **Directive features in the single plan.** Oral reporting (Art. 9(2)(b)), a read-only auditor/legal-counsel role, report categories mapped to Directive Art. 2(1), structured intake questions mapped to Art. 4 and Art. 19, and a full GDPR Art. 20 data export are part of the flat €41.67/month plan (billed annually) --- not a tier upgrade or enterprise add-on. - **Built-in structured intake.** EthicsPortal ships five optional, Directive-aligned intake questions (relationship to the organization, source of knowledge, timing, prior reporting, retaliation concern) as a default guided step, with retaliation surfaced to handlers as an urgency badge. NAVEX supports intake forms and questionnaires an organization configures itself; their public pages do not describe a Directive-aligned default question set (checked October 2026). - **Focused operating surface.** EthicsPortal limits the workflow to Directive reporting: whistleblowing channel configuration, secure intake, deadline tracking, case handling, and exports. ![Case list in EthicsPortal with each report's status, category, retaliation flags and the acknowledgment or feedback deadline remaining](https://ethicsportal.eu/images/screenshots/en-reports.webp) ## Who should choose NAVEX NAVEX is the right choice for large and global companies that need a comprehensive GRC platform spanning whistleblowing, policy management, and third-party risk. If your organization operates in many countries, needs wide language coverage, has a dedicated compliance department, and has the budget for enterprise software, NAVEX has the scale to match. ## Who should choose EthicsPortal EthicsPortal is for European SMEs that need EU whistleblower compliance, not a full GRC suite. If the requirement is a Directive 2019/1937 whistleblowing channel rather than a global ethics platform, EthicsPortal provides the narrower operating model at a published €41.67/month price (billed annually). --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # EthicsPortal vs. SpeakUp — 2026 comparison > Compare EthicsPortal and SpeakUp for EU whistleblower compliance. Pricing, privacy features, and setup compared side by side. Canonical: https://ethicsportal.eu/compare/speakup/ Last updated: 2026-10-28 SpeakUp is an ethics and compliance platform founded in Amsterdam. Its homepage reports 750+ organizations and 10M+ employees protected (checked October 2026). It started with whistleblower reporting and now also offers disclosure management (conflicts of interest, gifts) and AI tools. SpeakUp states ISO 27001 certification and quarterly ISAE 3000 Type II / SOC 2 and TISAX audits. It also cites ISO 27701: its product pages call it a certification, while its assurances page says it follows ISO 27701 guidelines. SpeakUp does not publish pricing: its pricing page states that pricing is customized to company size and the features required, and directs buyers to request a quote. ## Quick comparison | Feature | EthicsPortal | SpeakUp | |---|---|---| | **Pricing** | €41.67/mo billed annually | Not public — customized quote | | **Whistleblowing channel activation** | Self-service, minutes | Self-onboarding offered; "most organizations are live within days" (vendor claim) | | **Encryption** | Sensitive fields at rest + TLS in transit | Yes | | **EU hosting** | Yes (Hetzner, Germany) | Hosting location not stated on public pages (Oct 2026) | | **File metadata stripping** | Yes (EXIF, GPS, author info) | States that no metadata is collected or stored | | **IP anonymization** | Yes (one-way hash, no storage) | States that no IP addresses are collected or stored | | **Audit trail** | Yes, append-only | Yes | | **Deadline tracking** | Yes (7-day and 3-month with notifications) | Not listed on public pages (Oct 2026) | | **PDF export** | Yes | Data export listed; PDF not stated | | **Oral / voice reporting** | Yes (in-browser voice recording, voice automatically disguised) | Yes (phone line, phone drop box, AI voice agent) | | **Reports by email** | Included: own address per channel; sender hidden from handlers | Not listed as a channel (Oct 2026) | | **Data export (GDPR Art. 20)** | Yes (full-tenant ZIP, audit-logged) | Data export listed; full export not described | | **Structured intake** | Yes — 5 built-in Directive-aligned questions, all optional | Configurable custom questions (admin-built) | | **Languages** | 14 (13 EU official + Luxembourgish) | 100+ (vendor claim) | ## Where SpeakUp is strong - **Certifications.** ISO 27001 certification, quarterly ISAE 3000 Type II / SOC 2 and TISAX audits, and ISO 27701 cited as well. For organizations where vendor certifications are a procurement requirement, this is a strong set. - **Broad compliance platform.** SpeakUp covers ethics, compliance, and whistleblowing in a single platform. If your compliance needs go beyond whistleblower reporting, their broader suite may be relevant. - **EU-based.** SpeakUp was founded in Amsterdam more than 20 years ago and reports 750+ organizations on its homepage. ## Where EthicsPortal is different - **Predictable, flat pricing.** EthicsPortal is €41.67/month billed annually — that is €500/year. SpeakUp quotes per customer and publishes no figure, so the comparison has to be made after a sales conversation. With EthicsPortal, a flat published rate means you know your cost today and in two years. - **Privacy features as standard.** EthicsPortal strips file metadata (EXIF, GPS coordinates, author information) before storage and anonymizes IP addresses using a one-way hash. SpeakUp also states that it does not collect or store IP addresses or metadata. Oral reports recorded in the online reporting form are disguised automatically — the audio is pitch-shifted and the original recording deleted. These protections run on every account; they are not premium features. - **Directive features in the single plan.** Oral reporting (Art. 9(2)(b)), a read-only auditor/legal-counsel role, report categories mapped to Directive Art. 2(1), structured intake questions mapped to Art. 4 and Art. 19, and a full GDPR Art. 20 data export ship in the flat €41.67/month plan (billed annually) — there are no tiers to climb to reach them. - **Built-in structured intake.** EthicsPortal ships five optional, Directive-aligned intake questions (relationship to the organization, source of knowledge, timing, prior reporting, retaliation concern) as a default guided step, with retaliation surfaced to handlers as an urgency badge. SpeakUp lets an organization set its own intake questions; we found no shipped Directive-aligned question set on its public pages (checked October 2026). - **Operational in minutes.** Configure your whistleblowing channel, publish the reporting link, and start receiving reports. SpeakUp says most organizations are live within days. - **Focused on whistleblowing.** EthicsPortal does one thing well: EU Directive 2019/1937 compliant whistleblower reporting. SpeakUp also covers disclosures and wider compliance tasks. If you need only a whistleblowing channel, a narrower product means fewer modules to set up. ![EthicsPortal case view: the report text, secure messaging with the reporter, the 7-day acknowledgment deadline, the assignee and the intake answers, with the retaliation concern flagged](https://ethicsportal.eu/images/screenshots/en-report.webp) ## Who should choose SpeakUp SpeakUp is a good choice for organizations from 500 employees to global enterprises (the range its pricing page states) that need a vendor with strong assurance (ISO 27001 certification, quarterly ISAE 3000 Type II / SOC 2 and TISAX audits) to satisfy procurement requirements, or that want a single platform covering ethics and compliance beyond just whistleblowing. If your compliance team needs a broader toolset and is comfortable with quote-based pricing, SpeakUp delivers. ## Who should choose EthicsPortal EthicsPortal is for SMEs that need whistleblower compliance without buying an entire compliance suite. If you want EU Directive 2019/1937 compliance at a flat €41.67/month billed annually, with built-in privacy protections and a direct activation path, EthicsPortal is the narrower deployment. When you need ISO certifications from your vendor, EthicsPortal is not there yet; when the requirement is a focused Directive whistleblowing channel, it fits. --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # EthicsPortal vs. Whispli — 2026 comparison > Compare EthicsPortal and Whispli for EU whistleblower compliance. SME flat pricing vs. enterprise case management compared side by side. Canonical: https://ethicsportal.eu/compare/whispli/ Last updated: 2026-11-10 Whispli is an enterprise whistleblowing and case management platform with offices in Sydney, Paris and Boston. It states 300+ organisations across 60+ countries, ISO 27001 certification for the whole platform, and SOC 2 Type II. Whispli offers selectable hosting regions (including France and Germany), 70+ languages, a Voice AI phone hotline, and a mobile app. Prices are not published: every package is sold by quote, on a 3-year contract with annual payment (checked October 2026). ## Quick comparison | Feature | EthicsPortal | Whispli | |---|---|---| | **Pricing** | €41.67/mo billed annually | Quote only (3-year contract, annual payment) | | **Whistleblowing channel activation** | Self-service, minutes | Quote required; entry package lists self on-boarding | | **Encryption** | Sensitive fields at rest + TLS in transit | Yes (customer-managed keys on Enterprise plan) | | **EU hosting** | Yes (Hetzner, Germany) | Yes (France or Germany, from Plus plan) | | **File metadata stripping** | Yes (EXIF, GPS, author info) | Yes (metadata removed from files) | | **IP anonymization** | Yes (one-way hash, no storage) | Yes (no IP address or caller ID collected) | | **Oral / voice reporting** | Yes (in-browser voice recording, voice automatically disguised) | Yes (AI voice hotline with transcription) | | **Reports by email** | Included: own address per channel; sender hidden from handlers | Yes (integrated email intake) | | **Mobile app** | No | Yes (iOS and Android) | | **Audit trail** | Yes, append-only | Yes (full audit logs) | | **Deadline tracking** | Yes (7-day and 3-month with notifications) | Yes | | **Read-only auditor role** | Yes (viewer role) | Not listed on their public pages (role-based and per-case permissions; external auditors can get case access) | | **Data export (GDPR Art. 20)** | Yes (full-tenant ZIP, audit-logged) | Structured data export for audits and regulators | | **API and webhooks** | Yes (report metadata, whistleblowing channel settings, members and audit trail; never report content) | Yes (open API) | | **Structured intake** | Yes — 5 built-in Directive-aligned questions, all optional | Configurable intake forms | | **Languages** | 14 (13 EU official + Luxembourgish) | 70+ | | **ISO 27001** | No | Yes (system-level) | | **Conflicts of interest module** | No | Yes (Whispli Disclosures) | ## Where Whispli is strong - **Enterprise-grade security.** ISO 27001 certified for the whole platform, not just hosting, plus SOC 2 Type II. Customer-managed encryption keys on the Enterprise plan. - **Voice AI hotline.** AI-powered voice intake that transcribes verbal disclosures into structured cases. Useful for distributed workforces where written reporting is impractical. (EthicsPortal also supports oral reporting, but as in-browser voice recording rather than an AI-transcribed phone line — see below.) - **Mobile apps.** iOS and Android apps for anonymous reporting and follow-up, included from the entry package. - **70+ languages.** Intake pages and the voice hotline work in 70+ languages. Whispli does not publish which EU official languages are covered. - **Beyond whistleblowing.** Separate modules for conflicts of interest, gifts and hospitality, and culture surveys (Pulse). ## Where EthicsPortal is different - **Published flat pricing.** EthicsPortal is €41.67/month billed annually, published up front. Whispli does not publish prices: its pricing page names four packages, each sold by quote on a 3-year contract with annual payment (checked October 2026). For SMEs that need Directive compliance without enterprise features, a flat published rate keeps the budget predictable. - **Operational in minutes.** Configure your whistleblowing channel, publish the reporting link, and operate the channel without an enterprise onboarding project. Whispli sells every package by quote; its entry package lists self on-boarding (checked October 2026). - **Published privacy engineering.** Both vendors publish their main anonymity controls: Whispli's security page states that file metadata is removed and IP addresses are not collected. EthicsPortal also publishes how each control works: one-way IP hashing, EXIF stripping by file type, non-deterministic encryption details, ClamAV scanning. This documentation is available to anyone evaluating the platform. - **Voice-disguised oral reporting.** EthicsPortal accepts oral reports (Directive Art. 9(2)(b)) as an in-browser voice recording, and pitch-shifts the audio automatically --- only the pitch-shifted recording is kept, and the original is deleted after processing. The objective is the opposite of transcription: protect the reporter's voice, not capture it. - **Read-only auditor seat and full data export.** A dedicated viewer role gives auditors and external counsel read access to every report and the audit trail without any ability to act on a case, and an admin can export the entire organization dataset as a ZIP (GDPR Art. 20), with both the request and the download recorded in the audit trail. - **Built-in structured intake.** EthicsPortal ships five optional, Directive-aligned intake questions (relationship to the organization per Art. 4, source of knowledge, timing, prior reporting, retaliation concern per Art. 19) as a default guided step, with retaliation surfaced to handlers as an urgency badge. Whispli offers configurable intake forms; a Directive-aligned default question set is not described on its public pages (checked October 2026). - **Article-by-article Directive mapping.** EthicsPortal publishes a [Directive 2019/1937 coverage map](https://ethicsportal.eu/directive-coverage/) matching each feature to specific Directive articles --- useful for compliance officers documenting their channel. ![The EthicsPortal online reporting form: category, description, five optional intake questions, attachments, an in-browser voice message with the voice automatically altered, and anonymous submission](https://ethicsportal.eu/images/screenshots/en-new-report-desktop.webp) ## Who should choose Whispli Whispli is the right choice for large organisations that operate in several countries and need ISO 27001 certification, Voice AI for frontline workers, customer-managed encryption keys, and modules beyond whistleblowing (conflicts of interest, gifts and hospitality). If your compliance team expects board-ready reporting dashboards and multi-entity governance at scale, Whispli is built for that. ## Who should choose EthicsPortal EthicsPortal is the better fit for SMEs and mid-sized companies (50--500 employees) that need EU Directive 2019/1937 compliance without enterprise complexity or pricing. If the requirement is a focused whistleblowing channel rather than voice intake, mobile apps, and adjacent disclosure modules, EthicsPortal delivers the Directive workflow at a published €41.67/month price (billed annually). --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # EthicsPortal vs. Whistleblower Software (Formalize): 2026 comparison > Compare EthicsPortal and Whistleblower Software (Formalize) for EU whistleblower compliance. Pricing, hosting, languages, and who each tool fits. Canonical: https://ethicsportal.eu/compare/whistleblower-software-formalize/ Last updated: 2026-10-28 Whistleblower Software, marketed at whistleblowersoftware.com, is the whistleblowing product of Formalize, a Danish company based in Copenhagen. Formalize announced a €15M Series A in March 2024 and a €30M Series B in October 2025, and says it works with more than 850 consultancies and law firms. It has expanded from whistleblowing into broader compliance, including NIS2, DORA, ISO 27001, GDPR and SOC 2. Its whistleblowing product has public employee-band pricing (Core and Advanced tiers) and a 14-day free trial without a credit card (checked October 2026). ## Quick comparison | Feature | EthicsPortal | Whistleblower Software (Formalize) | |---|---|---| | **Pricing** | €41.67/mo billed annually (€500/year), flat | Employee-band: Core €99-349/mo, Advanced €149-529/mo; 1,000+ employees contact sales; billed annually | | **Whistleblowing channel activation** | Self-service, minutes | Self-service free trial or demo | | **Free trial** | No (30-day money-back) | Yes (14 days, no credit card) | | **EU hosting** | Yes (Hetzner, Germany) | Yes (AWS, Frankfurt, Germany) | | **Languages** | 14 (13 EU official + Luxembourgish) | 80+ (10 included in a standard setup) | | **Anonymous reporting** | Yes (Case ID + password) | Yes | | **Two-way messaging** | Yes | Yes | | **Deadline tracking** | Yes (7-day and 3-month with alerts) | Deadline reminders (7-day and 3-month tracking not stated) | | **Oral / voice reporting** | Yes (in-browser, voice auto-disguised) | Yes (voice reporting with voice distortion); phone hotline is an add-on | | **Reports by email** | Included: own address per channel; sender hidden from handlers | Not listed on their public pages (as of Oct 2026) | | **Encryption** | Sensitive fields at rest + TLS in transit | End-to-end (customer-held key) | | **Audit trail** | Yes, append-only | Activity logs (append-only not stated) | | **Certifications** | ISO 27001 covers hosting infrastructure; app not separately certified | ISO 27001:2022 (scope covers their whistleblowing product), ISAE 3000 Type 2 report, ENS High, WCAG 2.1 AA | | **Product scope** | Focused whistleblowing channel | Whistleblowing + NIS2 / DORA / ISO 27001 / SOC 2 suite | ## Where Whistleblower Software (Formalize) is strong - **Language breadth.** 80+ reporting languages, with 10 included in a standard setup and more on request. This helps organizations that receive reports in many languages. - **Certification that covers the product.** Their ISO 27001:2022 certificate covers the development, sales and service of their whistleblowing product. They also publish an ISAE 3000 Type 2 report, ENS High certification and a WCAG 2.1 AA audit. Some procurement processes require this. It is a real advantage over EthicsPortal, whose certification currently covers the hosting infrastructure only. - **End-to-end encryption.** Case text is encrypted before it is stored, and the customer holds the key. Formalize states that its own staff cannot read reports. - **Partner network.** Formalize says it works with more than 850 consultancies and law firms, which helps organizations that buy compliance tools through an advisor. - **Broader compliance suite.** If you need NIS2, DORA, ISO 27001, or SOC 2 management alongside whistleblowing, having them under one vendor can simplify procurement. ## Where EthicsPortal is different - **Flat pricing that does not scale with headcount.** EthicsPortal is €41.67/month billed annually --- €500/year --- regardless of company size. Whistleblower Software prices by employee band: Core runs €99-349/month and Advanced €149-529/month, so a larger organization pays more, and reaching some features means moving to the higher tier. Both vendors publish their prices; the difference is flat versus per-employee. - **Focused scope.** EthicsPortal does one thing --- an EU Directive 2019/1937 whistleblowing channel --- and keeps the operating surface to reporting, case handling, deadlines, and exports. If you do not need a broader compliance suite, you are not paying for one. - **Privacy features in the single plan.** EU hosting, encryption of sensitive fields at rest, no storage of reporter IP addresses, automatic metadata stripping from uploads, and automatic voice disguise for oral reports are all included. Formalize also lists metadata removal from uploads, voice distortion and no tracking on the reporting page. - **Same-day setup.** Configure your whistleblowing channel and publish the reporting link the same day. Whistleblower Software also offers a 14-day self-service trial; EthicsPortal keeps the whole configuration surface to a focused channel. - **Honest certification posture.** EthicsPortal's hosting infrastructure is ISO 27001 certified; the application is not separately certified, and we state that plainly. If your policy requires a certificate whose scope covers the product itself, that is a genuine point in Formalize's favor, and worth weighing directly rather than against a logo. ![Case list in EthicsPortal with each report's status, category, retaliation flags and the acknowledgment or feedback deadline remaining](https://ethicsportal.eu/images/screenshots/en-reports.webp) ## Who should choose Whistleblower Software (Formalize) Formalize fits EU companies that want 80+ reporting languages, an ISO 27001 certificate that covers the product, an ISAE 3000 Type 2 report and end-to-end encryption, that are comfortable with employee-band pricing, and that may want to add NIS2, DORA, ISO 27001, or SOC 2 management under the same vendor over time. ## Who should choose EthicsPortal EthicsPortal fits SMEs and mid-sized organizations that need EU Directive 2019/1937 compliance with flat pricing that does not scale with headcount and same-day self-service setup, that want core Directive features in a single plan rather than across tiers, and that do not need a broader GRC suite. If the requirement is a secure, EU-hosted whistleblowing channel at a predictable price, EthicsPortal is the practical choice. --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Contact > Contact EthicsPortal about whistleblower software, procurement or support. Find email contacts for privacy, security, legal and accessibility questions. Canonical: https://ethicsportal.eu/contact/ Last updated: 2026-11-10 Questions about EthicsPortal or EU whistleblower compliance? Email us directly. --- - **General:** [support@ethicsportal.eu](mailto:support@ethicsportal.eu) - **Privacy / GDPR rights:** [privacy@ethicsportal.eu](mailto:privacy@ethicsportal.eu) - **Data protection:** [privacy@ethicsportal.eu](mailto:privacy@ethicsportal.eu) - **Security disclosures:** [security@ethicsportal.eu](mailto:security@ethicsportal.eu) - **Legal / DPA:** [legal@ethicsportal.eu](mailto:legal@ethicsportal.eu) - **Accessibility:** [accessibility@ethicsportal.eu](mailto:accessibility@ethicsportal.eu) We typically respond within one business day. --- ## Common questions **"How much does it cost?"** €41.67/month billed annually (€500/year). Everything included. See [pricing](https://ethicsportal.eu/pricing/). **"Can we review the platform before deployment?"** Yes. Create the organization account at [ethicsportal.eu](https://secure.ethicsportal.eu/session/new) to review and configure the whistleblowing channel. Production operation requires an active plan. **"Is it compliant with EU Directive 2019/1937?"** Yes. See our [Directive 2019/1937 coverage map](https://ethicsportal.eu/directive-coverage/) for an article-by-article breakdown. **"Where is my data stored?"** Core whistleblower report data is hosted on Hetzner infrastructure in Nuremberg, Germany, with a backup copy of file attachments in Falkenstein, Germany. The marketing site is delivered via Cloudflare (United States); the whistleblowing channel and handler portal are not. See the [DPA](https://ethicsportal.eu/dpa/) for customer-instructed processing and the [Privacy Notice](https://ethicsportal.eu/privacy/) for separate public-site processing. **"Do you offer a DPA?"** Yes. See our [Data Processing Agreement](https://ethicsportal.eu/dpa/) or email for a countersigned PDF. **"Who is the contracting party?"** See our [trust](https://ethicsportal.eu/trust/) page for contracting-party and procurement details. **"Can you support procurement review?"** Yes. The DPA template, registry evidence, and available procurement-review materials can be requested. A signed DPA is supplied after execution with that customer. See [trust](https://ethicsportal.eu/trust/). --- **LinkedIn:** [linkedin.com/company/ethicsportal](https://www.linkedin.com/company/ethicsportal) **YouTube:** [youtube.com/@EthicsPortal](https://www.youtube.com/@EthicsPortal) --- # EthicsPortal developer documentation Source: https://ethicsportal.eu/developers/ The EthicsPortal API lets your systems monitor report status and deadlines, create organisations and configure whistleblowing channels. Webhooks notify your systems when that operational state changes. Report content remains in the authenticated application. API access and webhooks are available to every organisation. Create a token in EthicsPortal to start. 1. [Make your first request](https://ethicsportal.eu/developers/quickstart/). 2. [Choose a token type](https://ethicsportal.eu/developers/authentication/). 3. [Explore the API reference](https://ethicsportal.eu/developers/api/). 4. [Configure webhooks](https://ethicsportal.eu/developers/webhooks/). ## Metadata API and webhooks The metadata API provides four read-only endpoints: organisation discovery, whistleblowing channel metadata, report lists and individual report metadata. Further scopes let a token [create organisations and configure channels](https://ethicsportal.eu/developers/organisation-setup/), [manage webhooks](https://ethicsportal.eu/developers/webhooks/#manage-webhooks-through-the-api), and [read the audit trail, manage members, download documents and read billing status](https://ethicsportal.eu/developers/administration/). [Download the OpenAPI 3.1 schema](https://ethicsportal.eu/openapi.json). Reports expose identifiers, status, assignment presence, workflow timestamps and deadlines. [Review the complete data boundary](https://ethicsportal.eu/developers/data-boundaries/) before designing an integration. Use the API to reconcile current state. Use webhooks for notifications; delivery can be duplicated or arrive out of order. ## Integration surfaces An AI assistant can connect through the [MCP server](https://ethicsportal.eu/developers/mcp/), which offers the API’s operations as tools and has the same data boundary. A person [adds it to their assistant](https://ethicsportal.eu/developers/mcp/#add-ethicsportal-to-an-assistant) and approves the connection; a person with no account can start there. [SAML single sign-on and SCIM provisioning](https://ethicsportal.eu/developers/identity-integrations/) use separate organisation settings and credentials. The metadata API token does not replace a SCIM token. ## Machine-readable files For an AI coding agent, start from [developers/llms.txt](https://ethicsportal.eu/developers/llms.txt). It lists every guide and API operation as Markdown, in reading order. [developers/llms-full.txt](https://ethicsportal.eu/developers/llms-full.txt) has all of them in one file, and the [OpenAPI 3.1 schema](https://ethicsportal.eu/openapi.json) describes every operation, scope and token type. The [public resource directory](https://ethicsportal.eu/developers/public-resources/) lists our other Markdown exports, agent resources, sitemap and compliance questionnaire. Documentation is public and available in English only. ## Markdown content negotiation Append `.md` to a documentation URL, or request it with `Accept: text/markdown`. For example, `/developers/quickstart.md`. These representations contain public documentation only. ## Not-found responses Unknown documentation paths return HTTP 404\. Unsupported representation requests return HTTP 406\. [Content negotiation details](https://ethicsportal.eu/developers/public-resources/#markdown-content-negotiation). ## Other integration boundaries There is no report-content API, programmatic report submission, service-account credential, GraphQL API or SDK in this release. OAuth is used only to connect an AI assistant to the [MCP server](https://ethicsportal.eu/developers/mcp/); the API itself uses tokens. Full report portability uses the authenticated application’s PDF and bulk exports. ## Contact * Integration assistance: [support@ethicsportal.eu](mailto:support@ethicsportal.eu). * Security reports: [security@ethicsportal.eu](mailto:security@ethicsportal.eu) and [security.txt](https://ethicsportal.eu/.well-known/security.txt). --- # Audit trail, members, documents, billing and feedback Source: https://ethicsportal.eu/developers/administration/ These operations let an organisation’s systems handle routine administration: send the audit trail to a security log, keep the member list in step with HR records, and invite new case handlers. Each one needs its own scope. A personal token also needs its user’s current role, as stated per operation in the [API reference](https://ethicsportal.eu/developers/api/). | Scope | Operations | | ------------------- | -------------------------------------------------------------------- | | audit\_log:read | The organisation’s audit trail and each report’s audit trail | | members:read | Members, and pending invitations | | members:write | Invite, resend and revoke invitations | | documents:read | List and download the channel’s documents | | billing:read | Read access and subscription status | | billing:write | Create subscription checkout and billing portal links | | organizations:write | Rename the organisation | | invitations:respond | List, accept and decline your own invitations (personal tokens only) | ## Read the audit trail ``` curl --fail-with-body --get \ -H "Authorization: Bearer $ETHICSPORTAL_TOKEN" \ --data-urlencode 'created_after=2026-11-01T00:00:00Z' \ "$ETHICSPORTAL_ORIGIN/organizations/$ETHICSPORTAL_ORGANIZATION_ID/whistleblower/audit_logs.json" ``` Each entry says who did what and when: an action name such as `whistleblower.report.viewed`, the actor’s kind, name and membership ID, the subject’s type and ID, and the time. Entries are oldest first. To collect continuously, store the `created_at` of the last entry you received and pass it as `created_after` on the next run; within one run, follow `next_cursor`. An entry appears once it is a minute old, so that a slow write cannot land behind a timestamp you have already passed. As a further safeguard, resume a few minutes before your stored `created_at` and skip entries whose `id` you already have. The API returns less than the screen, on purpose: * **No change details, IP addresses or email addresses.** Use the action and subject, then read the subject through its own endpoint. * **Nothing a reporter did.** A reporter’s visit time can match one employee’s breaks or shifts. * **No entries about messages, notes or retaliation reports**, consistent with the [data boundary](https://ethicsportal.eu/developers/data-boundaries/). A personal token reads the audit trail if its user is an administrator or viewer. Every request is itself recorded in the trail. ## Members and invitations `GET /organizations/{organization_id}/members.json` lists members with their role and status. Use a member’s `id` as `compliance_officer_id` when [configuring the whistleblowing channel](https://ethicsportal.eu/developers/organisation-setup/). Administrators and organisation tokens also see deactivated members. ``` curl --fail-with-body -X POST \ -H "Authorization: Bearer $ETHICSPORTAL_TOKEN" \ -H 'Content-Type: application/json' \ -H "Idempotency-Key: $(uuidgen)" \ --data '{"invitation":{"email":"new.handler@example.com","role":"member"}}' \ "$ETHICSPORTAL_ORIGIN/organizations/$ETHICSPORTAL_ORGANIZATION_ID/invitations.json" ``` The invitee receives an email and accepts in EthicsPortal; the API never returns the acceptance link. Invitations expire after 14 days. Resending restarts that period and is allowed once every two minutes per invitation. Each organisation can send up to 30 invitations per hour. Changing a member’s role, deactivating or removing a member stays in the web application: granting or withdrawing access to cases is a decision a person makes there. Customers with single sign-on can automate removal through [SCIM provisioning](https://ethicsportal.eu/developers/identity-integrations/). ## Your own invitations A personal token with `invitations:respond` lists the pending invitations addressed to its user, and accepts or declines them by ID with `PATCH /me/invitations/{id}/accept.json` or `…/decline.json`. Accepting returns the new membership. It suits a consultant who works across several client organisations. An invitation that has expired or was already answered returns `409 invitation_unavailable`. ## Product feedback Any valid token sends a bug report, feature request or other feedback to the EthicsPortal team. It needs no scope. Feedback from a personal token is attributed to its user, and feedback from an organisation token to that token: ``` curl --fail-with-body \ -H "Authorization: Bearer $ETHICSPORTAL_TOKEN" \ -H "Content-Type: application/json" \ -H "Idempotency-Key: $(uuidgen)" \ -d '{"feedback":{"kind":"bug","message":"The yearly export times out."}}' \ "$ETHICSPORTAL_ORIGIN/me/feedback.json" ``` `kind` is `bug`, `feature` or `other` (the default). Only text is accepted; attach screenshots through the in-app form. Feedback reaches EthicsPortal staff, not your organisation, so never include report content or anything that identifies a reporter. Each user can send ten per minute, and so can each organisation across all its tokens. ## Documents `GET /organizations/{organization_id}/whistleblower/documents.json` lists the documents the token may download, each with its URL and file type. Request each URL with the same `Authorization` header: ``` curl --fail-with-body -o poster.pdf \ -H "Authorization: Bearer $ETHICSPORTAL_TOKEN" \ "$ETHICSPORTAL_ORIGIN/organizations/$ETHICSPORTAL_ORGANIZATION_ID/whistleblower/documents/poster.pdf" ``` The policy and privacy notice are editable Word files (`.docx`); the others are PDFs. Documents are generated from the channel’s current settings each time, so publish them again after you change those settings. While the channel is inactive, downloads return `409 channel_inactive`. The compliance report and certificate are audit evidence: a personal token gets them only if its user is an administrator or viewer, and each download is recorded in the audit trail. ## Billing `GET /organizations/{organization_id}/subscriptions.json` returns whether the organisation has access, whether that access is complimentary, and its subscription status, billing interval and period end. The whistleblowing channel can be active only while `access` is true. The API never takes a payment itself. With `billing:write` it returns a link to a Stripe-hosted page, and a person completes it there; Stripe handles strong customer authentication, tax and VAT ID collection. ``` curl --fail-with-body -X POST \ -H "Authorization: Bearer $ETHICSPORTAL_TOKEN" \ -H 'Content-Type: application/json' \ -H "Idempotency-Key: $(uuidgen)" \ --data '{"subscription":{"interval":"year"}}' \ "$ETHICSPORTAL_ORIGIN/organizations/$ETHICSPORTAL_ORGANIZATION_ID/subscriptions/checkout.json" ``` * **Subscribe:** `POST …/subscriptions/checkout.json` with `interval` `month` or `year` returns a Checkout `url` and its `expires_at`. Send it to whoever pays. Access starts when Stripe confirms the payment, even if that person never signs in to EthicsPortal. An organisation that already has a subscription gets `409 already_subscribed`. * **Manage:** `POST …/subscriptions/billing_portal.json` returns a Stripe customer portal link to change the plan, update the payment method, download invoices or cancel. It expires shortly after creation, so create it just before use. Until then it manages the subscription for whoever holds it: treat it like a password. Each link is recorded in the audit trail. Without a Stripe customer yet, it returns `409 no_subscription`. These suit a partner who sets up organisations for clients, and an assistant that answers “open this link to pay”. ## Rename the organisation ``` curl --fail-with-body -X PATCH \ -H "Authorization: Bearer $ETHICSPORTAL_TOKEN" \ -H 'Content-Type: application/json' \ --data '{"organization":{"name":"Example organisation"}}' \ "$ETHICSPORTAL_ORIGIN/organizations/$ETHICSPORTAL_ORGANIZATION_ID/profile.json" ``` --- # API reference Source: https://ethicsportal.eu/developers/api/ ## EthicsPortal API 1.1.0 Report metadata, organisation and whistleblowing channel setup, administration, product feedback and outbound webhooks. Each token carries the scopes chosen at issuance; write scopes are opt-in. Report content, attachments and their metadata, messages, notes, category, closure outcome, retaliation, reporter identity and access codes are always excluded. Billing and agreement acceptance require a browser session. Information * OpenAPI version: `3.1.0` ## Operations GET [/identity.json](https://ethicsportal.eu/developers/api/operations/getidentity/) GET [/organizations/{organization\_id}/whistleblower/portal.json](https://ethicsportal.eu/developers/api/operations/getchannel/) GET [/organizations/{organization\_id}/whistleblower/reports.json](https://ethicsportal.eu/developers/api/operations/listreports/) GET [/organizations/{organization\_id}/whistleblower/reports/{id}.json](https://ethicsportal.eu/developers/api/operations/getreport/) POST [/organizations.json](https://ethicsportal.eu/developers/api/operations/createorganization/) GET [/organizations/{organization\_id}/whistleblower/portal/configuration.json](https://ethicsportal.eu/developers/api/operations/getchannelconfiguration/) PATCH [/organizations/{organization\_id}/whistleblower/portal/configuration.json](https://ethicsportal.eu/developers/api/operations/updatechannelconfiguration/) GET [/organizations/{organization\_id}/webhooks.json](https://ethicsportal.eu/developers/api/operations/listwebhooks/) POST [/organizations/{organization\_id}/webhooks.json](https://ethicsportal.eu/developers/api/operations/createwebhook/) GET [/organizations/{organization\_id}/webhooks/{webhook\_id}.json](https://ethicsportal.eu/developers/api/operations/getwebhook/) DELETE [/organizations/{organization\_id}/webhooks/{webhook\_id}.json](https://ethicsportal.eu/developers/api/operations/deletewebhook/) PATCH [/organizations/{organization\_id}/webhooks/{webhook\_id}.json](https://ethicsportal.eu/developers/api/operations/updatewebhook/) POST [/organizations/{organization\_id}/webhooks/{webhook\_id}/rotate.json](https://ethicsportal.eu/developers/api/operations/rotatewebhooksecret/) POST [/organizations/{organization\_id}/webhooks/{webhook\_id}/test.json](https://ethicsportal.eu/developers/api/operations/testwebhook/) GET [/organizations/{organization\_id}/webhooks/{webhook\_id}/deliveries.json](https://ethicsportal.eu/developers/api/operations/listwebhookdeliveries/) POST [/organizations/{organization\_id}/webhooks/{webhook\_id}/deliveries/{delivery\_id}/retry.json](https://ethicsportal.eu/developers/api/operations/retrywebhookdelivery/) GET [/organizations/{organization\_id}/whistleblower/audit\_logs.json](https://ethicsportal.eu/developers/api/operations/listaudittrail/) GET [/organizations/{organization\_id}/whistleblower/reports/{id}/audit-log.json](https://ethicsportal.eu/developers/api/operations/listreportaudittrail/) GET [/organizations/{organization\_id}/members.json](https://ethicsportal.eu/developers/api/operations/listmembers/) GET [/organizations/{organization\_id}/invitations.json](https://ethicsportal.eu/developers/api/operations/listinvitations/) POST [/organizations/{organization\_id}/invitations.json](https://ethicsportal.eu/developers/api/operations/createinvitation/) DELETE [/organizations/{organization\_id}/invitations/{invitation\_id}.json](https://ethicsportal.eu/developers/api/operations/revokeinvitation/) POST [/organizations/{organization\_id}/invitations/{invitation\_id}/resend.json](https://ethicsportal.eu/developers/api/operations/resendinvitation/) PATCH [/organizations/{organization\_id}/profile.json](https://ethicsportal.eu/developers/api/operations/updateorganization/) GET [/me/invitations.json](https://ethicsportal.eu/developers/api/operations/listmyinvitations/) PATCH [/me/invitations/{invitation\_id}/accept.json](https://ethicsportal.eu/developers/api/operations/acceptinvitation/) PATCH [/me/invitations/{invitation\_id}/decline.json](https://ethicsportal.eu/developers/api/operations/declineinvitation/) GET [/organizations/{organization\_id}/whistleblower/documents.json](https://ethicsportal.eu/developers/api/operations/listdocuments/) GET [/organizations/{organization\_id}/whistleblower/documents/compliance\_report.pdf](https://ethicsportal.eu/developers/api/operations/downloadcompliancereport/) GET [/organizations/{organization\_id}/whistleblower/documents/compliance\_certificate.pdf](https://ethicsportal.eu/developers/api/operations/downloadcompliancecertificate/) GET [/organizations/{organization\_id}/whistleblower/documents/whistleblower\_policy.docx](https://ethicsportal.eu/developers/api/operations/downloadwhistleblowerpolicy/) GET [/organizations/{organization\_id}/whistleblower/documents/privacy\_notice.docx](https://ethicsportal.eu/developers/api/operations/downloadprivacynotice/) GET [/organizations/{organization\_id}/whistleblower/documents/poster.pdf](https://ethicsportal.eu/developers/api/operations/downloadposter/) GET [/organizations/{organization\_id}/whistleblower/documents/case\_handler\_manual.pdf](https://ethicsportal.eu/developers/api/operations/downloadcasehandlermanual/) GET [/organizations/{organization\_id}/subscriptions.json](https://ethicsportal.eu/developers/api/operations/getbillingstatus/) POST [/organizations/{organization\_id}/subscriptions/checkout.json](https://ethicsportal.eu/developers/api/operations/createcheckoutlink/) POST [/organizations/{organization\_id}/subscriptions/billing\_portal.json](https://ethicsportal.eu/developers/api/operations/createbillingportallink/) POST [/me/feedback.json](https://ethicsportal.eu/developers/api/operations/submitfeedback/) POST [Receive a webhook event](https://ethicsportal.eu/developers/api/webhooks/receivereportevent/) WEBHOOK ## Authentication ### personalToken Personal token, prefixed ep\_pat\_. It belongs to a user and acts with that user’s current role in every organisation they belong to, so some operations also need a role. Only personal tokens can create organisations, and answer the user’s own invitations. Send it as a bearer token. It expires after 90 days and carries fixed scopes chosen at issuance; each operation lists the scope it requires. **Security scheme type:** http ### organizationToken Organisation token, prefixed ep\_oat\_. It belongs to one organisation, is managed by its administrators and keeps working when staff change. It has no role: its scopes alone decide what it can do. Send it as a bearer token. It expires after 90 days and carries fixed scopes chosen at issuance; each operation lists the scope it requires. **Security scheme type:** http --- # Accept an invitation Source: https://ethicsportal.eu/developers/api/operations/acceptinvitation/ PATCH /me/invitations/{invitation\_id}/accept.json ``` const url = 'https://secure.ethicsportal.eu/me/invitations/example/accept.json'; const options = {method: 'PATCH', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request PATCH \ --url https://secure.ethicsportal.eu/me/invitations/example/accept.json \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Join the organisation with the invited role. The organisation’s own agreements still apply before its data can be read. Personal tokens only. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** invitations:respond ## Parameters ### Path Parameters **invitation\_id** required string ## Responses ### 200 The new membership. application/json object **id** required Membership ID; use as compliance\_officer\_id when the member is an administrator. string **name** required string | null **email** required Null for an erased account. string | null **role** required string Allowed values: admin member viewer **owner** required boolean **active** required boolean **created\_at** required string format: date-time **deactivated\_at** required string | null format: date-time #### Example ``` { "id": "nOpQrs", "name": "Anna Novak", "email": "anna.novak@example.com", "role": "member", "owner": false, "active": true, "created_at": "2026-11-09T10:05:00Z", "deactivated_at": null } ``` ### 400 Invalid query or parameters application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 The invitation is no longer valid: expired, already answered, or you are already an active member application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invitation_unavailable", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Create a billing portal link Source: https://ethicsportal.eu/developers/api/operations/createbillingportallink/ POST /organizations/{organization\_id}/subscriptions/billing\_portal.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/subscriptions/billing_portal.json'; const options = {method: 'POST', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request POST \ --url https://secure.ethicsportal.eu/organizations/example/subscriptions/billing_portal.json \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Return a Stripe customer portal link where a person changes the plan, updates the payment method, downloads invoices or cancels. The link manages the subscription for whoever holds it until it expires, so treat it like a credential; each link is recorded in the audit trail. A personal token also needs its user to be a current administrator. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** billing:write * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** billing:write ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ### Header Parameters **Idempotency-Key** string \>= 1 characters <= 255 characters /^\[\\x21-\\x7e\]+$/ Recommended on every POST. Retrying with the same key and the same request within 24 hours returns the first response (with Idempotent-Replayed: true) instead of acting twice. Only successful responses and validation errors are stored; any other outcome releases the key. Reusing a key with a different request returns 409 idempotency\_key\_reused; a retry while the first request is still running returns 409 idempotency\_key\_in\_progress. Keys are scoped to the token. ## Responses ### 201 Billing portal link created. application/json object **url** required Stripe-hosted page. Give it to the person who pays or manages billing; it works for whoever holds it until it expires. string format: uri **expires\_at** required When the link stops working. Null for billing portal links, which expire shortly after creation; create one just before use. string | null format: date-time #### Example ``` { "url": "https://billing.stripe.com/p/session/live_example", "expires_at": null } ``` ### 400 Invalid body application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation missing or inaccessible, API access suspended, or billing not configured application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 The organisation has no Stripe customer yet (create a checkout link first), or an Idempotency-Key conflict (This Idempotency-Key was already used with a different request, or its first request is still running) application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "no_subscription", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Create a subscription checkout link Source: https://ethicsportal.eu/developers/api/operations/createcheckoutlink/ POST /organizations/{organization\_id}/subscriptions/checkout.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/subscriptions/checkout.json'; const options = { method: 'POST', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"subscription":{"interval":"year"}}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request POST \ --url https://secure.ethicsportal.eu/organizations/example/subscriptions/checkout.json \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "subscription": { "interval": "year" } }' ``` * EthicsPortal application Return a Stripe Checkout link for the monthly or yearly plan. A person opens it and pays; Stripe handles strong customer authentication, tax and VAT ID collection. Access starts when Stripe confirms the payment, whether or not the payer is signed in to EthicsPortal. Send an Idempotency-Key so a retry returns the same link. A personal token also needs its user to be a current administrator. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** billing:write * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** billing:write ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ### Header Parameters **Idempotency-Key** string \>= 1 characters <= 255 characters /^\[\\x21-\\x7e\]+$/ Recommended on every POST. Retrying with the same key and the same request within 24 hours returns the first response (with Idempotent-Replayed: true) instead of acting twice. Only successful responses and validation errors are stored; any other outcome releases the key. Reusing a key with a different request returns 409 idempotency\_key\_reused; a retry while the first request is still running returns 409 idempotency\_key\_in\_progress. Keys are scoped to the token. ## Request Bodyrequired application/json object **subscription** required object **interval** required string Allowed values: month year ### Example ``` { "subscription": { "interval": "year" } } ``` ## Responses ### 201 Checkout link created. application/json object **url** required Stripe-hosted page. Give it to the person who pays or manages billing; it works for whoever holds it until it expires. string format: uri **expires\_at** required When the link stops working. Null for billing portal links, which expire shortly after creation; create one just before use. string | null format: date-time #### Example ``` { "url": "https://checkout.stripe.com/c/pay/cs_live_example", "expires_at": "2026-11-10T10:00:00Z" } ``` ### 400 Invalid body application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation missing or inaccessible, API access suspended, or billing not configured application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 The organisation already has a subscription (use the billing portal link), or an Idempotency-Key conflict (This Idempotency-Key was already used with a different request, or its first request is still running) application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "already_subscribed", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 422 Unknown interval application/json object **error** required object **code** required Allowed value: validation\_failed **fields** required Array \>= 1 items unique items **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "validation_failed", "fields": [ "interval" ], "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Invite a member Source: https://ethicsportal.eu/developers/api/operations/createinvitation/ POST /organizations/{organization\_id}/invitations.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/invitations.json'; const options = { method: 'POST', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"invitation":{"email":"new.handler@example.com","role":"member"}}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request POST \ --url https://secure.ethicsportal.eu/organizations/example/invitations.json \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "invitation": { "email": "new.handler@example.com", "role": "member" } }' ``` * EthicsPortal application Email an invitation that is valid for 14 days. The invitee accepts it in EthicsPortal; the API never returns the acceptance link. Up to 30 invitations per organisation per hour. A personal token also needs its user to be a current administrator of the organisation. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** members:write * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** members:write ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ### Header Parameters **Idempotency-Key** string \>= 1 characters <= 255 characters /^\[\\x21-\\x7e\]+$/ Recommended on every POST. Retrying with the same key and the same request within 24 hours returns the first response (with Idempotent-Replayed: true) instead of acting twice. Only successful responses and validation errors are stored; any other outcome releases the key. Reusing a key with a different request returns 409 idempotency\_key\_reused; a retry while the first request is still running returns 409 idempotency\_key\_in\_progress. Keys are scoped to the token. ## Request Bodyrequired application/json object **invitation** required object **email** required string format: email **role** required string Allowed values: admin member viewer ### Example ``` { "invitation": { "email": "new.handler@example.com", "role": "member" } } ``` ## Responses ### 201 Invitation sent. application/json object **id** required string **email** required string **role** required string Allowed values: admin member viewer **expires\_at** required string format: date-time **last\_sent\_at** required string | null format: date-time **created\_at** required string format: date-time #### Example ``` { "id": "tUvWxy", "email": "new.handler@example.com", "role": "member", "expires_at": "2026-11-23T10:00:00Z", "last_sent_at": "2026-11-09T10:00:00Z", "created_at": "2026-11-09T10:00:00Z" } ``` ### 400 Invalid query, body or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation or resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 This Idempotency-Key was already used with a different request, or its first request is still running application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "idempotency_key_reused", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 422 Validation failed; fields are named, values are not echoed application/json object **error** required object **code** required Allowed value: validation\_failed **fields** required Array \>= 1 items unique items **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "validation_failed", "fields": [ "email" ], "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Create an organisation Source: https://ethicsportal.eu/developers/api/operations/createorganization/ POST /organizations.json ``` const url = 'https://secure.ethicsportal.eu/organizations.json'; const options = { method: 'POST', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"organization":{"name":"Example organisation"}}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request POST \ --url https://secure.ethicsportal.eu/organizations.json \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "organization": { "name": "Example organisation" } }' ``` * EthicsPortal application Create an organisation. Requires organizations:create, which only personal tokens can hold, current user terms, and at least one active membership. An assistant connection is the exception: a person with no organisation can create their first one through it. The owner and an administrator membership are assigned from the token user. Creates the default inactive whistleblowing channel. No billing or DPA acceptance is performed: the owner accepts the DPA in a browser, and until then the organisation’s operations answer agreement\_required. Limited to 10 creation attempts per user per minute, across tokens. Send an Idempotency-Key so a retry after a lost response returns the first response instead of creating a second organisation. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** organizations:create ## Parameters ### Header Parameters **Idempotency-Key** string \>= 1 characters <= 255 characters /^\[\\x21-\\x7e\]+$/ Recommended on every POST. Retrying with the same key and the same request within 24 hours returns the first response (with Idempotent-Replayed: true) instead of acting twice. Only successful responses and validation errors are stored; any other outcome releases the key. Reusing a key with a different request returns 409 idempotency\_key\_reused; a retry while the first request is still running returns 409 idempotency\_key\_in\_progress. Keys are scoped to the token. ## Request Bodyrequired application/json object **organization** required object **name** required string \>= 1 characters <= 100 characters ### Example ``` { "organization": { "name": "Example organisation" } } ``` ## Responses ### 201 Organisation and owner membership created, with a default channel. application/json object **id** required string **name** required string **membership\_id** required The creating user’s administrator membership, as an obfuscated ID. Use as compliance\_officer\_id to appoint yourself. string **channel** required object **id** required string **active** required boolean **reports\_url** required string format: uri **channel\_url** required string format: uri **members\_url** required string format: uri **webhooks\_url** required string format: uri **audit\_trail\_url** required string format: uri **documents\_url** required string format: uri **billing\_url** required string format: uri #### Example ``` { "id": "gHiJkl", "name": "Example organisation", "membership_id": "mAbCde", "channel": { "id": "AB12CD34", "active": false }, "reports_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/reports.json", "channel_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/portal.json", "members_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/members.json", "webhooks_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/webhooks.json", "audit_trail_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/audit_logs.json", "documents_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/documents.json", "billing_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/subscriptions.json" } ``` #### Headers **Location** string format: uri Organisation web page; requires a separate authenticated browser session. ### 400 Invalid JSON body, attributes or types. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing or unusable token. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 Required scope missing, a personal token whose user is not a current administrator, or agreement\_required until browser acceptance. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "forbidden", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Resource inaccessible, or API access suspended. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 This Idempotency-Key was already used with a different request, or its first request is still running application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "idempotency_key_reused", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 422 Model validation failed. Fields are attribute names only; values and personal data are never reflected. application/json object **error** required object **code** required Allowed value: validation\_failed **fields** required Array \>= 1 items unique items **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "validation_failed", "fields": [ "name" ], "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limit exceeded. Retry-After: 60. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Create a webhook Source: https://ethicsportal.eu/developers/api/operations/createwebhook/ POST /organizations/{organization\_id}/webhooks.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/webhooks.json'; const options = { method: 'POST', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"webhook":{"name":"Case dashboard","url":"https://receiver.example/ethicsportal","events":["report.created","report.overdue"]}}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request POST \ --url https://secure.ethicsportal.eu/organizations/example/webhooks.json \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "webhook": { "name": "Case dashboard", "url": "https://receiver.example/ethicsportal", "events": [ "report.created", "report.overdue" ] } }' ``` * EthicsPortal application Register a public HTTPS destination for the selected events. The response contains the signing secret once. A personal token also needs its user to be a current administrator of the organisation. Each organisation can have up to ten webhooks. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** webhooks:write * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** webhooks:write ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ### Header Parameters **Idempotency-Key** string \>= 1 characters <= 255 characters /^\[\\x21-\\x7e\]+$/ Recommended on every POST. Retrying with the same key and the same request within 24 hours returns the first response (with Idempotent-Replayed: true) instead of acting twice. Only successful responses and validation errors are stored; any other outcome releases the key. Reusing a key with a different request returns 409 idempotency\_key\_reused; a retry while the first request is still running returns 409 idempotency\_key\_in\_progress. Keys are scoped to the token. ## Request Bodyrequired application/json object **webhook** required object **name** required string \>= 1 characters <= 100 characters **url** required Public HTTPS URL on port 443\. Redirects are not followed. string **enabled** boolean **events** required Array \>= 1 items unique items Allowed values: report.created report.acknowledged report.feedback\_given report.closed report.reopened report.assignment\_changed report.due\_soon report.overdue ### Example ``` { "webhook": { "name": "Case dashboard", "url": "https://receiver.example/ethicsportal", "events": [ "report.created", "report.overdue" ] } } ``` ## Responses ### 201 Webhook created; store the secret now. application/json object **id** required string **name** required string <= 100 characters **url** required The destination EthicsPortal sends events to, as in Stripe’s API. Other \*\_url fields are links within this API. string format: uri **enabled** required boolean **events** required Array \>= 1 items unique items Allowed values: report.created report.acknowledged report.feedback\_given report.closed report.reopened report.assignment\_changed report.due\_soon report.overdue **failing\_since** required Set when a delivery failed permanently or exhausted its retries; cleared by a later success or a configuration change. string | null format: date-time **created\_at** required string format: date-time **updated\_at** required string format: date-time **secret** required Signing secret. Returned only when created or rotated; store it immediately. string **deliveries\_url** required string format: uri #### Example ``` { "id": "pQrStu", "name": "Case dashboard", "url": "https://receiver.example/ethicsportal", "enabled": true, "events": [ "report.created", "report.overdue" ], "failing_since": null, "created_at": "2026-11-09T10:00:00Z", "updated_at": "2026-11-09T10:00:00Z", "secret": "ep_whsec_example", "deliveries_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/webhooks/pQrStu/deliveries.json" } ``` ### 400 Invalid query, body or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation or resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 This Idempotency-Key was already used with a different request, or its first request is still running application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "idempotency_key_reused", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 422 Validation failed; fields are named, values are not echoed application/json object **error** required object **code** required Allowed value: validation\_failed **fields** required Array \>= 1 items unique items **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "validation_failed", "fields": [ "url" ], "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Decline an invitation Source: https://ethicsportal.eu/developers/api/operations/declineinvitation/ PATCH /me/invitations/{invitation\_id}/decline.json ``` const url = 'https://secure.ethicsportal.eu/me/invitations/example/decline.json'; const options = {method: 'PATCH', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request PATCH \ --url https://secure.ethicsportal.eu/me/invitations/example/decline.json \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Decline a pending invitation. Personal tokens only. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** invitations:respond ## Parameters ### Path Parameters **invitation\_id** required string ## Responses ### 204 Declined. ### 400 Invalid query or parameters application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 The invitation is no longer valid: expired, already answered, or you are already an active member application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invitation_unavailable", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Delete a webhook Source: https://ethicsportal.eu/developers/api/operations/deletewebhook/ DELETE /organizations/{organization\_id}/webhooks/{webhook\_id}.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/webhooks/example.json'; const options = {method: 'DELETE', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request DELETE \ --url https://secure.ethicsportal.eu/organizations/example/webhooks/example.json \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Delete the webhook and its delivery history. A personal token also needs its user to be a current administrator of the organisation. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** webhooks:write * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** webhooks:write ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. **webhook\_id** required string ## Responses ### 204 Deleted. ### 400 Invalid query, body or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation or resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Download the case handler manual Source: https://ethicsportal.eu/developers/api/operations/downloadcasehandlermanual/ GET /organizations/{organization\_id}/whistleblower/documents/case\_handler\_manual.pdf ``` const url = 'https://secure.ethicsportal.eu/organizations/example/whistleblower/documents/case_handler_manual.pdf'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url https://secure.ethicsportal.eu/organizations/example/whistleblower/documents/case_handler_manual.pdf \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Manual for the people who handle reports. Generated on request from the channel’s current settings. Any member’s personal token can download it. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** documents:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** documents:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ## Responses ### 200 The case handler manual as PDF. application/pdf string format: binary ### 400 Invalid query or parameters application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 The whistleblowing channel is not active yet, so its documents cannot be generated application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "channel_inactive", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Download the compliance certificate Source: https://ethicsportal.eu/developers/api/operations/downloadcompliancecertificate/ GET /organizations/{organization\_id}/whistleblower/documents/compliance\_certificate.pdf ``` const url = 'https://secure.ethicsportal.eu/organizations/example/whistleblower/documents/compliance_certificate.pdf'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url https://secure.ethicsportal.eu/organizations/example/whistleblower/documents/compliance_certificate.pdf \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Certificate of an active whistleblowing channel. Administrators and viewers only. Generated on request from the channel’s current settings. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** documents:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** documents:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ## Responses ### 200 The compliance certificate as PDF. application/pdf string format: binary ### 400 Invalid query or parameters application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 The whistleblowing channel is not active yet, so its documents cannot be generated application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "channel_inactive", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Download the compliance report Source: https://ethicsportal.eu/developers/api/operations/downloadcompliancereport/ GET /organizations/{organization\_id}/whistleblower/documents/compliance\_report.pdf ``` const url = 'https://secure.ethicsportal.eu/organizations/example/whistleblower/documents/compliance_report.pdf'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url https://secure.ethicsportal.eu/organizations/example/whistleblower/documents/compliance_report.pdf \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Evidence of the channel’s configuration and handling, for auditors. Administrators and viewers only. Generated on request from the channel’s current settings. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** documents:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** documents:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ## Responses ### 200 The compliance report as PDF. application/pdf string format: binary ### 400 Invalid query or parameters application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 The whistleblowing channel is not active yet, so its documents cannot be generated application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "channel_inactive", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Download the poster Source: https://ethicsportal.eu/developers/api/operations/downloadposter/ GET /organizations/{organization\_id}/whistleblower/documents/poster.pdf ``` const url = 'https://secure.ethicsportal.eu/organizations/example/whistleblower/documents/poster.pdf'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url https://secure.ethicsportal.eu/organizations/example/whistleblower/documents/poster.pdf \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Poster with the online reporting form address and QR code. Generated on request from the channel’s current settings. Any member’s personal token can download it. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** documents:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** documents:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ## Responses ### 200 The poster as PDF. application/pdf string format: binary ### 400 Invalid query or parameters application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 The whistleblowing channel is not active yet, so its documents cannot be generated application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "channel_inactive", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Download the privacy notice Source: https://ethicsportal.eu/developers/api/operations/downloadprivacynotice/ GET /organizations/{organization\_id}/whistleblower/documents/privacy\_notice.docx ``` const url = 'https://secure.ethicsportal.eu/organizations/example/whistleblower/documents/privacy_notice.docx'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url https://secure.ethicsportal.eu/organizations/example/whistleblower/documents/privacy_notice.docx \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Editable privacy notice for the whistleblowing channel. Generated on request from the channel’s current settings. Any member’s personal token can download it. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** documents:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** documents:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ## Responses ### 200 The privacy notice as DOCX. application/vnd.openxmlformats-officedocument.wordprocessingml.document string format: binary ### 400 Invalid query or parameters application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 The whistleblowing channel is not active yet, so its documents cannot be generated application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "channel_inactive", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Download the whistleblowing policy Source: https://ethicsportal.eu/developers/api/operations/downloadwhistleblowerpolicy/ GET /organizations/{organization\_id}/whistleblower/documents/whistleblower\_policy.docx ``` const url = 'https://secure.ethicsportal.eu/organizations/example/whistleblower/documents/whistleblower_policy.docx'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url https://secure.ethicsportal.eu/organizations/example/whistleblower/documents/whistleblower_policy.docx \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Editable policy for staff, filled with the channel’s details. Generated on request from the channel’s current settings. Any member’s personal token can download it. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** documents:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** documents:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ## Responses ### 200 The whistleblowing policy as DOCX. application/vnd.openxmlformats-officedocument.wordprocessingml.document string format: binary ### 400 Invalid query or parameters application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 The whistleblowing channel is not active yet, so its documents cannot be generated application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "channel_inactive", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Read billing status Source: https://ethicsportal.eu/developers/api/operations/getbillingstatus/ GET /organizations/{organization\_id}/subscriptions.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/subscriptions.json'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url https://secure.ethicsportal.eu/organizations/example/subscriptions.json \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Access and subscription status, read from EthicsPortal’s synced billing records. Subscribing, changing plan and cancelling stay in the web application. A personal token also needs its user to be a current administrator. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** billing:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** billing:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ### Header Parameters **If-None-Match** string The ETag of a response you already hold. If nothing changed, the response is 304 Not Modified with no body. It still counts toward rate limits and, where reads are audited, the audit trail. ## Responses ### 200 Billing status. application/json object **access** required Whether the organisation currently has paid or granted access. The whistleblowing channel can be active only when this is true. boolean **complimentary** required Access granted by EthicsPortal without a subscription. boolean **subscription** required object **status** required Stripe subscription status, such as active, trialing, past\_due or canceled. string **interval** required string | null Allowed values: month year **current\_period\_end** required string | null format: date-time **ends\_at** required Set when the subscription has been cancelled and access ends at this time. string | null format: date-time **trial\_ends\_at** required string | null format: date-time #### Example ``` { "access": true, "complimentary": false, "subscription": { "status": "active", "interval": "year", "current_period_end": "2027-11-09T10:00:00Z", "ends_at": null, "trial_ends_at": null } } ``` #### Headers **ETag** string Weak validator of this response body. Send it back as If-None-Match. ### 304 Not modified since the ETag sent in If-None-Match. No body. ### 400 Invalid query or parameters application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Read whistleblowing channel metadata Source: https://ethicsportal.eu/developers/api/operations/getchannel/ GET /organizations/{organization\_id}/whistleblower/portal.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/whistleblower/portal.json'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url https://secure.ethicsportal.eu/organizations/example/whistleblower/portal.json \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Return the whistleblowing channel of one organisation: its ID, whether it is active and the URL of its online reporting form. Any member’s personal token can read it. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** channel:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** channel:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ### Header Parameters **If-None-Match** string The ETag of a response you already hold. If nothing changed, the response is 304 Not Modified with no body. It still counts toward rate limits and, where reads are audited, the audit trail. ## Responses ### 200 Metadata only. Dates describe recorded workflow state, not proof of notification delivery. application/json object **id** required string **active** required boolean **reporting\_form\_url** required string format: uri **configuration\_url** required string format: uri **documents\_url** required string format: uri #### Example ``` { "id": "QATEST12", "active": true, "reporting_form_url": "https://secure.ethicsportal.eu/p/QATEST12", "configuration_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/portal/configuration.json", "documents_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/documents.json" } ``` #### Headers **ETag** string Weak validator of this response body. Send it back as If-None-Match. ### 304 Not modified since the ETag sent in If-None-Match. No body. ### 400 Invalid query or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, invalid, expired or revoked bearer token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` #### Headers **WWW-Authenticate** string Bearer realm=“EthicsPortal” ### 403 Required agreement not accepted or permission denied application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "agreement_required", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Missing or inaccessible organisation or resource, or feature disabled application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limit exceeded application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` #### Headers **Retry-After** string 60 seconds --- # Read channel configuration Source: https://ethicsportal.eu/developers/api/operations/getchannelconfiguration/ GET /organizations/{organization\_id}/whistleblower/portal/configuration.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/whistleblower/portal/configuration.json'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url https://secure.ethicsportal.eu/organizations/example/whistleblower/portal/configuration.json \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Read the channel’s company details, settings and compliance officer. Requires channel:write. A personal token also needs its user to be a current administrator; an organisation token needs only the scope. This privileged resource includes company details and the compliance officer membership ID; the ordinary channel metadata endpoint remains unchanged. Organisation integrations and the current DPA must be enabled/accepted. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** channel:write * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** channel:write ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID. ### Header Parameters **If-None-Match** string The ETag of a response you already hold. If nothing changed, the response is 304 Not Modified with no body. It still counts toward rate limits and, where reads are audited, the audit trail. ## Responses ### 200 Current settings and derived readiness. application/json object **legal\_name** required string | null <= 255 characters **country\_code** required A supported ISO 3166-1 alpha-2 country code. Country-specific retention minimums apply. string | null **registration\_number** required string | null **address** required string | null **employee\_range** required string | null Allowed values: 1-49 50-249 250+ "" **industry** required string | null Allowed values: agriculture\_forestry mining\_quarrying manufacturing energy\_utilities water\_waste\_management construction wholesale\_retail\_trade transportation\_logistics hospitality\_food\_services information\_communication financial\_services\_insurance real\_estate professional\_scientific\_services administrative\_support\_services public\_administration\_defence education healthcare\_social\_work arts\_entertainment\_recreation other "" **website** required string | null **phone\_number** required string | null **compliance\_officer\_id** required An active administrator membership in this organisation, identified by its obfuscated ID. Creation returns your membership\_id. Null removes the appointment and can make the channel inactive. Raw database IDs are rejected. string | null **brand\_color** required string | null **retention\_months** required Must also meet the selected country’s minimum. Defaults to 60 months. A country change and its retention adjustment are validated together. integer Allowed values: 12 24 36 48 60 **social\_dialogue\_consulted** required boolean **voice\_recording\_enabled** required boolean **email\_intake\_enabled** required boolean **id** required string **active** required boolean **verified** required boolean **reporting\_form\_url** required string format: uri **missing\_fields** required Array unique items Allowed values: legal\_name country\_code registration\_number address employee\_range industry compliance\_officer\_id #### Example ``` { "legal_name": "Example company", "country_code": "FR", "registration_number": "EXAMPLE-123", "address": "1 Example Street", "employee_range": "1-49", "industry": "professional_scientific_services", "website": null, "phone_number": null, "compliance_officer_id": "mAbCde", "brand_color": "#123456", "retention_months": 60, "social_dialogue_consulted": false, "voice_recording_enabled": false, "email_intake_enabled": false, "id": "AB12CD34", "active": false, "verified": false, "reporting_form_url": "https://secure.ethicsportal.eu/p/AB12CD34", "missing_fields": [] } ``` #### Headers **ETag** string Weak validator of this response body. Send it back as If-None-Match. ### 304 Not modified since the ETag sent in If-None-Match. No body. ### 400 Invalid JSON body, attributes or types. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing or unusable token. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 Required scope missing, a personal token whose user is not a current administrator, or agreement\_required until browser acceptance. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "forbidden", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Resource inaccessible, or API access suspended. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limit exceeded. Retry-After: 60. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Discover organisations Source: https://ethicsportal.eu/developers/api/operations/getidentity/ GET /identity.json ``` const url = 'https://secure.ethicsportal.eu/identity.json?limit=50'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url 'https://secure.ethicsportal.eu/identity.json?limit=50' \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Return the organisations that an access token can read, with the token’s scopes and expiry date. Use it to find organisation IDs. An assistant connection of a person who has no organisation yet returns an empty list. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** ## Parameters ### Query Parameters **limit** integer default: 50 \>= 1 <= 100 **cursor** string Follow the Link response header unchanged. Signed cursor expires after one hour. ### Header Parameters **If-None-Match** string The ETag of a response you already hold. If nothing changed, the response is 304 Not Modified with no body. It still counts toward rate limits and, where reads are audited, the audit trail. ## Responses ### 200 Metadata only. Dates describe recorded workflow state, not proof of notification delivery. application/json object **type** required Personal: acts as its user, with that user’s current role, in each of their organisations. organization: belongs to one organisation and ignores roles; its scopes alone apply. string Allowed values: personal organization **name** required The name given to the token when it was created, as shown on the token list. string <= 100 characters **last\_four** required The token’s last four characters, as shown on the token list. string \>= 4 characters <= 4 characters **scopes** required Array <= 14 items unique items Allowed values: reports:read channel:read channel:write webhooks:read webhooks:write audit\_log:read members:read members:write documents:read billing:read billing:write organizations:write organizations:create invitations:respond **expires\_at** required string format: date-time **last\_used\_at** required When the token was last used before this request, recorded to the minute; null if this is its first use. string | null format: date-time **organizations** required Array <= 100 items object **id** required string **name** required string **reports\_url** required string format: uri **channel\_url** required string format: uri **members\_url** required string format: uri **webhooks\_url** required string format: uri **audit\_trail\_url** required string format: uri **documents\_url** required string format: uri **billing\_url** required string format: uri **next\_cursor** required Pass as the cursor parameter for the next page; null on the last page. The Link header carries the same next page. string | null #### Example ``` { "type": "personal", "name": "Case dashboard", "last_four": "x7Qa", "scopes": [ "reports:read", "channel:read" ], "expires_at": "2027-02-05T10:00:00Z", "last_used_at": "2026-11-09T16:42:00Z", "organizations": [ { "id": "gHiJkl", "name": "Example organisation", "reports_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/reports.json", "channel_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/portal.json", "members_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/members.json", "webhooks_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/webhooks.json", "audit_trail_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/audit_logs.json", "documents_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/documents.json", "billing_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/subscriptions.json" } ], "next_cursor": null } ``` #### Headers **ETag** string Weak validator of this response body. Send it back as If-None-Match. ### 304 Not modified since the ETag sent in If-None-Match. No body. ### 400 Invalid query or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, invalid, expired or revoked bearer token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` #### Headers **WWW-Authenticate** string Bearer realm=“EthicsPortal” ### 403 Required agreement not accepted or permission denied application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "agreement_required", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Missing or inaccessible organisation or resource, or feature disabled application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limit exceeded application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` #### Headers **Retry-After** string 60 seconds --- # Read report metadata Source: https://ethicsportal.eu/developers/api/operations/getreport/ GET /organizations/{organization\_id}/whistleblower/reports/{id}.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/whistleblower/reports/example.json'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url https://secure.ethicsportal.eu/organizations/example/whistleblower/reports/example.json \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Read the metadata of one report: status, assignment, acknowledgement and feedback deadlines, and overdue flags. Report content is never returned. A personal token reads only a report its user can open; any other report returns 404\. An organisation token reads every report. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** reports:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** reports:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. **id** required string Obfuscated report ID; not the reporter access code. ### Header Parameters **If-None-Match** string The ETag of a response you already hold. If nothing changed, the response is 304 Not Modified with no body. It still counts toward rate limits and, where reads are audited, the audit trail. ## Responses ### 200 Metadata only. Dates describe recorded workflow state, not proof of notification delivery. application/json object **id** required string **organization\_id** required string **status** required string Allowed values: received acknowledged feedback\_given closed **assigned** required boolean **created\_at** required string format: date-time **acknowledged\_at** required string | null format: date-time **feedback\_given\_at** required string | null format: date-time **closed\_at** required string | null format: date-time **acknowledgment\_due\_at** required string format: date-time **feedback\_due\_at** required string format: date-time **acknowledgment\_overdue** required boolean **feedback\_overdue** required boolean **url** required string format: uri **web\_url** required string format: uri **audit\_trail\_url** required string format: uri #### Example ``` { "id": "aBcDef", "organization_id": "gHiJkl", "status": "received", "assigned": false, "created_at": "2026-11-07T10:00:00Z", "acknowledged_at": null, "feedback_given_at": null, "closed_at": null, "acknowledgment_due_at": "2026-11-14T10:00:00Z", "feedback_due_at": "2027-02-14T10:00:00Z", "acknowledgment_overdue": false, "feedback_overdue": false, "url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/reports/aBcDef.json", "web_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/reports/aBcDef", "audit_trail_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/reports/aBcDef/audit-log.json" } ``` #### Headers **ETag** string Weak validator of this response body. Send it back as If-None-Match. ### 304 Not modified since the ETag sent in If-None-Match. No body. ### 400 Invalid query or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, invalid, expired or revoked bearer token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` #### Headers **WWW-Authenticate** string Bearer realm=“EthicsPortal” ### 403 Required agreement not accepted or permission denied application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "agreement_required", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Missing or inaccessible organisation or resource, or feature disabled application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limit exceeded application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` #### Headers **Retry-After** string 60 seconds --- # Read a webhook Source: https://ethicsportal.eu/developers/api/operations/getwebhook/ GET /organizations/{organization\_id}/webhooks/{webhook\_id}.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/webhooks/example.json'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url https://secure.ethicsportal.eu/organizations/example/webhooks/example.json \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Read one webhook without its secret. A personal token also needs its user to be a current administrator of the organisation. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** webhooks:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** webhooks:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. **webhook\_id** required string ### Header Parameters **If-None-Match** string The ETag of a response you already hold. If nothing changed, the response is 304 Not Modified with no body. It still counts toward rate limits and, where reads are audited, the audit trail. ## Responses ### 200 The webhook. application/json object **id** required string **name** required string <= 100 characters **url** required The destination EthicsPortal sends events to, as in Stripe’s API. Other \*\_url fields are links within this API. string format: uri **enabled** required boolean **events** required Array \>= 1 items unique items Allowed values: report.created report.acknowledged report.feedback\_given report.closed report.reopened report.assignment\_changed report.due\_soon report.overdue **failing\_since** required Set when a delivery failed permanently or exhausted its retries; cleared by a later success or a configuration change. string | null format: date-time **created\_at** required string format: date-time **updated\_at** required string format: date-time **deliveries\_url** required string format: uri #### Example ``` { "id": "pQrStu", "name": "Case dashboard", "url": "https://receiver.example/ethicsportal", "enabled": true, "events": [ "report.created", "report.overdue" ], "failing_since": null, "created_at": "2026-11-09T10:00:00Z", "updated_at": "2026-11-09T10:00:00Z", "deliveries_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/webhooks/pQrStu/deliveries.json" } ``` #### Headers **ETag** string Weak validator of this response body. Send it back as If-None-Match. ### 304 Not modified since the ETag sent in If-None-Match. No body. ### 400 Invalid query, body or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation or resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # List the audit trail Source: https://ethicsportal.eu/developers/api/operations/listaudittrail/ GET /organizations/{organization\_id}/whistleblower/audit\_logs.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/whistleblower/audit_logs.json?limit=50'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url 'https://secure.ethicsportal.eu/organizations/example/whistleblower/audit_logs.json?limit=50' \ --header 'Authorization: Bearer ' ``` * EthicsPortal application The organisation’s audit trail: who did what and when. Omits anything a reporter did and entries about messages, notes and retaliation, consistent with the data boundary. Entries carry no change details, IP addresses or email addresses. Oldest first. A personal token needs its user to be a current administrator or viewer. Each request is itself recorded in the trail. Entries appear once they are a minute old, so a collector resuming with created\_after cannot skip one that committed late. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** audit\_log:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** audit\_log:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ### Query Parameters **limit** integer default: 50 \>= 1 <= 100 **cursor** string Follow the Link response header unchanged. Signed cursor expires after one hour. **created\_after** string format: date-time Exclusive lower bound; resume a log collector from the last entry it stored. ### Header Parameters **If-None-Match** string The ETag of a response you already hold. If nothing changed, the response is 304 Not Modified with no body. It still counts toward rate limits and, where reads are audited, the audit trail. ## Responses ### 200 Audit trail entries. application/json object **data** required Array <= 100 items object **id** required string **action** required Stable action name, such as whistleblower.report.viewed or invitation.created. string **actor** required object **kind** required string Allowed values: member system scim sso api mcp admin **name** required string | null **membership\_id** required string | null **subject** required object **type** required string Allowed values: report channel organization membership invitation webhook organization\_token personal\_token data\_export other **id** required string **created\_at** required string format: date-time **next\_cursor** required Pass as the cursor parameter for the next page; null on the last page. The Link header carries the same next page. string | null #### Example ``` { "data": [ { "id": "hIjKlm", "action": "whistleblower.report.viewed", "actor": { "kind": "member", "name": "Anna Novak", "membership_id": "nOpQrs" }, "subject": { "type": "report", "id": "aBcDef" }, "created_at": "2026-11-09T10:00:00Z" } ], "next_cursor": null } ``` #### Headers **ETag** string Weak validator of this response body. Send it back as If-None-Match. ### 304 Not modified since the ETag sent in If-None-Match. No body. ### 400 Invalid query, body or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation or resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # List documents Source: https://ethicsportal.eu/developers/api/operations/listdocuments/ GET /organizations/{organization\_id}/whistleblower/documents.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/whistleblower/documents.json'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url https://secure.ethicsportal.eu/organizations/example/whistleblower/documents.json \ --header 'Authorization: Bearer ' ``` * EthicsPortal application The documents the token may download, with their download URLs. A personal token sees compliance evidence only if its user is an administrator or viewer. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** documents:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** documents:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ### Header Parameters **If-None-Match** string The ETag of a response you already hold. If nothing changed, the response is 304 Not Modified with no body. It still counts toward rate limits and, where reads are audited, the audit trail. ## Responses ### 200 Documents. application/json object **data** required Array <= 6 items object **type** required string Allowed values: compliance\_report compliance\_certificate whistleblower\_policy privacy\_notice poster case\_handler\_manual **content\_type** required string Allowed values: application/pdf application/vnd.openxmlformats-officedocument.wordprocessingml.document **available** required False while the whistleblowing channel is inactive; downloads then return 409 channel\_inactive. boolean **url** required string format: uri **next\_cursor** required null #### Example ``` { "data": [ { "type": "poster", "content_type": "application/pdf", "available": true, "url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/documents/poster.pdf" } ], "next_cursor": null } ``` #### Headers **ETag** string Weak validator of this response body. Send it back as If-None-Match. ### 304 Not modified since the ETag sent in If-None-Match. No body. ### 400 Invalid query or parameters application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # List pending invitations Source: https://ethicsportal.eu/developers/api/operations/listinvitations/ GET /organizations/{organization\_id}/invitations.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/invitations.json?limit=50'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url 'https://secure.ethicsportal.eu/organizations/example/invitations.json?limit=50' \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Invitations not yet accepted, declined or expired. A personal token also needs its user to be a current administrator of the organisation. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** members:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** members:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ### Query Parameters **limit** integer default: 50 \>= 1 <= 100 **cursor** string Follow the Link response header unchanged. Signed cursor expires after one hour. ### Header Parameters **If-None-Match** string The ETag of a response you already hold. If nothing changed, the response is 304 Not Modified with no body. It still counts toward rate limits and, where reads are audited, the audit trail. ## Responses ### 200 Pending invitations. application/json object **data** required Array <= 100 items object **id** required string **email** required string **role** required string Allowed values: admin member viewer **expires\_at** required string format: date-time **last\_sent\_at** required string | null format: date-time **created\_at** required string format: date-time **next\_cursor** required Pass as the cursor parameter for the next page; null on the last page. The Link header carries the same next page. string | null #### Example ``` { "data": [ { "id": "tUvWxy", "email": "new.handler@example.com", "role": "member", "expires_at": "2026-11-23T10:00:00Z", "last_sent_at": "2026-11-09T10:00:00Z", "created_at": "2026-11-09T10:00:00Z" } ], "next_cursor": null } ``` #### Headers **ETag** string Weak validator of this response body. Send it back as If-None-Match. ### 304 Not modified since the ETag sent in If-None-Match. No body. ### 400 Invalid query, body or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation or resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # List members Source: https://ethicsportal.eu/developers/api/operations/listmembers/ GET /organizations/{organization\_id}/members.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/members.json?limit=50'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url 'https://secure.ethicsportal.eu/organizations/example/members.json?limit=50' \ --header 'Authorization: Bearer ' ``` * EthicsPortal application The organisation’s members. Every member can list active members; administrators and organisation tokens also see deactivated ones. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** members:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** members:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ### Query Parameters **limit** integer default: 50 \>= 1 <= 100 **cursor** string Follow the Link response header unchanged. Signed cursor expires after one hour. ### Header Parameters **If-None-Match** string The ETag of a response you already hold. If nothing changed, the response is 304 Not Modified with no body. It still counts toward rate limits and, where reads are audited, the audit trail. ## Responses ### 200 Members. application/json object **data** required Array <= 100 items object **id** required Membership ID; use as compliance\_officer\_id when the member is an administrator. string **name** required string | null **email** required Null for an erased account. string | null **role** required string Allowed values: admin member viewer **owner** required boolean **active** required boolean **created\_at** required string format: date-time **deactivated\_at** required string | null format: date-time **next\_cursor** required Pass as the cursor parameter for the next page; null on the last page. The Link header carries the same next page. string | null #### Example ``` { "data": [ { "id": "nOpQrs", "name": "Anna Novak", "email": "anna.novak@example.com", "role": "admin", "owner": false, "active": true, "created_at": "2026-10-01T09:00:00Z", "deactivated_at": null } ], "next_cursor": null } ``` #### Headers **ETag** string Weak validator of this response body. Send it back as If-None-Match. ### 304 Not modified since the ETag sent in If-None-Match. No body. ### 400 Invalid query, body or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation or resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # List my invitations Source: https://ethicsportal.eu/developers/api/operations/listmyinvitations/ GET /me/invitations.json ``` const url = 'https://secure.ethicsportal.eu/me/invitations.json'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url https://secure.ethicsportal.eu/me/invitations.json \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Pending invitations addressed to the token’s user. The acceptance link is never returned. Personal tokens only. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** invitations:respond ## Parameters ### Header Parameters **If-None-Match** string The ETag of a response you already hold. If nothing changed, the response is 304 Not Modified with no body. It still counts toward rate limits and, where reads are audited, the audit trail. ## Responses ### 200 Pending invitations. application/json object **data** required Array object **id** required string **organization** required object **id** required string **name** required string **role** required string Allowed values: admin member viewer **expires\_at** required string format: date-time **created\_at** required string format: date-time **accept\_url** required string format: uri **decline\_url** required string format: uri **next\_cursor** required null #### Example ``` { "data": [ { "id": "tUvWxy", "organization": { "id": "gHiJkl", "name": "Example organisation" }, "role": "member", "expires_at": "2026-11-23T10:00:00Z", "created_at": "2026-11-09T10:00:00Z", "accept_url": "https://secure.ethicsportal.eu/me/invitations/tUvWxy/accept.json", "decline_url": "https://secure.ethicsportal.eu/me/invitations/tUvWxy/decline.json" } ], "next_cursor": null } ``` #### Headers **ETag** string Weak validator of this response body. Send it back as If-None-Match. ### 304 Not modified since the ETag sent in If-None-Match. No body. ### 400 Invalid query or parameters application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # List a report's audit trail Source: https://ethicsportal.eu/developers/api/operations/listreportaudittrail/ GET /organizations/{organization\_id}/whistleblower/reports/{id}/audit-log.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/whistleblower/reports/example/audit-log.json?limit=50'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url 'https://secure.ethicsportal.eu/organizations/example/whistleblower/reports/example/audit-log.json?limit=50' \ --header 'Authorization: Bearer ' ``` * EthicsPortal application One report’s audit trail. Omits anything a reporter did and entries about messages, notes and retaliation, consistent with the data boundary. Entries carry no change details, IP addresses or email addresses. Oldest first. A personal token needs access to the report. Entries appear once they are a minute old, so a collector resuming with created\_after cannot skip one that committed late. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** audit\_log:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** audit\_log:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. **id** required string Obfuscated report ID; not the reporter access code. ### Query Parameters **limit** integer default: 50 \>= 1 <= 100 **cursor** string Follow the Link response header unchanged. Signed cursor expires after one hour. **created\_after** string format: date-time Exclusive lower bound; resume a log collector from the last entry it stored. ### Header Parameters **If-None-Match** string The ETag of a response you already hold. If nothing changed, the response is 304 Not Modified with no body. It still counts toward rate limits and, where reads are audited, the audit trail. ## Responses ### 200 Audit trail entries for the report. application/json object **data** required Array <= 100 items object **id** required string **action** required Stable action name, such as whistleblower.report.viewed or invitation.created. string **actor** required object **kind** required string Allowed values: member system scim sso api mcp admin **name** required string | null **membership\_id** required string | null **subject** required object **type** required string Allowed values: report channel organization membership invitation webhook organization\_token personal\_token data\_export other **id** required string **created\_at** required string format: date-time **next\_cursor** required Pass as the cursor parameter for the next page; null on the last page. The Link header carries the same next page. string | null #### Example ``` { "data": [ { "id": "hIjKlm", "action": "whistleblower.report.viewed", "actor": { "kind": "member", "name": "Anna Novak", "membership_id": "nOpQrs" }, "subject": { "type": "report", "id": "aBcDef" }, "created_at": "2026-11-09T10:00:00Z" } ], "next_cursor": null } ``` #### Headers **ETag** string Weak validator of this response body. Send it back as If-None-Match. ### 304 Not modified since the ETag sent in If-None-Match. No body. ### 400 Invalid query, body or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation or resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # List report metadata Source: https://ethicsportal.eu/developers/api/operations/listreports/ GET /organizations/{organization\_id}/whistleblower/reports.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/whistleblower/reports.json?limit=50&status=received'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url 'https://secure.ethicsportal.eu/organizations/example/whistleblower/reports.json?limit=50&status=received' \ --header 'Authorization: Bearer ' ``` * EthicsPortal application List report metadata for one organisation: status, assignment, deadlines and overdue flags. Filter by status or creation date and page with a cursor. A personal token lists only the reports its user can open: every report for administrators and viewers, and for members only the reports assigned to them or in which they participate. An organisation token lists every report. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** reports:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** reports:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ### Query Parameters **limit** integer default: 50 \>= 1 <= 100 **cursor** string Follow the Link response header unchanged. Signed cursor expires after one hour. **status** string Allowed values: received acknowledged feedback\_given closed **created\_after** string format: date-time Exclusive lower receipt-time bound. **created\_before** string format: date-time Exclusive upper receipt-time bound. ### Header Parameters **If-None-Match** string The ETag of a response you already hold. If nothing changed, the response is 304 Not Modified with no body. It still counts toward rate limits and, where reads are audited, the audit trail. ## Responses ### 200 Metadata only. Dates describe recorded workflow state, not proof of notification delivery. application/json object **data** required Array <= 100 items object **id** required string **organization\_id** required string **status** required string Allowed values: received acknowledged feedback\_given closed **assigned** required boolean **created\_at** required string format: date-time **acknowledged\_at** required string | null format: date-time **feedback\_given\_at** required string | null format: date-time **closed\_at** required string | null format: date-time **acknowledgment\_due\_at** required string format: date-time **feedback\_due\_at** required string format: date-time **acknowledgment\_overdue** required boolean **feedback\_overdue** required boolean **url** required string format: uri **web\_url** required string format: uri **audit\_trail\_url** required string format: uri **next\_cursor** required Pass as the cursor parameter for the next page; null on the last page. The Link header carries the same next page. string | null #### Example ``` { "data": [ { "id": "aBcDef", "organization_id": "gHiJkl", "status": "received", "assigned": false, "created_at": "2026-11-07T10:00:00Z", "acknowledged_at": null, "feedback_given_at": null, "closed_at": null, "acknowledgment_due_at": "2026-11-14T10:00:00Z", "feedback_due_at": "2027-02-14T10:00:00Z", "acknowledgment_overdue": false, "feedback_overdue": false, "url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/reports/aBcDef.json", "web_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/reports/aBcDef", "audit_trail_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/whistleblower/reports/aBcDef/audit-log.json" } ], "next_cursor": null } ``` #### Headers **ETag** string Weak validator of this response body. Send it back as If-None-Match. ### 304 Not modified since the ETag sent in If-None-Match. No body. ### 400 Invalid query or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, invalid, expired or revoked bearer token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` #### Headers **WWW-Authenticate** string Bearer realm=“EthicsPortal” ### 403 Required agreement not accepted or permission denied application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "agreement_required", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Missing or inaccessible organisation or resource, or feature disabled application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limit exceeded application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` #### Headers **Retry-After** string 60 seconds --- # List webhook deliveries Source: https://ethicsportal.eu/developers/api/operations/listwebhookdeliveries/ GET /organizations/{organization\_id}/webhooks/{webhook\_id}/deliveries.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/webhooks/example/deliveries.json?limit=50'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url 'https://secure.ethicsportal.eu/organizations/example/webhooks/example/deliveries.json?limit=50' \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Deliveries retained for 30 days, oldest first. Receiver response bodies are never stored. A personal token also needs its user to be a current administrator of the organisation. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** webhooks:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** webhooks:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. **webhook\_id** required string ### Query Parameters **limit** integer default: 50 \>= 1 <= 100 **cursor** string Follow the Link response header unchanged. Signed cursor expires after one hour. ### Header Parameters **If-None-Match** string The ETag of a response you already hold. If nothing changed, the response is 304 Not Modified with no body. It still counts toward rate limits and, where reads are audited, the audit trail. ## Responses ### 200 Deliveries. application/json object **data** required Array <= 100 items object **id** required string **event\_id** required Matches the payload id and the X-EthicsPortal-Event-Id header. string **event\_type** required string Allowed values: report.created report.acknowledged report.feedback\_given report.closed report.reopened report.assignment\_changed report.due\_soon report.overdue webhook.test **status** required string Allowed values: pending delivering delivered failed cancelled **attempts** required integer **response\_code** required integer | null **error\_code** required string | null Allowed values: connection\_failed unsafe\_destination **created\_at** required string format: date-time **delivered\_at** required string | null format: date-time **next\_attempt\_at** required Earliest time of the next scheduled attempt for a pending delivery of the current configuration; queue delays can postpone it. string | null format: date-time **next\_cursor** required Pass as the cursor parameter for the next page; null on the last page. The Link header carries the same next page. string | null #### Example ``` { "data": [ { "id": "vWxYza", "event_id": "bCdEfg", "event_type": "webhook.test", "status": "pending", "attempts": 0, "response_code": null, "error_code": null, "created_at": "2026-11-09T10:05:00Z", "delivered_at": null, "next_attempt_at": null } ], "next_cursor": null } ``` #### Headers **ETag** string Weak validator of this response body. Send it back as If-None-Match. ### 304 Not modified since the ETag sent in If-None-Match. No body. ### 400 Invalid query, body or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation or resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # List webhooks Source: https://ethicsportal.eu/developers/api/operations/listwebhooks/ GET /organizations/{organization\_id}/webhooks.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/webhooks.json'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request GET \ --url https://secure.ethicsportal.eu/organizations/example/webhooks.json \ --header 'Authorization: Bearer ' ``` * EthicsPortal application List the organisation’s webhooks. Secrets are never included. A personal token also needs its user to be a current administrator of the organisation. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** webhooks:read * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** webhooks:read ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ### Header Parameters **If-None-Match** string The ETag of a response you already hold. If nothing changed, the response is 304 Not Modified with no body. It still counts toward rate limits and, where reads are audited, the audit trail. ## Responses ### 200 The organisation’s webhooks (at most ten). application/json object **data** required Array <= 10 items object **id** required string **name** required string <= 100 characters **url** required The destination EthicsPortal sends events to, as in Stripe’s API. Other \*\_url fields are links within this API. string format: uri **enabled** required boolean **events** required Array \>= 1 items unique items Allowed values: report.created report.acknowledged report.feedback\_given report.closed report.reopened report.assignment\_changed report.due\_soon report.overdue **failing\_since** required Set when a delivery failed permanently or exhausted its retries; cleared by a later success or a configuration change. string | null format: date-time **created\_at** required string format: date-time **updated\_at** required string format: date-time **deliveries\_url** required string format: uri **next\_cursor** required null #### Example ``` { "data": [ { "id": "pQrStu", "name": "Case dashboard", "url": "https://receiver.example/ethicsportal", "enabled": true, "events": [ "report.created", "report.overdue" ], "failing_since": null, "created_at": "2026-11-09T10:00:00Z", "updated_at": "2026-11-09T10:00:00Z", "deliveries_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/webhooks/pQrStu/deliveries.json" } ], "next_cursor": null } ``` #### Headers **ETag** string Weak validator of this response body. Send it back as If-None-Match. ### 304 Not modified since the ETag sent in If-None-Match. No body. ### 400 Invalid query, body or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation or resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Resend an invitation Source: https://ethicsportal.eu/developers/api/operations/resendinvitation/ POST /organizations/{organization\_id}/invitations/{invitation\_id}/resend.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/invitations/example/resend.json'; const options = {method: 'POST', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request POST \ --url https://secure.ethicsportal.eu/organizations/example/invitations/example/resend.json \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Send the invitation email again and restart its 14-day validity. Allowed once every two minutes per invitation; sooner returns 429\. A personal token also needs its user to be a current administrator of the organisation. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** members:write * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** members:write ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. **invitation\_id** required string ### Header Parameters **Idempotency-Key** string \>= 1 characters <= 255 characters /^\[\\x21-\\x7e\]+$/ Recommended on every POST. Retrying with the same key and the same request within 24 hours returns the first response (with Idempotent-Replayed: true) instead of acting twice. Only successful responses and validation errors are stored; any other outcome releases the key. Reusing a key with a different request returns 409 idempotency\_key\_reused; a retry while the first request is still running returns 409 idempotency\_key\_in\_progress. Keys are scoped to the token. ## Responses ### 200 Invitation resent. application/json object **id** required string **email** required string **role** required string Allowed values: admin member viewer **expires\_at** required string format: date-time **last\_sent\_at** required string | null format: date-time **created\_at** required string format: date-time #### Example ``` { "id": "tUvWxy", "email": "new.handler@example.com", "role": "member", "expires_at": "2026-11-23T10:00:00Z", "last_sent_at": "2026-11-09T10:00:00Z", "created_at": "2026-11-09T10:00:00Z" } ``` ### 400 Invalid query, body or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation or resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 This Idempotency-Key was already used with a different request, or its first request is still running application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "idempotency_key_reused", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Retry a failed delivery Source: https://ethicsportal.eu/developers/api/operations/retrywebhookdelivery/ POST /organizations/{organization\_id}/webhooks/{webhook\_id}/deliveries/{delivery\_id}/retry.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/webhooks/example/deliveries/example/retry.json'; const options = {method: 'POST', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request POST \ --url https://secure.ethicsportal.eu/organizations/example/webhooks/example/deliveries/example/retry.json \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Retry a failed delivery with the webhook’s current URL and secret, keeping its event ID. Only failed deliveries can be retried. A personal token also needs its user to be a current administrator of the organisation. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** webhooks:write * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** webhooks:write ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. **webhook\_id** required string **delivery\_id** required string ### Header Parameters **Idempotency-Key** string \>= 1 characters <= 255 characters /^\[\\x21-\\x7e\]+$/ Recommended on every POST. Retrying with the same key and the same request within 24 hours returns the first response (with Idempotent-Replayed: true) instead of acting twice. Only successful responses and validation errors are stored; any other outcome releases the key. Reusing a key with a different request returns 409 idempotency\_key\_reused; a retry while the first request is still running returns 409 idempotency\_key\_in\_progress. Keys are scoped to the token. ## Responses ### 202 Retry queued. application/json object **id** required string **event\_id** required Matches the payload id and the X-EthicsPortal-Event-Id header. string **event\_type** required string Allowed values: report.created report.acknowledged report.feedback\_given report.closed report.reopened report.assignment\_changed report.due\_soon report.overdue webhook.test **status** required string Allowed values: pending delivering delivered failed cancelled **attempts** required integer **response\_code** required integer | null **error\_code** required string | null Allowed values: connection\_failed unsafe\_destination **created\_at** required string format: date-time **delivered\_at** required string | null format: date-time **next\_attempt\_at** required Earliest time of the next scheduled attempt for a pending delivery of the current configuration; queue delays can postpone it. string | null format: date-time #### Example ``` { "id": "vWxYza", "event_id": "bCdEfg", "event_type": "report.created", "status": "pending", "attempts": 0, "response_code": null, "error_code": null, "created_at": "2026-11-09T10:05:00Z", "delivered_at": null, "next_attempt_at": null } ``` ### 400 Invalid query, body or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation or resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 The delivery is not failed, the Idempotency-Key was used for a different request, or its first request is still running application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_retryable", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Revoke an invitation Source: https://ethicsportal.eu/developers/api/operations/revokeinvitation/ DELETE /organizations/{organization\_id}/invitations/{invitation\_id}.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/invitations/example.json'; const options = {method: 'DELETE', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request DELETE \ --url https://secure.ethicsportal.eu/organizations/example/invitations/example.json \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Revoke a pending invitation. A personal token also needs its user to be a current administrator of the organisation. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** members:write * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** members:write ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. **invitation\_id** required string ## Responses ### 204 Revoked. ### 400 Invalid query, body or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation or resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Rotate a webhook's signing secret Source: https://ethicsportal.eu/developers/api/operations/rotatewebhooksecret/ POST /organizations/{organization\_id}/webhooks/{webhook\_id}/rotate.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/webhooks/example/rotate.json'; const options = {method: 'POST', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request POST \ --url https://secure.ethicsportal.eu/organizations/example/webhooks/example/rotate.json \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Replace the signing secret immediately; there is no overlap period. Pending deliveries from the previous secret are cancelled. The response contains the new secret once. A personal token also needs its user to be a current administrator of the organisation. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** webhooks:write * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** webhooks:write ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. **webhook\_id** required string ### Header Parameters **Idempotency-Key** string \>= 1 characters <= 255 characters /^\[\\x21-\\x7e\]+$/ Recommended on every POST. Retrying with the same key and the same request within 24 hours returns the first response (with Idempotent-Replayed: true) instead of acting twice. Only successful responses and validation errors are stored; any other outcome releases the key. Reusing a key with a different request returns 409 idempotency\_key\_reused; a retry while the first request is still running returns 409 idempotency\_key\_in\_progress. Keys are scoped to the token. ## Responses ### 200 The webhook with its new secret. application/json object **id** required string **name** required string <= 100 characters **url** required The destination EthicsPortal sends events to, as in Stripe’s API. Other \*\_url fields are links within this API. string format: uri **enabled** required boolean **events** required Array \>= 1 items unique items Allowed values: report.created report.acknowledged report.feedback\_given report.closed report.reopened report.assignment\_changed report.due\_soon report.overdue **failing\_since** required Set when a delivery failed permanently or exhausted its retries; cleared by a later success or a configuration change. string | null format: date-time **created\_at** required string format: date-time **updated\_at** required string format: date-time **secret** required Signing secret. Returned only when created or rotated; store it immediately. string **deliveries\_url** required string format: uri #### Example ``` { "id": "pQrStu", "name": "Case dashboard", "url": "https://receiver.example/ethicsportal", "enabled": true, "events": [ "report.created", "report.overdue" ], "failing_since": null, "created_at": "2026-11-09T10:00:00Z", "updated_at": "2026-11-09T10:00:00Z", "secret": "ep_whsec_example", "deliveries_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/webhooks/pQrStu/deliveries.json" } ``` ### 400 Invalid query, body or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation or resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 This Idempotency-Key was already used with a different request, or its first request is still running application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "idempotency_key_reused", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Send product feedback Source: https://ethicsportal.eu/developers/api/operations/submitfeedback/ POST /me/feedback.json ``` const url = 'https://secure.ethicsportal.eu/me/feedback.json'; const options = { method: 'POST', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"feedback":{"kind":"bug","message":"The yearly report export times out for large organisations."}}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request POST \ --url https://secure.ethicsportal.eu/me/feedback.json \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "feedback": { "kind": "bug", "message": "The yearly report export times out for large organisations." } }' ``` * EthicsPortal application File a bug report, feature request or other feedback to EthicsPortal, as the in-app feedback form does. Any valid token may send it, without a scope; every error response links here as `error.feedback_url`. Feedback is attributed to the token’s user, or to the organisation token itself. Limited to 10 submissions per user or organisation per minute. Do not include report content or personal data about reporters. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** ## Parameters ### Header Parameters **Idempotency-Key** string \>= 1 characters <= 255 characters /^\[\\x21-\\x7e\]+$/ Recommended on every POST. Retrying with the same key and the same request within 24 hours returns the first response (with Idempotent-Replayed: true) instead of acting twice. Only successful responses and validation errors are stored; any other outcome releases the key. Reusing a key with a different request returns 409 idempotency\_key\_reused; a retry while the first request is still running returns 409 idempotency\_key\_in\_progress. Keys are scoped to the token. ## Request Bodyrequired application/json object **feedback** required object **kind** string default: other Allowed values: bug feature other **message** required string \>= 1 characters ### Example ``` { "feedback": { "kind": "bug", "message": "The yearly report export times out for large organisations." } } ``` ## Responses ### 201 Feedback filed for the EthicsPortal team. application/json object **kind** required string Allowed values: bug feature other **message** required string **status** required string Allowed values: open in\_review resolved **created\_at** required string format: date-time #### Example ``` { "kind": "bug", "message": "The yearly report export times out for large organisations.", "status": "open", "created_at": "2026-11-09T10:05:00Z" } ``` ### 400 Invalid JSON body, attributes or types. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing or unusable token. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 Required scope missing, a personal token whose user is not a current administrator, or agreement\_required until browser acceptance. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "forbidden", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Resource inaccessible, or API access suspended. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 This Idempotency-Key was already used with a different request, or its first request is still running application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "idempotency_key_reused", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 422 Model validation failed. Fields are attribute names only; values and personal data are never reflected. application/json object **error** required object **code** required Allowed value: validation\_failed **fields** required Array \>= 1 items unique items **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "validation_failed", "fields": [ "message" ], "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limit exceeded. Retry-After: 60. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Send a test event Source: https://ethicsportal.eu/developers/api/operations/testwebhook/ POST /organizations/{organization\_id}/webhooks/{webhook\_id}/test.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/webhooks/example/test.json'; const options = {method: 'POST', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request POST \ --url https://secure.ethicsportal.eu/organizations/example/webhooks/example/test.json \ --header 'Authorization: Bearer ' ``` * EthicsPortal application Queue a webhook.test event containing only the organisation ID. A queued delivery is not proof of receipt; check its status. A personal token also needs its user to be a current administrator of the organisation. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** webhooks:write * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** webhooks:write ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. **webhook\_id** required string ### Header Parameters **Idempotency-Key** string \>= 1 characters <= 255 characters /^\[\\x21-\\x7e\]+$/ Recommended on every POST. Retrying with the same key and the same request within 24 hours returns the first response (with Idempotent-Replayed: true) instead of acting twice. Only successful responses and validation errors are stored; any other outcome releases the key. Reusing a key with a different request returns 409 idempotency\_key\_reused; a retry while the first request is still running returns 409 idempotency\_key\_in\_progress. Keys are scoped to the token. ## Responses ### 202 Test delivery queued. application/json object **id** required string **event\_id** required Matches the payload id and the X-EthicsPortal-Event-Id header. string **event\_type** required string Allowed values: report.created report.acknowledged report.feedback\_given report.closed report.reopened report.assignment\_changed report.due\_soon report.overdue webhook.test **status** required string Allowed values: pending delivering delivered failed cancelled **attempts** required integer **response\_code** required integer | null **error\_code** required string | null Allowed values: connection\_failed unsafe\_destination **created\_at** required string format: date-time **delivered\_at** required string | null format: date-time **next\_attempt\_at** required Earliest time of the next scheduled attempt for a pending delivery of the current configuration; queue delays can postpone it. string | null format: date-time #### Example ``` { "id": "vWxYza", "event_id": "bCdEfg", "event_type": "webhook.test", "status": "pending", "attempts": 0, "response_code": null, "error_code": null, "created_at": "2026-11-09T10:05:00Z", "delivered_at": null, "next_attempt_at": null } ``` ### 400 Invalid query, body or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation or resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 409 This Idempotency-Key was already used with a different request, or its first request is still running application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "idempotency_key_reused", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Configure a whistleblowing channel Source: https://ethicsportal.eu/developers/api/operations/updatechannelconfiguration/ PATCH /organizations/{organization\_id}/whistleblower/portal/configuration.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/whistleblower/portal/configuration.json'; const options = { method: 'PATCH', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"portal":{"legal_name":"Example company","country_code":"FR","registration_number":"EXAMPLE-123","address":"1 Example Street","employee_range":"1-49","industry":"professional_scientific_services","website":null,"phone_number":null,"compliance_officer_id":"mAbCde","brand_color":"#123456","retention_months":60,"social_dialogue_consulted":false,"voice_recording_enabled":false,"email_intake_enabled":false}}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request PATCH \ --url https://secure.ethicsportal.eu/organizations/example/whistleblower/portal/configuration.json \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "portal": { "legal_name": "Example company", "country_code": "FR", "registration_number": "EXAMPLE-123", "address": "1 Example Street", "employee_range": "1-49", "industry": "professional_scientific_services", "website": null, "phone_number": null, "compliance_officer_id": "mAbCde", "brand_color": "#123456", "retention_months": 60, "social_dialogue_consulted": false, "voice_recording_enabled": false, "email_intake_enabled": false } }' ``` * EthicsPortal application Change the channel’s company details and settings. Requires channel:write. A personal token also needs its user to be a current administrator; an organisation token needs only the scope. Send application/json with a nonempty portal object; only supplied fields change. Unknown fields, query parameters and incorrect JSON types are rejected. Verified company details remain locked. Retention minimums, active administrator appointments and readiness rules are the same as the web application. active, verified, slug, billing and organisation flags cannot be set. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** channel:write * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** channel:write ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID. ## Request Bodyrequired application/json object **portal** required object \>= 1 properties **legal\_name** string | null <= 255 characters **country\_code** A supported ISO 3166-1 alpha-2 country code. Country-specific retention minimums apply. string | null **registration\_number** string | null **address** string | null **employee\_range** string | null Allowed values: 1-49 50-249 250+ "" **industry** string | null Allowed values: agriculture\_forestry mining\_quarrying manufacturing energy\_utilities water\_waste\_management construction wholesale\_retail\_trade transportation\_logistics hospitality\_food\_services information\_communication financial\_services\_insurance real\_estate professional\_scientific\_services administrative\_support\_services public\_administration\_defence education healthcare\_social\_work arts\_entertainment\_recreation other "" **website** string | null **phone\_number** string | null **compliance\_officer\_id** An active administrator membership in this organisation, identified by its obfuscated ID. Creation returns your membership\_id. Null removes the appointment and can make the channel inactive. Raw database IDs are rejected. string | null **brand\_color** string | null **retention\_months** Must also meet the selected country’s minimum. Defaults to 60 months. A country change and its retention adjustment are validated together. integer Allowed values: 12 24 36 48 60 **social\_dialogue\_consulted** boolean **voice\_recording\_enabled** boolean **email\_intake\_enabled** boolean ### Example ``` { "portal": { "legal_name": "Example company", "country_code": "FR", "registration_number": "EXAMPLE-123", "address": "1 Example Street", "employee_range": "1-49", "industry": "professional_scientific_services", "website": null, "phone_number": null, "compliance_officer_id": "mAbCde", "brand_color": "#123456", "retention_months": 60, "social_dialogue_consulted": false, "voice_recording_enabled": false, "email_intake_enabled": false } } ``` ## Responses ### 200 Validated settings saved. active is derived, never a promise of activation. application/json object **legal\_name** required string | null <= 255 characters **country\_code** required A supported ISO 3166-1 alpha-2 country code. Country-specific retention minimums apply. string | null **registration\_number** required string | null **address** required string | null **employee\_range** required string | null Allowed values: 1-49 50-249 250+ "" **industry** required string | null Allowed values: agriculture\_forestry mining\_quarrying manufacturing energy\_utilities water\_waste\_management construction wholesale\_retail\_trade transportation\_logistics hospitality\_food\_services information\_communication financial\_services\_insurance real\_estate professional\_scientific\_services administrative\_support\_services public\_administration\_defence education healthcare\_social\_work arts\_entertainment\_recreation other "" **website** required string | null **phone\_number** required string | null **compliance\_officer\_id** required An active administrator membership in this organisation, identified by its obfuscated ID. Creation returns your membership\_id. Null removes the appointment and can make the channel inactive. Raw database IDs are rejected. string | null **brand\_color** required string | null **retention\_months** required Must also meet the selected country’s minimum. Defaults to 60 months. A country change and its retention adjustment are validated together. integer Allowed values: 12 24 36 48 60 **social\_dialogue\_consulted** required boolean **voice\_recording\_enabled** required boolean **email\_intake\_enabled** required boolean **id** required string **active** required boolean **verified** required boolean **reporting\_form\_url** required string format: uri **missing\_fields** required Array unique items Allowed values: legal\_name country\_code registration\_number address employee\_range industry compliance\_officer\_id #### Example ``` { "legal_name": "Example company", "country_code": "FR", "registration_number": "EXAMPLE-123", "address": "1 Example Street", "employee_range": "1-49", "industry": "professional_scientific_services", "website": null, "phone_number": null, "compliance_officer_id": "mAbCde", "brand_color": "#123456", "retention_months": 60, "social_dialogue_consulted": false, "voice_recording_enabled": false, "email_intake_enabled": false, "id": "AB12CD34", "active": false, "verified": false, "reporting_form_url": "https://secure.ethicsportal.eu/p/AB12CD34", "missing_fields": [] } ``` ### 400 Invalid JSON body, attributes or types. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing or unusable token. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 Required scope missing, a personal token whose user is not a current administrator, or agreement\_required until browser acceptance. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "forbidden", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Resource inaccessible, or API access suspended. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 422 Model validation failed. Fields are attribute names only; values and personal data are never reflected. application/json object **error** required object **code** required Allowed value: validation\_failed **fields** required Array \>= 1 items unique items **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "validation_failed", "fields": [ "retention_months" ], "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limit exceeded. Retry-After: 60. application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Rename the organisation Source: https://ethicsportal.eu/developers/api/operations/updateorganization/ PATCH /organizations/{organization\_id}/profile.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/profile.json'; const options = { method: 'PATCH', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"organization":{"name":"Example organisation"}}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request PATCH \ --url https://secure.ethicsportal.eu/organizations/example/profile.json \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "organization": { "name": "Example organisation" } }' ``` * EthicsPortal application Change the organisation’s name. A personal token also needs its user to be a current administrator of the organisation. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** organizations:write * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** organizations:write ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. ## Request Bodyrequired application/json object **organization** required object **name** required string \>= 1 characters ### Example ``` { "organization": { "name": "Example organisation" } } ``` ## Responses ### 200 The renamed organisation. application/json object **id** required string **name** required string #### Example ``` { "id": "gHiJkl", "name": "Example organisation" } ``` ### 400 Invalid query, body or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation or resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 422 Validation failed; fields are named, values are not echoed application/json object **error** required object **code** required Allowed value: validation\_failed **fields** required Array \>= 1 items unique items **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "validation_failed", "fields": [ "name" ], "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Update a webhook Source: https://ethicsportal.eu/developers/api/operations/updatewebhook/ PATCH /organizations/{organization\_id}/webhooks/{webhook\_id}.json ``` const url = 'https://secure.ethicsportal.eu/organizations/example/webhooks/example.json'; const options = { method: 'PATCH', headers: {Authorization: 'Bearer ', 'Content-Type': 'application/json'}, body: '{"webhook":{"enabled":false}}' }; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ``` curl --request PATCH \ --url https://secure.ethicsportal.eu/organizations/example/webhooks/example.json \ --header 'Authorization: Bearer ' \ --header 'Content-Type: application/json' \ --data '{ "webhook": { "enabled": false } }' ``` * EthicsPortal application Change the name, URL, enabled state or events; only supplied fields change. Changing the URL, events or enabled state cancels pending deliveries from the previous configuration. A personal token also needs its user to be a current administrator of the organisation. ## Authorizations * **[personalToken](https://ethicsportal.eu/developers/api/#personaltoken)** webhooks:write * **[organizationToken](https://ethicsportal.eu/developers/api/#organizationtoken)** webhooks:write ## Parameters ### Path Parameters **organization\_id** required string Obfuscated organisation ID returned by identity. **webhook\_id** required string ## Request Bodyrequired application/json object **webhook** required object \>= 1 properties **name** string \>= 1 characters <= 100 characters **url** Public HTTPS URL on port 443\. Redirects are not followed. string **enabled** boolean **events** Array \>= 1 items unique items Allowed values: report.created report.acknowledged report.feedback\_given report.closed report.reopened report.assignment\_changed report.due\_soon report.overdue ### Example ``` { "webhook": { "enabled": false } } ``` ## Responses ### 200 The updated webhook. application/json object **id** required string **name** required string <= 100 characters **url** required The destination EthicsPortal sends events to, as in Stripe’s API. Other \*\_url fields are links within this API. string format: uri **enabled** required boolean **events** required Array \>= 1 items unique items Allowed values: report.created report.acknowledged report.feedback\_given report.closed report.reopened report.assignment\_changed report.due\_soon report.overdue **failing\_since** required Set when a delivery failed permanently or exhausted its retries; cleared by a later success or a configuration change. string | null format: date-time **created\_at** required string format: date-time **updated\_at** required string format: date-time **deliveries\_url** required string format: uri #### Example ``` { "id": "pQrStu", "name": "Case dashboard", "url": "https://receiver.example/ethicsportal", "enabled": false, "events": [ "report.created", "report.overdue" ], "failing_since": null, "created_at": "2026-11-09T10:00:00Z", "updated_at": "2026-11-09T10:00:00Z", "deliveries_url": "https://secure.ethicsportal.eu/organizations/gHiJkl/webhooks/pQrStu/deliveries.json" } ``` ### 400 Invalid query, body or cursor application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_request", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 401 Missing, unknown, expired or revoked token application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "invalid_token", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 403 The token lacks the required scope (WWW-Authenticate names it), the user’s role does not allow the action, or an agreement must be accepted in the web application application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "insufficient_scope", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 404 Organisation or resource missing or inaccessible, or API access suspended application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "not_found", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 422 Validation failed; fields are named, values are not echoed application/json object **error** required object **code** required Allowed value: validation\_failed **fields** required Array \>= 1 items unique items **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "validation_failed", "fields": [ "events" ], "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` ### 429 Rate limited; retry after the Retry-After interval application/json object **error** required object **code** required string Allowed values: invalid\_token forbidden insufficient\_scope not\_found invalid\_request agreement\_required rate\_limited idempotency\_key\_reused idempotency\_key\_in\_progress not\_retryable channel\_inactive invitation\_unavailable already\_subscribed no\_subscription **feedback\_url** required Where to tell EthicsPortal what went wrong: POST product feedback here with the same token. string format: uri #### Example ``` { "error": { "code": "rate_limited", "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } } ``` --- # Receive a webhook event Source: https://ethicsportal.eu/developers/api/webhooks/receivereportevent/ POST EthicsPortal sends a signed POST request to your HTTPS endpoint when a report is created or changes, or when a deadline is close or has passed. The destination must be public. Verify HMAC-SHA256(timestamp + “.” + raw request body), timestamp freshness and event ID. At-least-once delivery; no ordering guarantee. ## Parameters ### Header Parameters **X-EthicsPortal-Event-Id** required string **X-EthicsPortal-Signature** required string `t=,v1=` ## Request Bodyrequired application/json One of: * [Report lifecycle event](https://ethicsportal.eu/developers/api/webhooks/receivereportevent/#tab-panel-0-0) * [Deadline event](https://ethicsportal.eu/developers/api/webhooks/receivereportevent/#tab-panel-0-1) * [Test event](https://ethicsportal.eu/developers/api/webhooks/receivereportevent/#tab-panel-0-2) _Report lifecycle event_object **id** required string **type** required string Allowed values: report.created report.acknowledged report.feedback\_given report.closed report.reopened report.assignment\_changed **created\_at** required string format: date-time **data** required object **id** required string **organization\_id** required string **status** required string Allowed values: received acknowledged feedback\_given closed **assigned** required boolean **created\_at** required string format: date-time **acknowledged\_at** required string | null format: date-time **feedback\_given\_at** required string | null format: date-time **closed\_at** required string | null format: date-time **acknowledgment\_due\_at** required string format: date-time **feedback\_due\_at** required string format: date-time **acknowledgment\_overdue** required boolean **feedback\_overdue** required boolean _Deadline event_object **id** required string **type** required string Allowed values: report.due\_soon report.overdue **created\_at** required string format: date-time **data** required object **report\_id** required string **organization\_id** required string **deadline\_type** required string Allowed values: acknowledgment feedback **deadline\_at** required string format: date-time _Test event_object **id** required string **type** required string Allowed values: webhook.test **created\_at** required string format: date-time **data** required object **organization\_id** required string ## Responses ### 2XX Receipt accepted. Process asynchronously and deduplicate by event ID. ### default Non-2xx responses are retried; redirects are never followed. --- # Authentication and permissions Source: https://ethicsportal.eu/developers/authentication/ Send the token in the HTTP `Authorization` header on every API request: ``` Authorization: Bearer ``` Use HTTPS and keep credentials out of URLs, logs and source control. There is no report-content or report-write scope. ## Choose a token type | | Personal token | Organisation token | | ----------------- | ------------------------------------------------------------------ | ---------------------------------------------------------------- | | Prefix | ep\_pat\_ | ep\_oat\_ | | Belongs to | You | One organisation | | Created in | Account settings → **Personal API tokens** | Organisation → **Organisation API tokens** (administrators only) | | Reaches | Every organisation you belong to, now and in future | Only its organisation | | Report access | Your current role and case permissions in each organisation | Every report’s metadata in its organisation | | When people leave | Stops for an organisation when your membership ends | Keeps working | | Typical use | Your own scripts and account tasks, such as creating organisations | Shared automations, such as a Slack or dashboard integration | Use an organisation token for anything the organisation depends on. It does not break when the person who set it up changes role or leaves, and every administrator can see and revoke it. ## Scopes Each token carries fixed scopes chosen when it is created. Each operation in the [API reference](https://ethicsportal.eu/developers/api/) lists the scope it requires; a request without it returns `403 insufficient_scope`, with a `WWW-Authenticate` header naming the missing scope. | Scope | Allows | Token types | | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | ------------- | | reports:read | List and read report metadata | Both | | channel:read | Read whistleblowing channel status | Both | | channel:write | Read and change channel configuration. [Organisation setup](https://ethicsportal.eu/developers/organisation-setup/) | Both | | webhooks:read | List webhooks and their delivery history | Both | | webhooks:write | Create, change, delete and test webhooks, rotate secrets and retry deliveries. [Webhooks](https://ethicsportal.eu/developers/webhooks/#manage-webhooks-through-the-api) | Both | | audit\_log:read | Read the organisation’s and each report’s audit trail. [Administration](https://ethicsportal.eu/developers/administration/) | Both | | members:read | List members and pending invitations | Both | | members:write | Invite members, resend and revoke invitations | Both | | documents:read | List and download the channel’s documents | Both | | billing:read | Read access and subscription status | Both | | billing:write | Create subscription checkout and billing portal links | Both | | organizations:write | Rename the organisation | Both | | organizations:create | Create organisations | Personal only | | invitations:respond | List, accept and decline your own invitations | Personal only | [Product feedback](https://ethicsportal.eu/developers/administration/#product-feedback) needs no scope: any valid token can send it. Read scopes are preselected; write scopes must be selected explicitly. Scopes cannot be changed after creation: issue a replacement token instead. ## Case permissions A personal token never does more than its owner could do in the web application. Every request rechecks current access. Administrators and viewers can read report metadata throughout their organisation. Members can read only reports assigned to them or in which they participate. Changing channel configuration, managing webhooks or invitations, listing invitations and renaming the organisation require a current administrator; reading the audit trail requires an administrator or viewer. An organisation token has no role. Its scopes alone decide what it can do, and `reports:read` covers every report in the organisation, as an administrator’s view does. Only administrators can create one. ## Which token can call each endpoint Every operation in the [API reference](https://ethicsportal.eu/developers/api/) also lists the token types it accepts under **Authorizations**. A personal token additionally needs its user’s current role, shown in the last column. | Endpoints | Organisation token | Personal token | | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------- | -------------------------------------------------------------------------------------------------------- | | [Discover organisations](https://ethicsportal.eu/developers/api/operations/getidentity/) | Yes | Any user | | [Read channel metadata](https://ethicsportal.eu/developers/api/operations/getchannel/) | Yes | Any member | | [List](https://ethicsportal.eu/developers/api/operations/listreports/) and [read](https://ethicsportal.eu/developers/api/operations/getreport/) report metadata | Yes, every report | Administrators and viewers: every report. Members: reports assigned to them or in which they participate | | [Read](https://ethicsportal.eu/developers/api/operations/getchannelconfiguration/) and [change](https://ethicsportal.eu/developers/api/operations/updatechannelconfiguration/) channel configuration | Yes | Administrator | | [Webhooks](https://ethicsportal.eu/developers/webhooks/#manage-webhooks-through-the-api) and their deliveries | Yes | Administrator | | [Organisation audit trail](https://ethicsportal.eu/developers/api/operations/listaudittrail/) | Yes | Administrator or viewer | | [A report’s audit trail](https://ethicsportal.eu/developers/api/operations/listreportaudittrail/) | Yes | Access to that report | | [List members](https://ethicsportal.eu/developers/api/operations/listmembers/) | Yes, including deactivated members | Any member. Only administrators also see deactivated members | | [List](https://ethicsportal.eu/developers/api/operations/listinvitations/), [send](https://ethicsportal.eu/developers/api/operations/createinvitation/), [resend](https://ethicsportal.eu/developers/api/operations/resendinvitation/) and [revoke](https://ethicsportal.eu/developers/api/operations/revokeinvitation/) invitations | Yes | Administrator | | [Rename the organisation](https://ethicsportal.eu/developers/api/operations/updateorganization/) | Yes | Administrator | | [List documents](https://ethicsportal.eu/developers/api/operations/listdocuments/) | Yes | Any member. Compliance evidence is listed only for administrators and viewers | | [Compliance report](https://ethicsportal.eu/developers/api/operations/downloadcompliancereport/) and [certificate](https://ethicsportal.eu/developers/api/operations/downloadcompliancecertificate/) | Yes | Administrator or viewer | | [Policy](https://ethicsportal.eu/developers/api/operations/downloadwhistleblowerpolicy/), [privacy notice](https://ethicsportal.eu/developers/api/operations/downloadprivacynotice/), [poster](https://ethicsportal.eu/developers/api/operations/downloadposter/) and [case handler manual](https://ethicsportal.eu/developers/api/operations/downloadcasehandlermanual/) | Yes | Any member | | [Billing status](https://ethicsportal.eu/developers/api/operations/getbillingstatus/), [checkout](https://ethicsportal.eu/developers/api/operations/createcheckoutlink/) and [billing portal](https://ethicsportal.eu/developers/api/operations/createbillingportallink/) links | Yes | Administrator | | [Create an organisation](https://ethicsportal.eu/developers/api/operations/createorganization/) | No | Any user with an active membership | | [List](https://ethicsportal.eu/developers/api/operations/listmyinvitations/), [accept](https://ethicsportal.eu/developers/api/operations/acceptinvitation/) and [decline](https://ethicsportal.eu/developers/api/operations/declineinvitation/) your own invitations | No | The invited user | | [Send product feedback](https://ethicsportal.eu/developers/api/operations/submitfeedback/) | Yes | Any user | Required organisation agreements apply to both types. Personal tokens also require your current account terms. Organisation discovery can list an organisation whose agreement needs renewed acceptance; reading its report or channel metadata requires acceptance. Tokens do not authenticate the web application. Open a report’s `web_url` in a separate authenticated browser session. Supplying a token alongside a browser cookie does not unlock confidential endpoints. ## Expiry and replacement Tokens expire after 90 days and cannot renew themselves. Generate a replacement, update the consuming system, verify it, then revoke the old token. Full credentials are displayed once when created. Each user, and each organisation, can have up to 20 unexpired, unrevoked API tokens. Revoke an unused token to free a slot. ## Token activity Token lists show **Last used**, or **Never used** if no activity has been recorded. Users see activity for their own tokens; organisation administrators see it for their organisation’s tokens. **Last used** records a request that passed credential, request-shape, account-terms and token-rate checks. It can update even when access to the requested organisation or resource is denied. **Last successful request** records a completed 2xx API response, including authorised setup writes, discovery and HEAD requests. **Last refusal** shows a timestamp and fixed diagnostic code for a request made with that credential. Unknown credentials never update another token’s diagnostics. | Refusal code | Meaning | | ------------------- | --------------------------------------------------------------------------- | | expired / revoked | Replace the expired or revoked token | | unavailable | The owner’s account, or the token’s organisation, can no longer be used | | agreement\_required | Accept the required user terms or organisation DPA in the web application | | invalid\_request | Review JSON body types, allowed fields, query, filters or pagination cursor | | validation\_failed | Correct the fields named in the validation error | | rate\_limited | Respect the response’s retry interval | | insufficient\_scope | The token lacks the scope the operation requires | | forbidden | Current permissions do not allow the action | | not\_found | The resource is missing or inaccessible, or API access is suspended | Each timestamp updates at most once per minute independently. The code describes the refusal sampled at that timestamp; later refusals within that minute may have a different cause. These are operational hints, not a complete request history. Disallowed routes/formats and IP throttling before credential identification do not update them. HTTP errors continue to conceal whether an invalid credential is expired, revoked or unavailable. ## Revocation Users revoke their own personal tokens in account settings. Organisation administrators revoke organisation tokens on the organisation’s token page. An organisation stops a person’s personal tokens from reaching its data by ending that person’s membership. Existing credentials remain available for revocation while API access is suspended. Closing an account removes its personal tokens; organisation tokens and webhooks stay with the organisation. Banned or closed accounts cannot authenticate. ## Separate credentials API tokens, webhook signing secrets, SCIM provisioning tokens and browser sessions serve different purposes. Never interchange them. OAuth access tokens exist only for the [MCP server](https://ethicsportal.eu/developers/mcp/): they work at its endpoint, and the API refuses them. --- # Integration changelog Source: https://ethicsportal.eu/developers/changelog/ ## Versioning and compatibility The API has one current contract. URLs carry no version. The `info.version` field in the [OpenAPI schema](https://ethicsportal.eu/openapi.json) identifies the contract with semantic versioning: the minor version rises for additions and the major version for a breaking change. Every change is listed on this page with its date. ### Changes that do not break clients These can ship at any time, recorded here: * New endpoints, operations and scopes. * New optional request fields. * New response fields, including fields inside nested objects. * New values in fields that list a fixed set of values, such as a report `status`. * New webhook event types, and new fields in webhook payloads. * New error codes, response headers and `_url` links. ### Build your client to tolerate them * Ignore response and webhook fields you do not recognise. * Handle an unknown value in a fixed-value field without failing. * Acknowledge webhook events whose `type` you do not handle with a `2xx` response, and ignore them. * Follow `_url` links and `Link` headers instead of building URLs. * Treat IDs and cursors as opaque strings. ### Breaking changes A breaking change removes or renames a field, endpoint or event type, changes a field’s type or meaning, makes an optional request field required, or asks for a different scope. The confidential-data boundary never changes: no version adds report content to the API. We avoid breaking changes. If one is needed: 1. The new behaviour ships next to the old one. 2. The old one is marked deprecated in the OpenAPI schema, and its responses carry `Deprecation` and `Sunset` headers ([RFC 9745](https://www.rfc-editor.org/rfc/rfc9745), [RFC 8594](https://www.rfc-editor.org/rfc/rfc8594)). 3. We email everyone whose tokens still use it: the owner of a personal token, or the administrators of the organisation that owns an organisation token. 4. It keeps working for at least six months after that email. If breaking changes ever become frequent, new behaviour will be opt-in through an `EthicsPortal-Version` date header. Requests without the header will keep the contract they use today. ## MCP server 10 November 2026\. An AI assistant can connect to EthicsPortal through the [MCP server](https://ethicsportal.eu/developers/mcp/) and call the API’s operations as tools, after a person approves the connection with OAuth. It started as a pilot for chosen organisations. Existing API tokens and webhooks work as before. In the audit trail, an entry written through a connection has the actor kind `mcp`. 11 November 2026\. A person with no account or no organisation can [start from an assistant](https://ethicsportal.eu/developers/mcp/#start-without-an-organisation): they sign up on the consent screen, and the assistant creates their first organisation. The same day, the MCP server opened to every organisation that has API access. ## 1.1.0: feedback from any token, and a feedback link in every error Released on 10 November 2026. * [Product feedback](https://ethicsportal.eu/developers/administration/#product-feedback) needs no scope. Any valid token can send it, and an organisation token can send it too. The `feedback:write` scope no longer exists. It was removed from the tokens that held it, and their other scopes are unchanged. * Every error response carries `error.feedback_url`, the address of the feedback operation. [Errors](https://ethicsportal.eu/developers/pagination-and-errors/#errors). ## 1.0.1: audit trail entries appear after a minute Released on 10 November 2026\. Both audit trail endpoints now return an entry once it is a minute old. Before, an entry whose write finished late could appear behind a timestamp a collector had already passed, and resuming with `created_after` skipped it. [Read the audit trail](https://ethicsportal.eu/developers/administration/#read-the-audit-trail). ## Initial contract Version 1.0.0, released on 10 November 2026\. The first API and webhook contract, available to every organisation. * Organisation, whistleblowing channel and report metadata reads. * Personal tokens that act with their owner’s current role in every organisation, and organisation tokens that belong to one organisation and keep working when staff change. * Fixed scopes per token: `reports:read`, `channel:read`, `channel:write`, `webhooks:read`, `webhooks:write`, and `organizations:create` for personal tokens. A missing scope returns `insufficient_scope` and names it in `WWW-Authenticate`. * Lists are objects with `data` and `next_cursor`, so they can gain fields without breaking clients. * `Idempotency-Key` on every POST makes retries after a lost response safe. * The audit trail, members, invitations and organisation renaming, with `audit_log:read`, `members:read`, `members:write` and `organizations:write`. * Document downloads (`documents:read`), billing status (`billing:read`), and accepting or declining your own invitations with a personal token (`invitations:respond`). * Product feedback with a personal token (`feedback:write`). * Subscription checkout and billing portal links (`billing:write`), completed by a person on Stripe’s pages. * `ETag` on every JSON read with `If-None-Match` support, and `_url` links so clients can navigate from `/identity.json` without building URLs. * Organisation creation and channel configuration with strict JSON writes and field-only validation errors. New organisations still need their DPA accepted in the application. * Organisation-owned, signed lifecycle and deadline webhooks, with retries, stable event IDs and scheduled retry times in delivery history. Everything on the webhook screen is also available through the API. * Token activity with separately sampled successful requests and refusals, plus a limit of 20 active tokens per user and per organisation. * Webhook failure warnings with administrator notifications. Failures do not automatically disable webhooks. * Explicit exclusion of report content, identities, attachments, messages, notes, category, closure outcome and retaliation. --- # Data boundaries Source: https://ethicsportal.eu/developers/data-boundaries/ The API supports operational monitoring and explicitly authorised organisation and whistleblowing channel setup. It cannot read report content or submit or change reports. The [MCP server](https://ethicsportal.eu/developers/mcp/) offers the same operations as tools, so the same boundary applies to it. ## Included report fields The [generated reference](https://ethicsportal.eu/developers/api/) is the field-by-field contract. Report responses contain: * Obfuscated report and organisation IDs. * Workflow status: `received`, `acknowledged`, `feedback_given` or `closed`. * Whether an assignee exists, without their identity. * Creation, acknowledgement, feedback and closure timestamps. * Acknowledgement and feedback deadlines and overdue flags. * API and authenticated web links. Dates use UTC ISO-8601\. These timestamps describe recorded workflow state. Closing a report can fill missing acknowledgement and feedback timestamps; reopening can clear automatically filled values. They do not prove a message was delivered or a legal obligation was fulfilled. ## Always excluded Excluded fields are omitted entirely. They are never returned as `REDACTED`, and there is no expansion option. * Subject, description, summaries, translations and intake answers. * Reporter identity, contact information and access credentials. * Attachments, recordings and their metadata. * Messages and notes, including their counts. * Category, closure outcome and retaliation indicators. * Priority, source, language, confirmation and assignee identities. * Audit metadata, notification text, PDFs and exports. There is no `updated_at` field or filter that reveals hidden content activity. Changes confined to excluded content do not emit webhook events. ## Handle metadata appropriately Operational metadata can still identify a case inside your organisation. Restrict access to the receiving system and store only what the integration needs. Report links require a separate authenticated browser session. ## Audit trail The [audit trail](https://ethicsportal.eu/developers/administration/#read-the-audit-trail) returns who did what and when, without change details, IP addresses or email addresses. It omits anything a reporter did and every entry about messages, notes or retaliation reports, so their existence, number and timing stay inside the application. ## Whistleblowing channel metadata The channel endpoint returns its identifier, active state and public online reporting form URL. It does not expose handler identities or private settings. A separate [configuration resource](https://ethicsportal.eu/developers/organisation-setup/) requires the `channel:write` scope; it includes company details, settings and the compliance officer’s obfuscated membership ID. Those fields never appear in report metadata or webhook snapshots. --- # Fetch every report Source: https://ethicsportal.eu/developers/examples/pagination/ This Python 3 example uses the standard library. Supply `ETHICSPORTAL_TOKEN` and `ETHICSPORTAL_ORGANIZATION_ID` through your environment, then run the [downloadable example](https://ethicsportal.eu/developers/examples/paginate.py). ``` python3 paginate.py ``` It prints one report metadata object per line. It passes each page’s `next_cursor` back as the `cursor` parameter, so it only ever requests the report collection on the EthicsPortal origin, and it refuses redirects. paginate.py ``` """Fetch authorised report metadata using Python 3's standard library.""" import json import os import urllib.error import urllib.parse import urllib.request ORIGIN = "https://secure.ethicsportal.eu" class NoRedirects(urllib.request.HTTPRedirectHandler): def redirect_request(self, req, fp, code, msg, headers, newurl): return None def reports(token, organization_id, opener=None): base = f"{ORIGIN}/organizations/{urllib.parse.quote(organization_id, safe='')}/whistleblower/reports.json" opener = opener or urllib.request.build_opener(NoRedirects()) cursor, seen = None, set() while True: query = {"limit": "100", **({"cursor": cursor} if cursor else {})} request = urllib.request.Request(f"{base}?{urllib.parse.urlencode(query)}", headers={ "Authorization": f"Bearer {token}", "Accept": "application/json" }) with opener.open(request, timeout=20) as response: page = json.load(response) if not isinstance(page, dict) or not isinstance(page.get("data"), list): raise ValueError("Expected a report list") yield from page["data"] cursor = page.get("next_cursor") if not cursor: return if cursor in seen: raise ValueError("Repeated pagination cursor; restart reconciliation") seen.add(cursor) if __name__ == "__main__": try: for report in reports(os.environ["ETHICSPORTAL_TOKEN"], os.environ["ETHICSPORTAL_ORGANIZATION_ID"]): print(json.dumps(report)) except urllib.error.HTTPError as error: retry = error.headers.get("Retry-After", "unspecified") if error.code == 429 else None raise SystemExit(f"API returned HTTP {error.code}" + (f"; retry after {retry} seconds" if retry else "")) from None ``` A `429` stops the example and reports the wait interval. In a scheduled integration, wait and retry with bounded backoff. Start a fresh traversal after an expired cursor and reconcile by report ID; permissions can change between pages. The output contains case metadata, so handle it according to your organisation’s access and retention rules. --- # Verify a webhook Source: https://ethicsportal.eu/developers/examples/verify-webhook/ Use this helper in a Node.js receiver. [Download verify-webhook.mjs](https://ethicsportal.eu/developers/examples/verify-webhook.mjs). It uses only the built-in cryptography module. verify-webhook.mjs ``` import { createHmac, timingSafeEqual } from 'node:crypto' export function verifyWebhook({ rawBody, signature, eventId, secret, now = Date.now() }) { if (!Buffer.isBuffer(rawBody) || rawBody.length > 256 * 1024) throw new Error('Invalid webhook body') if (typeof secret !== 'string' || !secret) throw new Error('Missing signing secret') if (typeof signature !== 'string' || typeof eventId !== 'string' || !eventId) throw new Error('Missing webhook headers') const match = /^t=(\d+),v1=([a-f0-9]{64})$/.exec(signature) if (!match) throw new Error('Invalid signature header') const timestamp = Number(match[1]) if (!Number.isSafeInteger(timestamp) || !Number.isFinite(now) || Math.abs(now / 1000 - timestamp) > 300) { throw new Error('Webhook timestamp outside tolerance') } const expected = createHmac('sha256', secret).update(`${match[1]}.`).update(rawBody).digest() if (!timingSafeEqual(expected, Buffer.from(match[2], 'hex'))) throw new Error('Invalid webhook signature') const event = JSON.parse(rawBody.toString('utf8')) if (!event || typeof event !== 'object' || event.id !== eventId) throw new Error('Event ID mismatch') return event } ``` ## Connect it to your HTTP handler Read the request body as a `Buffer`, with a size limit enforced **while reading**. Do not let JSON middleware transform it before verification. Pass the raw body, `X-EthicsPortal-Signature`, `X-EthicsPortal-Event-Id` and your secret to `verifyWebhook`. ``` const event = verifyWebhook({ rawBody, signature: request.headers['x-ethicsportal-signature'], eventId: request.headers['x-ethicsportal-event-id'], secret: process.env.ETHICSPORTAL_WEBHOOK_SECRET }) ``` Catch verification failures and return a non-2xx response. Do not log the secret or full body. A valid signature authenticates a delivery; it does not make the delivery unique. ## Persist before acknowledging In your application’s database, insert the verified event into a durable inbox with a unique event ID. On a duplicate, return `2xx` without inserting or applying it again. Return `2xx` for a new event only after the inbox transaction commits. If storage is unavailable, return a failure status. A worker can then process the inbox with idempotent business operations. This helper deliberately handles verification only; the durable inbox belongs in your application. [Delivery and retry semantics](https://ethicsportal.eu/developers/webhooks/). --- # SAML and SCIM Source: https://ethicsportal.eu/developers/identity-integrations/ EthicsPortal supports two identity integrations. Each one is configured per organisation and works without the other: * **SAML 2.0 single sign-on** lets members sign in through your identity provider. * **SCIM 2.0 provisioning** lets your identity provider add, update and deactivate members. Use both to keep access to cases in step with your directory: SCIM decides who is a member, and SAML decides how they sign in. ## Before you start | Requirement | Details | | -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Role | Organisation **Admin**. Other roles do not see these settings. | | Subscription | The organisation needs active access. Without it, the settings open the billing page instead. | | Where | **Organisation → Enterprise identity → Single sign-on (SSO)** and **Organisation → Enterprise identity → SCIM provisioning** | | Identity check | EthicsPortal asks you to confirm your identity before it opens either screen. | | Credentials | SAML uses your identity provider’s signing certificate. SCIM uses its own bearer token. Neither uses an [API token](https://ethicsportal.eu/developers/authentication/), and an API token does not work for either. | All values on this page use the production host `https://secure.ethicsportal.eu`. The settings screens show the same values with a copy button. ## SAML 2.0 single sign-on EthicsPortal acts as the SAML service provider (SP). One set of SP values serves every organisation: EthicsPortal finds the right organisation from the email domain the person enters, so there is no organisation-specific URL. | Setting | Value | | -------------------------- | ------------------------------------------------- | | SP entity ID and metadata | https://secure.ethicsportal.eu/auth/saml/metadata | | Assertion consumer service | https://secure.ethicsportal.eu/auth/saml/callback | | Binding | HTTP-POST | | NameID | Email address | The metadata URL returns the SP metadata as XML. You can import it in identity providers that accept a metadata URL, or enter the two URLs by hand. The metadata states that assertions must be signed and requests the `email` and `name` attributes. ### Identity provider requirements | Item | Requirement | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | Sign-in flow | Service-provider-initiated only. People start at EthicsPortal. Sign-in started from an identity provider dashboard or app tile is refused. | | Authentication request | EthicsPortal sends an unsigned request to your SSO URL with the HTTP-Redirect binding. Do not require signed requests. | | Response | Sent to the assertion consumer service URL with HTTP-POST. The Destination must be that URL. | | Audience | Exactly the SP entity ID: https://secure.ethicsportal.eu/auth/saml/metadata | | Issuer | Exactly the identity provider entity ID you enter in EthicsPortal | | Signature | The **assertion** must be signed. A response where only the outer envelope is signed is refused. Signing both is fine. | | Algorithms | RSA-SHA256 signature and SHA-256 digest. SHA-1 is refused. | | Encryption | Do not encrypt the assertion. The connection is protected by HTTPS. | | Validity | The assertion must be inside its validity window. EthicsPortal allows 30 seconds of clock difference. | | Time limit | The person must finish signing in within 10 minutes of starting at EthicsPortal. | | Single logout | Not supported. Leave the single logout URL empty. | ### Attributes | Data | Where EthicsPortal reads it | Required | | ------------- | -------------------------------------------------------------------------------------------------- | -------- | | Email address | An attribute named email or mail. If neither is present, the NameID value. | Yes | | NameID format | urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress, with the user’s email address as the value | Yes | | Display name | An attribute named name | No | Attribute names are matched exactly. Names written as URIs, or `first_name` and `last_name`, are not read. Without a `name` attribute, a person created on first sign-in is named after their email address. The email address must be in one of the organisation’s verified domains. EthicsPortal compares addresses without regard to letter case. ### Set up single sign-on 1. In your identity provider, create a SAML 2.0 application for EthicsPortal. Enter the SP entity ID and the assertion consumer service URL from the table above. Set the NameID to the user’s email address with the email address format, and add a `name` attribute if you want display names. 2. Make sure the application signs the assertion with SHA-256. 3. In EthicsPortal, open **Organisation → Enterprise identity → Single sign-on (SSO)**. Copy these values from your identity provider: * **Identity provider entity ID**: the issuer from your identity provider’s SAML metadata. * **Identity provider SSO URL**: the sign-on endpoint. It must be an `https://` URL. * **Identity provider certificate**: the X.509 signing certificate, in PEM format (with or without the `BEGIN CERTIFICATE` lines). 4. Choose the **Default role for provisioned members** and whether to **Provision members on first sign-in**. Leave **Enable single sign-on** and **Require single sign-on** off for now. Select **Save changes**. 5. Under **Email domains**, add each domain your people’s addresses use, then verify it. See [Verify your email domains](https://ethicsportal.eu/developers/identity-integrations/#verify-your-email-domains). 6. Turn on **Enable single sign-on** and save. EthicsPortal refuses to enable a connection without the three identity provider values and at least one verified domain. 7. Test it. Sign out, open the sign-in page, choose **Sign in with single sign-on** and enter your work email. You can also go straight to `https://secure.ethicsportal.eu/sso/new`. The settings screen then shows the time of the last sign-in through your identity provider. 8. When the test works, decide whether to turn on **Require single sign-on**. See [Require single sign-on](https://ethicsportal.eu/developers/identity-integrations/#require-single-sign-on). Assign the EthicsPortal application in your identity provider to the people who handle cases. EthicsPortal accepts an assertion only for an address in a verified domain. The [just-in-time provisioning](https://ethicsportal.eu/developers/identity-integrations/#just-in-time-provisioning) setting and existing memberships decide what that person can then reach. ### Verify your email domains A domain does nothing until it is verified. Only verified domains send people to your identity provider, and only addresses in verified domains are accepted from it. 1. Enter the domain under **Email domains**, for example `example.com`, and select **Add domain**. 2. Publish the TXT record shown for it at the root (`@`) of that domain. It has this form: ``` ethicsportal-verification= ``` 3. Select **Verify**. EthicsPortal looks the record up when you press the button. If DNS has not updated yet, wait and try again; changes can take up to 24 hours. Each domain matches exactly. Add subdomains separately: verifying `example.com` does not cover `eu.example.com`. One connection can hold several domains. Only one EthicsPortal organisation can hold a domain as verified. Once verified, EthicsPortal treats your identity provider as the sign-in route for every EthicsPortal account with an address in that domain. This includes accounts that belong only to other EthicsPortal organisations. The identity provider signs those people in, but that does not add them to your organisation. Removing a domain stops sending its addresses to your identity provider. ### Just-in-time provisioning **Provision members on first sign-in** is off by default. Leave it off if you add members with SCIM or invitations. | Person signing in | Provisioning off | Provisioning on | | ----------------------------------------------- | ----------------------------------------- | ---------------------------------------------------- | | Active member of your organisation | Signed in | Signed in | | Deactivated member of your organisation | Signed in, no access to your organisation | Reactivated, then signed in | | Has no EthicsPortal account | Refused | Account and membership created with the default role | | Has an EthicsPortal account but is not a member | Signed in, not added to your organisation | Signed in, not added to your organisation | People who already hold an EthicsPortal account join your organisation by accepting an invitation, sent by an administrator or by [SCIM](https://ethicsportal.eu/developers/identity-integrations/#scim-20-provisioning). Single sign-on alone never adds an existing account to an organisation. A reactivated member returns with the lower of their previous role and the default role. The identity provider confirms who someone is. It does not restore a role an administrator removed. If a member has turned on two-factor authentication in EthicsPortal, they still enter their authenticator code after signing in through your identity provider. ### Require single sign-on **Require single sign-on** applies to every address in the connection’s verified domains: * Emailed sign-in codes (magic links) are refused for those addresses. The sign-in page sends them to single sign-on with the message “Your organization requires single sign-on. Continue with your identity provider.” * Existing sessions for those addresses that were not started through your identity provider end at their next request. This also happens when you enable an enforced connection or verify another domain on it. * A member with an address in an enforced domain can change their email only to another address in the same domains. Nobody can change their email into a domain where another organisation requires single sign-on unless they are a member of that organisation. To prevent a lockout, an administrator whose own address is in the domain must be signed in through single sign-on before turning this on. Otherwise saving fails with “Sign in through single sign-on once before requiring it, so a setup mistake can’t lock you out.” Addresses outside the verified domains, such as external counsel, keep signing in with emailed codes. ### Sessions and sign-out An EthicsPortal session ends after 14 days without activity, or when the person signs out. Signing out of your identity provider, or disabling the person there, does not end an EthicsPortal session that already exists. To remove access at once, deactivate the member: through SCIM, or in **Team** in EthicsPortal. ### Rotate the signing certificate Identity providers issue a new signing certificate before the old one expires. To rotate without interruption: 1. Paste the new certificate below the old one in **Identity provider certificate** and save. Assertions signed with either certificate are accepted. 2. Switch your identity provider to the new certificate. 3. Remove the old certificate from the field and save. The settings screen shows the latest expiry date among the certificates in the field. When every certificate has expired, it shows a warning and all sign-ins fail until you add a valid one. ### Okta | Okta field | Value | | --------------------------- | ------------------------------------------------------------------------------------------------ | | Single sign-on URL | https://secure.ethicsportal.eu/auth/saml/callback (keep it as the recipient and destination URL) | | Audience URI (SP Entity ID) | https://secure.ethicsportal.eu/auth/saml/metadata | | Name ID format | EmailAddress | | Application username | Email | | Attribute statements | email \= user.email; name \= user.firstName + " " + user.lastName | | Assertion signature | Signed, RSA-SHA256 | Copy Okta’s **Identity Provider Issuer**, **Identity Provider Single Sign-On URL** and **X.509 Certificate** into the matching EthicsPortal fields. Sign-in from the Okta dashboard tile is identity-provider-initiated and is refused. Hide the tile, or replace it with a bookmark to `https://secure.ethicsportal.eu/sso/new`. ### Microsoft Entra ID | Entra ID field | Value | | ------------------------------------------ | --------------------------------------------------------------------------------------------------- | | Identifier (Entity ID) | https://secure.ethicsportal.eu/auth/saml/metadata | | Reply URL (Assertion Consumer Service URL) | https://secure.ethicsportal.eu/auth/saml/callback | | Sign on URL | https://secure.ethicsportal.eu/sso/new, so that opening the app from My Apps starts at EthicsPortal | | Unique User Identifier (Name ID) | The user’s email address, for example user.mail, with the email address format | | Additional claim | Name name with no namespace, source user.displayname | | Signing option | Sign SAML assertion, or sign both the response and the assertion | | Signing algorithm | SHA-256 | Copy **Microsoft Entra Identifier** to **Identity provider entity ID**, **Login URL** to **Identity provider SSO URL**, and the contents of **Certificate (Base64)** to **Identity provider certificate**. Entra ID’s default claims use URI names, which EthicsPortal does not read. The email address therefore comes from the NameID. If a user principal name differs from the email address, map the NameID to the email address. ### Google Workspace and other identity providers Any SAML 2.0 identity provider that meets the [requirements](https://ethicsportal.eu/developers/identity-integrations/#identity-provider-requirements) works. In a custom SAML application, enter the assertion consumer service URL as the ACS URL and the SP entity ID as the entity ID. Set the NameID format to email, with the user’s primary email as the value. Add a `name` attribute for display names. ## SCIM 2.0 provisioning | Setting | Value | | -------------- | -------------------------------------------------------------- | | Base URL | https://secure.ethicsportal.eu/scim/v2 | | Authentication | Dedicated bearer token generated in organisation SCIM settings | | Resource | /Users | | Media type | application/scim+json | The token identifies the organisation, so the base URL is the same for every organisation. A SCIM user is a person’s membership in your organisation. ### Generate and manage the token 1. Open **Organisation → Enterprise identity → SCIM provisioning** and select **Generate token**. 2. Copy the token. It starts with `scim_` and is shown only once. EthicsPortal cannot display it again. 3. In your identity provider, enter the base URL and the token as the bearer token or secret. | Action | Effect | | ---------------------------------------- | --------------------------------------------------------------------------------- | | **Regenerate token** | Issues a new token. The old token stops working immediately. | | **Disable** | Every request is refused with 401 until you select **Enable**. The token is kept. | | **Remove** | Deletes the connection and its token. Members already provisioned stay. | | **Default role for provisioned members** | The role new members receive: Admin, Handler or Viewer. Handler is the default. | The screen shows the last four characters of the token and the time of the last request from your identity provider. Send the token in the `Authorization` header on every request: ``` Authorization: Bearer scim_... Content-Type: application/scim+json ``` ### Endpoints | Method | Path | Purpose | | ------ | ------------------------------------- | --------------------------------------------- | | GET | /Users | List members, with optional filter and paging | | GET | /Users/{id} | Read one member | | POST | /Users | Provision a member | | PUT | /Users/{id} | Replace a member’s attributes | | PATCH | /Users/{id} | Update attributes or deactivate | | DELETE | /Users/{id} | Deactivate a member | | GET | /ServiceProviderConfig | Supported features | | GET | /ResourceTypes, /ResourceTypes/{name} | Resource types | | GET | /Schemas | Schemas | All endpoints require the token. There is no `/Groups` endpoint and no bulk endpoint. Turn off group push or group provisioning in your identity provider; assigning a group to the application still provisions its members one by one. Sorting and ETags are not supported. ### Attribute mapping | SCIM attribute | Read and write | What it sets in EthicsPortal | | ------------------------------- | ----------------------- | ------------------------------------------------------------------ | | id | Read only | EthicsPortal’s identifier for the member. Use it in /Users/{id}. | | externalId | Read and write | Your identity provider’s identifier, stored and returned unchanged | | userName | Read; written on create | The person’s email address. It must be an email address. | | emails\[primary eq true\].value | Read; written on create | The same email address, returned with type work | | displayName | Read and write | The person’s name in your organisation | | name.formatted | Read and write | Same as displayName | | active | Read and write | false deactivates the member, true reactivates them | | meta.created, meta.lastModified | Read only | When the member was added and last changed | Other attributes, including `name.givenName`, `name.familyName` and `roles`, are not stored. Map `displayName` if you want names to appear. The email address is fixed once a member exists. A later change to `userName` or `emails` is accepted but has no effect. An EthicsPortal account can belong to several organisations, and one organisation’s identity provider cannot change it for the others. A name set through SCIM applies in your organisation only. When SCIM creates a brand-new account, the name also becomes that account’s name. Roles are not synchronised. New members receive the default role, and administrators change roles in EthicsPortal. ### Provision a user ``` POST /scim/v2/Users HTTP/1.1 Host: secure.ethicsportal.eu Authorization: Bearer scim_... Content-Type: application/scim+json { "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"], "userName": "jane.doe@example.com", "externalId": "00u1abcd2EFGH3ijk4l5", "displayName": "Jane Doe", "emails": [{ "value": "jane.doe@example.com", "type": "work", "primary": true }], "active": true } ``` Response `201 Created`: ``` { "id": "4821", "externalId": "00u1abcd2EFGH3ijk4l5", "userName": "jane.doe@example.com", "name": { "formatted": "Jane Doe" }, "displayName": "Jane Doe", "emails": [{ "primary": true, "value": "jane.doe@example.com", "type": "work" }], "active": true, "meta": { "location": "https://secure.ethicsportal.eu/scim/v2/Users/4821", "created": "2026-11-09T10:15:00Z", "lastModified": "2026-11-09T10:15:00Z", "resourceType": "User" }, "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"] } ``` What `POST /Users` does depends on the address: | Address | Result | | ---------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | No EthicsPortal account | Account and active membership created with the default role. 201. | | Deactivated member of your organisation | Reactivated with the lower of their previous role and the default role. 201. | | Active member of your organisation | 409, scimType uniqueness | | Existing EthicsPortal account, not a member | Not added. EthicsPortal emails the person an invitation and answers 409. After they accept, retry the assignment: the identity provider finds the member by userName. | | In a domain another organisation has verified for single sign-on | 409. Invite the person instead. | An account that was never confirmed and belongs to no organisation counts as having no account if your organisation has verified its domain for single sign-on. Repeated requests for the same address do not send duplicate invitations while one is pending. New members receive no welcome email from provisioning. They sign in through single sign-on, or with an emailed code if single sign-on is not required for their domain. ### List and filter users ``` GET /scim/v2/Users?filter=userName%20eq%20%22jane.doe%40example.com%22 HTTP/1.1 ``` ``` { "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"], "totalResults": 1, "startIndex": 1, "itemsPerPage": 100, "Resources": [{ "id": "4821", "userName": "jane.doe@example.com", "active": true }] } ``` The list contains every member of your organisation, including members added by invitation and deactivated members (`"active": false`). The `Resources` entries are full user objects, shortened here. | Filter attribute | Notes | | -------------------- | ----------------------------------------- | | userName | Matched without regard to letter case | | emails, emails.value | Same as userName | | externalId | Case-sensitive | | id | Case-sensitive | | active | Accepted, but does not narrow the results | Supported operators: `eq`, `ne`, `co`, `sw`, `ew`, `gt`, `ge`, `lt`, `le`, `pr`, combined with `and` and `or`. Filtering on any other attribute returns `400` with `scimType` `invalidFilter`. ### Pagination | Parameter | Default | Meaning | | ---------- | ------- | ------------------------------------------------------- | | startIndex | 1 | 1-based position of the first result | | count | 100 | Maximum number of results. 0 returns only totalResults. | Results are ordered by `id`, oldest first. `itemsPerPage` repeats the requested `count`. Continue until `startIndex + count` is greater than `totalResults`. ### Update and replace users `PATCH` accepts a SCIM `PatchOp` with the operations `add`, `replace` and `remove`, with or without a `path`: ``` { "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"], "Operations": [ { "op": "replace", "path": "displayName", "value": "Jane Smith" }, { "op": "replace", "value": { "active": false } } ] } ``` Send `active` as a JSON boolean (`true` or `false`). `PUT` replaces the member’s attributes with the request body. Send the full user, including `externalId` and `active`. A `PUT` that leaves out `active` does not deactivate anyone. Both return `200` with the updated user. ### Deactivate users `DELETE /Users/{id}`, or setting `active` to `false`, deactivates the membership. It does not delete it. `DELETE` returns `204 No Content` and is safe to repeat. When a member is deactivated: * They lose access to the organisation at their next request. * Their open reports are unassigned and they are removed from reports they participate in. * They see a notification in EthicsPortal that their access ended. * The change is recorded in the audit trail as made by SCIM. * Their past actions stay attributed to them in case history and the audit trail. Some members cannot be deactivated. EthicsPortal answers `409` with the reason, and the member stays active: | Member | Reason returned | What to do | | ------------------------------------------------ | --------------------------------------------------------------- | ---------------------------------------------------------------------------------- | | Organisation owner | The organization owner cannot be deactivated. | Transfer ownership in EthicsPortal first | | Only active admin | This is the only active admin. | Make another member an Admin first | | Compliance officer of the whistleblowing channel | This member is the whistleblowing channel’s compliance officer. | Assign a different compliance officer in the whistleblowing channel settings first | Setting `active` to `true`, or a new `POST` for the same address, reactivates the member with the lower of their previous role and the default role. ### SCIM errors Errors use the SCIM error format: ``` { "schemas": ["urn:ietf:params:scim:api:messages:2.0:Error"], "detail": "User jane.doe@example.com is already provisioned in this organization.", "status": "409", "scimType": "uniqueness" } ``` | Status | Cause | | ------ | ---------------------------------------------------------------------------------------------------------- | | 400 | Invalid JSON, empty body, invalid resource, unknown PATCH operation, or unsupported filter (invalidFilter) | | 401 | Missing or unknown token, a regenerated token, or a disabled or removed connection | | 404 | No member with that id in this organisation | | 406 | Unsupported media type. Send Content-Type: application/scim+json. | | 409 | See [Provision a user](https://ethicsportal.eu/developers/identity-integrations/#provision-a-user) and [Deactivate users](https://ethicsportal.eu/developers/identity-integrations/#deactivate-users) | | 429 | More than 300 requests in one minute with the same token. Retry after a pause. | ### Okta provisioning In the Okta application’s provisioning settings, use SCIM 2.0 with: | Okta field | Value | | --------------------------------- | --------------------------------------------------------------- | | SCIM connector base URL | https://secure.ethicsportal.eu/scim/v2 | | Unique identifier field for users | userName | | Supported provisioning actions | Push New Users, Push Profile Updates. Do not select group push. | | Authentication mode | HTTP Header, with the SCIM token as the bearer token | Then enable creating users, updating user attributes and deactivating users. Make sure `userName` is the user’s email address and `displayName` is mapped. ### Microsoft Entra ID provisioning Set the provisioning mode to automatic and enter: | Entra ID field | Value | | -------------- | -------------------------------------- | | Tenant URL | https://secure.ethicsportal.eu/scim/v2 | | Secret token | The SCIM token | Test the connection, then check the user attribute mappings. `userName` must hold the email address; if user principal names differ from email addresses, map `userName` to `mail`. Turn off group provisioning, because EthicsPortal has no `/Groups` endpoint. ## Troubleshooting ### Single sign-on messages | Message or symptom | Cause | Fix | | ------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | “Single sign-on isn’t set up for that email domain.” | The connection is not enabled, or the address’s domain is not verified on it | Enable the connection, and add and verify the domain | | “We couldn’t complete single sign-on. Please try again.” | The assertion was refused: wrong certificate, only the response signed, SHA-1, audience or issuer mismatch, wrong Destination, clock difference beyond 30 seconds, sign-in started from an identity provider tile, more than 10 minutes since starting, or the same response sent twice | Check the values in [identity provider requirements](https://ethicsportal.eu/developers/identity-integrations/#identity-provider-requirements) and start again at https://secure.ethicsportal.eu/sso/new | | “Your identity provider signed you in, but you don’t have access here yet. Ask an administrator to add you.” | The asserted email address is not in a verified domain, the person has no account and just-in-time provisioning is off, or the account cannot be used | Check the email the identity provider sends, invite the person or provision them with SCIM, or turn on just-in-time provisioning | | “needs at least one verified email domain before single sign-on can be enabled” | No verified domain | Verify a domain first | | “Sign in through single sign-on once before requiring it, so a setup mistake can’t lock you out.” | Your current session did not start through single sign-on | Sign out, sign in through single sign-on, then turn on **Require single sign-on** | | “doesn’t look like a valid X.509 certificate” | The certificate field contains something other than certificates | Paste the certificate from your identity provider, in PEM or Base64 form | | “We couldn’t find the TXT record yet” | The record is not visible in DNS yet, or is not at the domain root | Check the record and wait for DNS to update. | | “Another organisation has already verified this domain” | The domain is verified by a different organisation, and only one can hold it | If the domain is yours, [contact support](mailto:support@ethicsportal.eu). | | “Your organization requires single sign-on. Continue with your identity provider.” | Emailed sign-in codes are refused for this domain | Sign in through single sign-on | | All sign-ins fail from one day | The identity provider certificate expired or was replaced | Paste the current certificate. See [Rotate the signing certificate](https://ethicsportal.eu/developers/identity-integrations/#rotate-the-signing-certificate). | ### Provisioning problems | Symptom | Cause | Fix | | ------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------- | --------------------------------------------------------------------- | | 401 on every request | Wrong token, token regenerated, or connection disabled | Enter the current token, or select **Enable** | | 409 with “an invitation to join this organization has been sent” | The address already has an EthicsPortal account | Ask the person to accept the invitation, then retry the assignment | | 409 with “is in a domain another organization has verified for single sign-on” | Another organisation owns that domain | Invite the person instead | | 409 when deactivating | The member is the owner, the only active admin, or the channel’s compliance officer | Follow the table in [Deactivate users](https://ethicsportal.eu/developers/identity-integrations/#deactivate-users) | | Members have no name | displayName is not mapped | Map displayName in your identity provider | | Email change in the directory not reflected | Email addresses are fixed once provisioned | The person changes their email in their EthicsPortal account settings | ## Metadata API and member lifecycle Deactivation through SCIM ends a member’s access to the organisation through the metadata API as well. Their personal API tokens stop reaching the organisation, and they stop receiving the alerts sent to administrators when a webhook fails. Organisation API tokens and webhooks belong to the organisation and keep working. [API permissions](https://ethicsportal.eu/developers/authentication/). The metadata API lists members and sends invitations, but it does not deactivate members or change roles. Use SCIM or the web application for that. See [Members and invitations](https://ethicsportal.eu/developers/administration/#members-and-invitations). For identity-provider configuration assistance, [contact support](mailto:support@ethicsportal.eu). --- # MCP server for AI assistants Source: https://ethicsportal.eu/developers/mcp/ The EthicsPortal MCP server lets an AI assistant work with EthicsPortal for a person who approves it. It offers the operations of the [API](https://ethicsportal.eu/developers/api/) as tools of the Model Context Protocol (MCP). The assistant acts as that person, with their current role, only in the organisations they choose. Report content is never available. ## Status The MCP server is available to every organisation that has API access. It opened on 11 November 2026. * EthicsPortal has tested it with Claude Code. Other assistants that support remote MCP servers with OAuth are expected to work. Write to [support@ethicsportal.eu](mailto:support@ethicsportal.eu) if one does not. * If API access is suspended for an organisation, the person cannot choose it on the consent screen, and its tools answer `not_found`. * If EthicsPortal switches assistant connections off, the MCP endpoint and every OAuth address on this page answer `404`. The REST API and webhooks do not depend on the MCP server. [Choose an API token](https://ethicsportal.eu/developers/authentication/) for scripts and server integrations. ## Add EthicsPortal to an assistant A person adds the server to their assistant once. They need no EthicsPortal account first: a person with no account [signs up while they connect](https://ethicsportal.eu/developers/mcp/#start-without-an-organisation). | Assistant | How to add the server | | ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- | | Claude Code | Run claude mcp add --transport http ethicsportal https://secure.ethicsportal.eu/mcp. Then open /mcp, choose ethicsportal and **Authenticate** | | Cursor | Add the server to \~/.cursor/mcp.json, as shown below. Sign in when Cursor asks | | Claude | **Settings → Connectors → Add custom connector**. Enter the address https://secure.ethicsportal.eu/mcp | | Any other assistant | Add https://secure.ethicsportal.eu/mcp as a remote MCP server or custom connector in the assistant’s settings | ``` { "mcpServers": { "ethicsportal": { "url": "https://secure.ethicsportal.eu/mcp" } } } ``` The assistant then opens a browser window. The person signs in or signs up there, reads the consent screen and presses **Connect**. An assistant cannot use a server that nobody added. A coding assistant can add the server itself, because it can run the command or change its configuration. A chat assistant cannot: the person adds the connector in its settings. The [setup skill](https://ethicsportal.eu/.well-known/agent-skills/ethicsportal-setup/SKILL.md) gives an assistant these steps, and the steps that follow, in a form it can read. ## Endpoint and transport | Property | Value | | ------------- | ------------------------------------------------------------------------- | | Endpoint | https://secure.ethicsportal.eu/mcp | | Transport | Streamable HTTP, POST only | | Request | One JSON-RPC message per request. A batch is refused | | Response | One JSON document, or no body. The server opens no stream | | Session | None. The server issues no Mcp-Session-Id | | Authorization | Authorization: Bearer with an OAuth access token issued for this endpoint | | Features | Tools only. No prompts and no resources | Send `Content-Type: application/json` and `Accept: application/json, text/event-stream` with every request. Two lifecycles work: * **Revision `2026-07-28`**, without a handshake. Each request carries its protocol revision, and `server/discover` describes the server. * **Revisions `2025-11-25` and `2025-06-18`**, with the `initialize` handshake. Send the `MCP-Protocol-Version` header on the requests that follow. A client that asks for `2026-07-28` in `initialize` is offered `2025-11-25`. The server returns short instructions for the assistant in both lifecycles. They tell it to start with `get_identity`. ``` curl --fail-with-body https://secure.ethicsportal.eu/mcp \ -H "Authorization: Bearer $ETHICSPORTAL_MCP_TOKEN" \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -H 'MCP-Protocol-Version: 2026-07-28' \ -H 'Mcp-Method: tools/call' \ -H 'Mcp-Name: get_identity' \ --data '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_identity","arguments":{},"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientCapabilities":{}}}}' ``` Most clients do not build these requests themselves. Add the endpoint address as a remote MCP server in the assistant. The assistant must support OAuth 2.1 with PKCE and Dynamic Client Registration. ## Connect a client A connection is made with OAuth 2.1\. The client is a public client: it has no secret. The steps are discovery, registration, the authorization request, and the token exchange. ### Discovery A request without a usable token answers `401`. The `WWW-Authenticate` header names the protected resource metadata (RFC 9728): ``` WWW-Authenticate: Bearer scope="reports:read channel:read channel:write webhooks:read webhooks:write audit_log:read members:read members:write documents:read billing:read billing:write organizations:write organizations:create", resource_metadata="https://secure.ethicsportal.eu/.well-known/oauth-protected-resource/mcp" ``` ``` curl --fail-with-body https://secure.ethicsportal.eu/.well-known/oauth-protected-resource/mcp ``` ``` { "resource": "https://secure.ethicsportal.eu/mcp", "authorization_servers": ["https://secure.ethicsportal.eu"], "scopes_supported": [ "reports:read", "channel:read", "channel:write", "webhooks:read", "webhooks:write", "audit_log:read", "members:read", "members:write", "documents:read", "billing:read", "billing:write", "organizations:write", "organizations:create" ], "bearer_methods_supported": ["header"] } ``` `scopes_supported` lists every scope a connection can hold, here and in the authorization server metadata. The same document is also at `/.well-known/oauth-protected-resource`. The authorization server metadata (RFC 8414) is at the issuer: ``` curl --fail-with-body https://secure.ethicsportal.eu/.well-known/oauth-authorization-server ``` The response includes these fields: ``` { "issuer": "https://secure.ethicsportal.eu", "authorization_endpoint": "https://secure.ethicsportal.eu/oauth/authorize", "token_endpoint": "https://secure.ethicsportal.eu/oauth/token", "revocation_endpoint": "https://secure.ethicsportal.eu/oauth/revoke", "registration_endpoint": "https://secure.ethicsportal.eu/oauth/register", "scopes_supported": [ "reports:read", "channel:read", "channel:write", "webhooks:read", "webhooks:write", "audit_log:read", "members:read", "members:write", "documents:read", "billing:read", "billing:write", "organizations:write", "organizations:create" ], "response_types_supported": ["code"], "response_modes_supported": ["query"], "grant_types_supported": ["authorization_code", "refresh_token"], "token_endpoint_auth_methods_supported": ["none"], "code_challenge_methods_supported": ["S256"], "authorization_response_iss_parameter_supported": true, "resource_indicators_supported": true } ``` There is no token introspection endpoint. ### Register the client Clients register themselves with Dynamic Client Registration (RFC 7591). Client ID Metadata Documents are not supported yet. ``` curl --fail-with-body https://secure.ethicsportal.eu/oauth/register \ -H 'Content-Type: application/json' \ --data '{"client_name":"Example assistant","redirect_uris":["https://assistant.example/callback"],"token_endpoint_auth_method":"none","grant_types":["authorization_code","refresh_token"],"response_types":["code"]}' ``` A `201` response contains the `client_id`. There is no client secret. ``` { "client_id": "CLIENT_ID", "client_id_issued_at": 1794268800, "client_name": "Example assistant", "redirect_uris": ["https://assistant.example/callback"], "grant_types": ["authorization_code", "refresh_token"], "response_types": ["code"], "token_endpoint_auth_method": "none" } ``` | Field | Accepted | | ----------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | | redirect\_uris | Required. One to ten addresses, 4,000 characters in total | | client\_name | Optional. Up to 100 characters, without control or invisible characters. Without a name, the host of the first redirect address is used | | token\_endpoint\_auth\_method | Omitted, or none | | grant\_types | Omitted, or only authorization\_code and refresh\_token | | response\_types | Omitted, or only code | Every other field is ignored and is not stored. A redirect address must use `https`, or `http` on a loopback host: `localhost`, `127.0.0.1` or `::1`. It must not contain user information or a fragment, and it must not point to an EthicsPortal host. Custom URL schemes are refused. The only exception is the exact address `cursor://anysphere.cursor-mcp/oauth/callback`; no other address with that scheme is accepted. A refused address answers `400` with `invalid_redirect_uri`. Any other refused field answers `400` with `invalid_client_metadata`. A registration that has no connection is deleted when it is 30 days old. If a client ID is no longer recognised, register again. ### Ask for authorization Send the person’s browser to the authorization endpoint: ``` https://secure.ethicsportal.eu/oauth/authorize ?response_type=code &client_id=CLIENT_ID &redirect_uri=https%3A%2F%2Fassistant.example%2Fcallback &code_challenge=CODE_CHALLENGE &code_challenge_method=S256 &resource=https%3A%2F%2Fsecure.ethicsportal.eu%2Fmcp &scope=reports%3Aread%20channel%3Aread &state=STATE ``` | Parameter | Rule | | ---------------------------------------- | --------------------------------------------------------------------------------------------------- | | response\_type | code only | | redirect\_uri | A registered address. For a loopback address, the port can differ from the registered one | | code\_challenge, code\_challenge\_method | PKCE is required, with S256 only. plain is refused | | resource | Required. Exactly https://secure.ethicsportal.eu/mcp | | scope | Optional. Without it, the request asks for every scope a connection can hold. See [Scopes](https://ethicsportal.eu/developers/mcp/#scopes) | | response\_mode | Omitted, or query | A request that breaks one of these rules is refused on an error page in EthicsPortal. The browser is not sent back to the client, so the client receives no error redirect. ### What the person sees 1. The person signs in to EthicsPortal if they are not signed in, and completes a fresh-authentication challenge. A person with no account creates one at this step: they confirm their email address, accept the account terms and enter their name. Then they return to the same request. 2. The consent screen shows the name of the app and the host of its redirect address. It states that the app chose both and that EthicsPortal has not verified them. 3. It lists the permissions the app asks for, in plain language, and the limits of a connection. 4. It lists the organisations the person can connect. These are the organisations where the person is an active member and API access is on. The person ticks at least one. 5. **Connect** sends the browser back to the redirect address with `code`, `state` and `iss`. **Cancel** sends it back with `error=access_denied`. Consent is asked every time. An earlier connection never approves a new request by itself. After each approval, the person receives one email. It names the app and its address, the time, the organisations, the permissions and the end date, and it links to **Connected apps**, where the person can end the connection. ### Start without an organisation A person who has no organisation in EthicsPortal can connect an assistant, and the assistant creates their first organisation. 1. The authorization request must include `organizations:create`. A request that follows the metadata includes it. 2. The consent screen shows no list of organisations. It says that the app can create one, and that the person accepts its Data Processing Agreement afterwards. 3. The connection reaches no organisation at first. `get_identity` returns an empty `organizations` list. 4. `create_organization` creates the organisation with the person as its owner, and adds it to the connection. 5. The owner accepts the organisation’s Data Processing Agreement in a browser, at `https://secure.ethicsportal.eu/organizations/{organization_id}`. Until then, the organisation’s tools answer `agreement_required`. The assistant cannot accept it. 6. After that, the assistant can configure the whistleblowing channel, invite members and create a checkout link, with the scopes the person approved. The tool results guide the assistant through steps 3 to 5\. The empty `get_identity` result, the `create_organization` result and every `agreement_required` answer carry a `next_step` text: what to do next, and the address the person must open. The text is in the result’s content and in `structuredContent.next_step`. The REST API does not return this field. ### Exchange the code The authorization code is valid for one minute and for one use. ``` curl --fail-with-body https://secure.ethicsportal.eu/oauth/token \ --data-urlencode 'grant_type=authorization_code' \ --data-urlencode "code=$CODE" \ --data-urlencode "client_id=$CLIENT_ID" \ --data-urlencode 'redirect_uri=https://assistant.example/callback' \ --data-urlencode "code_verifier=$CODE_VERIFIER" \ --data-urlencode 'resource=https://secure.ethicsportal.eu/mcp' ``` ``` { "access_token": "ACCESS_TOKEN", "token_type": "Bearer", "expires_in": 3600, "refresh_token": "REFRESH_TOKEN", "scope": "reports:read channel:read", "created_at": 1794268800 } ``` The access token works at the MCP endpoint only. The REST API refuses it with `401`. A `resource` other than the MCP endpoint answers `invalid_target`. ### Refresh and revoke tokens ``` curl --fail-with-body https://secure.ethicsportal.eu/oauth/token \ --data-urlencode 'grant_type=refresh_token' \ --data-urlencode "refresh_token=$REFRESH_TOKEN" \ --data-urlencode "client_id=$CLIENT_ID" ``` Each refresh returns a new access token and a new refresh token. The earlier access token and refresh token stop working at once. Store the new pair before you use it. * A refresh cannot change the scopes. If you send `scope`, it must name exactly the scopes of the connection, or the answer is `invalid_scope`. * A refresh token works once. There is no period in which the earlier one is still accepted. * Other grant types answer `unsupported_grant_type`. To end a connection from the client, revoke its current access token or refresh token (RFC 7009): ``` curl --fail-with-body https://secure.ethicsportal.eu/oauth/revoke \ --data-urlencode "token=$REFRESH_TOKEN" \ --data-urlencode "client_id=$CLIENT_ID" ``` A client can revoke only its own tokens. Another client’s token answers `403`. ### Lifetimes | Item | Lifetime | | ------------------ | ------------------------------------------------------- | | Authorization code | One minute, one use | | Access token | One hour | | Refresh token | One use. Each refresh returns a new one | | Connection | 90 days from the approval. A refresh does not extend it | ### Browser-based clients A client that runs in a web page on another origin can connect. The MCP endpoint, both metadata documents and the registration, token and revocation endpoints answer with `Access-Control-Allow-Origin: *` and answer an `OPTIONS` preflight with `204`. They never use cookies, and they send no `Access-Control-Allow-Credentials` header. The MCP endpoint and the protected resource metadata expose the `WWW-Authenticate` and `Retry-After` headers to the page. The consent screen has no such headers. Open it as a page in the person’s browser. ## What ends a connection When a connection ends, its access tokens answer `401` and its refresh tokens answer `invalid_grant`. The person must approve a new authorization request. * 90 days have passed since the approval. * The person disconnects the app under **Connected apps**. * An administrator removes the connection from the last organisation it reaches. * The person’s membership is deactivated in the last organisation it reaches. * The client revokes its current access token or refresh token. * **A refresh token is used a second time.** This includes a client that repeats a refresh request after a lost response. * An authorization code is exchanged a second time with its PKCE verifier. * The person approves a new request from the same app. The new connection replaces the earlier one, and the 90 days start again. A connection stops working, without ending, while the person’s account cannot authenticate or while assistant connections are switched off. ## What a connection can do A connection acts as the person who approved it. Every tool call checks that person’s current role and case permissions again, as described in [Case permissions](https://ethicsportal.eu/developers/authentication/#case-permissions). A connection never does more than the person can do in the web application. * It reaches only the organisations the person ticked. Any other organisation answers `not_found`, also when the person is a member of it. * An organisation that the person joins later is not added. The one exception is an organisation created with the `create_organization` tool of that connection. * When the person’s membership in an organisation is deactivated, that organisation is removed from the connection. * The person’s account terms and the organisation’s agreement must be accepted, as for the API. Otherwise the tool answers `agreement_required`. Tool descriptions come from the API reference. Where a description says “personal token”, it applies to a connection in the same way. ### Scopes A connection uses the scopes of the API. The [scope table](https://ethicsportal.eu/developers/authentication/#scopes) describes each one. A connection can hold these: `reports:read`, `channel:read`, `channel:write`, `webhooks:read`, `webhooks:write`, `audit_log:read`, `members:read`, `members:write`, `documents:read`, `billing:read`, `billing:write`, `organizations:write`, `organizations:create` * `invitations:respond` cannot be granted. Accepting an invitation joins an organisation that the person did not choose on the consent screen. A request that asks for it is refused. * `get_identity` and `submit_feedback` need no scope. * `members:write` lets the app send invitations with any role, in the organisations where the person is an administrator. A person who is invited as an administrator can read reports in the web application after they accept. The consent screen warns the person when an app asks for this scope, and each invitation is recorded in the audit trail as made through an AI assistant. * The metadata advertises every scope, so a client that follows it asks for all of them in the first authorization request. Most assistants make the person sign in again for each scope added later. A client can ask for fewer scopes. The consent screen always shows every scope the client asks for. ### Ask for a further scope A connection that asked for fewer scopes can ask for more later. When a tool needs a scope the connection does not have, nothing runs. The whole HTTP response is `403`: ``` WWW-Authenticate: Bearer error="insufficient_scope", error_description="This tool needs the webhooks:write scope.", scope="reports:read channel:read webhooks:write", resource_metadata="https://secure.ethicsportal.eu/.well-known/oauth-protected-resource/mcp" ``` 1. Read `scope`. It names the scopes the connection already has and the missing one. 2. Send a new authorization request with exactly that `scope`. 3. The person approves on the consent screen. The organisations of the earlier connection are ticked already. 4. Exchange the new code, then call the tool again with the new access token. The new connection replaces the earlier one. The earlier tokens stop working, the 90 days start again, and the person receives a new email. ## Tools The server offers one tool for each API operation, with the exceptions listed below. Tool definitions are generated from the [OpenAPI schema](https://ethicsportal.eu/openapi.json), so a tool has the same fields, rules and errors as its operation. Follow the link of a tool to its page in the API reference. * The tool name is the `operationId` of the operation in snake case: `listReports` becomes `list_reports`. * The tool title and description are the summary and description of the operation. * Tools that read are marked read-only. Tools that send `PATCH` or `DELETE` are marked destructive and idempotent. * `tools/list` returns the tools in the order of the OpenAPI schema. | Tool | API operation | Scope | | ------------------------------ | -------------------------------------------------------------------------------------------- | -------------------- | | get\_identity | [Discover organisations](https://ethicsportal.eu/developers/api/operations/getidentity/) | None | | get\_channel | [Read whistleblowing channel metadata](https://ethicsportal.eu/developers/api/operations/getchannel/) | channel:read | | list\_reports | [List report metadata](https://ethicsportal.eu/developers/api/operations/listreports/) | reports:read | | get\_report | [Read report metadata](https://ethicsportal.eu/developers/api/operations/getreport/) | reports:read | | create\_organization | [Create an organisation](https://ethicsportal.eu/developers/api/operations/createorganization/) | organizations:create | | get\_channel\_configuration | [Read channel configuration](https://ethicsportal.eu/developers/api/operations/getchannelconfiguration/) | channel:write | | update\_channel\_configuration | [Configure a whistleblowing channel](https://ethicsportal.eu/developers/api/operations/updatechannelconfiguration/) | channel:write | | list\_webhooks | [List webhooks](https://ethicsportal.eu/developers/api/operations/listwebhooks/) | webhooks:read | | create\_webhook | [Create a webhook](https://ethicsportal.eu/developers/api/operations/createwebhook/) | webhooks:write | | get\_webhook | [Read a webhook](https://ethicsportal.eu/developers/api/operations/getwebhook/) | webhooks:read | | update\_webhook | [Update a webhook](https://ethicsportal.eu/developers/api/operations/updatewebhook/) | webhooks:write | | delete\_webhook | [Delete a webhook](https://ethicsportal.eu/developers/api/operations/deletewebhook/) | webhooks:write | | rotate\_webhook\_secret | [Rotate a webhook's signing secret](https://ethicsportal.eu/developers/api/operations/rotatewebhooksecret/) | webhooks:write | | test\_webhook | [Send a test event](https://ethicsportal.eu/developers/api/operations/testwebhook/) | webhooks:write | | list\_webhook\_deliveries | [List webhook deliveries](https://ethicsportal.eu/developers/api/operations/listwebhookdeliveries/) | webhooks:read | | retry\_webhook\_delivery | [Retry a failed delivery](https://ethicsportal.eu/developers/api/operations/retrywebhookdelivery/) | webhooks:write | | list\_audit\_trail | [List the audit trail](https://ethicsportal.eu/developers/api/operations/listaudittrail/) | audit\_log:read | | list\_report\_audit\_trail | [List a report's audit trail](https://ethicsportal.eu/developers/api/operations/listreportaudittrail/) | audit\_log:read | | list\_members | [List members](https://ethicsportal.eu/developers/api/operations/listmembers/) | members:read | | list\_invitations | [List pending invitations](https://ethicsportal.eu/developers/api/operations/listinvitations/) | members:read | | create\_invitation | [Invite a member](https://ethicsportal.eu/developers/api/operations/createinvitation/) | members:write | | revoke\_invitation | [Revoke an invitation](https://ethicsportal.eu/developers/api/operations/revokeinvitation/) | members:write | | resend\_invitation | [Resend an invitation](https://ethicsportal.eu/developers/api/operations/resendinvitation/) | members:write | | update\_organization | [Rename the organisation](https://ethicsportal.eu/developers/api/operations/updateorganization/) | organizations:write | | list\_documents | [List documents](https://ethicsportal.eu/developers/api/operations/listdocuments/) | documents:read | | get\_billing\_status | [Read billing status](https://ethicsportal.eu/developers/api/operations/getbillingstatus/) | billing:read | | create\_checkout\_link | [Create a subscription checkout link](https://ethicsportal.eu/developers/api/operations/createcheckoutlink/) | billing:write | | create\_billing\_portal\_link | [Create a billing portal link](https://ethicsportal.eu/developers/api/operations/createbillingportallink/) | billing:write | | submit\_feedback | [Send product feedback](https://ethicsportal.eu/developers/api/operations/submitfeedback/) | None | ### Arguments * **Path parameters**, such as `organization_id`, are record IDs. Take them from `get_identity` and from earlier results. A value that is not a record ID is refused before anything runs. * **Query parameters**, such as `limit`, `cursor` and `status`, are arguments with the same names. * **The request body** keeps its shape. `create_webhook` takes a `webhook` object, as the API does. * **`idempotency_key`** is an argument of every tool whose operation accepts the `Idempotency-Key` header. * Arguments that the tool does not declare are refused. An `Idempotency-Key` header that the client sends to the MCP endpoint does not reach the operation: use the argument. Conditional requests with `If-None-Match` are not available through tools. The `params` of a `tools/call` request: ``` { "name": "list_reports", "arguments": { "organization_id": "gHiJkl", "status": "received", "limit": 50 } } ``` ### Results and errors A successful call returns the JSON response of the API in `structuredContent`. The same JSON is in `content` as text. An operation that returns no content answers with the text `Done.` When the API refuses the call, the result has `isError: true`, and `structuredContent` holds the [error body of the API](https://ethicsportal.eu/developers/pagination-and-errors/#errors). The HTTP status of the MCP response is still `200`, so read `error.code`: ``` { "content": [ { "type": "text", "text": "{\"error\":{\"code\":\"validation_failed\",\"fields\":[\"url\"],\"feedback_url\":\"https://secure.ethicsportal.eu/me/feedback.json\"}}" } ], "structuredContent": { "error": { "code": "validation_failed", "fields": ["url"], "feedback_url": "https://secure.ethicsportal.eu/me/feedback.json" } }, "isError": true } ``` `feedback_url` is the address of the product feedback operation. Through MCP, use the `submit_feedback` tool for the same purpose. Through a connection, `get_identity` returns `type` `connection`, the name of the app as `name`, and `last_four` `null`. Its `expires_at` is the end of the connection, and `organizations` lists only the organisations the connection reaches. ### Pagination, retries and rate limits * **Pagination.** A list returns `next_cursor`. Call the tool again with `cursor` set to that value until it is `null`. [Pagination](https://ethicsportal.eu/developers/pagination-and-errors/#pagination). * **Safe retries.** Send `idempotency_key` with every tool that accepts it, and send the same key again when you retry. The rules are those of the API: [Safe retries](https://ethicsportal.eu/developers/pagination-and-errors/#safe-retries). Keys belong to the connection. A new approval creates a new connection, so earlier keys do not carry over. * **Rate limits of the endpoint.** Each connection can send 120 MCP requests per minute. Requests without a usable token are limited to 120 per minute per source address. Above the limit the HTTP response is `429` with `Retry-After: 60`. * **Rate limits of the API.** Tool calls also count toward the [API limits](https://ethicsportal.eu/developers/pagination-and-errors/#rate-limits): 60 per minute per connection and 300 per minute per organisation. Above these, the tool result is an error with the code `rate_limited`. ### Operations without a tool | API operation | Why it has no tool | | ------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------- | | [List my invitations](https://ethicsportal.eu/developers/api/operations/listmyinvitations/) | It needs invitations:respond, which no connection can hold. | | [Accept an invitation](https://ethicsportal.eu/developers/api/operations/acceptinvitation/) | It needs invitations:respond, which no connection can hold. | | [Decline an invitation](https://ethicsportal.eu/developers/api/operations/declineinvitation/) | It needs invitations:respond, which no connection can hold. | | [Download the compliance report](https://ethicsportal.eu/developers/api/operations/downloadcompliancereport/) | It returns a file, and a file does not fit a tool result. list\_documents returns its download link. | | [Download the compliance certificate](https://ethicsportal.eu/developers/api/operations/downloadcompliancecertificate/) | It returns a file, and a file does not fit a tool result. list\_documents returns its download link. | | [Download the whistleblowing policy](https://ethicsportal.eu/developers/api/operations/downloadwhistleblowerpolicy/) | It returns a file, and a file does not fit a tool result. list\_documents returns its download link. | | [Download the privacy notice](https://ethicsportal.eu/developers/api/operations/downloadprivacynotice/) | It returns a file, and a file does not fit a tool result. list\_documents returns its download link. | | [Download the poster](https://ethicsportal.eu/developers/api/operations/downloadposter/) | It returns a file, and a file does not fit a tool result. list\_documents returns its download link. | | [Download the case handler manual](https://ethicsportal.eu/developers/api/operations/downloadcasehandlermanual/) | It returns a file, and a file does not fit a tool result. list\_documents returns its download link. | `list_documents` returns the address of each document. An access token of a connection cannot download it, because the API refuses that token. A signed-in person can open the address in a browser, and a script can download it with an [API token](https://ethicsportal.eu/developers/authentication/). Billing tools return a link to a Stripe-hosted page for a person to open. They never take a payment. ## Data boundary The MCP server has the same [data boundary](https://ethicsportal.eu/developers/data-boundaries/) as the API. Report content, reporter identity, messages, notes and attachments are never available. No tool reads report content, and no tool submits or changes a report. A tool returns the response of its API operation, so every field that the API excludes is also absent here. Excluded fields are omitted entirely. They are never returned as `REDACTED`, and there is no expansion option. No tool returns report content. One permission can give another person access to reports in the web application: see `members:write` under [Scopes](https://ethicsportal.eu/developers/mcp/#scopes). Operational metadata can still identify a case inside your organisation. A tool result leaves EthicsPortal and goes to the assistant that the person connected. Administrators can see and remove these connections under **Connected apps**. ## Manage connections * **The person** sees their connections in account settings under **Connected apps**. Each entry shows the app, its address, the organisations, the permissions, the dates and the last activity. **Disconnect** ends the connection in every organisation. * **An administrator** sees every connection that reaches the organisation under Organisation → Integrations → **Connected apps**, with the member who connected it. **Remove access** removes that organisation from the connection. The person’s other organisations are not affected. * **The audit trail.** Where the API records a request in the audit trail, it records the same tool call. The entry names the person and is marked **AI assistant**, with the name and address of the app. In the [audit trail API](https://ethicsportal.eu/developers/administration/#read-the-audit-trail), the actor’s kind is `mcp`. Approving, removing and ending a connection is recorded in the audit trail of each organisation it reaches. ## Errors and troubleshooting HTTP responses of the MCP endpoint: | Status | Meaning | Action | | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------- | | 400 | The body is not one JSON-RPC request, or the protocol revision is not supported | Send one request per POST. The error lists the supported revisions | | 401 | There is no token, or the token cannot be used: it is unknown, expired or issued for another resource, or its connection has ended | Refresh the access token. If the refresh answers invalid\_grant, start a new authorization request | | 403 | The tool needs a scope the connection does not have | [Ask for a further scope](https://ethicsportal.eu/developers/mcp/#ask-for-a-further-scope) | | 404 | Assistant connections are switched off. In the 2026-07-28 lifecycle, also a JSON-RPC method that the server does not offer, such as prompts/list | Try again later, or write to support. Use tools only | | 405 | The method is GET or DELETE. The response has Allow: POST | Send POST | | 406, 415 | The Accept or Content-Type header is not accepted | Send the headers shown under [Endpoint and transport](https://ethicsportal.eu/developers/mcp/#endpoint-and-transport) | | 413 | The request body is larger than 1 MB | Send a smaller request | | 429 | The connection or the source address sent too many requests | Wait for the Retry-After interval | A tool error arrives with HTTP `200` and `isError: true`. The codes are those of the [API errors](https://ethicsportal.eu/developers/pagination-and-errors/#errors). The most frequent: | Code | Meaning | | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | | not\_found | The record does not exist, the person cannot access it, the organisation is not part of the connection, or API access is suspended | | forbidden | The person’s current role does not allow the action | | agreement\_required | The person or the organisation must accept an agreement in the web application | | validation\_failed | Correct the fields named in fields | | rate\_limited | Wait one minute | OAuth endpoints: | Where | Answer | Meaning | | ------------------------------- | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Registration | 400 invalid\_redirect\_uri | A redirect address is missing or not accepted | | Registration | 400 invalid\_client\_metadata | The client is not a public client, or a field is not accepted | | Registration, token, revocation | 413 | The request body is larger than 16 KB | | Authorization | Error page | The request is not valid. The browser is not sent back to the client | | Authorization | Page “Assistant connections are not available” | The person has no organisation with API access, and the request does not include organizations:create | | Token | invalid\_grant | The code or refresh token is unknown, expired or already used, the PKCE verifier is wrong, or the connection has ended | | Token | invalid\_target | resource is not the MCP endpoint | | Token | invalid\_scope | A refresh asked for scopes other than those of the connection | | Any | 429 | Too many requests. Registration allows 20 per hour and authorization 30 per minute per source address. The token and revocation endpoints allow 60 per minute per client at one source address, and 600 per minute per source address | --- # Set up organisations and whistleblowing channels Source: https://ethicsportal.eu/developers/organisation-setup/ Setup uses two write scopes. Neither is preselected: choose them when you create a token. Scopes cannot be added to an existing token. ## Choose the scopes * `organizations:create` creates organisations. Only personal tokens can hold it, because a new organisation belongs to a person: you become its owner and administrator. * `channel:write` reads and changes channel configuration. On a personal token it works only where you are a current administrator; it never promotes a member or viewer. On an organisation token, an administrator granted it when creating the token, so the scope alone applies. Creating a token requires fresh authentication. Tokens cannot issue tokens or accept agreements. Webhooks, invitations and billing links each have their own scope. [Authentication and permissions](https://ethicsportal.eu/developers/authentication/). ## Create an organisation Your token owner must have at least one active membership and must have accepted the current account terms. An [assistant connection](https://ethicsportal.eu/developers/mcp/#start-without-an-organisation) is the exception: a person with no organisation can create their first one through it. ``` curl --fail-with-body \ -X POST \ -H "Authorization: Bearer $ETHICSPORTAL_TOKEN" \ -H 'Content-Type: application/json' \ -H "Idempotency-Key: $(uuidgen)" \ --data '{"organization":{"name":"Example organisation"}}' \ "$ETHICSPORTAL_ORIGIN/organizations.json" ``` A `201` response contains: ``` { "id": "gHiJkl", "name": "Example organisation", "membership_id": "mAbCde", "channel": { "id": "AB12CD34", "active": false } } ``` The token owner becomes the organisation owner and an administrator. Its default whistleblowing channel is created automatically. Treat all IDs as strings. Save `id` as `ETHICSPORTAL_ORGANIZATION_ID` and `membership_id` for appointing yourself as compliance officer. Creation does **not** start a subscription or accept the DPA. The new organisation is reachable through the API at once, but its owner must accept the current organisation agreement in EthicsPortal before configuration requests can succeed. The `Location` response header points to the organisation’s web page, which requires a separate browser session. Send an `Idempotency-Key` header with each creation, as in the example. If the response is lost, repeat the request with the same key: you get the first response back instead of a second organisation. Without a key, a lost response may still mean the organisation was created, so check before retrying. [Safe retries](https://ethicsportal.eu/developers/pagination-and-errors/#safe-retries). Names need not be unique. Organisation creation allows up to ten attempts per user per minute, shared across tokens. ## Read the configuration ``` curl --fail-with-body \ -H "Authorization: Bearer $ETHICSPORTAL_TOKEN" \ "$ETHICSPORTAL_ORIGIN/organizations/$ETHICSPORTAL_ORGANIZATION_ID/whistleblower/portal/configuration.json" ``` This privileged resource returns company details, channel settings, the compliance officer’s obfuscated membership ID, public reporting form URL, verification state, `missing_fields` and derived `active` state. It requires `channel:write` even for GET. Ordinary channel metadata remains limited to its identifier, active state and public form URL. ## Configure the channel Send only the fields you want to change. Use native JSON booleans and numbers. Unknown attributes, nested values, additional top-level objects and query parameters are rejected with `400 invalid_request`. ``` curl --fail-with-body \ -X PATCH \ -H "Authorization: Bearer $ETHICSPORTAL_TOKEN" \ -H 'Content-Type: application/json' \ --data '{"portal":{ "legal_name":"Example company", "country_code":"FR", "registration_number":"EXAMPLE-123", "address":"1 Example Street", "employee_range":"1-49", "industry":"professional_scientific_services", "retention_months":60, "compliance_officer_id":"mAbCde", "social_dialogue_consulted":true, "voice_recording_enabled":false, "email_intake_enabled":false, "brand_color":"#123456" }}' \ "$ETHICSPORTAL_ORIGIN/organizations/$ETHICSPORTAL_ORGANIZATION_ID/whistleblower/portal/configuration.json" ``` Additional optional fields are `phone_number` and `website`. [The API reference](https://ethicsportal.eu/developers/api/) lists types and supported values. Use the `membership_id` returned by creation to appoint yourself. Other officers must already be active administrators in the same organisation; obtain their obfuscated membership ID from your authorised team workflow. Raw database IDs are rejected. Settings obey the same model rules as the application: * Verified company details are locked. The API cannot grant or remove verification. * Retention must be an offered value and meet the country’s minimum. Change the country and retention together when needed. * Compliance officers must be active administrators in the organisation. * Removing required information, including setting the compliance officer to `null`, can make the channel inactive. * `active` is derived from complete required information and existing subscription or granted access. It cannot be set directly. A successful save does not guarantee activation. The API does not create missing channels during GET or PATCH. A normal organisation creation already creates one; a missing channel returns `404`. ## Handle validation errors A model validation failure returns `422` and the affected field names, without echoing submitted values: ``` {"error":{"code":"validation_failed","fields":["retention_months"],"feedback_url":"https://secure.ethicsportal.eu/me/feedback.json"}} ``` `base` indicates a record-level restriction, such as locked verified company details. A non-administrator compliance officer can be reported as `compliance_officer`. No partial settings are saved on validation failure. [Errors and rate limits](https://ethicsportal.eu/developers/pagination-and-errors/#errors). All report-content exclusions continue to apply. There is no report submission, report mutation or agreement-acceptance API. After setup, the API also manages [webhooks](https://ethicsportal.eu/developers/webhooks/#manage-webhooks-through-the-api), and sends invitations and creates subscription checkout links: [Administration](https://ethicsportal.eu/developers/administration/). Changing a member’s role and removing a member stay in the web application. --- # Pagination, filters and errors Source: https://ethicsportal.eu/developers/pagination-and-errors/ ## Pagination Lists are objects, never bare arrays: records are in `data`, and `next_cursor` is the cursor for the next page, or `null` on the last page. ``` {"data":[{"id":"aBcDef","status":"received"}],"next_cursor":"SIGNED_CURSOR"} ``` Organisation discovery, report lists and webhook delivery lists accept `limit` (default 50, maximum 100) and `cursor`. Request the same URL again with `cursor` set to the `next_cursor` value until it is `null`. The same next page is also in the `Link` response header, for clients that follow RFC 8288 links. Discovery returns its organisations in `organizations`, with `next_cursor` beside it. Cursors expire after one hour and are bound to the credential, resource, organisation and filters. Restart the traversal if a cursor expires; deduplicate report IDs when reconciling. New records created after the first page appear in a fresh traversal. Permissions and workflow state can change between requests. Pagination is not a database snapshot. [Use the Python pagination example](https://ethicsportal.eu/developers/examples/pagination/), which only ever requests the report collection on the EthicsPortal origin. ## Links Responses link to where you can go next, in fields ending in `_url`. Each organisation in `/identity.json` links to its reports, channel, members, webhooks, audit trail, documents and billing. A report links to its audit trail, the channel to its configuration and documents, a webhook to its deliveries, and your invitations to their accept and decline actions. Follow these links rather than building URLs. The one exception to the naming: a webhook’s own `url` is its destination, as in Stripe’s API. ## Conditional requests Every successful JSON read carries an `ETag`. Send it back as `If-None-Match`, and an unchanged resource returns `304 Not Modified` with no body: ``` curl -sS -o /dev/null -w '%{http_code}\n' \ -H "Authorization: Bearer $ETHICSPORTAL_TOKEN" \ -H 'If-None-Match: W/"0ba6c64b35971e64b16534c1f240e4a0"' \ "$ETHICSPORTAL_ORIGIN/organizations/$ETHICSPORTAL_ORGANIZATION_ID/whistleblower/reports.json" ``` Use it when polling a dashboard or re-reading a resource in an assistant’s context: an unchanged response costs no transfer and no context. It still counts toward rate limits and, for audited reads, the audit trail. ## Report filters | Parameter | Meaning | | --------------- | ------------------------------------------------------ | | status | One of received, acknowledged, feedback\_given, closed | | created\_after | Exclusive ISO-8601 creation-time lower bound | | created\_before | Exclusive ISO-8601 creation-time upper bound | ``` curl --fail-with-body --get \ -H "Authorization: Bearer $ETHICSPORTAL_TOKEN" \ --data-urlencode 'status=received' \ --data-urlencode 'created_after=2026-11-01T00:00:00Z' \ "$ETHICSPORTAL_ORIGIN/organizations/$ETHICSPORTAL_ORGANIZATION_ID/whistleblower/reports.json" ``` Unknown parameters, array values, arbitrary sorting, content filters and expansions are rejected. Single-resource endpoints do not accept list filters. ## Errors ``` {"error":{"code":"invalid_token","feedback_url":"https://secure.ethicsportal.eu/me/feedback.json"}} ``` Every error has a `code` and a `feedback_url`. A validation error also has `fields`. `feedback_url` is the address of the [product feedback](https://ethicsportal.eu/developers/administration/#product-feedback) operation. If an error looks wrong, or the documentation did not help, send a short description there with the same token. | Status | Code | Action | | ------ | -------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- | | 400 | invalid\_request | Correct the parameters or restart an expired cursor traversal | | 401 | invalid\_token | Check the credential, expiry, revocation and owner access | | 403 | insufficient\_scope | Issue a token with the scope named in the WWW-Authenticate header | | 403 | forbidden or agreement\_required | The user’s role does not allow the action, or an agreement must be accepted in the web application | | 404 | not\_found | Check the resource ID and current membership or case access | | 409 | idempotency\_key\_reused, idempotency\_key\_in\_progress or not\_retryable | Use a new key for a different request, wait for the first request, or retry only failed deliveries | | 409 | channel\_inactive or invitation\_unavailable | Activate the whistleblowing channel first, or ask for a new invitation | | 409 | already\_subscribed or no\_subscription | Use a billing portal link instead, or create a checkout link first | | 422 | validation\_failed | Correct the named fields; submitted values are not echoed | | 429 | rate\_limited | Wait for the Retry-After interval before retrying | ## Rate limits Limits are 120 eligible requests per minute per source IP, 60 per token and 300 per organisation. Organisation creation has an additional ten-attempt limit per user per minute across tokens. A `429` response includes `Retry-After: 60`. Avoid concurrent retry bursts. Bound retries for network or server failures and use backoff; do not continuously retry invalid credentials or forbidden access. Responses use `Cache-Control: no-store`. Reads support GET and HEAD. Only the documented resources accept POST, PATCH or DELETE, with the matching write scope. PUT and all report writes remain unavailable. A missing scope returns `403` with a header naming it: ``` WWW-Authenticate: Bearer realm="EthicsPortal", error="insufficient_scope", scope="webhooks:write" ``` ## Safe retries Send an `Idempotency-Key` header with every POST, such as a UUID you generate per operation. If the response is lost, repeat the same request with the same key: within 24 hours you get the first response again, marked `Idempotent-Replayed: true`, instead of a second organisation, webhook or test event. * Successful responses and `422` validation errors are stored and replayed. Any other outcome releases the key, so the retry runs normally. * Reusing a key with a different method, path or body returns `409 idempotency_key_reused`. * A retry while the first request is still running returns `409 idempotency_key_in_progress`; wait and retry with the same key. * Keys belong to the token that sent them and may contain up to 255 printable ASCII characters. PATCH and DELETE requests are already safe to repeat. --- # Public developer resources Source: https://ethicsportal.eu/developers/public-resources/ These resources describe EthicsPortal and its published documentation. They do not grant access to customer organisations or reports. | Resource | Address | | ------------------------------------------- | ------------------------------------------------------- | | OpenAPI 3.1 | [Schema](https://ethicsportal.eu/openapi.json) | | API catalog (RFC 9727) | [api-catalog](https://ethicsportal.eu/.well-known/api-catalog) | | Developer documentation index for AI agents | [developers/llms.txt](https://ethicsportal.eu/developers/llms.txt) | | All developer documentation in one file | [developers/llms-full.txt](https://ethicsportal.eu/developers/llms-full.txt) | | Agent guide | [agents.md](https://ethicsportal.eu/agents.md) | | Site overview | [llms.txt](https://ethicsportal.eu/llms.txt) | | Full public content | [llms-full.txt](https://ethicsportal.eu/llms-full.txt) | | Agent card | [A2A card](https://ethicsportal.eu/.well-known/agent-card.json) | | Agent skills | [Skills manifest](https://ethicsportal.eu/.well-known/agent-skills/index.json) | | Sitemap | [sitemap.xml](https://ethicsportal.eu/sitemap.xml) | | Crawl policy | [robots.txt](https://ethicsportal.eu/robots.txt) | | Vulnerability disclosure | [security.txt](https://ethicsportal.eu/.well-known/security.txt) | | Vendor questionnaire | [CAIQ CSV](https://ethicsportal.eu/caiq-ethicsportal.csv) | | Blog feed | [RSS](https://ethicsportal.eu/blog/index.xml) | ## Markdown content negotiation Eligible public pages have a Markdown representation. Append `.md` to a page URL or request `Accept: text/markdown`: ``` curl --fail \ -H 'Accept: text/markdown' \ 'https://ethicsportal.eu/developers/quickstart/' ``` Representation selection honours quality values. `Vary: Accept` distinguishes HTML and Markdown responses. With no preference, the response is HTML. Unsupported preferences receive `406 Not Acceptable`; unknown pages receive `404 Not Found`. HTML responses advertise their Markdown twin with an alternate link. Markdown copies link back to canonical HTML and are excluded from search indexing. The customer application is separate from these public exports. The OpenAPI schema documents a credential-protected metadata contract; it is not an API gateway. The [MCP server](https://ethicsportal.eu/developers/mcp/) is part of the customer application: an assistant reaches it only after a person approves the connection. --- # Make your first API request Source: https://ethicsportal.eu/developers/quickstart/ ## 1\. Accept your agreements Sign in to EthicsPortal and accept any outstanding account terms or organisation agreement. API requests are refused until you do. ## 2\. Create an API token For an integration your organisation depends on, an administrator opens the organisation, selects **Organisation API tokens**, then **Create API token**. For your own scripts, open your account settings and select **Personal API tokens** instead. [Compare token types](https://ethicsportal.eu/developers/authentication/#choose-a-token-type). Complete the fresh-authentication challenge and give the credential a recognisable name. Keep the preselected read scopes for a monitoring integration. To configure channels or create organisations, follow the [organisation setup guide](https://ethicsportal.eu/developers/organisation-setup/) and select those scopes explicitly. Copy the token immediately: the full value is displayed once. Store it in your integration’s secret store. Tokens expire after 90 days. ## 3\. Discover your organisation Set `ETHICSPORTAL_TOKEN` through your secret manager or a private local environment. The examples use environment-variable references so the token is not written into source code. ``` export ETHICSPORTAL_ORIGIN='https://secure.ethicsportal.eu' curl --fail-with-body \ -H "Authorization: Bearer $ETHICSPORTAL_TOKEN" \ -H 'Accept: application/json' \ "$ETHICSPORTAL_ORIGIN/identity.json" ``` The response contains the token’s type, name, last four characters, scopes, expiry and last use, and the IDs and names of the organisations it can reach. Use `expires_at` to replace the token before it expires. Copy the required organisation’s `id` into `ETHICSPORTAL_ORGANIZATION_ID`. Treat all IDs as strings; do not decode them or substitute reporter access codes. ## 4\. Fetch report metadata ``` curl --fail-with-body \ -H "Authorization: Bearer $ETHICSPORTAL_TOKEN" \ -H 'Accept: application/json' \ "$ETHICSPORTAL_ORIGIN/organizations/$ETHICSPORTAL_ORGANIZATION_ID/whistleblower/reports.json?limit=50" ``` The reports are in the response’s `data` array. An empty `data` array means there are no matching reports you can access. While `next_cursor` is not `null`, request the list again with `cursor` set to that value. [Pagination example](https://ethicsportal.eu/developers/examples/pagination/). ## 5\. Add notifications [Register a webhook](https://ethicsportal.eu/developers/webhooks/) for lifecycle or deadline events. Verify signatures and persist receipt before acknowledging delivery. Periodically use the API to reconcile current state after missed or out-of-order events. ## If the request fails A `401` indicates a missing or unusable token. A `403` can indicate an outstanding agreement. A `404` can mean integrations are disabled or the organisation/report is outside your access. [Errors and rate limits](https://ethicsportal.eu/developers/pagination-and-errors/#errors). --- # Webhooks Source: https://ethicsportal.eu/developers/webhooks/ ## Configure a destination An administrator opens **Organisation → Integrations → Webhooks**, registers a public HTTPS destination on port 443 and selects events. Each organisation can have up to ten destinations. Webhooks belong to the organisation, not to the administrator who created them. They receive events for every report in the organisation and keep delivering when staff change. Only administrators can see, create or operate them. Copy the signing secret when it is displayed after creation. Store it in the receiver’s secret store. Use **Send test event** to queue a `webhook.test` event containing only the organisation ID. A queued event is not proof of delivery; inspect delivery history. ## Manage webhooks through the API Everything on the webhook screen is also available to a token with `webhooks:read` and `webhooks:write`: list, create, read, update and delete webhooks, rotate the signing secret, send a test event, list deliveries and retry a failed delivery. A personal token also needs its user to be a current administrator. The [API reference](https://ethicsportal.eu/developers/api/) lists each operation. ``` curl --fail-with-body -X POST \ -H "Authorization: Bearer $ETHICSPORTAL_TOKEN" \ -H 'Content-Type: application/json' \ -H "Idempotency-Key: $(uuidgen)" \ --data '{"webhook":{"name":"Case dashboard","url":"https://receiver.example/ethicsportal","events":["report.created","report.overdue"]}}' \ "$ETHICSPORTAL_ORIGIN/organizations/$ETHICSPORTAL_ORGANIZATION_ID/webhooks.json" ``` The `201` response contains the signing secret once, as does rotating it; reading a webhook never returns it. Store it before doing anything else. If the response is lost, repeat the request with the same `Idempotency-Key` to receive it again within 24 hours. ## Events | Event | Meaning | | -------------------------- | -------------------------------------------------- | | report.created | A report was created | | report.acknowledged | An acknowledgement timestamp was recorded | | report.feedback\_given | A feedback timestamp was recorded | | report.closed | A report was closed, without the closure outcome | | report.reopened | A report was reopened | | report.assignment\_changed | Assignment changed between present and absent | | report.due\_soon | An outstanding deadline entered the two-day window | | report.overdue | An outstanding deadline passed | Replacing one assignee with another does not emit an event because assignment remains present. Closure emits one closure event instead of extra events for automatically filled acknowledgement/feedback timestamps. Messages, notes, files and other excluded content do not generate events. ## Payloads Every envelope contains `id`, `type`, `created_at` and `data`. Lifecycle events contain the report metadata snapshot at event creation, without `url` and `web_url`. Deadline data contains only `report_id`, `organization_id`, `deadline_type` and `deadline_at`. [Read the generated webhook schema](https://ethicsportal.eu/developers/api/webhooks/receivereportevent/) for exact fields and event variants. Snapshots can differ from current state by delivery time. Subscriptions do not receive events from before their creation. Deadline events deduplicate by report, event type, deadline kind and due time within the 30-day retention window. An unresolved deadline may produce another reminder after the earlier event has expired. ## Verify deliveries ``` X-EthicsPortal-Event-Id: X-EthicsPortal-Signature: t=,v1= ``` Compute HMAC-SHA256 using your secret over the timestamp, a full stop and the **exact raw request bytes**. Compare the hexadecimal digest in constant time. Reject timestamps more than five minutes from your clock, then parse the JSON and require its `id` to match the event header. [Use the tested Node.js verification example](https://ethicsportal.eu/developers/examples/verify-webhook/). Do not parse and re-serialize JSON before signature verification. ## Acknowledge and deduplicate Persist a verified event in a durable inbox with a unique event ID before returning any `2xx` response. If that event already exists, acknowledge it without repeating its effects. Perform business processing asynchronously from that inbox. If persistence fails, return a non-2xx status so delivery can retry. Delivery is at least once. There is no ordering guarantee. A lost response can cause a duplicate with the same event ID/body and a new signature timestamp. Reconcile current state through the API after missed or out-of-order events. ## Retries and history Non-2xx responses and connection failures retry after 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours and 24 hours: seven attempts over about 32 hours 36 minutes, plus queue delays. Unsafe destinations fail permanently. Redirects are not followed. The endpoint screen shows the latest 100 deliveries with the stable event ID, status, attempts, HTTP status or a fixed error code. For a pending retry, it shows the next scheduled attempt time. This is the earliest eligible time; queue delays can postpone it. Paused retries are labelled when integrations are disabled. Match the event ID to your receiver logs; manual retries retain it. Failed deliveries can be retried manually while retained. A manual retry uses the endpoint’s current URL and signing secret, so retry after fixing your receiver. Events and delivery history expire after 30 days. Receiver response bodies are not retained. Deleting a report removes its retained events; deleting an endpoint removes its delivery history. ## Failure warnings When a delivery fails permanently or exhausts its retries, the webhook displays a warning. Organisation administrators receive an in-app notification and email. Notifications contain a generic warning and a link to delivery history, without report data, the destination URL or the signing secret. Email checks current access and failure state again before sending. Further failed deliveries do not create another alert during the same failure episode. The warning clears after a successful delivery or a change to the destination, secret, event selection or enabled state. A manual retry alone does not clear it. A later failure after recovery can create a new alert. Email delivery is asynchronous and may repeat if a job is recovered after an interrupted send. **Failure does not automatically disable the webhook.** New events continue to be attempted. Inspect the receiver, correct the configuration if necessary, and send a test event. Reconcile missed state through the API. ## Rotation and access changes Generate a replacement secret in the endpoint screen and update the receiver. There is no overlap period. Changing the URL, secret, event selection or enabled state invalidates pending deliveries from the previous configuration. Send a fresh test event and reconcile through the API after changes. If API access is suspended, sends pause and event capture stops. An in-flight HTTP request cannot be recalled. When access is restored, retained pending deliveries resume; report changes made during the suspension are not backfilled. The organisation’s agreement is checked again before each delivery. Existing endpoints can still be deleted during a suspension. --- # Directive 2019/1937 coverage map > Article-by-article map of how EthicsPortal meets every requirement of EU Directive 2019/1937 and GDPR for whistleblower protection. Canonical: https://ethicsportal.eu/directive-coverage/ Last updated: 2026-11-10 EthicsPortal is built to keep your organization compliant with EU Directive 2019/1937, its national transposition in your country, and GDPR. Every feature maps directly to a legal requirement. This page is the feature-to-requirement map: each article of the Directive is matched to the specific EthicsPortal capability that addresses it. For how EthicsPortal interprets the ambiguous provisions of those articles --- the 50-worker threshold, what counts as "diligent follow-up", retention justifications, GDPR lawful basis, national-law supremacy --- see the separate [interpretations](https://ethicsportal.eu/directive-interpretations/). All 27 EU member states have transposed the Directive into national law. Your organization must comply with the national law in your country of operation --- see our [whistleblower laws by country](https://ethicsportal.eu/whistleblower-laws/) reference for specific law names, penalties, and enforcement authorities. Key national laws include [Loi Waserman](https://ethicsportal.eu/whistleblower-laws/france/) (France), [HinSchG](https://ethicsportal.eu/whistleblower-laws/germany/) (Germany), [D.Lgs. 24/2023](https://ethicsportal.eu/whistleblower-laws/italy/) (Italy), [Ley 2/2023](https://ethicsportal.eu/whistleblower-laws/spain/) (Spain), and the [Act of 14 June 2024](https://ethicsportal.eu/whistleblower-laws/poland/) (Poland). Last updated: 2026-05-17. --- ## §1. Reporting channels (Art. 8) Organizations with 50 or more employees must establish secure internal reporting channels (what this site calls a whistleblowing channel). For which breaches the channel must accept, including those added by later EU acts such as the AI Act, see §12 of the [interpretations](https://ethicsportal.eu/directive-interpretations/). | Requirement | How EthicsPortal handles it | |---|---| | Secure channel for reporting | Encrypted whistleblowing channel with a unique URL per organization | | Confidentiality of reporter identity | Application-level encryption at rest of report text, reporter identity fields and case messages, and per-file encryption of attachments; TLS in transit; no reporter IP addresses stored with reports or in application logs, automatic metadata stripping from uploaded files | | Accessible to all workers | Online reporting form works on any device, no app install or account required | | Customizable to the organization | Logo and brand color | --- ## §2. Reporting procedures (Art. 9) | Requirement | Article | How EthicsPortal handles it | |---|---|---| | Designate impartial person or department | [Art. 9(1)(c)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) | Case assignment system with role-based access --- only authorized handlers see reports | | Acknowledge receipt within 7 days | [Art. 9(1)(b)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) | Automatic deadline tracking with email notifications to handlers when the 7-day deadline approaches or is missed | | Diligent follow-up by the designated person | [Art. 9(1)(d)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) | Case management with status workflow (received, acknowledged, investigating, closed), internal notes for handler collaboration, and full audit trail | | Provide feedback within three months | [Art. 9(1)(f)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) | Automatic 3-month deadline tracking with overdue alerts to all organization admins. Reporters see the timeline in the whistleblowing channel and can check status at any time using their Case ID and password | | Enable oral reporting (telephone, voice messaging, or physical meeting on request) | [Art. 9(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) | Configurable phone number displayed in the whistleblowing channel; handlers can log phone, in-person, and letter reports directly in the system | | Inform about external reporting options | [Art. 9(1)(g)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) | The whistleblowing channel displays information about the reporter's right to contact national competent authorities, citing Directive 2019/1937 | --- ## §3. Scope of protection (Art. 4) The directive protects not just employees but also contractors, suppliers, shareholders, and other third parties. EthicsPortal displays clear guidance in the whistleblowing channel that reporting is open to employees, contractors, suppliers, and any other third parties. The intake form also asks the reporter — optionally — for their relationship to the organization (current or former employee, contractor, supplier, job applicant, shareholder, or other), mirroring the Art. 4 personal-scope categories, so handlers can confirm that protection attaches. The question is skippable, so anonymity is never conditioned on answering it. --- ## §4. Anti-retaliation (Art. 6, 19--21) Reporters must be informed that retaliation is prohibited by law. EthicsPortal displays an anti-retaliation notice on every page of the whistleblowing channel, citing Directive 2019/1937, before the reporter submits. The intake form additionally lets the reporter flag, optionally, whether they fear or already face retaliation. When set, the report carries a prominent urgency badge in the handler view, so a heightened-protection case is visible at a glance. --- ## §5. Confidentiality of identity (Art. 16) | Requirement | How EthicsPortal handles it | |---|---| | Identity not disclosed beyond authorized staff | Role-based access control --- only admins, the primary assignee, and explicitly added participants (e.g. legal, HR) can view a report. Non-admin handlers only see cases they are assigned to or added to as a participant | | Handler anonymity toward reporter | Whistleblowers see "Case handler" in messages, never the handler's real name or email | | Sensitive data encrypted | Reporter names, contact details, report descriptions, and message bodies are encrypted at rest using non-deterministic encryption; attached files are encrypted at rest with a separate key per file | **No AI processing of report content.** Confidentiality under [Art. 16](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) extends to *which third parties* see the report. EthicsPortal does not transmit report content, reporter identity, or case communications to any large language model or AI inference service --- not for categorisation, not for summarisation, not for translation. No AI provider (OpenAI, Anthropic, Google, Mistral, or other) is a sub-processor. This removes a class of sub-processor disclosure from your DPA and removes [Art. 22](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) (automated decision-making) considerations from your DPIA. See the [sub-processor list](https://ethicsportal.eu/subprocessors/) for the corresponding entry. Two additional reasons this is a confidentiality-grade decision, not a feature preference: - **No hallucination in the compliance evidence chain.** Large language models produce probabilistic output. A summary that says "this report does not appear urgent" is a probability, not a fact, and cannot be reproduced or audited. EthicsPortal records actor, action, and timestamp deterministically --- the audit log is evidence, not a guess. - **No prompt-injection attack surface on reporter submissions.** Reporter input is untrusted by definition. Routing it through an LLM creates a class of attack where instructions embedded in report text can manipulate handler-facing output (suggested replies, summaries, categorisation). EthicsPortal removes the surface entirely by not performing inference on report content. --- ## §6. Record-keeping (Art. 18) | Requirement | How EthicsPortal handles it | |---|---| | Maintain records of every report | Complete audit log of all actions: submissions, status changes, messages, assignments, and report views | | Records stored securely | All sensitive fields encrypted at rest | | Records retrievable | Full case export to PDF including metadata, message thread, attachments list, and audit trail. Organization-level compliance report PDF available for auditors --- includes directive checklist, SLA metrics, and data protection summary without exposing sensitive report data | | Delete records when no longer necessary | Configurable data retention period (12, 24, 36, 48, or 60 months) with automatic deletion of expired closed reports | --- ## §7. GDPR compliance | Requirement | Article | How EthicsPortal handles it | |---|---|---| | Lawful basis for processing | Art. 6(1)(c) | Processing is necessary for compliance with EU Directive 2019/1937 | | Data processing disclosure | Art. 13/14 | Privacy notice displayed on the report submission form before the reporter submits | | Data minimization | Art. 5(1)(c) | Only essential fields collected; reporter name and contact are optional | | Storage limitation | Art. 5(1)(e) | Configurable retention period per organization with automatic deletion | | Integrity and confidentiality | Art. 5(1)(f) | Encryption at rest for report text, reporter identity fields, case messages and file attachments; no reporter IP addresses in application logs; file metadata automatically stripped | | Right to erasure | Art. 17 | Automatic retention-based deletion; manual deletion available to admins | --- ## §8. Security measures | Measure | Detail | |---|---| | Encryption at rest | All report descriptions, reporter names, contact details, and message bodies are encrypted using non-deterministic encryption; attached files are encrypted with a separate key per file | | No reporter IP storage | Reporter IP addresses are not stored with reports or in application logs --- rate limiting uses a keyed hash kept only for the rate-limit window | | File metadata stripping | EXIF data (GPS coordinates, camera model, author info) is automatically removed from uploaded images before storage | | Anonymous handler identity | Whistleblowers never see the handler's real name --- messages display "Case handler" | | Rate limiting | Public endpoints of the whistleblowing channel are rate-limited to prevent abuse | | Access control | Role-based permissions ensure only authorized handlers can view reports; non-admin handlers only see cases they are assigned to or added to as a participant | | Audit trail | Every action is logged with timestamp, actor, and action type --- append-only and always available for regulatory review | --- ## §9. What your organization still needs to do EthicsPortal handles the technical requirements. Your organization is responsible for: - **Data Protection Impact Assessment (DPIA)** --- whistleblowing is high-risk processing under Art. 35 GDPR and requires a DPIA before launch; start from our [pre-filled DPIA template for whistleblowing](https://ethicsportal.eu/dpia/) - **Designating a reporting officer** --- assign at least one person responsible for handling reports - **Internal policy** --- adopt a whistleblower protection policy and communicate it to employees - **Training** --- ensure designated handlers understand confidentiality obligations - **Non-retaliation enforcement** --- ensure management understands that retaliation is a legal violation - **Identity disclosure consent** --- if a reporter's identity must be shared beyond authorized handlers (e.g., with law enforcement), obtain the reporter's explicit consent first ([Art. 16(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937)) - **Informing workers** --- share the whistleblowing channel URL with employees (EthicsPortal provides a shareable link and QR code) --- ## Questions? Admins can download a **compliance report PDF** directly from the whistleblowing channel settings page. It includes a full EU Directive 2019/1937 checklist, SLA metrics, data protection measures, and audit trail summary --- ready to hand to an auditor without exposing any sensitive report data. For country-specific requirements (penalties, retention periods, enforcement authorities), see our [whistleblower laws by country](https://ethicsportal.eu/whistleblower-laws/) reference. For how EthicsPortal interprets the ambiguous provisions of the Directive (the 50-worker threshold, what counts as "diligent follow-up", retention justifications, GDPR lawful basis), see the [Directive 2019/1937 interpretations](https://ethicsportal.eu/directive-interpretations/). If you need help demonstrating compliance to your legal team or regulator, contact us at [legal@ethicsportal.eu](mailto:legal@ethicsportal.eu). --- # Directive 2019/1937 interpretations > How EthicsPortal interprets the ambiguous provisions of EU Directive 2019/1937. A reference document for compliance officers, data protection officers, and legal counsel. Canonical: https://ethicsportal.eu/directive-interpretations/ Last updated: 2026-11-10 This document records how EthicsPortal interprets provisions of EU Directive 2019/1937 that admit more than one reasonable reading. It is written for compliance officers, data protection officers, and legal counsel who must make defensible operational decisions in the absence of authoritative interpretive guidance from the European Commission or the Court of Justice. It is a living document. Where the Court of Justice, the European Data Protection Board, or a competent national authority issues binding interpretation that differs from the positions below, this document is revised and the prior position is preserved in the revision log. For the feature-to-requirement map --- which EthicsPortal capability satisfies each provision of the Directive --- see the [Directive 2019/1937 coverage map](https://ethicsportal.eu/directive-coverage/). The two documents are complementary: the coverage map documents what the product does; this document documents how we read the law. Last updated: November 2026. --- ## §1. Scope and sources This methodology addresses Directive 2019/1937 as transposed into the national law of the 27 EU member states. Where national transposition is stricter than the Directive, the national rule governs for organizations operating in that jurisdiction (see §9). Authoritative sources, in order of precedence: 1. **The Directive text itself** --- Directive (EU) 2019/1937 of 23 October 2019, including its recitals. 2. **National transposition laws** --- binding within each member state. See [whistleblower laws by country](https://ethicsportal.eu/whistleblower-laws/) for specific law names and enforcement authorities. 3. **Court of Justice of the European Union rulings** --- binding across the Union. 4. **European Data Protection Board guidance** --- for data protection aspects (Articles 17, GDPR overlay). 5. **National competent authority guidance** --- persuasive within the issuing state. This document is operational methodology. It is not legal advice. Organizations should validate interpretations with competent legal counsel in their jurisdiction before relying on them in audit or litigation. --- ## §2. Conventions **The Directive provides** introduces a statement of what the Directive text requires. **In practice, this means** introduces EthicsPortal's interpretation where the text permits more than one reading. **EthicsPortal implements this by** introduces how the interpretation manifests in the product. Operators choosing a different interpretation may need to adjust configuration or procedures accordingly. All Article references are to Directive 2019/1937 unless otherwise noted. --- ## §3. The 50-worker threshold (Art. 8) **The question.** Article 8(3) requires entities with "50 or more workers" to establish internal reporting channels. The Directive does not define how the headcount is calculated, how part-time and temporary workers count, or whether the threshold applies per legal entity or per corporate group. **The Directive provides** that "legal entities in the private sector with 50 or more workers" must comply (Art. 8(3)). Recital 48 clarifies that the threshold is calculated "in accordance with national law transposing the relevant Union law." **In practice, this means** the calculation follows each member state's existing workforce-counting rules for employment and social-security purposes. These rules vary: - **Germany** (HinSchG §12): headcount based on the number of persons regularly employed, counted per legal entity. - **France** (Loi Waserman, Art. 8): 50 workers calculated as the average monthly headcount over the preceding 12 months. - **Italy** (D.Lgs. 24/2023): average employment over the preceding year. - **Spain** (Ley 2/2023): 50 workers per entity, with group-level channels permitted under conditions. **The threshold is calculated per legal entity**, not per corporate group. A parent and a subsidiary are separate entities for Article 8 purposes unless national law provides otherwise. Article 8(6) permits shared resources within a group of up to 249 workers --- but the obligation to establish a channel is still triggered per entity above the 50-worker threshold. **Contractors, temporary agency workers, and interns** generally count toward the threshold when they fall within the national definition of "worker" --- which is broader than "employee" under EU law. The Court of Justice has consistently held that the EU-law concept of "worker" includes any person who performs services for and under the direction of another in return for remuneration (see *Lawrie-Blum*, C-66/85). **EthicsPortal implements this by** not gating access by headcount. Any organization may deploy a whistleblowing channel regardless of size. Organizations below the 50-worker threshold frequently operate whistleblowing channels voluntarily --- for risk management, because national law applies a lower threshold to their sector (e.g., financial services), or because group policy mandates it. --- ## §4. The acknowledgment timeline (Art. 9(1)(b)) **The question.** Article 9(1)(b) requires acknowledgment of receipt "within seven days of that receipt." The Directive does not specify calendar days or business days, nor when the clock starts for reports received outside business hours. **The Directive provides** for acknowledgment "within seven days of receipt." No further qualification is given. **In practice, this means** seven **calendar** days, counted from the moment the report enters the channel. This follows the general principle that Union-law time limits run in calendar days unless expressly stated otherwise (Regulation (EEC, Euratom) No 1182/71, Art. 3). Member states that have transposed the Directive have consistently treated the seven-day limit as calendar days (HinSchG §17(1)2; D.Lgs. 24/2023 Art. 5(1)(d); Loi Waserman Art. 8). A report submitted at 23:59 on a Sunday is a report received on that Sunday. The seven-day clock starts on the following day (day 1 = Monday) and expires at the end of the seventh day. This follows Regulation 1182/71 Article 3(1), which provides that where a period is expressed in days, the day of the triggering event does not count. **Acknowledgment is not the same as substantive response.** Acknowledgment is a confirmation that the report has been received and registered. It need not contain any assessment of the report's merits, nor the name of the person handling it. **EthicsPortal implements this by** sending an automatic acknowledgment to the reporter at the moment of submission, displayed in the whistleblowing channel and (where contact details are provided) by email. The acknowledgment includes the Case ID and the statutory three-month feedback deadline. Organizations configured for manual acknowledgment receive deadline alerts at 48 hours before the seven-day mark and on the day of expiry. --- ## §5. The feedback timeline (Art. 9(1)(f)) **The question.** Article 9(1)(f) requires feedback "not exceeding three months from the acknowledgment of receipt or, if no acknowledgment was sent to the reporting person, three months from the expiry of the seven-day period after the report was made." The Directive does not define what qualifies as "feedback." **The Directive provides** that "feedback" means "the provision to the reporting person of information on the action envisaged or taken as follow-up and on the grounds for such follow-up" (Art. 5(13)). **In practice, this means** feedback is substantive. A further acknowledgment or a statement that the report is "under review" is not feedback for the purposes of Article 9(1)(f). The reporter is entitled to know, by the three-month mark, what action the organization intends to take (or has taken) and the reasoning behind it. Feedback need not be a final determination. An organization may state that the matter is still under investigation, provided it also states what has been done so far, what further steps are planned, and when a further update can be expected. What is required is information sufficient for the reporter to evaluate whether the organization is handling the report seriously. **The three-month clock runs from the date of acknowledgment**, not from the date of report submission. Where acknowledgment is delayed, the feedback window shortens accordingly --- the latest permissible feedback date is three months and seven days after the report was made. **EthicsPortal implements this by** tracking both deadlines (7-day acknowledgment, 3-month feedback) per case and surfacing overdue alerts to all organization admins. Feedback to the reporter is delivered through two-way messaging in the whistleblowing channel, which preserves the reporter's anonymity where they have not disclosed their identity. --- ## §6. Diligent follow-up (Art. 9(1)(d)) **The question.** Article 9(1)(d) requires a "diligent follow-up by the designated person or department referred to in point (c)." "Diligent" is not defined. **The Directive provides** that follow-up means "any action taken by the recipient of a report or any competent authority, to assess the accuracy of the allegations made in the report and, where relevant, to address the breach reported" (Art. 5(12)). **In practice, this means** diligent follow-up has three minimum operational components: 1. **Assessment.** A documented evaluation of whether the allegations, if true, would constitute a breach within the material scope of the Directive (Art. 2) or national transposition. 2. **Investigation proportionate to the allegation.** Investigation steps commensurate with the seriousness of the alleged breach, the strength of the evidence, and the potential harm. Not every report warrants a full investigation; a report unsupported by any concrete detail may be assessed and closed with a documented rationale. A report with specific, corroborated detail warrants more. 3. **Contemporaneous record.** Actions taken, decisions made, and their reasoning must be recorded at the time they occur. A diligent follow-up that leaves no trail is indistinguishable from no follow-up at all. "Diligent" is an objective standard. It is not satisfied by subjective good faith alone. An organization that routinely closes reports without assessment, or that takes months to open a file, is not diligent even if it believes itself to be. **EthicsPortal implements this by** providing a case management workflow with status transitions (received, acknowledged, under investigation, closed), internal notes for handler collaboration, and an append-only audit trail that records every action with timestamp and actor. The audit trail is the primary evidence of diligence in an audit or regulatory review. --- ## §7. Confidentiality of identity (Art. 16) **The question.** Article 16(1) requires that the identity of the reporting person not be disclosed to anyone beyond authorized staff members. The Directive does not specify whether "identity" extends to metadata that could identify the reporter (IP addresses, browser fingerprints, file authorship metadata, timestamps patterns). **The Directive provides** that "the identity of the reporting person is not disclosed to anyone beyond the authorised staff members competent to receive or follow up on reports, without the explicit consent of that person" (Art. 16(1)). **In practice, this means** "identity" is read functionally: it includes any information that, alone or in combination, permits identification of the reporter. This reading aligns with the GDPR definition of personal data (Regulation (EU) 2016/679, Art. 4(1)) and with the European Data Protection Board's consistent position that identifiability is context-dependent. The following are treated as identity information: - The reporter's name, contact details, and any information they provide about themselves. - The **IP address** from which the report was submitted. - **File metadata** embedded in uploaded documents (author name, GPS coordinates in photos, device identifiers, revision history in office documents). - Patterns of timestamps or access that could uniquely identify one person (e.g., a report submitted at a time only one employee could plausibly have submitted it). Organizations that retain reporter IP addresses, or that accept uploaded files without stripping metadata, are exposed to a confidentiality failure that is technically a breach of Article 16 even if the reporter's name is never disclosed. **EthicsPortal implements this by** not storing reporter IP addresses with reports or in application logs (rate limiting uses a keyed hash kept only for the rate-limit window), stripping EXIF and document metadata from all uploaded files before storage, and encrypting reporter identity fields at rest with non-deterministic encryption (so that even full database access does not permit bulk lookup by name). --- ## §8. Retention period (Art. 18) **The question.** Article 18(1) requires that records of reports be kept "for no longer than it is necessary and proportionate in order to comply with the requirements imposed by this Directive, or other requirements imposed by Union or national law." The Directive does not specify a maximum period. **The Directive provides** a "necessary and proportionate" standard, anchored to compliance purposes. **In practice, this means** retention must be justified by reference to a concrete legal or operational purpose, time-limited, and documented in the organization's data protection records (GDPR Art. 30). In the absence of an ongoing investigation, litigation, or specific statutory requirement, retention beyond the close of the case becomes progressively harder to justify. Common justifications and their typical durations: | Purpose | Typical retention | |---|---| | Active case (received to closure) | Duration of case | | Subsequent investigation or litigation | Until final resolution | | Regulatory audit trail | Period set by sector regulation (commonly 5 years for financial services) | | Retaliation claim protection (Art. 21) | National limitation period for employment claims (typically 2--5 years) | | Statistical reporting under Art. 27(2) | Anonymized data only; personal data to be minimized or deleted | National transposition may set specific periods. Examples: - **Germany** (HinSchG §11(5)): documentation deleted three years after closure of the procedure, longer only where required by other laws. - **France** (CNIL guidance on Loi Waserman): retention periods calibrated per case type, with routine cases deleted within two months of closure if no follow-up is pursued. - **Italy** (D.Lgs. 24/2023 Art. 14): five years from closure of the report, subject to GDPR minimization. - **Slovenia** (ZZPri Art. 7(4)): five years after the end of the procedure, unless another act provides otherwise. A blanket retention period chosen for convenience ("we keep everything for 10 years") is not compliant with either Article 18 or GDPR Article 5(1)(e). Retention must be tied to purpose. **EthicsPortal implements this by** providing configurable retention periods (12, 24, 36, 48, 60 months) with automatic deletion of closed reports at the end of the configured period. The default setting is the shortest period that satisfies the most common national transposition requirements. Operators in sectors with longer statutory retention obligations configure the period to match. --- ## §9. Lawful basis for processing (GDPR interaction) **The question.** Article 17 of the Directive requires that personal data processing comply with GDPR. The Directive itself is not a lawful basis under GDPR Article 6 --- a controller must identify which specific basis applies. **The Directive provides** that processing "shall be carried out in accordance with Regulation (EU) 2016/679" (Art. 17). **In practice, this means** the lawful basis is **Article 6(1)(c) GDPR --- legal obligation**, where the organization is subject to a legal obligation to establish and operate a whistleblowing channel. For organizations above the 50-worker threshold (or below it where sector-specific law imposes the obligation), Article 6(1)(c) is the correct and sufficient basis. No consent from the reporter is required, and none should be sought --- treating the processing as consent-based would be misleading and would create a theoretical right to withdraw that the controller cannot honor. For organizations operating a whistleblowing channel **voluntarily** (below the 50-worker threshold and not subject to sector-specific mandate), the lawful basis is **Article 6(1)(f) --- legitimate interest**, subject to a documented balancing test. The legitimate interest in preventing and detecting wrongdoing within the organization is well-established and has been recognized in national guidance across member states. Special categories of personal data (GDPR Art. 9) may appear incidentally in reports --- a report of discrimination may reveal health information or ethnic origin. The lawful basis for Article 9 data is typically Article 9(2)(g) --- substantial public interest, provided the processing is proportionate and accompanied by specific safeguards. Reports revealing criminal offences (GDPR Art. 10) are processed under the corresponding Article 10 basis in national law. **EthicsPortal implements this by** documenting Article 6(1)(c) as the default lawful basis in the Data Processing Agreement and privacy notice. Operators below the statutory threshold adjust the privacy notice to reflect Article 6(1)(f) and record their balancing test separately. --- ## §10. National law supremacy (Art. 25) **The question.** Article 25(1) provides that member states may introduce or retain provisions "more favourable to the rights of reporting persons" than those set out in the Directive. The Directive does not address how operators should resolve conflicts when national law is stricter. **The Directive provides** in Article 25(1) that "Member States may introduce or retain provisions more favourable to the rights of reporting persons than those set out in this Directive, without prejudice to Article 22 [rights of persons concerned] and Article 23(2) [penalties for knowingly false reports]." **In practice, this means** where national transposition is stricter than the Directive, **national law governs** for organizations operating in that jurisdiction. There is no option to rely on the Directive minimum where the local rule is stricter. The Directive sets a floor, not a ceiling. Practical examples of stricter national rules: - **France** requires acknowledgment of external reports within seven working days and a feedback period that may be shorter than the Directive minimum for certain sectors (AMF, ACPR). - **Germany** explicitly extends protection to reports about certain categories of legal violations beyond the material scope of the Directive (HinSchG §2). - **Italy** imposes a lower worker threshold (50, but with specific sectors at any headcount for certain entities) and specific record-keeping formalities. - **Poland** imposes specific requirements on the form of the whistleblowing channel policy that are not in the Directive text. - **Slovenia** requires the person who receives internal reports (the *zaupnik*) to be appointed from among the employer's own employees, and obliges every covered employer to file an annual return to the anti-corruption commission by 1 March. **For multi-country operators**, the operating rule is: in each jurisdiction, apply the stricter of (Directive, national law). This sometimes means that a group policy sets a uniform high standard matching the strictest national rule in any country of operation. This is generally preferable to maintaining parallel policies per jurisdiction, which increases administrative burden and the risk of applying the wrong rule. **EthicsPortal implements this by** defaulting to the strictest common denominator across the 27 member states: shortest acknowledgment and feedback windows, narrowest retention period, fullest anti-retaliation notice. Operators in a single jurisdiction may relax specific defaults to match national rules, but the baseline is calibrated above the Directive minimum in every article where national transposition laws exceed it. --- ## §11. Anonymous reporting (Art. 6(2), Art. 9(1)(e)) **The question.** Must an organization accept anonymous reports? **The Directive provides** in Article 6(2) that it "does not affect the power of Member States to decide whether or not to require legal entities [...] to accept and follow up on anonymous reports." Article 9(1)(e) requires "diligent follow-up, where provided for in national law, as regards anonymous reporting." **In practice, this means** national law decides. Two postures: - **Required** in some jurisdictions or sectors (e.g., French financial-services regulation). - **Permitted** in most Member States --- Germany (HinSchG), Italy (D.Lgs. 24/2023, with mandated diligent follow-up once a report is accepted), Poland (Ustawa o ochronie sygnalistów), and others. Three consequences. **Once accepted, binding.** An organization that publishes "we accept anonymous reports" has triggered Article 9(1)(e). The obligation attaches to the policy, not the individual report. **Anti-retaliation applies only from identification.** Article 21 cannot protect an unknown person. Actions taken during the anonymous period are not retroactively covered. **Anonymity is a technical standard, not a promise.** A form that collects an email is not anonymous. A channel that logs IP addresses is not anonymous. Article 16 confidentiality protects a known identity from disclosure; anonymity prevents identification. **EthicsPortal implements this by** accepting anonymous reports by default. No contact details are required. Reporter IP addresses are not stored with reports or in application logs (rate limiting uses a keyed hash kept only for the rate-limit window). File metadata is stripped before storage. Anonymous reporting cannot be switched off. Where national law requires identified reports, the organization's own procedure decides how an anonymous report is handled. Accepted anonymous reports follow the same case workflow, deadlines, and diligent-follow-up standard as identified ones. --- ## §12. Which breaches the channel must accept (Art. 2 and later EU acts) **The question.** Article 2 and the Annex list the areas of Union law the Directive covers. Several EU acts adopted since 2019 add to that list. Which reports must a whistleblowing channel accept today, and from when? **The Directive provides** in Article 2(1) that it covers breaches of the Union acts listed in the Annex, breaches affecting the financial interests of the Union, and breaches relating to the internal market. Article 2(2) allows member states to extend protection to other areas under national law. **In practice, this means** the list grows each time a new EU act refers to the Directive. There are two forms: - **Applies directly.** A regulation states that Directive 2019/1937 "shall apply" to reports of breaches of that regulation. No national law is needed. - **Through national law.** A directive requires member states to make Directive 2019/1937 apply. The date and the detail depend on each country's transposition. | EU act | Article | Reports covered | Form | From | |---|---|---|---|---| | Markets in Crypto-Assets Regulation (EU) 2023/1114 | Art. 116 | Breaches of the crypto-asset rules | Applies directly | 30 December 2024 | | Directive (EU) 2024/1226 on violations of Union restrictive measures | Art. 14 | Violations of EU sanctions | Through national law | Transposition deadline 20 May 2025 | | AI Act, Regulation (EU) 2024/1689 | Art. 87 | Breaches of the AI Act | Applies directly | 2 August 2026 | | Anti-Money Laundering Regulation (EU) 2024/1624 | Art. 14(1) | Breaches of the anti-money laundering rules and of Regulation (EU) 2023/1113 on transfers of funds | Applies directly | 10 July 2027 | | Forced Labour Regulation (EU) 2024/3015 | Art. 9(7), Art. 36 | Breaches of the ban on products made with forced labour | Applies directly | 14 December 2027 | | Anti-corruption Directive (EU) 2026/1021 | Art. 25(1) | The corruption offences in its Articles 3 to 11, including bribery in the private sector | Through national law | Transposition deadline 1 June 2028 | | Corporate Sustainability Due Diligence Directive (EU) 2024/1760, as amended by Directive (EU) 2026/470 | Art. 30 | Breaches of the national law that transposes it | Through national law | 26 July 2029 | **The Anti-Money Laundering Regulation also sets who must have a channel.** From 10 July 2027, every obliged entity must have an internal channel that meets the Directive, whatever its size (Art. 14(2)). Only a natural person, or a company whose activities are performed by one person, is exempt (Art. 14(3)). Many of these entities already had no 50-worker threshold under Article 8(4), which excludes the Union acts in Parts I.B and II of the Annex from that threshold. National law can go further than this list (Art. 2(2)). Where it does, the national scope governs (see §10). **EthicsPortal implements this by** accepting reports on any subject through the same whistleblowing channel. The reporter can choose the closest category or "Other", or leave the category empty. The category helps the handler and does not limit what can be reported. No separate channel is needed for any of the acts above. --- ## Revision log - **November 2026** --- §12 added on which breaches the channel must accept, including the EU acts that extend the Directive's scope since 2019. - **November 2026** --- §11 corrected: anonymous reporting cannot be switched off. An earlier version described a setting to require contact details that EthicsPortal does not have. - **April 2026** --- §11 added on anonymous reporting (Art. 6(2), Art. 9(1)(e)). - **April 2026** --- Initial publication. --- ## Corrections and inquiries This document is intended to be cited and relied upon. If you identify an error, a position that conflicts with a Court of Justice ruling, a European Data Protection Board opinion, or binding national guidance, contact [legal@ethicsportal.eu](mailto:legal@ethicsportal.eu). Corrections are published in the revision log with date and summary of change. For questions about how a specific interpretation applies to your organization's circumstances, this document is not a substitute for legal advice. Contact competent legal counsel in your jurisdiction. --- # DORA contracting template > Non-binding contracting template for financial entities procuring EthicsPortal under Regulation (EU) 2022/2554 (DORA). Canonical: https://ethicsportal.eu/dora-addendum/ Last updated: 2026-09-30 **Template date:** September 6, 2026 This page is a procurement template, not a binding addendum, compliance certification, legal opinion, or representation that EthicsPortal is suitable for a particular regulated function. Publication, a subscription, acceptance of the [Data Processing Agreement](https://ethicsportal.eu/dpa/), or a customer's unilateral classification of the Service does **not** incorporate this template into any agreement. A DORA addendum becomes binding only when the Financial Entity and EthicsPortal sign a written DORA order that: 1. identifies both parties and their authorized representatives; 2. identifies the covered Service, start date, term and countries of provision and processing; 3. records the Financial Entity's DORA status and the parties' agreed treatment of the Service, including whether it supports a critical or important function ("CIF"); 4. attaches or identifies fixed versions of the Terms, DPA, SLA, service description, security measures and ICT service supply chain; 5. specifies notice periods, quantitative service levels, transition period, included assistance and all pre-agreed rates; and 6. is signed by both parties. The complete signed order and its schedules form one downloadable and durable contractual record. Public website pages are procurement information only and are not incorporated unless the signed order identifies a dated version or attaches a snapshot. > To request a scoped and countersigned DORA order, contact [legal@ethicsportal.eu](mailto:legal@ethicsportal.eu). The provider-side evidence available for due diligence and the register of information is published in the [DORA ICT third-party map](https://ethicsportal.eu/dora/). --- ## 1. Parties and definitions **Provider:** EthicsPortal, a trade name used by Yaroslav Shmarov, a sole proprietor (jednoosobowa działalność gospodarcza) registered in Poland (NIP: 5272755790), at ul. Obrzeżna 1A, 02-691 Warsaw, Poland. **Financial Entity:** The customer identified in the signed DORA order. **Service:** The EthicsPortal whistleblowing channel components specifically identified in the signed DORA order. **CIF Service:** The Service only where the signed DORA order records the parties' agreed treatment of it as supporting a critical or important function. A notice or classification made by the Financial Entity alone does not expand the Provider's contractual obligations. Terms defined in Regulation (EU) 2022/2554 ("DORA") carry their DORA meanings. An **ICT subcontractor** is a third party to which the Provider subcontracts all or part of an ICT service supporting the Service. A **Material ICT Subcontractor** is an ICT subcontractor whose failure could materially impair a CIF Service. ## 2. Contract documents and precedence The signed DORA order must list every incorporated document by title, date or version and, where available, digest. It prevails over the Terms, DPA and SLA only to the extent of an express conflict concerning DORA. No marketing page, trust page, incident page, policy, roadmap, questionnaire answer or later website change amends the contract unless both parties agree in writing. Unless the signed DORA order expressly states otherwise, all claims arising from the order, this addendum, the Terms, DPA, SLA and Service are subject collectively to the single aggregate liability cap in the Terms. Nothing limits liability that cannot lawfully be limited. ## 3. Scope, locations and subcontracting {#scope-locations-and-subcontracting} The signed DORA order must describe the covered functions and services, processing and provision locations, permitted subcontracting, applicable data categories, and the division of responsibilities. The current provider-side baseline is available in the [DORA map](https://ethicsportal.eu/dora/), but it must be verified and fixed in the signed order before reliance. The Provider gives the change notice specified in the signed order before changing a covered country, region, direct ICT subcontractor or Material ICT Subcontractor. For a CIF Service, the order must also identify the material service chain and the applicable conditions required by Delegated Regulation (EU) 2025/532, including: - the services that may be subcontracted and the locations from which they may be provided; - the Provider's assessment and ongoing monitoring of Material ICT Subcontractors; - continuity, security, incident, reporting and audit obligations passed through to the extent required for the subcontracted component; - the notice and objection process for material subcontracting changes; and - the Financial Entity's termination rights where the agreed conditions are not met. The Provider does not represent an unverified downstream provider, certification or contractual right as equivalent compliance. If a required downstream right is unavailable, that gap must be recorded before the order is signed. ## 4. Data, security and service levels The DPA governs processing of personal data. The signed DORA order must attach or identify the applicable security schedule and SLA, including: - measures supporting availability, authenticity, integrity and confidentiality; - precise quantitative and qualitative targets for a CIF Service; - measurement, reporting, exclusions and corrective-action procedures; - recovery objectives and business-continuity arrangements; and - the process for agreeing changes to those measures and targets. Targets published on the website are the current standard offering, not a warranty for a DORA engagement unless the signed order incorporates them. ## 5. Data access, recovery, return and deletion Standard in-product exports and the return or deletion rights in the DPA remain available on their stated terms. The signed DORA order must specify any additional machine-readable export, recovery assistance, delivery deadline and format required for termination, insolvency, resolution or discontinuation. The Provider will use the contingency arrangements identified in the signed order to preserve access and return data in those events. Performance remains subject to applicable law, technical feasibility, security requirements and the availability of systems and subcontractors outside the Provider's control. This clause does not promise continued operation after the Provider has lost the legal or technical ability to perform; the signed order must record the relevant continuity limitations and customer-side contingency measures. ## 6. ICT incidents and assistance charges The Provider's required incident notifications under the DPA and delivery of information already produced in the ordinary incident response are included in the subscription fee. Additional DORA assistance—such as customer-specific classification, regulatory forms, meetings, bespoke evidence, extended root-cause analysis or support for authority submissions—is provided only to the extent stated in the signed DORA order. The order must set an hourly rate, included hours (if any), authorization process and expense treatment before service begins. No rate left blank or described as "to be agreed" satisfies this template. ## 7. Cooperation, audits and authorities The Provider will cooperate with the Financial Entity's competent and resolution authorities to the extent required by DORA and the signed order. Authority access is not made conditional on routine customer-audit notice periods. For customer and mandated-auditor reviews, the signed order must specify the scope, procedure, frequency, confidentiality safeguards, remote-first process, included assistance and pre-agreed rate for additional Provider time. Audits must relate to the covered Service and protect other customers' data and security. These logistical and cost provisions must not impede the effective exercise of a competent authority's rights or the unrestricted access, inspection, audit and copying rights required for a CIF Service. The Provider operates no office or data centre of its own. Its direct audit surface is the application and the documentation under its control. Supplier premises, reports and certifications are available only to the extent of the Provider's verified contractual rights and the supplier's applicable terms. ## 8. Training and threat-led penetration testing Participation in the Financial Entity's security-awareness or digital-operational-resilience training is subject to the remote format, frequency, included hours and pre-agreed rate stated in the signed DORA order. Where a competent authority scopes the Service into threat-led penetration testing, participation requires a separate written statement of work covering scope, rules of engagement, test environment, safety, confidentiality, responsibility for third-party effects, remediation and costs. The Financial Entity bears the testing provider's fees and the Provider's time is charged at the rate fixed in the signed DORA order unless that order includes specified hours. Testing may not endanger other customers or production data. Where DORA permits, the parties may use pooled testing or an equivalent environment. ## 9. Termination Ordinary cancellation remains governed by the Terms and the subscription order. The DORA order does not create an additional right to terminate at any time for any reason. The signed DORA order must state its minimum notice periods and the Financial Entity's termination rights for the circumstances required by DORA, including material legal or contractual breach, material changes affecting performance, evidenced weaknesses in ICT risk management, supervisory impediment, and non-compliant material subcontracting changes. Immediate suspension or shorter notice remains available where required by law or reasonably necessary to address non-payment, fraud, misuse or a security threat. ## 10. Exit and transition for a CIF Service For a CIF Service, the signed DORA order must set an adequate transition period based on the covered function and exit plan. During that period: - standard export functions remain available while the Service is operational; - any continued service, bulk export, migration assistance and knowledge transfer are provided only as defined in the order; - subscription and assistance fees remain payable; - the Financial Entity must cooperate, make timely decisions and maintain its own tested exit plan; and - performance is subject to law, safety, technical feasibility and third-party dependencies. The order must define extension, early termination and deletion instructions. It must not assume that the Provider can continue full service after insolvency, resolution, legal prohibition or technical incapacity. ## 11. Customer responsibilities and no compliance warranty The Financial Entity remains responsible for determining DORA applicability, classifying its functions, conducting due diligence and concentration-risk assessment, maintaining its register of information, testing its exit strategy, providing accurate instructions and obtaining any necessary regulatory approval. The Financial Entity must promptly provide the information and access reasonably needed for performance, mitigate avoidable loss, maintain appropriate internal controls, and use exports and contingency measures available to it. The Provider supplies information and contractual commitments about the Service. It does not warrant that the Financial Entity's use of the Service, this template, or any signed order by itself ensures the Financial Entity's compliance with DORA or any other law. ## 12. Governing law and language The signed DORA order is governed by Polish law and the forum stated in the Terms, without prejudice to powers that applicable law gives competent, resolution or oversight authorities. This template is drafted in English. Any translation is for convenience; the English text controls unless a signed DORA order expressly states otherwise. --- ## Contact **Contracts:** [legal@ethicsportal.eu](mailto:legal@ethicsportal.eu) **Security and incidents:** [security@ethicsportal.eu](mailto:security@ethicsportal.eu) **Commercial matters:** [support@ethicsportal.eu](mailto:support@ethicsportal.eu) --- # DORA ICT third-party map > Provider-side information for evaluating EthicsPortal under Regulation (EU) 2022/2554 (DORA) — Article 30 contracting topics, register of information data, subcontractor chain, and the withdrawn UKNF cloud communication. Canonical: https://ethicsportal.eu/dora/ Last updated: 2026-11-08 For a financial entity, buying a whistleblowing channel is not a software purchase. Regulation (EU) 2022/2554 (DORA) has applied since 17 January 2025, and it makes EthicsPortal an **ICT third-party service provider**: the engagement runs through your ICT third-party risk process, gets an entry in your register of information, and must carry the contractual provisions in Article 30. This page supplies provider-side information for that work. It is not legal advice, a compliance certification, a warranty of regulatory suitability, or part of a customer contract. The Financial Entity must verify the information against its own classification, risk assessment and intended use. The [DORA contracting template](https://ethicsportal.eu/dora-addendum/) shows the subjects a bilateral DORA order must cover. It does not bind through publication, subscription, acceptance of the DPA, or a customer's unilateral classification. A DORA arrangement exists only after both parties sign a scoped order with fixed schedules, assistance rates and transition terms. DORA does not require a whistleblowing channel. It governs how you procure one. The obligation itself comes from [Directive 2019/1937](https://ethicsportal.eu/directive-coverage/) — which, under [Art. 8(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937), applies to entities within the scope of the Union financial-services and anti-money-laundering acts **irrespective of headcount** — and from the sector rules summarised on the [financial services](https://ethicsportal.eu/industries/financial-services/) page. Last updated: 2026-10-06. --- ## How to read this page | Status | Meaning | |---|---| | **DPA / Terms** | The cited obligation is already present in the ordinary customer agreement, subject to its scope and limits | | **DORA order required** | The item must be completed and incorporated in a bilateral signed DORA order before it becomes contractual | | **Published** | The information the provision requires is published on this site and can be lifted directly into your register or assessment | | **Partial** | Substantively in place, with a stated limit — the limit is named, not glossed | | **Not offered** | Not available. The reason is stated, and the item appears in [open items](https://ethicsportal.eu/dora/#open-items) where it is fixable | --- ## Is this service in scope for you? Two determinations, in order. **Is it an ICT service?** Yes. EthicsPortal is delivered as software-as-a-service and falls under type **S19 (Cloud services: SaaS)** in the ICT-services taxonomy used by the register of information. **Does it support a critical or important function?** That classification is yours to make, not ours to assert. The facts you need to make it: - The function supported is a statutory compliance obligation, not a licensed activity. Directive 2019/1937 sets a 7-day acknowledgement and a 3-month feedback deadline. EthicsPortal publishes a **four-hour recovery time objective**, but the full-service recovery path and operator-incapacity response have not been demonstrated against it. Financial entities must assess the continuity impact on their own process. - The service holds no customer funds, executes no transactions, and sits on no payment, trading, settlement, or core-banking path. It has no integration with your systems: it runs standalone, so it cannot propagate a failure inward. - It does process information that may be legally protected in your sector, which is why the confidentiality controls below matter regardless of the classification. The result depends on your documented Article 3(22) assessment, including whether disruption or defective performance would materially impair your continuing compliance. The facts above support that assessment but do not predetermine it. If your assessment treats the Service as supporting a critical or important function, contact EthicsPortal before contracting. The classification does not itself activate additional obligations; the Article 30(3) scope, supplier chain, fees and exit terms must be agreed in a signed DORA order. --- ## Register of information data Provider-supplied fields for the register of information under Article 28(3) DORA and Implementing Regulation (EU) 2024/2956. They are a baseline, not a completed register: the financial entity supplies its own arrangement, function, risk, cost and classification fields and validates the relevant ICT service supply chain. ### Direct provider | Field | Value | |---|---| | Legal name | Yaroslav Shmarov, sole proprietor (jednoosobowa działalność gospodarcza), trading as EthicsPortal | | Registered country | 🇵🇱 Poland | | Registered address | ul. Obrzeżna 1A, 02-691 Warsaw, Poland | | Identification code | Polish tax identification number (NIP) **5272755790** | | Type of identification code | **VAT** — the ITS code for a VAT number | | Type of provider | Individual acting in a business capacity | | Type of ICT service | **S19** — Cloud services: SaaS | | Function supported | Internal reporting channel under Directive 2019/1937 and applicable sector rules | | Countries from which the service is provided | 🇵🇱 Poland (operator and contractual performance); 🇩🇪 Germany (application and storage infrastructure) | | Country where data is stored | 🇩🇪 Germany (Nuremberg; file attachment backup copy in Falkenstein) | | Sensitivity of data stored | Assess against your own scheme. Report content, reporter identity and handler messages are encrypted at rest at field level, and attached files with a separate key per file; see [Security](https://ethicsportal.eu/security/#data-encryption) | | Reliance on subcontracting | Yes — the provider-side baseline is below; the GDPR inventory is published separately at [/subprocessors/](https://ethicsportal.eu/subprocessors/) | | Governing law of the contractual arrangement | 🇵🇱 Poland ([Terms §13](https://ethicsportal.eu/terms/)) | | Provision of service to the entity's own critical or important functions | The entity's determination — see [scope](https://ethicsportal.eu/dora/#is-this-service-in-scope-for-you) | **On the identification code.** EthicsPortal does not hold a Legal Entity Identifier (LEI). The operator is a sole proprietorship registered in the Polish CEIDG rather than a company in the KRS, so no European Unique Identifier (EUID) is issued for it either. Use the NIP above with code type **VAT**. An LEI is on the [open items](https://ethicsportal.eu/dora/#open-items) list; when one is issued it will be published here. ### ICT service supply chain {#ict-service-supply-chain} The GDPR [sub-processor list](https://ethicsportal.eu/subprocessors/) and the DORA supply chain answer different questions. The table below contains direct providers whose components underpin delivery of the Service. Stripe is used for billing and Cloudflare only for the marketing site; neither supplies the whistleblowing channel and neither is included in this service chain. Rank 1 is EthicsPortal. Direct providers are shown at rank 2. The public rank-3 examples below show that the chain does not end there; they are **not** a complete, account-verified register. Where the Service supports a critical or important function, the Financial Entity determines which indirect providers effectively underpin it, and EthicsPortal must complete account-specific validation before accepting the CIF classification. | Direct ICT provider | Contracting country | ICT service type | Rank | Component and data | |---|---|---|---|---| | Hetzner Online GmbH | 🇩🇪 Germany | S17 — Cloud services: IaaS | 2 | Application server, database, file attachment storage — all report data | | Mailjet / Sinch (contracting entity to verify) | 🇫🇷 France | S19 — Cloud services: SaaS | 2 | Handler and optional reporter notification delivery; reporter email and Case ID where email is elected, but no report narrative in notification templates | | AppSignal B.V. | 🇳🇱 Netherlands | S19 — Cloud services: SaaS | 2 | Error and performance telemetry; reporter portal requests are configured for exclusion | Publicly listed downstream examples include Hetzner Finland Oy for EU hosting support; Google Cloud France for Mailjet infrastructure; US-based Mailgun Technologies for Mailjet support; AWS EMEA and Worldstream for AppSignal storage/hosting; and US-based Mailgun Technologies for AppSignal transactional email. [Hetzner DPA Appendix 3](https://www.hetzner.com/AV/DPA_en.pdf), [Sinch sub-processor list](https://sinch.com/legal/data-protection-agreement-sub-processors/), and [AppSignal security page](https://www.appsignal.com/security) describe these roles. A listed US supplier does not prove report content reaches it, but an EU-based direct supplier does not prove an EU-only chain. Legal names, identifiers, parent undertakings, exact provision locations, data access and material downstream ranks must be confirmed against account-specific evidence before submission to a competent authority. Subcontractor changes are notified at least **30 days** in advance, and you may object and terminate if no resolution is reached ([DPA §6.4](https://ethicsportal.eu/dpa/)). --- ## Article 30(2) — baseline provisions These apply to every ICT service contract, whatever the classification. | Article 30(2) | Requirement | Status | Where | |---|---|---|---| | (a) | Description of functions and services; whether subcontracting is permitted and on what conditions | DPA / Terms + order required | The [DPA §2](https://ethicsportal.eu/dpa/) and [§8](https://ethicsportal.eu/dpa/) provide the standard scope and processor chain. A DORA order must fix the covered service and ICT subcontracting conditions | | (b) | Locations — regions or countries — where services are provided and data is processed, with advance notice of change | Published + order required | Current locations are at [/subprocessors/](https://ethicsportal.eu/subprocessors/) and [Security#infrastructure](https://ethicsportal.eu/security/#infrastructure). The DORA order must fix the applicable locations and change notice | | (c) | Availability, authenticity, integrity and confidentiality of data, including personal data | DPA / Terms + published | [DPA §6.3](https://ethicsportal.eu/dpa/) and [/security/](https://ethicsportal.eu/security/) describe the standard contractual and operational controls | | (d) | Access, recovery and return of data in an easily accessible format on insolvency, resolution, discontinuation, or termination | Partial + order required | Standard export and DPA return/deletion rights exist. The order must define additional formats, deadlines, contingency arrangements and known incapacity limits; see [template §5](https://ethicsportal.eu/dora-addendum/) | | (e) | Service level descriptions, including updates and revisions | Published + order required | [/sla/](https://ethicsportal.eu/sla/) states the standard offering. The order must identify the binding version and change process | | (f) | Incident assistance at no additional cost, or at a cost determined ex ante | Order required | Ordinary incident notifications and existing information are included. Customer-specific DORA assistance requires included hours and a rate fixed in the signed order; see [template §6](https://ethicsportal.eu/dora-addendum/) | | (g) | Full cooperation with the entity's competent authorities and resolution authorities | Order required | The scope and process must be included in the signed order; see [template §7](https://ethicsportal.eu/dora-addendum/) | | (h) | Termination rights and minimum notice periods | Order required | Ordinary cancellation follows the Terms. DORA grounds and minimum notice periods must be stated in the signed order; see [template §9](https://ethicsportal.eu/dora-addendum/) | | (i) | Conditions for participation in the entity's ICT security awareness and digital operational resilience training (Art. 13(6)) | Order required | Format, frequency, included hours and the pre-agreed rate must be stated in the signed order; see [template §8](https://ethicsportal.eu/dora-addendum/) | --- ## Article 30(3) — extended provisions (critical or important functions) These topics apply only where the parties' signed DORA order records the Service as supporting a critical or important function. A unilateral classification does not activate them. | Article 30(3) | Requirement | Status | Where | |---|---|---|---| | (a) | Full service level descriptions with precise quantitative and qualitative performance targets | Published baseline + order required | [/sla/](https://ethicsportal.eu/sla/) states the standard offering. The signed order must fix binding targets, measurement, reporting and corrective actions | | (b) | Notice periods and reporting obligations, including developments with a material impact on service delivery | Order required | The signed order must define material developments, reporting content and notice periods | | (c) | Business contingency plans, tested, and ICT security measures appropriate to the service | Published | [Business continuity plan](https://ethicsportal.eu/policies/business-continuity/) with activation triggers and recovery objectives; [information security policy](https://ethicsportal.eu/policies/information-security/); [risk register](https://ethicsportal.eu/policies/risk-register/). Restore drills run monthly in CI and on demand, with backup freshness monitored continuously ([Security](https://ethicsportal.eu/security/#backups-and-restore)) | | (d) | Participation in threat-led penetration testing under Articles 26–27 | Order + statement of work required | Scope, safety, responsibility, environment and all charges must be agreed in writing; see [template §8](https://ethicsportal.eu/dora-addendum/) | | (e) | Unrestricted rights of access, inspection and audit, including by the competent authority | Order required, downstream validation open | The order must preserve the required rights while defining routine logistics and pre-agreed assistance rates. Supplier access exists only where verified; see [template §7](https://ethicsportal.eu/dora-addendum/) | | (f) | Exit strategies with a mandatory adequate transition period | Order required | The transition length, continued service, exports, migration work, fees, customer cooperation and incapacity limits must be fixed in the signed order; see [template §10](https://ethicsportal.eu/dora-addendum/) | --- ## Article 28 — the surrounding obligations | Provision | What it requires of you | What we supply | |---|---|---| | Art. 28(1)–(2) | Manage ICT third-party risk within your own framework, proportionate to the arrangement | The published evidence set: [security](https://ethicsportal.eu/security/), [subprocessors](https://ethicsportal.eu/subprocessors/), [business continuity plan](https://ethicsportal.eu/policies/business-continuity/), [risk register](https://ethicsportal.eu/policies/risk-register/), [incident register](https://ethicsportal.eu/incidents/), [ISO/IEC 27001:2022 self-assessment](https://ethicsportal.eu/iso-27001/), [internal audit record](https://ethicsportal.eu/policies/internal-audit/), [management review record](https://ethicsportal.eu/policies/management-review/), [CAIQ-aligned questionnaire](https://ethicsportal.eu/caiq/) | | Art. 28(3) | Maintain a register of information and report it to your competent authority | The [provider-side baseline](https://ethicsportal.eu/dora/#register-of-information-data) above, with the limits and customer-owned fields stated explicitly | | Art. 28(4) | Pre-contract due diligence and assessment before entering the arrangement | The same evidence set, plus a [pre-filled DPIA](https://ethicsportal.eu/dpia/) for the processing itself | | Art. 28(7) | Termination rights on material breach, supervisory impediment, or weaknesses in ICT risk management | Must be stated in the signed DORA order; ordinary cancellation remains governed by the Terms | | Art. 28(8) | Document and test an exit strategy — **required only for ICT services supporting a critical or important function** | Customer-owned obligation; standard exports support it, while a binding transition period requires a signed DORA order | | Art. 29 | Assess ICT concentration risk before contracting | Concentration is at the infrastructure layer: report data sits with a single IaaS subcontractor in one region. That is stated plainly rather than obscured, so it can enter your assessment | --- ## Open items Published because a gap that is named can be assessed, and one that is glossed over will be found later. | Item | Why it matters | Status | |---|---|---| | Legal Entity Identifier (LEI) | Your register of information prefers an LEI or EUID; neither exists for a Polish sole proprietorship today, so the NIP is used as an other identifier | Being obtained | | Executed DORA order | Article 30 requires the full arrangement to be documented in one written and durable record | [Template published](https://ethicsportal.eu/dora-addendum/); scoped bilateral signature required before any DORA commitment applies | | CIF subcontractor validation | Regulation (EU) 2025/532 requires identification of the material service chain and pass-through access, inspection and audit rights | Provider-by-provider evidence and downstream ranks must be verified before a CIF order is signed | | Operator-incapacity protocol | Article 30(2)(d) access and return in the discontinuation case | In treatment — [BCP §8](https://ethicsportal.eu/policies/business-continuity/), [risk register R-01](https://ethicsportal.eu/policies/risk-register/) | | Independent penetration test | Asked by every regulated-finance assessment | Completed October 2026; all findings fixed and confirmed by retest — [/trust/](https://ethicsportal.eu/trust/#certification-status) | | Cyber liability insurance | Asked by every regulated-finance assessment | Under review — [/trust/](https://ethicsportal.eu/trust/#contracting-positions) | --- ## Poland: the withdrawn UKNF cloud communication The UKNF communication of 23 January 2020 on the processing of information by supervised entities in public or hybrid cloud computing — the *komunikat chmurowy* — **was withdrawn on 17 January 2025**, the day DORA became applicable. KNF withdrew it alongside the sector IT-management resolutions (resolution 6/2025 repealing 7/2013, which issued Recommendation D for banks; 7/2025 repealing 615/2016; 8/2025 repealing resolutions 409–411 and 413/2014), on the stated ground that their subject matter overlaps the obligations arising from DORA and its implementing acts. Practically: the 14-day pre-notification to UKNF and the Annex 1 form no longer apply. Your obligations run through DORA and the register of information instead. Many internal cloud policies, vendor questionnaires and sector rankings still carry the komunikat's checklist. The mapping below is kept for that reason, and for that reason only — it describes a standard that is no longer in force. | Komunikat requirement | EthicsPortal position | |---|---| | VII.4.1(a) — division of responsibility for security, continuity, RTO/RPO, declared SLA with measurement method | [/sla/](https://ethicsportal.eu/sla/): 99.5% monthly, RPO 24h, RTO 4h, externally measured. Processor/controller split in [DPA §2](https://ethicsportal.eu/dpa/) | | VII.4.1(b) — clear definition of processing locations and how they are verified | Nuremberg and Falkenstein, Germany, named per component at [Security#infrastructure](https://ethicsportal.eu/security/#infrastructure) and [/subprocessors/](https://ethicsportal.eu/subprocessors/) | | VII.4.1(c)–(e) — governing law and venue; GDPR conformity; ownership of processed information | Polish law, Warsaw courts ([Terms §13](https://ethicsportal.eu/terms/)); [DPA](https://ethicsportal.eu/dpa/) under Article 28 GDPR; customer data returned or deleted at the customer's choice ([DPA §6.8](https://ethicsportal.eu/dpa/)) | | VII.4.1(f)–(g) — guarantees, insurance, liability limits | Liability capped at 12 months of fees ([Terms §11](https://ethicsportal.eu/terms/)); no cyber liability policy in place — see [open items](https://ethicsportal.eu/dora/#open-items) | | VII.4.1(h)–(i) — subcontractors named with location and scope, and their accountability made transparent | [/subprocessors/](https://ethicsportal.eu/subprocessors/) and [DPA §8](https://ethicsportal.eu/dpa/); the provider answers for its subcontractors as for itself ([DPA §6.12](https://ethicsportal.eu/dpa/)) | | VII.4.1(m)–(n) — right of inspection, and the supervisor's right to carry out its control duties | [DPA §6.9](https://ethicsportal.eu/dpa/) provides standard GDPR audit cooperation. DORA-specific authority rights require a signed order and downstream validation. Documentary and remote — no own premises exist to inspect | | VII.4.1(q) — rules and deadlines for the return or deletion of processed information | [DPA §6.8](https://ethicsportal.eu/dpa/) | | VII.4.1(s) — exchange of information on security and incident management | Breach notification without undue delay after awareness ([DPA §6.6](https://ethicsportal.eu/dpa/)); public [incident register](https://ethicsportal.eu/incidents/) | | VII.6.1 — provider conformity with ISO 20000, 27001, 22301, 27017, 27018 | Not certified. Published instead: an [ISO/IEC 27001:2022 self-assessment](https://ethicsportal.eu/iso-27001/) covering the Clause 4--10 requirements and all 93 Annex A controls with status and evidence. The infrastructure subcontractor holds ISO 27001 certification under its own scope | | VII.6.2 — data centre to EN 50600 class 3 or ANSI/TIA-942 Tier III | **Not evidenced.** Hetzner's ISO/IEC 27001 certification is not evidence of EN 50600 class 3 or ANSI/TIA-942 Tier III. The supervised entity would have had to accept the gap on a documented risk basis | | VII.6.3 — data centre located in the EEA | Core application, database and attachment storage: Nuremberg, Germany; file attachment backup copy: Falkenstein, Germany. This does not establish an EU-only email or telemetry supplier chain; see [international transfers](https://ethicsportal.eu/dpa/#9-international-data-transfers) | | VII.6.4 — default no access; least privilege for service work; tenant separation; secure-by-default | Privileged access is limited to the named operator; controls can be described during procurement review. Defined report and account events are written to an append-only audit trail, including which handler viewed which report; reads of other resources and every access are not logged. Report content, reporter identity and messages use non-deterministic field encryption, and tenants are logically separated ([Security](https://ethicsportal.eu/security/#access-control)) | | VII.7 — encryption at rest and in transit; key management | **Partial.** TLS protects transport, defined report fields use application encryption, and daily database dumps are encrypted with GnuPG AES-256 before they leave the host. File attachments are encrypted at rest with AES-256 under a separate key per file. The server disk is not volume-encrypted, so database fields outside the encrypted set are stored unencrypted on the host ([Security#data-encryption](https://ethicsportal.eu/security/#data-encryption)). Keys are processor-managed; customer-managed keys are not supported ([DPA §6.11](https://ethicsportal.eu/dpa/)) | | VII.8 — logging, log protection, MFA for privileged access | Append-only audit trail at database level; two-factor authentication available for handler and admin accounts ([Security](https://ethicsportal.eu/security/#two-factor-authentication)) | | IX — notification to UKNF before processing begins | No longer applicable following the withdrawal | --- ## What to ask for next Materials available for controlled procurement review include the DPA template, registry and tax evidence, a security questionnaire, a privileged production-access summary, and written business-continuity and offboarding answers. An executed DPA can be supplied for the contracting customer. Request available materials at [support@ethicsportal.eu](mailto:support@ethicsportal.eu). For the whistleblowing obligation itself rather than its procurement, see [financial services](https://ethicsportal.eu/industries/financial-services/) and [e-money and payment institutions](https://ethicsportal.eu/industries/e-money-and-payment-institutions/). --- # Data Processing Agreement > GDPR Article 28 Data Processing Agreement for EthicsPortal customers, with the Swiss FADP terms for controllers in Switzerland. Covers scope, security measures, sub-processors, and international transfers. Canonical: https://ethicsportal.eu/dpa/ Last updated: 2026-11-10 **Effective date:** September 13, 2026 **Last updated:** November 10, 2026 This Data Processing Agreement ("DPA") forms part of the agreement between the customer ("Controller") and EthicsPortal ("Processor") for the provision of the EthicsPortal whistleblower reporting platform ("Service"). The organization acceptance incorporates this DPA together with the Terms of Service identified in the same acceptance record. It does not incorporate the public DORA material. A financial entity that requires DORA-specific terms must enter a separate written DORA order signed by both parties. > **Need a signed copy?** Contact [legal@ethicsportal.eu](mailto:legal@ethicsportal.eu) to request a countersigned PDF version of this DPA for your records. > **A financial entity in DORA scope?** The [DORA contracting template](https://ethicsportal.eu/dora-addendum/) identifies the subjects to be completed in a separate bilateral order. Publication, subscription or acceptance of this DPA does not make that template binding. --- ## 1. Parties **Controller:** The organization that subscribes to EthicsPortal and determines the purposes and means of processing personal data through the Service. **Processor:** EthicsPortal, a trade name used by Yaroslav Shmarov, a sole proprietor (jednoosobowa działalność gospodarcza) registered in Poland (NIP: 5272755790), at ul. Obrzeżna 1A, 02-691 Warsaw, Poland. Contact: [legal@ethicsportal.eu](mailto:legal@ethicsportal.eu). --- ## 2. Scope and purpose of processing The Processor processes personal data on behalf of the Controller solely to provide the Service, which includes: - Receiving and storing whistleblower reports - Enabling secure communication between reporters and case handlers - Managing case workflows (assignment, status tracking, resolution) - Generating audit logs and compliance records - Sending transactional email notifications to case handlers and organization administrators and, when a reporter provides an email address, receipt and new-message notifications to that reporter The Processor does not process personal data covered by this DPA for any purpose other than providing the Service as instructed by the Controller. Account administration, contracting, billing, fraud prevention and marketing activities undertaken for the Processor's own business purposes fall outside this DPA and are described in the [Privacy Notice](https://ethicsportal.eu/privacy/). --- ## 3. Types of personal data processed | Data category | Examples | Safeguard applied | |---|---|---| | Reporter identity (optional) | Name, email address, phone number | Yes (non-deterministic) | | Report content | Description of the reported concern | Yes (non-deterministic) | | Communication content | Messages between reporter and case handler | Yes (non-deterministic) | | File attachments | Documents, images, audio, video uploaded by reporters | Metadata removal for supported formats; not every field guaranteed | | Reporter credentials | Random Case IDs used for lookup; reporter passwords stored separately as digests | Case IDs stored for lookup; passwords hashed | | Handler and admin data | Name, email address, role, organization membership | No (operational data) | | Audit log entries | Timestamps, actor identity, action type | No (integrity-critical records) | | Technical data | One-way hashed IP addresses used for rate limiting | Pseudonymized; treated as personal data where GDPR applies | --- ## 4. Categories of data subjects - **Whistleblowers / reporters** --- individuals who submit reports through the whistleblowing channel (may be anonymous) - **Case handlers** --- individuals designated by the Controller to receive and manage reports - **Organization administrators** --- individuals who manage the Controller's EthicsPortal account and settings --- ## 5. Duration of processing The Processor processes personal data for the duration of the Controller's subscription to the Service. Upon termination: - The Controller may export their data before the subscription ends. - Before termination, report data follows the Controller's configured retention instruction (12, 24, 36, 48, or 60 months after report closure). A report left with no activity for 18 months is closed automatically so that the retention period begins. - Subscription termination stops ordinary Service access but does not itself override the Controller's documented retention instructions. - After the Service ends, the Processor will, at the Controller's choice, return or delete personal data and delete existing copies unless EU or member state law requires storage. The Controller may give that instruction before or after the effective termination date, through available organization-deletion controls or by written request. - Until the instruction is completed, the Processor restricts processing to secure storage, return or deletion, and processing required by law or security. Backup copies expire through the documented backup lifecycle, currently no later than 28 days after production deletion, and are not restored except for disaster recovery. Database dumps are encrypted before they leave the server, and application-encrypted fields stay encrypted inside them. --- ## 6. Obligations of the Processor ### 6.1 Processing instructions The Processor processes personal data only on documented instructions from the Controller, unless required to do so by EU or member state law. If such a legal requirement arises, the Processor will inform the Controller before processing, unless the law prohibits such notification. ### 6.2 Confidentiality All persons authorized to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality. ### 6.3 Security measures The Processor implements and maintains the following technical and organizational measures. The [Security](https://ethicsportal.eu/security/) page provides current operational detail but does not amend these agreed measures unless a signed order expressly incorporates a dated version: - Non-deterministic application-level encryption at rest for report text, reporter contact fields, intake answers and case messages and notes - No storage of raw reporter IP addresses in the database (one-way hashing for rate limiting only) - Metadata stripping for supported uploaded image, document, audio and video formats before storage; embedded content and every possible metadata field cannot be guaranteed removed - Tenant-scoped role-based access controls - Append-only records for defined report and account events; not every read or action is logged - Rate limiting for reporter submission, case lookup by Case ID and password, and message creation - HTTPS/TLS for all connections - CSRF protection Security vulnerabilities and incident reports may be sent to [security@ethicsportal.eu](mailto:security@ethicsportal.eu). Data-subject and privacy inquiries may be sent to [privacy@ethicsportal.eu](mailto:privacy@ethicsportal.eu). ### 6.4 Sub-processors The Controller gives general written authorization for the sub-processors listed in Section 8 and for changes made under this section. The Processor will notify the Controller by email at least 30 days before adding or replacing a sub-processor. The Controller may object in writing within 14 days of the notice, on reasonable grounds relating to data protection. If the parties cannot resolve the objection, the Controller may terminate the affected Service from the date of the change, and the Processor will refund prepaid fees for the unused period. This is the Controller's only remedy for an objection. If no objection is received within 14 days, the change is accepted. Where a sub-processor must be replaced sooner to protect personal data or keep the Service running, for example after a security incident, a service shutdown or a breach of its data-protection obligations, the Processor may engage the replacement before the notice period ends. The Processor will notify the Controller without undue delay, and the objection and termination rights above apply from that notice. Each sub-processor is bound by written terms that protect personal data at least as well as this DPA. ### 6.5 Data subject rights The Processor assists the Controller in responding to requests from data subjects exercising their rights under GDPR (access, rectification, erasure, restriction, portability, objection) by providing the necessary technical capabilities within the Service. ### 6.6 Data breach notification In the event of a personal data breach, the Processor will notify the Controller without undue delay after becoming aware of the breach. To the extent available at the time, the notification will include: - A description of the nature of the breach - The categories and approximate number of data subjects affected - The likely consequences of the breach - The measures taken or proposed to address the breach ### 6.7 Data Protection Impact Assessments The Processor assists the Controller with Data Protection Impact Assessments and prior consultations with supervisory authorities, to the extent that the Processor's processing activities require such assistance. ### 6.8 Deletion and return of data After the end of the Service, the Processor will, at the Controller's choice: - Return all personal data to the Controller in the export formats made available by the Service at the time of termination, including PDF case exports and associated attachments, or - Delete personal data from production systems and confirm completion in writing unless EU or member state law requires continued storage. The Controller may give its choice before or after the effective termination date, through available organization-deletion controls or by written request. Until the choice is carried out, processing is restricted as described in Section 5. Backup copies are isolated from ordinary use and expire through the backup lifecycle described there. A deletion confirmation identifies any legally required retention and the applicable backup-expiry period; it is not a representation that every residual copy disappears instantaneously. If the Controller reasonably requires an additional portability format for migration or regulatory review, the Processor will assess the request in good faith and, where technically feasible, provide it under a separate written request. ### 6.9 Audit rights The Processor makes available to the Controller all information necessary to demonstrate compliance with GDPR Article 28 obligations. The Controller may conduct audits, including inspections, either directly or through a mandated independent auditor, subject to reasonable advance notice (normally at least 30 days) and during normal business hours, unless a shorter period is reasonably required by a supervisory authority or documented urgent risk. The audit must relate to processing under this DPA, avoid access to other customers' data, and observe reasonable confidentiality and security procedures. The Processor will cooperate. The Controller bears its auditor's costs; additional Processor assistance beyond information and reasonable cooperation required by Article 28 may be charged at a rate agreed in writing before that additional work begins. Where the Controller is a financial entity within the scope of Regulation (EU) 2022/2554 (DORA), DORA-specific cooperation, authority access and any extended rights under Article 30 are governed only by a separate DORA order signed by both parties. The Controller's unilateral classification does not amend this DPA. Equivalent downstream rights required by Delegated Regulation (EU) 2025/532 must be verified before a CIF order is signed. The Processor operates no office or data centre of its own. Its direct audit surface is this documentation and the application, and audit rights are exercised remotely and documentarily. Supplier environments are not represented as directly accessible unless the required rights have been verified in the signed DORA order. ### 6.10 No AI or LLM processing of report content The Processor commits that it does **not transmit personal data processed under this DPA --- including report content, reporter identity, handler messages, file attachments, and audit log entries --- to any large language model, generative AI service, or AI-based classifier**, whether operated by the Processor or by a third party (including but not limited to OpenAI, Anthropic, Google, and Mistral). The Service does not perform AI-driven categorisation, triage, summarisation, translation, or suggested replies on personal data. The Controller may rely on this commitment when assessing automated decision-making obligations under [Art. 22](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) GDPR and when scoping sub-processor disclosure in its own privacy notices and Data Protection Impact Assessments. Any change to this commitment would be a material change to the Service and would be notified to the Controller under Section 6.4 (Sub-processors) and Section 11 (Term and termination). This commitment covers the Processor's own processing. It does not limit what the Controller does with data it retrieves. The Service's API does not return report content, reporter identity, handler messages, internal notes, or attachments, and its audit log omits reporter activity and message, note, and retaliation events. Where the Controller, or a user or application it authorises, retrieves other data through the API or a connector, such as member names or audit log entries, and passes it to an AI assistant or other service of its choice, the Processor provides that data on the Controller's instruction. The Controller is responsible for that onward processing, and the provider of that service is not a sub-processor of the Processor. Self-hosted statistical machine translation that runs entirely on Processor-controlled infrastructure (no data leaves Processor infrastructure, no external inference call) is not within the scope of this restriction and may be used to translate reporter or handler messages where the Controller has enabled it. This commitment is reviewed annually. The "Last updated" date at the top of this DPA reflects the most recent affirmation. If the Processor at any point intends to introduce AI or LLM processing of personal data covered by this DPA, the Processor will notify the Controller in accordance with Section 6.4 and the change will take effect no earlier than the notice period stated there. ### 6.11 Customer-managed encryption keys (BYOK) The Service does not currently support customer-managed encryption keys, whether described as bring-your-own-key (BYOK), hold-your-own-key (HYOK), or external key management service (KMS) integration. The database fields listed in Section 6.3 use application-level encryption with Processor-managed keys. This does not establish whole-database, backup, or attachment encryption at rest. It is not a representation that customer-managed keys are legally incompatible with Directive 2019/1937 or that key destruction alone guarantees deletion of every copy. The Processor's encryption-at-rest scheme, non-deterministic encryption properties, and key isolation are documented on the [Security](https://ethicsportal.eu/security/#data-encryption) page. A change to this position would be a material change to the Service and would be notified to the Controller under Section 6.4 (Sub-processors) and Section 11 (Term and termination). ### 6.12 Responsibility for personnel, sub-processors, and infrastructure Subject to the limitations of liability in Section 10, the Processor is responsible for: - **Personnel.** The acts and omissions of its employees and any other persons it authorizes to process personal data under this DPA --- each bound by the confidentiality obligation in Section 6.2 --- as if they were the Processor's own acts and omissions. - **Sub-processors.** The performance of the sub-processors listed in Section 8. Where an engaged sub-processor fails to fulfil its data-protection obligations, the Processor remains liable to the Controller for the performance of that sub-processor's obligations, in accordance with Article 28(4) GDPR. - **Infrastructure.** Compliance with the security and availability obligations in this DPA for infrastructure under its control. This allocation does not create a guarantee against every outage or attack; liability depends on a breach of this DPA, the Terms, or applicable law and remains subject to Section 10. It does not extend to failures originating in the Controller's systems, devices, or network, or to events beyond the Processor's reasonable control. --- ## 7. Obligations of the Controller The Controller is responsible for: - Ensuring a lawful basis for processing personal data through the Service - Providing required privacy notices to data subjects (EthicsPortal displays a privacy notice on the online reporting form) - Configuring appropriate data retention periods within the Service - Designating authorized handlers and administrators - Responding to data subject requests, with assistance from the Processor as described above - Ensuring that its instructions, configurations, users and use of exports comply with applicable law - Maintaining appropriate internal access controls, endpoint security, business continuity and tested export or exit procedures - Providing timely and accurate information needed for assistance, cooperating with incident response, and taking reasonable steps to mitigate avoidable loss --- ## 8. Sub-processors The following sub-processors are authorized as of the effective date of this DPA: | Sub-processor | Purpose | Location | |---|---|---| | [Hetzner Online GmbH](https://www.hetzner.com) | Application hosting, database, and file attachment storage | Nuremberg, Germany (EU) | | [Mailjet (Sinch)](https://www.mailjet.com) | Transactional email, including reporter notifications when email is provided | France (EU) | | [AppSignal B.V.](https://www.appsignal.com) | Error and performance monitoring of the application | Netherlands (EU) | Stripe is used for subscription billing and payment processing. It is not used to process whistleblower reports or case data and is therefore not a sub-processor for the processing covered by this DPA. Subscription and billing processing is described separately in the [Privacy Notice](https://ethicsportal.eu/privacy/). Depending on the processing activity, Stripe acts as EthicsPortal's processor and/or as an independent controller under Stripe's applicable terms and privacy notice. The Cloudflare-delivered marketing site is likewise outside the processing performed on the Controller's behalf under this DPA. Its public-site role is described separately in the [Privacy Notice](https://ethicsportal.eu/privacy/). **No AI or LLM sub-processor.** No large language model, generative AI service, or AI-based classifier is a sub-processor of the Processor. Personal data processed under this DPA is not transmitted to OpenAI, Anthropic, Google, Mistral, or any other AI inference provider. See Section 6.10. --- ## 9. International data transfers The application, database and file attachments are hosted in the **European Union** with Hetzner. That location does not establish that every supplier activity stays in the EEA. Mailjet's published chain includes US-based support providers, and AppSignal lists a US-based transactional-email provider. Their involvement does not by itself prove that report content is transferred there; their account-specific access and data flows require verification. Where processing on the Controller's behalf involves a restricted transfer outside the EEA, the Processor will ensure a lawful transfer mechanism and applicable safeguards under GDPR Chapter V. The Processor will disclose material changes to the sub-processor chain under Section 6.4. The Processor does not promise that all email or telemetry data remains within the EEA. --- ## 10. Liability Each party's liability under this DPA is subject to the limitations of liability set out in the main service agreement between the parties. To the maximum extent permitted by law, claims arising out of or relating to this DPA form part of the same aggregate liability cap that applies to the Service. --- ## 11. Term and termination This DPA takes effect when the Controller begins using the Service and remains in effect for as long as the Processor processes personal data on behalf of the Controller. The obligations in this DPA survive termination to the extent necessary to complete the deletion or return of personal data. --- ## 12. Governing law This DPA is governed by the laws of the Republic of Poland, without regard to conflict of laws principles. The competent courts of Warsaw, Poland have jurisdiction over disputes arising from this DPA, subject to any mandatory jurisdiction rules that apply. --- ## 13. Controllers subject to the Swiss FADP Where the Controller's processing through the Service is subject to the Swiss Federal Act on Data Protection of 25 September 2020 (FADP, SR 235.1), this DPA is also the contract by which processing is assigned to a processor under Article 9 FADP, with the following adjustments: - References to the GDPR include the FADP, and references to EU or member state law include Swiss law, to the extent the FADP applies to the processing. - The authority competent for the Controller's processing under the FADP is the Federal Data Protection and Information Commissioner (FDPIC). - The notification in Section 6.6 is the processor's notification of a data security breach under Article 24(3) FADP, given as quickly as possible, so that the Controller can assess its own duty to notify the FDPIC under Article 24(1) FADP. - The general authorisation of sub-processors in Section 6.4, with prior notice and a right to object, is the Controller's prior approval under Article 9(3) FADP. - Report data is hosted in Germany (Section 8). The Swiss Federal Council recognises Germany as providing an adequate level of data protection (Annex 1 to the Data Protection Ordinance), so that hosting requires no further safeguards under Article 16 FADP. Any other disclosure abroad in the course of processing on the Controller's behalf is made only to a state with adequate protection or under the safeguards of Article 16(2) FADP. - The Controller names the states of the sub-processors in Section 8, currently Germany, France and the Netherlands, as the states to which personal data is disclosed in its own information to data subjects under Article 19(4) FADP. --- ## Contact For questions about this DPA or to request a signed copy: **EthicsPortal** Yaroslav Shmarov ul. Obrzeżna 1A, 02-691 Warsaw, Poland [legal@ethicsportal.eu](mailto:legal@ethicsportal.eu) --- # Data Protection Impact Assessment (DPIA) for whistleblowing > A pre-filled DPIA template for organizations deploying EthicsPortal, structured on GDPR Article 35(7) — processing description, necessity and proportionality, and a risk-and-measures table for whistleblower reporting. Canonical: https://ethicsportal.eu/dpia/ Last updated: 2026-11-04 Last updated: 2026-11-04. Operating an internal reporting channel is, for most organizations, the first time they process highly sensitive, high-risk personal data as a matter of routine. Under Article 35 GDPR, processing that is likely to result in a high risk to the rights and freedoms of individuals requires a **Data Protection Impact Assessment (DPIA)** before it begins. Whistleblowing channels sit squarely in that category, and most national supervisory authorities list them on their mandatory-DPIA lists. This page is a **pre-filled DPIA** you can adapt for your deployment of EthicsPortal. It follows the structure of Article 35(7) GDPR and the [EDPB DPIA template](https://www.edpb.europa.eu/news/news/2026/enhancing-compliance-and-consistency-edpb-adopts-dpia-template_en), and it is populated with the technical and organizational measures EthicsPortal provides as your processor. > **This is input, not a finished assessment.** The Controller — your organization — owns the DPIA and signs it. EthicsPortal is the processor and supplies the information below to assist you, in line with Article 28(3)(f) GDPR and [Section 6.7 of our DPA](https://ethicsportal.eu/dpa/). It is not legal advice. Your Data Protection Officer or counsel should review and adapt it to your context before relying on it. --- ## Who does what | Role | Party | Responsibility for the DPIA | |---|---|---| | **Controller** | Your organization | Owns, completes, and signs the DPIA. Determines purposes, retention, and who handles reports. | | **Processor** | EthicsPortal | Provides the processing description and the technical and organizational measures below, and participates in the assessment on request. | | **Assessor** | Your DPO (or a person with insight into the processing, ideally not the person responsible for it) | Carries out and signs off the assessment. | --- ## How to use this template 1. Copy the sections below into your own DPIA record (or the [EDPB template](https://www.edpb.europa.eu/news/news/2026/enhancing-compliance-and-consistency-edpb-adopts-dpia-template_en)). 2. Adjust the **scope, retention, and recipients** rows to match your configuration in EthicsPortal. 3. Add any organization-specific risks (for example, sector regulation or works-council obligations). 4. Have your DPO record the residual-risk decision and sign off. 5. To keep a copy, use your browser's **Print → Save as PDF**. --- ## Part A — Description of the processing *(Article 35(7)(a) GDPR — nature, scope, context, and purpose)* | Item | Description | |---|---| | **Purpose** | Receiving, handling, and following up on reports of breaches, in compliance with EU Directive 2019/1937, its national transposition, and internal ethics standards. | | **Lawful basis** | Compliance with a legal obligation (Article 6(1)(c) GDPR) under the national transposition of Directive 2019/1937; for special-category data, Article 9(2)(g) GDPR (substantial public interest). | | **Nature of processing** | Collection, storage, secure two-way communication, case management, and time-bound deletion of report data. | | **Personal data categories** | Optional reporter identity (name, email, phone — never mandatory); an optional email address for updates, which handlers do not see; for a report sent by email, the sender's email address, which handlers do not see either; report content; messages between reporter and handler; file attachments; case-handler and administrator account data; Case IDs, and reporter passwords stored only as a one-way hash. See [DPA §3](https://ethicsportal.eu/dpa/). | | **Special-category / sensitive data** | May incidentally appear in free-text reports (e.g. health, trade-union membership, criminal allegations). Cannot be predicted in advance; mitigated by access control, encryption, and minimization. | | **Data subjects** | Whistleblowers (may be anonymous), persons named in a report, case handlers, administrators. See [DPA §4](https://ethicsportal.eu/dpa/). | | **Recipients** | Designated case handlers; optionally an external investigator (e.g. law firm) the Controller adds. No other recipients. | | **Retention** | Controller-configured: 12, 24, 36, 48, or 60 months after case closure, then automatic permanent deletion. See [DPA §5](https://ethicsportal.eu/dpa/). | | **Data location / transfers** | Hosted entirely in the EU (Hetzner, Nuremberg, Germany, with a file attachment backup copy in Falkenstein, Germany). No report data leaves the EU. See [subprocessors](https://ethicsportal.eu/subprocessors/). | | **Automated decision-making / AI** | None. Report content is never sent to any AI or LLM service; no profiling or automated decisions. See [DPA §6.10](https://ethicsportal.eu/dpa/). | --- ## Part B — Necessity and proportionality *(Article 35(7)(b) GDPR)* The processing is **necessary** because operating an internal reporting channel is a legal obligation for in-scope organizations under the national transposition of Directive 2019/1937. It is **proportionate** because EthicsPortal is engineered to collect the minimum data and to strengthen data-subject rights: - **Data minimization** — no reporter contact field is mandatory; fully anonymous reporting is the default path. A reporter can get updates by email without handlers seeing the address. - **Identity protection** — reporter IP addresses are not stored with reports, messages, audit records or application logs; file metadata (EXIF, GPS, author) is stripped, except comment author names and embedded-photo metadata inside PDFs; voice reports recorded in the online reporting form are pitch-shifted and the original recording deleted. The shift makes a voice harder to recognize, but it can be reversed, so it is not anonymization; the form tells reporters whose voice could identify them to type instead. Voice messages are off by default. The organization can enable them in its whistleblowing channel settings, and the change is recorded in the audit trail. - **Storage limitation** — retention is configurable and enforced by automatic deletion (Article 5(1)(e) GDPR). - **Data-subject rights** — access, rectification, erasure, restriction, portability, and objection are supported in-product; the Controller can export the full dataset. See [DPA §6.5](https://ethicsportal.eu/dpa/). - **Erasure, and what it does not reach** — a handler or administrator may close their account after resolving any ownership or required-handler responsibility that blocks closure. An account with no attributed compliance activity is deleted outright. Otherwise, its email address is replaced with a non-routable placeholder, access credentials and preferences are removed, the avatar is purged, and memberships are deactivated. The name and attributed case records remain only while the Controller's documented retention instructions, applicable legal obligations, or legal claims require them. Audit entries may retain the actor's email address and request IP address for authenticated actions; organization administrators cannot edit or individually delete entries, but the entries are removed with associated records or the organization under the applicable retention and deletion controls. See [privacy notice §9](https://ethicsportal.eu/privacy/). - **Transparency** — a privacy notice is shown on the reporting form. - **Processor safeguards** — a published [DPA](https://ethicsportal.eu/dpa/), a named [subprocessor list](https://ethicsportal.eu/subprocessors/) (all EU), and the security measures below. --- ## Part C — Risks and measures *(Article 35(7)(c) GDPR — risks to the rights and freedoms of data subjects, and the measures addressing them)* Likelihood and severity are assessed **before** measures; the final column is the residual risk **after** the measures EthicsPortal provides. Adjust these to your own configuration. | # | Processing activity | Risk to data subjects | Likelihood | Severity | Measures in EthicsPortal | Residual risk | |---|---|---|---|---|---|---| | 1 | Submitting a report | A reporter who wishes to stay anonymous is re-identified | Medium | High | No mandatory contact fields; reporter IP not stored with the report or in application logs; file metadata stripped; voice recordings pitch-shifted (reversible) and the original deleted, with reporters told to type if their voice could identify them; voice messages off unless the organization enables them | Reduced | | 2 | Receiving a report | Excessive or incorrect personal data about third parties is submitted | Medium | Medium | Minimization guidance on the form; access restricted to designated handlers; configurable retention with auto-deletion | Reduced | | 3 | Reporter follow-up | Someone other than the reporter reads the case messages | Low | High | Return access requires the Case ID and a password generated by the system, stored only as a hash; a password sent by email or passed on by staff works once and is replaced at the reporter's first sign-in; session-gated inbox | Reduced | | 4 | Assigning to a handler | A person other than the designated handler accesses the case | Low | High | Role-based access control; per-report assignment; opt-in two-factor authentication for handler/admin accounts; defined event logging; automatic session expiry | Partially reduced | | 5 | Involving an external party (e.g. law firm) | An external investigator over-accesses data | Low | High | Read-only auditor role and explicit per-account provisioning by an admin; defined events are audit-logged including which handler viewed which report, so over-access is visible after the fact; reads of other pages are not logged | Partially reduced | | 6 | Handler notes and case data at rest | Stored report content is exposed in a breach | Low | High | Non-deterministic application encryption for report content, identity, and messages; daily database dumps encrypted with GnuPG AES-256 before upload; file attachments encrypted at rest under a separate key per file | Reduced | | 7 | Conflict of interest | The person named in a report is also a handler/admin and can suppress it | Medium | High | Multi-handler assignment and read-only auditor role; defined events are logged including which handler viewed which report, so a conflicted admin's access to it is on the record; a single operator or conflicted admin still remains a residual risk | Partially reduced | | 8 | File attachments | Malware or hidden metadata enters the system | Medium | Medium | Antivirus scanning (ClamAV) of every upload with signature updates; automatic EXIF/GPS/author stripping, which leaves comment author names and embedded-photo metadata inside PDFs | Reduced | | 9 | Retention and deletion | Data kept longer than lawful | Medium | Medium | Controller-set retention (12–60 months) with automatic production deletion after closure; inactive cases auto-close, while backups expire on a separate lifecycle and law may require different periods | Partially reduced | | 10 | Hosting and sub-processors | Data transferred outside the EU or to an undisclosed party | Medium | High | Core report data hosted in the EU; named direct suppliers and 30-day notice with objection right ([DPA §6.4](https://ethicsportal.eu/dpa/)); downstream support and telemetry data flows remain to be verified | Partially reduced | | 11 | Breach | A breach goes unreported to the Controller | Low | High | Contractual breach notification without undue delay after awareness ([DPA §6.6](https://ethicsportal.eu/dpa/)) | Reduced | | 12 | Closing a handler or administrator account | The person remains identifiable by name in attributed compliance records after access is removed | High | Medium | Closure first requires resolving any ownership or required-handler responsibility. The email address is replaced with a non-routable placeholder; authentication credentials, sessions, preferences, and avatar are removed. The name and attributed records remain under the Controller's applicable retention instructions and are deleted with those records or the organization. Organization administrators cannot edit or individually delete audit entries; the confirmation dialog explains what remains. | Reduced | | 13 | Reporting by email | The message or the sender's address is exposed in transit or to handlers, or a forged sender gains access to the case | Medium | High | Received by EthicsPortal's own mail server on the EU infrastructure, not a third-party email provider; TLS offered for delivery (opportunistic); the sender's address is stored encrypted and never shown to handlers, in the case, its PDF or exports; the raw email is kept encrypted only until the case is saved, then deleted; follow-up happens in the secure inbox, not by email; no password is sent when the sender's domain disowns the address under DMARC; SPF, DKIM and DMARC are checked without sending message data to outside services; the receipt tells the reporter that email is not anonymous. The reporter's own mail provider, and an employer's mail systems when writing from a work account, remain outside EthicsPortal's control. The Controller can switch email reports off for each whistleblowing channel; the address then refuses new mail within a minute | Partially reduced | --- ## Part D — Outcome and sign-off For a standard deployment with the measures above applied, the residual risk for each activity is **reduced to an acceptable level**, and a **prior consultation with the supervisory authority under Article 36 GDPR is generally not required**. If, after applying these measures, your own assessment still rates a residual risk as high — for example because of sector-specific processing you have added — you must consult your supervisory authority before processing begins. | Field | Entry | |---|---| | Assessment carried out by | _________________________ | | Role | _________________________ | | Date | _________________________ | | DPO opinion | _________________________ | | Residual-risk decision | ☐ Accepted ☐ Reduced further ☐ Prior consultation required | | Review date | _________________________ | --- ## Reference templates - [EDPB DPIA template (2026)](https://www.edpb.europa.eu/news/news/2026/enhancing-compliance-and-consistency-edpb-adopts-dpia-template_en) — the official EU-wide template. - Your national supervisory authority may publish its own template; where it does, use that as the canonical form. --- ## Related - [Data Processing Agreement](https://ethicsportal.eu/dpa/) - [Security measures](https://ethicsportal.eu/security/) - [Subprocessors](https://ethicsportal.eu/subprocessors/) - [Directive 2019/1937 coverage map](https://ethicsportal.eu/compliance/) --- # EN 301 549 conformance report > Accessibility assessment scope and outstanding verification for EthicsPortal. Canonical: https://ethicsportal.eu/en-301-549-conformance/ Last updated: 2026-10-25 Last reviewed: 2026-10-25. This accessibility information covers the EthicsPortal website, web application, public whistleblowing channels and downloadable documents. Our engineering target is WCAG 2.2 Level AA. ## Conformance status Full conformance with WCAG, EN 301 549 or RGAA has not been established. No complete RGAA audit or valid RGAA conformance percentage is available. ## Assessment and limitations The engineering review dated 25 October 2026 sampled mobile layouts, keyboard interactions and automated accessibility checks. It is not a complete accessibility assessment. Automated checks cannot establish screen-reader compatibility or conformance of every page and workflow. Outstanding assessment includes complete user journeys with assistive technologies, physical mobile devices, downloadable documents, customer attachments and third-party services. The website includes videos; captions alone do not establish that all media accessibility requirements are met. Accessible alternatives can be requested using the contact below. | Area | Assessment status | |---|---| | Web and complete user journeys | Full assessment pending | | Documents and media | Full assessment pending | | Software, documentation and support | Full assessment pending | ## Public-sector procurement For a French public-sector deployment, agree the service scope and applicable EN 301 549 edition with the buyer. A complete RGAA assessment remains necessary to establish the deployed service’s status. The public body is responsible for its scoped declaration and accessibility programme; EthicsPortal supplies product evidence. This page does not replace that declaration. [Accessibility statement](https://ethicsportal.eu/accessibility/) · [accessibility@ethicsportal.eu](mailto:accessibility@ethicsportal.eu) --- # Frequently asked questions > Common questions about EthicsPortal — compliance, anonymity, data security, billing, and technical details. Canonical: https://ethicsportal.eu/faq/ Last updated: 2026-11-11 --- ## For compliance officers and decision makers ### Does EthicsPortal comply with EU Directive 2019/1937? Yes. EthicsPortal is built specifically to meet the requirements of the EU Whistleblower Protection Directive. This includes a secure whistleblowing channel, anonymous two-way communication, deadline tracking (7-day acknowledgment, 3-month feedback), access controls, data retention policies, and a complete audit trail. See the [Directive 2019/1937 coverage map](https://ethicsportal.eu/directive-coverage/) for an article-by-article breakdown. ### Which countries is EthicsPortal compliant in? EthicsPortal covers the requirements of EU Directive 2019/1937, which has been transposed into national law across EU member states. The platform is designed to meet the Directive's baseline requirements, which apply across the EU. If your country has additional national requirements (e.g., France's Loi Waserman), check our [country-specific guides](https://ethicsportal.eu/whistleblower-laws/) or [contact us](mailto:support@ethicsportal.eu). ### Can a company outside the EU use EthicsPortal? The entity operating the whistleblowing channel must be registered in the EU, Switzerland, Moldova or Montenegro. Where a group has an entity in one of those countries, that entity can operate a single whistleblowing channel and open it to staff in any country — every report reaches the same case list regardless of where the reporter works. Staff outside the EU get anonymous intake, encrypted two-way messaging, and the Directive's 7-day acknowledgment and 3-month feedback deadlines. Neither US nor Canadian law requires those deadlines, so applying them across a group sets a standard stricter than either. A compliance report cites the national law of the operating entity. It evidences that entity's obligations, not those of operations in other jurisdictions. Switzerland has no general whistleblower statute, so a Swiss entity's documents apply the Directive as a voluntary standard, follow the Swiss reporting cascade, and cite the Swiss Federal Act on Data Protection instead of the GDPR. ### Can we operate the whistleblowing channel in-house? Yes — Article 8(5) of Directive 2019/1937 explicitly permits it. But meeting the Directive's conditions is structurally harder in-house. Article 9(1) requires confidentiality of the reporter's identity, impartial follow-up, and restricted access to reports. An in-house channel runs these through the same IT administrators, backups, and litigation-hold tooling that touch every other system in the company. A separate subdomain or mailbox does not change who has access. GDPR adds a second problem. Whistleblowing is on the EDPB's mandatory-DPIA list. An in-house DPIA has to document how the controller prevents itself from accessing data about itself — which is circular on its face. External operation is contemplated in Art. 8(5) and in the national transpositions: Loi Sapin II / Waserman (FR), HinSchG §14 (DE), D.Lgs. 24/2023 (IT), Ley 2/2023 (ES). ### Where is my data stored? Core report data is stored on Hetzner servers in Nuremberg, Germany, with a backup copy of file attachments in Falkenstein, Germany. The marketing site is delivered via Cloudflare (United States); the whistleblowing channel and handler portal are not. Hetzner is a German hosting provider subject to EU data protection law. Cloudflare's separate public-site processing and transfer information are described in the [Privacy Notice](https://ethicsportal.eu/privacy/), not the customer DPA chain. ### Is the reporting truly anonymous? Yes, if the reporter chooses it. Providing a name or contact information is optional. EthicsPortal does not store reporter IP addresses with reports or in application logs, strips file metadata (EXIF, GPS, author info) from uploads, with two limits inside PDFs, and the secure message thread never reveals the case handler's identity to the reporter. There is no technical mechanism to trace an anonymous report back to a person. ### How does the 7-day and 3-month deadline tracking work? When a report is submitted, EthicsPortal automatically starts two timers based on the Directive's requirements: - **7 days** to acknowledge receipt of the report. - **3 months** to provide substantive feedback to the reporter. Overdue reports are flagged in the dashboard, and handlers receive notifications as deadlines approach. ### Do you offer a Data Processing Agreement (DPA)? Yes. The current DPA is published at [DPA](https://ethicsportal.eu/dpa/), and a countersigned PDF is available on request. ### What certifications do you have? EthicsPortal publishes a full [ISO/IEC 27001:2022 self-assessment](https://ethicsportal.eu/iso-27001/) covering Clauses 4–10 and all 93 Annex A controls as a Statement of Applicability, an [ISO 37002 alignment map](https://ethicsportal.eu/iso-37002/), a [pre-filled CAIQ](https://ethicsportal.eu/caiq/), and named policy documents, alongside the [security](https://ethicsportal.eu/security/), [subprocessors](https://ethicsportal.eu/subprocessors/), [incidents](https://ethicsportal.eu/incidents/), and [SLA](https://ethicsportal.eu/sla/) pages. These are self-assessments against the control sets an external audit would evaluate, not accredited certification: EthicsPortal does not claim accredited ISO 27001 certification, and the current status is stated on [trust](https://ethicsportal.eu/trust/). ### Who is the contracting party? EthicsPortal is a trade name used by Yaroslav Shmarov, a sole proprietor registered in Poland (NIP: 5272755790). Baseline contracting and procurement details are published on the [trust](https://ethicsportal.eu/trust/) page. ### Can you support procurement review? Yes. Public due-diligence materials are published on the website, and additional procurement materials are available on request during procurement review. See the [trust](https://ethicsportal.eu/trust/) page. ### Can I export case data for auditors? Yes. Every report can be exported to PDF, including the full message history, timeline, and audit trail. This is designed for sharing with legal counsel, auditors, or regulators. Administrators can also export all of the organization's data in-app, as a ZIP file of JSON files and attachments, for migration or archiving. If you need another format, contact us during procurement or offboarding review. --- ## For employees and reporters ### Do I need to create an account to submit a report? No. You do not need an account, an email address, or any personal information. You open the whistleblowing channel link, fill in the report, and receive a Case ID and a password. That's it. ### Can I report by email? Yes, if the organization offers it. Every whistleblowing channel has its own email address, shown on the channel's page. Your email becomes a report, and you get a reply with a Case ID and a password to read and answer the case handler's questions in the secure inbox. The case handlers do not see your email address. Email is not anonymous, though: your mail provider keeps a copy, and so does your employer's mail system if you write from a work account. To stay anonymous, use the online reporting form. ### Can my employer find out who I am? Not through EthicsPortal. If you choose to submit anonymously (without providing your name or contact details), there is no way for your employer to identify you through the platform. EthicsPortal does not store your IP address with your report or in its application logs, and strips identifying metadata from the files you upload, with two limits inside PDFs. That said, be mindful of what you write --- if your report contains details that only you could know, that's outside the platform's control. ### How do I check back on my report? You need two things, both shown to you after submission: the Case ID (format `WB-XXXX-XXXX`) and the password. Return to the whistleblowing channel anytime, enter both, and see the current status or exchange messages with the case handler. Write both down and keep them somewhere safe. Nobody can recover the password, and EthicsPortal has no way to reset it, for the case handler or for us. If you lose it, submit a new report and mention your Case ID. ### Can I attach files to my report? Yes. You can upload images, PDFs, video, and audio files up to 100 MB each. Identifying metadata (location data, author info, camera details) is stripped before storage to protect your identity. Inside a PDF, the names on comments and the metadata of embedded photos are kept, so upload photos as separate image files. ### Can I communicate with the case handler anonymously? Yes. The built-in message thread is fully anonymous. You see "Case handler" --- never a real name. The handler sees your messages but has no way to identify you unless you choose to share that information yourself. ### What happens after I submit a report? Your report is received by the organization's designated case handler. Under EU law, they must acknowledge receipt within 7 days and provide substantive feedback within 3 months. You can check the status at any time using your Case ID and password. --- ## For IT and technical teams ### What encryption do you use? Report text, reporter identity fields and case messages are encrypted at rest in the database. All connections use TLS (HTTPS). File uploads, voice recordings and data exports are stored on EU-hosted infrastructure (Hetzner, Germany) and encrypted at rest with AES-256, under a separate key for every file; see [security](https://ethicsportal.eu/security/#file-attachments). ### Do you strip file metadata? Yes. Image uploads are stripped server-side before storage. PDF, video, and audio uploads are also processed for metadata removal in the standard production setup described on the [security page](https://ethicsportal.eu/security/). Two things inside a PDF are not removed: the names on comments, and the metadata of photos embedded in it. Upload photos as separate image files to have them stripped. This reduces the risk of accidental identity disclosure through file properties. ### Do you scan uploaded files for viruses? Yes. All uploaded files are scanned for malware using ClamAV, an open-source antivirus engine. Scanning happens server-side --- no file data is sent to external services. Infected files are removed automatically before case handlers can access them. ### Do you log IP addresses? Not for reporters. The application does not store a reporter's IP address with reports, messages or audit records, and its logs for the whistleblowing channel contain no IP addresses. Rate limiting uses a keyed hash kept only for the rate-limit window. The TLS proxy in front of the application keeps its own connection logs, which include IP addresses and request paths. The path of a reporter's report page contains its Case ID. See [security](https://ethicsportal.eu/security/#ip-addresses) for the precise wording. ### What third-party services do you use? - **Hetzner** (Germany) --- server hosting - **Stripe** --- payment processing - **Mailjet** (France) --- transactional email delivery - **Cloudflare** --- marketing-site CDN and analytics - **AppSignal** (Netherlands, EU) --- error monitoring and application performance monitoring for admin and handler interfaces No ad networks or third-party tracking cookies are used on the whistleblowing channel itself. ### Do you have an API? The metadata API and outbound webhooks are available to every organisation. They expose report status and deadlines, never report content, messages, notes or attachments. Optional setup access lets authorised tokens create organisations and administrators configure whistleblowing channels. See the [developer documentation](https://ethicsportal.eu/developers/). ### Do you support custom domains? Not currently available. All whistleblowing channels are served under the EthicsPortal domain. ### Do you support SSO? Yes. EthicsPortal supports SAML 2.0 single sign-on, configured per organization. Connect your identity provider — Okta, Microsoft Entra ID, or any SAML 2.0 provider — and your team signs in through it. You can require SSO for your email domains and provision members automatically on first sign-in. Magic-link sign-in (passwordless email authentication) remains available when SSO is not enforced. Pair SSO with SCIM 2.0 provisioning to keep accounts in sync with your directory. --- ## Billing ### How much does EthicsPortal cost? **€41.67/month billed annually (€500/year)**, flat. One plan, everything included. No per-user fees, no per-report fees, no feature tiers. ### How does the subscription work? EthicsPortal is a paid compliance service: €41.67/month billed annually (€500/year), with no free trial. Activate your whistleblowing channel from the application, configure it, and begin operation once the subscription is in place. ### Can we cancel the subscription? Yes. Subscriptions can be cancelled from account settings. There are no cancellation fees. ### What payment methods do you accept? Credit and debit cards via Stripe. If you need to pay by invoice or bank transfer, email [support@ethicsportal.eu](mailto:support@ethicsportal.eu). --- ## Still have a question? Email [support@ethicsportal.eu](mailto:support@ethicsportal.eu). You'll hear back within one business day. --- # Incident register > Public register of material incidents affecting personal data processed by EthicsPortal. Maintained in the spirit of Article 33 GDPR and as a matter of institutional transparency. Canonical: https://ethicsportal.eu/incidents/ Last updated: 2026-09-13 This page records every material incident affecting the confidentiality, integrity, or availability of personal data processed by EthicsPortal. It is maintained in the spirit of Article 33 GDPR (notification of personal data breaches) and as a matter of institutional transparency. Last updated: 2026-04. --- ## Scope An entry is created for any of the following: - A personal data breach as defined by Article 4(12) GDPR --- "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data." - A service outage exceeding two hours that prevented reporters from submitting reports or handlers from accessing active cases. - A significant vulnerability in EthicsPortal or a subprocessor that required emergency mitigation. - Any incident requiring notification to a supervisory authority under Article 33 GDPR. Routine interruptions shorter than two hours, planned maintenance, and incidents that did not involve personal data are not recorded here. --- ## Disclosure timeline - **Without undue delay** after becoming aware of a personal data breach --- notification to affected operators (controllers) via email, per Article 33(2) GDPR. - **Within 7 days** of containment --- preliminary entry added to this register with summary, affected data categories, and mitigation status. - **Within 30 days** of containment --- final entry with root cause, remediation, and lessons learned. Entries remain public indefinitely. Entries are never edited to reduce embarrassment; corrections are appended as later entries. --- ## Reporting a security concern To report a security issue affecting EthicsPortal, contact [security@ethicsportal.eu](mailto:security@ethicsportal.eu). Encrypted reports welcome; PGP key on request. --- ## Register *No entries.* --- # Whistleblower compliance by industry > Industry-specific whistleblower reporting requirements under EU Directive 2019/1937 and related regulations. Canonical: https://ethicsportal.eu/industries/ Last updated: 2026-08-25 EU Directive 2019/1937 applies to organizations with 50+ employees, and to regulated financial entities regardless of headcount. Some industries also face additional reporting obligations, sector-specific regulators, and elevated compliance risk. Select your industry below. ## Pages - [Whistleblower compliance for e-money and payment institutions](https://ethicsportal.eu/industries/e-money-and-payment-institutions/): EMIs and payment institutions must operate a whistleblowing channel regardless of headcount. The 50-employee threshold does not apply to them. What the obligation is, which regulator enforces it, and what DORA adds at procurement. - [Whistleblower compliance for financial services](https://ethicsportal.eu/industries/financial-services/): Whistleblower reporting requirements for banks, investment firms, and insurers under EU Directive 2019/1937, MiFID II, MAR, and AML directives, and what DORA means for procuring a whistleblowing channel. - [Whistleblower compliance for manufacturing and supply chain](https://ethicsportal.eu/industries/manufacturing/): Whistleblower reporting requirements for manufacturers under EU Directive 2019/1937, the German Supply Chain Act (LkSG), and the upcoming EU CSDDD. - [Whistleblower compliance for public sector](https://ethicsportal.eu/industries/public-sector/): Whistleblower reporting requirements for municipalities, government agencies, and public bodies under EU Directive 2019/1937 and national exemptions. --- # Whistleblower compliance for e-money and payment institutions > EMIs and payment institutions must operate a whistleblowing channel regardless of headcount. The 50-employee threshold does not apply to them. What the obligation is, which regulator enforces it, and what DORA adds at procurement. Canonical: https://ethicsportal.eu/industries/e-money-and-payment-institutions/ Last updated: 2026-09-30 **The 50-employee threshold does not apply to you.** A licensed e-money institution or payment institution with 18 staff carries the same whistleblowing channel obligation as a bank with 18,000. Headcount is not the trigger — your licence is. This is the single most misread point in the Directive. Most guidance leads with "50 or more employees", which is correct for ordinary private-sector companies and wrong for regulated financial entities. ## Why headcount does not apply The obligation runs through three steps: 1. **Your licence** places you within the scope of a Union financial-services act — the E-Money Directive (2009/110/EC) for EMIs, the Payment Services Directive (PSD2, (EU) 2015/2366) for payment institutions. 2. **Part I.B of the Annex** to Directive 2019/1937 enumerates the Union acts governing financial services, products and markets, and the prevention of money laundering and terrorist financing. The E-Money Directive is point (i) on that list; PSD2 is point (ix). 3. **[Art. 8(4)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937)** provides that the threshold in [Art. 8(3)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) "shall not apply to the entities falling within the scope of Union acts referred to in Parts I.B and II of the Annex". Article 8(3) is what sets the 50-worker trigger for private-sector entities generally. Part II of the Annex is a different list — the sector-specific acts that lay down their own reporting rules, which take precedence over this Directive under [Art. 3(1)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937). Several financial-services acts sit there, so a licensed firm may be answering to sector rules and this Directive at once, with the Directive filling whatever the sector act does not mandate. The practical result: there is no size at which a licensed EMI or payment institution is out of scope. A newly authorised firm is in scope from the day it holds the licence. **PSD3 and the PSR do not remove this.** The agreed texts were published in April 2026 and will in time repeal and replace both PSD2 and the E-Money Directive, merging the payment-institution and e-money-institution regimes into a single framework. Application is not expected before late 2027. Until then PSD2 and EMD2 remain the operative acts and the analysis above is unchanged. How the Annex to Directive 2019/1937 comes to reference the successor acts is a point to watch — not a reason to defer, because the obligation applies now. Member states transpose this in their own drafting. Romania, for example, places financial services, anti-money-laundering and insurance entities in Annex 3 to [Legea nr. 361/2022](https://ethicsportal.eu/whistleblower-laws/romania/) and applies the obligation to them regardless of employee count. Confirm your own national transposition — the mechanism is uniform, the drafting is not. ## Who supervises this Whistleblowing obligations for licensed firms are enforced by your prudential or conduct regulator, independently of the national whistleblower authority. Both can act on the same failure. | Country | Regulator for EMIs / PIs | |---------|--------------------------| | [Lithuania](https://ethicsportal.eu/whistleblower-laws/lithuania/) | Bank of Lithuania | | [Ireland](https://ethicsportal.eu/whistleblower-laws/ireland/) | Central Bank of Ireland | | [Malta](https://ethicsportal.eu/whistleblower-laws/malta/) | MFSA | | [Luxembourg](https://ethicsportal.eu/whistleblower-laws/luxembourg/) | CSSF | | [Netherlands](https://ethicsportal.eu/whistleblower-laws/netherlands/) | DNB | | [Germany](https://ethicsportal.eu/whistleblower-laws/germany/) | BaFin | | [France](https://ethicsportal.eu/whistleblower-laws/france/) | ACPR | | [Poland](https://ethicsportal.eu/whistleblower-laws/poland/) | KNF | | [Romania](https://ethicsportal.eu/whistleblower-laws/romania/) | BNR | ## What the obligation actually requires - Channels designed, established and operated securely, so that the reporter's confidentiality is protected ([Art. 9(1)(a)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937)). Reports may be accepted in writing, orally, or both ([Art. 9(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937)). - **Acknowledgement within seven days** of receipt ([Art. 9(1)(b)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937)). - A designated impartial person or function to follow up ([Art. 9(1)(c)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937)). - **Feedback within three months** ([Art. 9(1)(f)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937)). - The reporter's identity not disclosed to anyone beyond the staff authorised to receive and follow up reports, absent their explicit consent ([Art. 16](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937)). - Records of every report, retained no longer than necessary and proportionate ([Art. 18](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937)). Small licensed firms usually fail on the same point: the person who would receive a report is also the person a report is most likely to concern. Article 9 requires the channel to prevent exactly that conflict, which is difficult to satisfy with a shared mailbox. ## What DORA adds at procurement Regulation (EU) 2022/2554 (DORA) has applied since 17 January 2025. It does not create a whistleblowing obligation — but it governs how you buy the software that satisfies one. Whistleblowing software is an ICT service, so the engagement runs through your ICT third-party risk process rather than as an ordinary software purchase: an entry in your Register of Information, and the baseline contractual provisions in Article 30(2), including access, inspection and audit rights. A second, heavier tier — the extended provisions in Article 30(3), and the documented exit strategy required by Article 28(8) — applies where the service supports a **critical or important function**. The financial entity makes that regulatory classification, but the classification does not unilaterally amend the supplier contract. See [procurement under DORA](https://ethicsportal.eu/industries/financial-services/#procurement-under-dora) for the framing, the [DORA ICT third-party map](https://ethicsportal.eu/dora/) for provider-side evidence, and the non-binding [DORA contracting template](https://ethicsportal.eu/dora-addendum/). Customer-specific DORA commitments require an order signed by both parties. ## Reviewing EthicsPortal The documentation a licensed firm's third-party assessment asks for is published rather than released on request: [security architecture](https://ethicsportal.eu/security/), [subprocessors](https://ethicsportal.eu/subprocessors/), [business continuity plan](https://ethicsportal.eu/policies/business-continuity/), [incident register](https://ethicsportal.eu/incidents/), [DPA](https://ethicsportal.eu/dpa/), and the [ISO/IEC 27001:2022 control map](https://ethicsportal.eu/iso-27001/). A pre-filled [DPIA template](https://ethicsportal.eu/dpia/) is available for you to adapt and sign as controller. --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower compliance for financial services > Whistleblower reporting requirements for banks, investment firms, and insurers under EU Directive 2019/1937, MiFID II, MAR, and AML directives, and what DORA means for procuring a whistleblowing channel. Canonical: https://ethicsportal.eu/industries/financial-services/ Last updated: 2026-09-30 Financial institutions operate under the EU Whistleblower Directive *and* sector-specific regulations that independently require whistleblowing channels. Non-compliance exposes firms to penalties from both national transposition laws and financial regulators. ## Regulations that require whistleblowing channels - **EU Directive 2019/1937** — requires confidential whistleblowing channels, 7-day acknowledgment, and 3-month feedback deadlines. The 50-employee threshold that applies to most private-sector firms **does not apply to regulated financial entities**: under Article 8(4), entities within the scope of the Union acts listed in Parts I.B and II of the Annex must operate an internal reporting channel irrespective of headcount. Part I.B is the financial services, products, markets and anti-money-laundering list; Part II covers sector-specific acts that carry their own reporting rules. A supervised firm with 20 employees carries the same obligation as one with 2,000. - **MiFID II (2014/65/EU)** — Article 73 requires investment firms to have procedures for employees to report potential breaches internally. National regulators enforce this independently of the Whistleblower Directive. - **Market Abuse Regulation (EU 596/2014)** — Article 32 requires member states to establish mechanisms for reporting actual or potential market abuse. Firms must ensure internal channels exist so employees can report before going to regulators. - **Anti-Money Laundering Directives (AMLD 4/5/6)** — require internal reporting procedures for suspicious transactions. The upcoming AMLD package (2024) strengthens whistleblower protections for AML reporting. - **Solvency II (2009/138/EC)** — Article 71 requires insurers to maintain whistleblowing procedures. ## Sector regulators with enforcement powers | Country | Regulator | Scope | |---------|-----------|-------| | [Germany](https://ethicsportal.eu/whistleblower-laws/germany/) | BaFin | Banking, insurance, securities | | [France](https://ethicsportal.eu/whistleblower-laws/france/) | AMF / ACPR | Markets / banking and insurance | | [Netherlands](https://ethicsportal.eu/whistleblower-laws/netherlands/) | AFM / DNB | Markets / prudential supervision | | [Italy](https://ethicsportal.eu/whistleblower-laws/italy/) | Consob / Banca d'Italia | Markets / banking | | [Spain](https://ethicsportal.eu/whistleblower-laws/spain/) | CNMV | Securities markets | | [Poland](https://ethicsportal.eu/whistleblower-laws/poland/) | KNF | All financial sectors | | [Romania](https://ethicsportal.eu/whistleblower-laws/romania/) | ASF / BNR | Markets and insurance / banking | | [Ireland](https://ethicsportal.eu/whistleblower-laws/ireland/) | Central Bank of Ireland | All financial sectors | These regulators can impose fines independently of national whistleblower authorities. ## Procurement under DORA Regulation (EU) 2022/2554 (DORA) has applied since 17 January 2025. It does not require a whistleblowing channel — but for financial entities within its scope, it governs how one is *procured*. Whistleblowing software is an ICT service, so the engagement runs through your ICT third-party risk process rather than as an ordinary software purchase. In practice: - The engagement is recorded in your **Register of Information** and reported to your competent authority. - **Article 30** contractual provisions apply. Which set — the baseline in Article 30(2), or the extended requirements in Article 30(3) — depends on whether the service is classified as supporting a *critical or important function*. That classification is the financial entity's determination, not the vendor's. - Audit, access, and inspection rights must extend to your competent authority, not only to you. - Subcontracting, incident reporting, service levels, and a documented **exit strategy** must be addressed contractually. The [DORA ICT third-party map](https://ethicsportal.eu/dora/) provides provider-side register fields, an Article 30 crosswalk, stated limitations, and legacy UKNF mapping. It is procurement evidence, not a compliance certification or contract. The [DORA contracting template](https://ethicsportal.eu/dora-addendum/) is a non-binding starting point; DORA commitments arise only through a customer-specific order signed by both parties. Electronic money institutions and payment institutions have a narrower scope question — which parts of DORA apply at their size, and what a whistleblowing channel has to satisfy. That is set out separately for [e-money and payment institutions](https://ethicsportal.eu/industries/e-money-and-payment-institutions/). ## What gets reported - Market manipulation and insider trading - AML/KYC procedure failures - Mis-selling of financial products - Sanctions evasion - Unauthorized trading or risk limit breaches - Conflicts of interest in advisory roles ## Why a dedicated channel matters Financial sector employees who report through general HR channels risk having their disclosure misrouted to the person responsible for the breach. Article 9 of the Directive requires channels that protect confidentiality and prevent conflicts of interest — critical in organizations where compliance, trading, and management overlap. --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower compliance for manufacturing and supply chain > Whistleblower reporting requirements for manufacturers under EU Directive 2019/1937, the German Supply Chain Act (LkSG), and the upcoming EU CSDDD. Canonical: https://ethicsportal.eu/industries/manufacturing/ Last updated: 2026-09-30 Manufacturers face whistleblower obligations from two directions: the EU Whistleblower Directive (2019/1937) for internal reporting, and supply chain due diligence laws that explicitly require grievance mechanisms covering employees *and* third parties. ## Regulations that require whistleblowing channels - **EU Directive 2019/1937** — applies to all manufacturers with 50+ employees. Internal channels for employees. - **German Supply Chain Act (LkSG)** — in force since January 2023. Requires companies with 1,000+ employees (and their direct suppliers) to establish a **complaints procedure** accessible to affected persons in the supply chain — not just employees. [Section 8 LkSG](https://www.gesetze-im-internet.de/lksg/__8.html) - **EU Corporate Sustainability Due Diligence Directive (CSDDD)** — adopted 2024, phased implementation from 2027. Requires companies with 1,000+ employees and €450M+ turnover to establish complaints mechanisms for human rights and environmental violations in their value chains. - **EU Product Safety Regulation (2023/988)** — requires manufacturers to have internal channels for reporting product safety concerns. ## LkSG vs. Whistleblower Directive | | Whistleblower Directive | LkSG | |---|---|---| | Who can report | Employees, contractors | Employees, suppliers, affected third parties | | Scope | Breaches of EU/national law | Human rights, environmental violations in supply chain | | Anonymity required | Varies by country | Not required but recommended (BAFA guidance) | | Enforcement | National whistleblower authorities | BAFA ([German](https://ethicsportal.eu/whistleblower-laws/germany/) Federal Office for Economic Affairs) | | Penalties | Varies by country | Up to 2% of annual global turnover | Companies subject to both laws need a channel that serves dual obligations — internal whistleblowing *and* supply chain grievance. A single whistleblowing channel can cover both if configured correctly. ## What gets reported - Workplace safety violations in production facilities - Environmental non-compliance (emissions, waste disposal) - Forced labor or exploitative conditions at supplier sites - Product safety defects concealed from regulators - Bribery in procurement or supplier relationships - Circumvention of export controls or sanctions ## Why this matters now The CSDDD extends supply chain due diligence obligations across the EU, not just Germany. Companies preparing for 2027 compliance need grievance mechanisms in place. Waiting means retrofitting under deadline pressure — the same pattern that led to five member states being fined for late Directive transposition. --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower compliance for public sector > Whistleblower reporting requirements for municipalities, government agencies, and public bodies under EU Directive 2019/1937 and national exemptions. Canonical: https://ethicsportal.eu/industries/public-sector/ Last updated: 2026-10-23 Public sector entities have a broader default obligation than private companies. Under EU Directive 2019/1937, **all public sector entities must establish whistleblowing channels**, with no 50-worker minimum. But each Member State may exempt municipalities with fewer than 10,000 inhabitants or fewer than 50 workers, and other public entities with fewer than 50 workers. Germany, France and Poland use this option. Spain does not. ## How the Directive applies differently | Requirement | Private sector | Public sector | |-------------|---------------|---------------| | Employee threshold | 50+ employees | **No threshold by default**. Member States may exempt entities with fewer than 50 workers | | Deadline | 17 December 2021; 17 December 2023 for 50–249 employees | 17 December 2021 | | Shared channels | Entities with 50–249 employees may share resources to receive and investigate reports | Member States may allow municipalities to share channels or use joint municipal authorities | | Anonymous reporting | National law decides | National law decides | Article 8(9) of the Directive applies the obligation to all legal entities in the public sector, including entities they own or control. Member States may exempt municipalities with fewer than 10,000 inhabitants or fewer than 50 workers, and other public entities with fewer than 50 workers. Member States may also allow municipalities to share a whistleblowing channel or to run one through a joint municipal authority. A shared channel must stay separate from, and independent of, the external reporting channels. ## National variations - **[Germany](https://ethicsportal.eu/whistleblower-laws/germany/) (HinSchG)** — public employers with 50 or more employees must set up an internal reporting office. For municipalities and the employers they own or control, the law of each federal state (Land) decides. The fine for not setting up the office is up to €20,000. The fine for obstructing a report or for retaliation is up to €50,000, and up to €500,000 for legal entities. - **[France](https://ethicsportal.eu/whistleblower-laws/france/) (Loi Waserman)** — public bodies with 50 or more employees are covered. Municipalities under 10,000 inhabitants are excluded, and so are intercommunal bodies where no member municipality exceeds that size. Whistleblowers can report directly to external authorities without using internal channels first. - **[Poland](https://ethicsportal.eu/whistleblower-laws/poland/) (Whistleblower Protection Act of 14 June 2024)** — public entities with 50 or more people doing paid work must set up an internal reporting procedure. Organisational units of municipalities and counties with fewer than 10,000 inhabitants are exempt. Local government units may set up a joint procedure. The obligation has applied since 25 September 2024. - **[Spain](https://ethicsportal.eu/whistleblower-laws/spain/) (Ley 2/2023)** — all public entities covered regardless of size. Municipalities with fewer than 10,000 inhabitants may share an internal system. Fines go up to €1,000,000 for legal entities and up to €300,000 for individuals. ## What gets reported - Misuse of public funds or procurement fraud - Conflicts of interest in contracting - Environmental violations by public works - Workplace safety failures in public facilities - Data protection breaches involving citizen data - Abuse of authority ## Why municipalities are at risk Most large government agencies have compliance infrastructure. Municipalities and smaller public bodies often do not. Many assume the obligation does not apply to them because they have fewer than 50 employees. Under the Directive, it applies to them unless national law exempts them. Spain, for example, covers every municipality regardless of size. A whistleblowing channel for a municipality can be deployed directly without a broad IT integration project. --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # ISO/IEC 27001:2022 self-assessment > Self-assessment of EthicsPortal against ISO/IEC 27001:2022 --- the mandatory management-system requirements in Clauses 4-10 and all 93 Annex A controls, published as a Statement of Applicability. Not an accredited certification. Canonical: https://ethicsportal.eu/iso-27001/ Last updated: 2026-11-08 EthicsPortal does not currently hold accredited ISO/IEC 27001 certification. This page is a structured self-assessment against the same evidence an external auditor would evaluate, so a procurement reviewer can verify the substance directly. Certification is awarded against two things: the mandatory management-system requirements in **Clauses 4--10**, and an **Annex A control set justified by the risk assessment**. This page covers both --- the clause-by-clause position first, then all 93 Annex A controls in the form Clause 6.1.3 d) requires of a Statement of Applicability. The self-assessment is published openly. Where a requirement or control is not in place, that fact is stated openly with a target. Where it does not apply given the structure of the Service (for example, personnel controls in a zero-employee organization), that fact is stated openly with the reasoning. When EthicsPortal pursues accredited certification, the certificate scope and date will be published on [/trust/](https://ethicsportal.eu/trust/#certification-status) alongside this page. Last updated: 2026-10-28. --- ## How to read this page | Status | Meaning | |---|---| | **Implemented** | The control is in place and operating; evidence is published or available during procurement review | | **Partial** | Some measures operate, but a material part of the asserted control remains unverified or absent | | **Self-assessed** | The control is in place and operates substantively as ISO/IEC 27001:2022 describes, but has not been independently audited | | **Compensating** | The primary form of the control does not apply (typically because of the sole-operator structure), and an alternative arrangement achieves the same security objective | | **Inherited** | The control is provided by a named sub-processor (typically [Hetzner](https://ethicsportal.eu/subprocessors/)) under its own certification regime | | **Not applicable** | The control does not apply given the structure of the Service; the reason is stated | | **In treatment** | The control is not yet in place at the operator's target level; the current state, the target, and the planned action are stated openly | | **Inherited + Implemented** | The control has both an infrastructure layer (provided by a named sub-processor under its own certification) and an application layer (implemented in EthicsPortal); both are in place. In the summary tally below, such hybrids are counted under **Implemented** | The companion documents this page cites: - [Information security policy](https://ethicsportal.eu/policies/information-security/) - [Business continuity plan](https://ethicsportal.eu/policies/business-continuity/) - [Risk register](https://ethicsportal.eu/policies/risk-register/) - [Internal audit record](https://ethicsportal.eu/policies/internal-audit/) - [Management review record](https://ethicsportal.eu/policies/management-review/) - [Security](https://ethicsportal.eu/security/) (technical and organizational measures) - [Data Processing Agreement](https://ethicsportal.eu/dpa/) - [Subprocessors](https://ethicsportal.eu/subprocessors/) - [Incident register](https://ethicsportal.eu/incidents/) - [Self-conducted security testing](https://ethicsportal.eu/security-testing/) --- ## ISMS requirements (Clauses 4--10) Clauses 1--3 of the standard are informational. Clauses 4--10 are the mandatory requirements an accredited certification body confirms before it will certify anything, and they govern the management system itself rather than any individual control. Annex A is selected and justified by that system, not the other way round. | Clause | Requirement | Status | Position and evidence | |---|---|---|---| | 4.1 | Understanding the organization and its context | Self-assessed | Regulatory, threat and supplier context is carried by the [risk register](https://ethicsportal.eu/policies/risk-register/) rows it produces (R-03 supplier chain, R-07 upstream dependencies, R-10 regulatory change), together with [Subprocessors](https://ethicsportal.eu/subprocessors/) and the [Directive coverage map](https://ethicsportal.eu/directive-coverage/). There is no separate context-analysis document | | 4.2 | Understanding the needs and expectations of interested parties | Self-assessed | Interested parties are addressed per relationship rather than in a single register: controllers in the [DPA](https://ethicsportal.eu/dpa/), reporters in the [Privacy notice](https://ethicsportal.eu/privacy/), supervisory authorities at A.5.5, sub-processors on [Subprocessors](https://ethicsportal.eu/subprocessors/) | | 4.3 | Determining the scope of the ISMS | Implemented | [IS policy §2](https://ethicsportal.eu/policies/information-security/) states the boundary --- reporter portal, handler portal, supporting infrastructure, all personal data processed on behalf of controllers, the operator and the named sub-processors --- and states that controller-operated systems fall outside it | | 4.4 | Information security management system | Self-assessed | The ISMS is the published document set indexed on [Trust#public-documents](https://ethicsportal.eu/trust/#public-documents) plus this page. It operates and is versioned; it has not been certified | | 5.1 | Leadership and commitment | Implemented | The operator is sole top management. Commitments are stated and signed in the [IS policy](https://ethicsportal.eu/policies/information-security/) | | 5.2 | Policy | Implemented | [Information security policy](https://ethicsportal.eu/policies/information-security/) --- published, dated, versioned, signed, reviewed annually | | 5.3 | Organizational roles, responsibilities and authorities | Implemented | [IS policy §4](https://ethicsportal.eu/policies/information-security/) assigns all five security roles to the named operator and states that concentration openly rather than implying separation | | 6.1.1 | Actions to address risks and opportunities | Self-assessed | [IS policy §6](https://ethicsportal.eu/policies/information-security/) sets the assessment trigger and cadence; the [risk register](https://ethicsportal.eu/policies/risk-register/) records the output | | 6.1.2 | Information security risk assessment | Implemented | [Risk register](https://ethicsportal.eu/policies/risk-register/) --- defined impact and likelihood scale, ten assessed risks, and an explicit list of risk categories deliberately excluded with the design reason | | 6.1.3 | Information security risk treatment | Implemented | Treatment is recorded per risk in the register, control selection is the Statement of Applicability below, and the [treatment plan](https://ethicsportal.eu/policies/risk-register/) gives every **In treatment** risk a named action and a completion date, with a stated rule for what happens when one is missed | | 6.2 | Information security objectives and planning to achieve them | Implemented | [IS policy §3](https://ethicsportal.eu/policies/information-security/) states three objectives, each with a measure, a target, and the source the result is read from | | 6.3 | Planning of changes | Self-assessed | Changes to the Service run through the pre-deploy checklist and the deploy gate (A.8.32). Changes to the ISMS are versioned in each document's control block and recorded in the corrective-action log below | | 7.1 | Resources | Partial | The ISMS is resourced by one person's time. That constraint is the subject of [risk register R-01](https://ethicsportal.eu/policies/risk-register/) and is disclosed on [Trust#continuity-and-personnel](https://ethicsportal.eu/trust/#continuity-and-personnel) | | 7.2 | Competence | Self-assessed | [IS policy §8](https://ethicsportal.eu/policies/information-security/) records the operator's competence basis and the feeds that maintain it. Self-declared; no third-party certification is claimed | | 7.3 | Awareness | Compensating | There are no personnel to make aware. The operator's own awareness is maintained through the security feeds listed at A.5.6 | | 7.4 | Communication | Implemented | Security events follow the [incident register](https://ethicsportal.eu/incidents/) disclosure timeline; sub-processor changes carry 30-day notice under [DPA §6.4](https://ethicsportal.eu/dpa/); inbound reports reach [security@ethicsportal.eu](mailto:security@ethicsportal.eu) ([Security#responsible-disclosure](https://ethicsportal.eu/security/#responsible-disclosure)) | | 7.5 | Documented information | Implemented | Every policy document carries a version, effective date, next-review date, owner and signature, and is published rather than held privately | | 8.1 | Operational planning and control | Implemented | [Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle) --- the automated suite and static analysis gate every deploy and block it on failure; the written pre-deploy checklist governs approval | | 8.2 | Information security risk assessment (performed) | Self-assessed | Register last reviewed 2026-09-05 on the annual cadence plus the interim triggers in [IS policy §6](https://ethicsportal.eu/policies/information-security/) | | 8.3 | Information security risk treatment (implemented) | Self-assessed | The selected controls operate --- see the tally below --- and the five open items now run against the dated [treatment plan](https://ethicsportal.eu/policies/risk-register/). The first cycle of results against those dates is reported at the 2027-09 [management review](https://ethicsportal.eu/policies/management-review/); until then the plan is executing rather than evidenced | | 9.1 | Monitoring, measurement, analysis and evaluation | Self-assessed | A production check set runs continuously and is published at [secure.ethicsportal.eu/up](https://secure.ethicsportal.eu/up). It verifies, among other things, that the append-only audit triggers are present on the deployed database, that the latest PostgreSQL dump is under 36 hours old, and that the GDPR retention, deadline and inactivity-close jobs completed within 26 hours. Availability against the 99.5% target is measured per [SLA#measurement](https://ethicsportal.eu/sla/#measurement). Analysis of the collected data is periodic, at the review points below, rather than continuous | | 9.2 | Internal audit | Partial | A programme and a first audit are published at [Internal audit record](https://ethicsportal.eu/policies/internal-audit/); it found no control failures and five documentation defects, all corrected before close. The requirement that the audit process be objective and impartial cannot be met under a single-operator structure, since the auditor is the person who built the system. That is the same limit recorded at A.5.35, and an independent review is what closes it | | 9.3 | Management review | Self-assessed | [Management review record](https://ethicsportal.eu/policies/management-review/) --- conducted against the Clause 9.3 input list, dated, with conclusions and five decisions recorded. Single-person review; not independently witnessed | | 10.1 | Continual improvement | Self-assessed | Evidenced by the corrective-action log below and by the dated revisions of each policy document | | 10.2 | Nonconformity and corrective action | Implemented | Security events are recorded and closed out through the [incident register](https://ethicsportal.eu/incidents/); ISMS nonconformities --- inaccurate or incomplete assertions found during review --- are recorded with their correction and re-verification in the corrective-action log below | --- ## Statement of Applicability Clause 6.1.3 d) requires a Statement of Applicability: the controls determined necessary, the justification for including each, whether it is implemented, and the justification for excluding any Annex A control. The four control tables below are that statement. **Basis for inclusion.** All 93 Annex A controls are treated as applicable by default. A control is excluded only where the structure of the Service makes it meaningless --- eight of the 93 --- and every exclusion carries its reason in its own row. Inclusion is not asserted control by control against a single risk, because most controls treat several. The mapping below shows which controls carry the treatment for each assessed risk; the controls it does not name are included as baseline hygiene for the three objectives in [IS policy §3](https://ethicsportal.eu/policies/information-security/). | Assessed risk ([register](https://ethicsportal.eu/policies/risk-register/)) | Treatment carried by | |---|---| | R-01 Operator incapacity | A.5.2, A.5.4, A.5.24, A.5.29, A.5.30, A.8.13 | | R-02 Hetzner outage | A.5.23, A.5.29, A.5.30, A.7.1--A.7.13 (inherited), A.8.13, A.8.14 | | R-03 Sub-processor personal-data breach | A.5.19, A.5.20, A.5.21, A.5.22, A.5.23, A.8.12, A.8.16 | | R-04 Operator credential theft | A.5.15, A.5.17, A.5.18, A.8.2, A.8.4, A.8.5 | | R-05 Restore failure | A.5.30, A.8.13, A.8.14 | | R-06 Reporter network-side attribution leak | A.5.34, A.8.11, A.8.15, A.8.16 | | R-07 Upstream dependency vulnerability | A.5.7, A.5.21, A.8.8, A.8.19, A.8.29 | | R-08 Audit-log integrity compromise | A.5.28, A.5.33, A.8.2, A.8.15 | | R-09 Reporter password loss | A.5.17, A.8.5, A.8.24 | | R-10 Regulatory change requiring re-architecture | A.5.31, A.5.36, A.8.25, A.8.26 | --- ## A.5 Organizational controls | Control | Title | Status | Evidence | |---|---|---|---| | A.5.1 | Policies for information security | Implemented | [Information security policy](https://ethicsportal.eu/policies/information-security/) | | A.5.2 | Information security roles and responsibilities | Implemented | [IS policy §4](https://ethicsportal.eu/policies/information-security/) --- single named operator holds all security roles | | A.5.3 | Segregation of duties | Compensating | Sole-operator structure makes traditional duty segregation inapplicable. Defined events are recorded in an append-only audit log, including which handler viewed which report; reads of other resources are not logged. The automated suite and static analysis gate deploy, and signed commits make authorship attributable ([Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle), [Risk register R-04](https://ethicsportal.eu/policies/risk-register/)) | | A.5.4 | Management responsibilities | Implemented | Operator is sole management; commitments stated in [IS policy](https://ethicsportal.eu/policies/information-security/) §3 | | A.5.5 | Contact with authorities | Self-assessed | Direct contact with Polish supervisory authority (UODO) and customer-side DPAs through the breach-notification path; no standing liaison | | A.5.6 | Contact with special interest groups | Self-assessed | CVE feeds, Rails security mailing list, Ruby Advisory Database subscribed via tooling ([Security#dependency-and-patch-management](https://ethicsportal.eu/security/#dependency-and-patch-management)) | | A.5.7 | Threat intelligence | Self-assessed | Continuous SCA via Brakeman, bundler-audit, Dependabot; no formal threat-intel program. [Risk register R-07](https://ethicsportal.eu/policies/risk-register/) states the residual position | | A.5.8 | Information security in project management | Implemented | [Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle) --- features with new personal-data flows are reviewed at design stage (e.g. the oral-reporting voice channel was designed to pitch-shift audio locally and purge the raw recording, introducing no new sub-processor) | | A.5.9 | Inventory of information and other associated assets | Implemented | [DPA §3](https://ethicsportal.eu/dpa/) lists processed data categories; [Subprocessors](https://ethicsportal.eu/subprocessors/) lists external assets; privileged-access summary available during procurement review | | A.5.10 | Acceptable use of information and other associated assets | Compensating | No employees; operator's own use is governed by the [IS policy](https://ethicsportal.eu/policies/information-security/) and the [Terms](https://ethicsportal.eu/terms/) §7 | | A.5.11 | Return of assets | Not applicable | No employees, no joiner/leaver process. Customer-side asset return (data export and deletion) is governed by [DPA §6.8](https://ethicsportal.eu/dpa/) | | A.5.12 | Classification of information | Implemented | [DPA §3](https://ethicsportal.eu/dpa/) classifies each data category (reporter identity, report content, communications, attachments, operational data, audit-log) and states encryption status | | A.5.13 | Labelling of information | Implemented | Encryption status of each field is identified in [DPA §3](https://ethicsportal.eu/dpa/) and [Security#data-encryption](https://ethicsportal.eu/security/#data-encryption) | | A.5.14 | Information transfer | Partial | Customer-facing connections use HTTPS/TLS ([Security#data-encryption](https://ethicsportal.eu/security/#data-encryption)). Public supplier terms describe DPAs, but executed account-specific terms, onward access and restricted transfers have not been verified ([Subprocessors](https://ethicsportal.eu/subprocessors/)) | | A.5.15 | Access control | Implemented | [Security#access-control](https://ethicsportal.eu/security/#access-control) --- Pundit policy authorization on every controller action; three-role RBAC (admin/member/viewer); opt-in TOTP 2FA; sliding session lifecycle | | A.5.16 | Identity management | Implemented | Magic-link authentication; per-user identity tracked through the membership lifecycle; deactivation cuts access at the request boundary | | A.5.17 | Authentication information | Implemented | Reporter passwords generated by the system (16 random digits), bcrypt-hashed and non-recoverable; a one-time password that staff pass on for a report they log is replaced at the reporter's first sign-in by one only the reporter sees; handler authentication via passwordless magic-link with opt-in TOTP 2FA (recommended at onboarding, not enforced); operator production accounts use mandatory hardware-key 2FA ([Risk register R-04](https://ethicsportal.eu/policies/risk-register/)); no plaintext password storage | | A.5.18 | Access rights | Implemented | Three roles (admin, member, viewer) with least-privilege defaults; read-only viewer role for auditors and legal counsel; periodic review via member deactivation and audit-log review ([Security#access-control](https://ethicsportal.eu/security/#access-control)) | | A.5.19 | Information security in supplier relationships | Implemented | [Subprocessors](https://ethicsportal.eu/subprocessors/) page lists each supplier with data category, jurisdiction, and purpose; [DPA §6.4](https://ethicsportal.eu/dpa/) governs the relationship | | A.5.20 | Addressing information security within supplier agreements | Implemented | Written DPA in place with each sub-processor under GDPR Art. 28 | | A.5.21 | Managing information security in the ICT supply chain | Self-assessed | SCA on every dependency change; new gem releases adopted only after a 3-day cooldown, Dependabot version updates after 3, 7 or 14 days; every GitHub Actions step pinned to a commit SHA; binaries downloaded during the image build verified against a pinned SHA-256 checksum ([Security#dependency-and-patch-management](https://ethicsportal.eu/security/#dependency-and-patch-management)); sub-processor change notice on additions ([DPA §6.4](https://ethicsportal.eu/dpa/)). No formal upstream-supplier audit program | | A.5.22 | Monitoring, review and change management of supplier services | Self-assessed | Sub-processor SLAs and security disclosures monitored informally; no formal annual supplier-review program | | A.5.23 | Information security for use of cloud services | Self-assessed | EU hosting for the reporting service is documented on [Security#infrastructure](https://ethicsportal.eu/security/#infrastructure) and [Subprocessors](https://ethicsportal.eu/subprocessors/). Separate US processing for the public site is disclosed in the [Privacy Notice](https://ethicsportal.eu/privacy/). This self-assessment does not itself prove that a particular transfer mechanism or supplier contract is sufficient. | | A.5.24 | Information security incident management planning and preparation | Implemented | [Business continuity plan §3--5](https://ethicsportal.eu/policies/business-continuity/) defines triggers, decision authority, communication; [Incident register](https://ethicsportal.eu/incidents/) defines disclosure timeline | | A.5.25 | Assessment and decision on information security events | Implemented | [BCP §3](https://ethicsportal.eu/policies/business-continuity/) defines trigger conditions; operator is sole decision authority | | A.5.26 | Response to information security incidents | Implemented | [BCP §4--7](https://ethicsportal.eu/policies/business-continuity/); [Incident register](https://ethicsportal.eu/incidents/) records every material incident | | A.5.27 | Learning from information security incidents | Implemented | [Incident register](https://ethicsportal.eu/incidents/) final entry includes root cause, remediation, and lessons learned within 30 days of containment | | A.5.28 | Collection of evidence | Implemented | Append-only audit log: PostgreSQL triggers reject changes to core audit content and table truncation while permitting required foreign-key nullification; application deletion paths are limited to retention and GDPR Art. 17 erasure flows; privileged database intervention remains a documented residual risk ([Risk register R-08](https://ethicsportal.eu/policies/risk-register/#r-08-audit-log-integrity-compromise)). The trail is preserved in all PDF case exports; per-incident written log retained for audit | | A.5.29 | Information security during disruption | Implemented | [Business continuity plan](https://ethicsportal.eu/policies/business-continuity/) §1--7 | | A.5.30 | ICT readiness for business continuity | Partial | [BCP §2 & §6](https://ethicsportal.eu/policies/business-continuity/); RPO 24h / RTO 4h are published objectives in the [SLA](https://ethicsportal.eu/sla/#recovery-objectives). The monthly drill now proves the restored database is readable by the application, not only that the rows returned. It still does not measure the end-to-end RTO, off-provider recovery or operator-incapacity response | | A.5.31 | Legal, statutory, regulatory and contractual requirements | Implemented | [Directive coverage map](https://ethicsportal.eu/directive-coverage/), [Directive interpretations](https://ethicsportal.eu/directive-interpretations/), [Whistleblower laws by country](https://ethicsportal.eu/whistleblower-laws/), GDPR Art. 32 coverage on [Security](https://ethicsportal.eu/security/) | | A.5.32 | Intellectual property rights | Implemented | [Terms §8](https://ethicsportal.eu/terms/) addresses ownership of the Service and customer content; [Terms §12](https://ethicsportal.eu/terms/) states that the standard terms do not include IP defence or indemnity | | A.5.33 | Protection of records | Implemented | Append-only audit log; retention-based deletion ([Security#audit-and-compliance](https://ethicsportal.eu/security/#audit-and-compliance)) | | A.5.34 | Privacy and protection of personal identifiable information (PII) | Implemented | [Privacy policy](https://ethicsportal.eu/privacy/), [DPA](https://ethicsportal.eu/dpa/), [Security#anonymity-and-privacy](https://ethicsportal.eu/security/#anonymity-and-privacy); GDPR Art. 14 notice to third parties named in a report is documented as the controller's (customer's) responsibility, not automated by the platform; data-subject rights including portability (Art. 20) and complaint to a supervisory authority (Art. 77) documented; GDPR Art. 32 measures documented | | A.5.35 | Independent review of information security | Partial | An independent penetration test by Spektr Security LLC, 26--30 October 2026: a code audit against a copy of the source and a penetration test following the OWASP Web Security Testing Guide, unauthenticated and at each role, plus a network exposure scan of the production host. It found 3 medium and 2 low issues, none high or critical. All are fixed, and the assessor's retest confirmed the fixes. A letter of attestation is available on request ([Trust#certification-status](https://ethicsportal.eu/trust/#certification-status)). No independent review of the management system itself is on record, so the control is Partial. First-party testing is published at [Self-conducted security testing](https://ethicsportal.eu/security-testing/) | | A.5.36 | Compliance with policies, rules and standards for information security | Implemented | This control map plus the [IS policy](https://ethicsportal.eu/policies/information-security/), [BCP](https://ethicsportal.eu/policies/business-continuity/), and [Risk register](https://ethicsportal.eu/policies/risk-register/) form the compliance frame; the automated suite and static analysis enforce those invariants on every change and block the deploy on failure | | A.5.37 | Documented operating procedures | Implemented | SDLC documented on [Security](https://ethicsportal.eu/security/#secure-development-lifecycle); restore procedure documented in [BCP §6](https://ethicsportal.eu/policies/business-continuity/); deployment via versioned Kamal configuration | --- ## A.6 People controls | Control | Title | Status | Evidence | |---|---|---|---| | A.6.1 | Screening | Compensating | There is no hiring process to screen, but the operator is the only person with access and is therefore the subject this control exists to assure. The equivalent assurance is identity verifiability: contracting party, registry number and tax registration are published on [Trust#contracting-party](https://ethicsportal.eu/trust/#contracting-party), and the registry extract is available during procurement review. Sole-operator structure disclosed on [Trust#continuity-and-personnel](https://ethicsportal.eu/trust/#continuity-and-personnel) | | A.6.2 | Terms and conditions of employment | Not applicable | No employees | | A.6.3 | Information security awareness, education and training | Compensating | No employees to train, but Clause 7.2 makes the operator's own competence a requirement rather than an exemption. The competence basis and the feeds that maintain it are recorded in [IS policy §8](https://ethicsportal.eu/policies/information-security/); the subscriptions are listed at A.5.6. Self-directed and self-declared | | A.6.4 | Disciplinary process | Not applicable | No employees | | A.6.5 | Responsibilities after termination or change of employment | Not applicable | No employees | | A.6.6 | Confidentiality or non-disclosure agreements | Implemented | Operator's confidentiality obligation to controllers is in [DPA §6.2](https://ethicsportal.eu/dpa/); customer-facing NDAs available on request during procurement review | | A.6.7 | Remote working | Self-assessed | Operator works remotely; workstation hardened with full-disk encryption, screen-lock, and OS auto-update; production access only via the operator's authenticated session. No separate remote-working policy document | | A.6.8 | Information security event reporting | Implemented | [Responsible disclosure](https://ethicsportal.eu/security/#responsible-disclosure) inbox at security@ethicsportal.eu; [Incident register](https://ethicsportal.eu/incidents/) records confirmed events | --- ## A.7 Physical controls EthicsPortal does not operate its own physical infrastructure. The physical controls below are inherited from [Hetzner](https://ethicsportal.eu/subprocessors/) (Nuremberg and Falkenstein, Germany --- ISO 27001-certified data centers under Hetzner's own scope) for hosting controls, or fulfilled at the operator-workstation level for endpoint controls. | Control | Title | Status | Evidence | |---|---|---|---| | A.7.1 | Physical security perimeters | Inherited | Hetzner Nuremberg and Falkenstein data centers under Hetzner certification scope | | A.7.2 | Physical entry | Inherited | Hetzner Nuremberg and Falkenstein data centers | | A.7.3 | Securing offices, rooms and facilities | Not applicable | No EthicsPortal office processes customer data | | A.7.4 | Physical security monitoring | Inherited | Hetzner Nuremberg and Falkenstein data centers | | A.7.5 | Protecting against physical and environmental threats | Inherited | Hetzner Nuremberg and Falkenstein data centers | | A.7.6 | Working in secure areas | Not applicable | No EthicsPortal physical secure areas | | A.7.7 | Clear desk and clear screen | Self-assessed | Operator workstation has automatic screen-lock and clear-desk practice for any printed materials touching customer data (rare in practice) | | A.7.8 | Equipment siting and protection | Self-assessed | Operator workstation; production equipment is at Hetzner | | A.7.9 | Security of assets off-premises | Self-assessed | Operator workstation = primary off-premises asset; full-disk encryption, screen-lock, hardware-key 2FA on production-access accounts | | A.7.10 | Storage media | Self-assessed | No removable media is used for production data. Backups exist only in EU cloud object storage | | A.7.11 | Supporting utilities | Inherited | Hetzner Nuremberg and Falkenstein data centers | | A.7.12 | Cabling security | Inherited | Hetzner Nuremberg and Falkenstein data centers | | A.7.13 | Equipment maintenance | Inherited | Hetzner Nuremberg and Falkenstein data centers | | A.7.14 | Secure disposal or re-use of equipment | Self-assessed | Operator workstation is full-disk encrypted, so destruction of the encryption key on re-use suffices. Hetzner handles its own equipment disposal under its certification | --- ## A.8 Technological controls | Control | Title | Status | Evidence | |---|---|---|---| | A.8.1 | User end point devices | Self-assessed | Operator workstation: full-disk encryption, screen-lock, OS auto-update, hardware-key 2FA on production-access accounts | | A.8.2 | Privileged access rights | Implemented | Only the operator has production access; access requires the operator's authenticated session with hardware-key 2FA; the in-app admin panel and staff dashboards refuse any account without two-factor authentication; privileged-access summary available during procurement review | | A.8.3 | Information access restriction | Implemented | [Security#access-control](https://ethicsportal.eu/security/#access-control) --- Pundit policy authorization on every controller action; RBAC; least privilege | | A.8.4 | Access to source code | Implemented | Private repository on Git hosting with hardware-key 2FA enforced on the operator's account; no shared credentials. Commits and tags are signed with an SSH key and verified against a pinned allowed-signers list, so the authorship of every revision is cryptographically attributable | | A.8.5 | Secure authentication | Implemented | Magic-link primary authentication with encrypted pending-auth token and sliding session expiry; sessions are identified by a random token, never a database identifier that a restore could reissue; opt-in TOTP 2FA for handler/admin accounts (not enforced); bcrypt-hashed reporter passwords ([Security#access-control](https://ethicsportal.eu/security/#access-control)) | | A.8.6 | Capacity management | Self-assessed | AppSignal performance monitoring on the handler portal; informal capacity planning. No formal capacity-management plan document | | A.8.7 | Protection against malware | Implemented | ClamAV scan on every file attached to a report, message or note via a swappable AntivirusScanner client; voice recordings are re-encoded instead and the raw recording is never served; uploads are gated from delivery (HTTP 403) until scanned clean, a file with no recorded scan counts as unscanned and an hourly job queues its scan, the organization data export leaves out files not scanned clean, and infected files are purged ([Security#virus-scanning](https://ethicsportal.eu/security/#virus-scanning)) | | A.8.8 | Management of technical vulnerabilities | Implemented | Brakeman, bundler-audit, importmap audit on every change plus a daily dependency-audit CI cron to catch new CVEs on unchanged dependencies; the production container image scanned weekly for operating-system and base-image vulnerabilities; Dependabot weekly grouped updates; documented response SLA (critical 7d, high 30d, medium 90d) ([Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle)); vulnerabilities found by manual testing are tracked with their remediation at [Self-conducted security testing](https://ethicsportal.eu/security-testing/) | | A.8.9 | Configuration management | Implemented | All infrastructure configuration is version-controlled (Kamal deployment configuration); no out-of-band production changes | | A.8.10 | Information deletion | Implemented | Retention-based automatic deletion (12/24/36/48/60 months, country-minimum enforced); 18-month inactivity auto-close starts the retention clock; organization soft-delete with retention-aware auto-purge; post-Service return or deletion follows the Controller's instruction and the documented production/backup lifecycle ([DPA §6.8](https://ethicsportal.eu/dpa/), [Security#audit-and-compliance](https://ethicsportal.eu/security/#audit-and-compliance)) | | A.8.11 | Data masking | Implemented | Compliance-report PDF excludes sensitive report content; handler-portal views display "Case handler" rather than handler identity to reporters; admin-side views surface only authorized fields; EXIF/metadata stripped from uploaded images, PDFs, audio and video (libvips + exiftool, with each PDF then rewritten by qpdf so no earlier revision keeps the original metadata; comment author names and the metadata of photos embedded in a PDF are kept, a stated gap), selected by the file's detected type rather than the type the browser declares, with images decoded only by the libvips loader named for that type; oral-report audio pitch-shifted locally (a reversible disguise, not anonymization) and the raw recording purged, and voice messages are off unless the organization enables them in its channel settings | | A.8.12 | Data leakage prevention | Partial | No AI/LLM sub-processor is used for report content ([DPA §6.10](https://ethicsportal.eu/dpa/)). Mailjet receives email addresses and, when enabled, reporter notifications that carry the Case ID; AppSignal receives application telemetry. Actual downstream access, telemetry content and restricted transfers require account-level verification ([Subprocessors](https://ethicsportal.eu/subprocessors/)) | | A.8.13 | Information backup | Implemented | Three layers, all in the EU: daily PostgreSQL dumps via a Kamal accessory to Hetzner Object Storage (separate from the compute host), encrypted with GnuPG symmetric AES-256 on the host before upload, with 21 current daily backups and deletion of noncurrent versions after 7 additional days; full-disk snapshots of the application host retained 7 days in Hetzner Cloud; and a copy of every encrypted file attachment, under its own per-file key, in a versioned bucket in Hetzner Falkenstein, separate from the Nuremberg primary. Backup freshness is checked continuously and alerts if the latest dump exceeds 36 hours. The monthly drill decrypts, restores, compares every table against production and boots the application against the restored data to confirm an encrypted column decrypts, that one encrypted file attachment opens with the key carried in the dump, and that every settled attachment has a copy in Falkenstein, with one copy opened and checked against its checksum ([Security#backups-and-restore](https://ethicsportal.eu/security/#backups-and-restore)). Recovery outside Hetzner is unmeasured and tracked under A.5.30 | | A.8.14 | Redundancy of information processing facilities | Self-assessed | No cross-provider hot failover at current customer footprint. Backups and restore procedures provide a documented recovery path, but the published RTO has not been demonstrated end to end. Trade-off stated in [Risk register R-02](https://ethicsportal.eu/policies/risk-register/) | | A.8.15 | Logging | Implemented | Append-only audit trail for defined report and account events (timestamp, actor, action type). Report reads are covered: each handler's view of a given report is logged, deduplicated to one entry per handler per report per 24 hours, and reporter follow-up views are logged the same way. Reads of other resources, and actions outside the defined event set, are not logged. Rejected sign-in codes, rejected Case ID and password lookups, and tripped rate limits are written to the application log, naming the limit but never the email address, Case ID or IP address. Application request logs contain no reporter IP address and replace file-download paths, so attachment file names and download tokens are not written to them. The reverse proxy keeps its own request log of IP addresses and paths, overwritten after about two days; attachment download paths carry a fixed segment rather than the file name ([Security#ip-addresses](https://ethicsportal.eu/security/#ip-addresses)). AppSignal records application telemetry subject to the restrictions and remaining verification in A.8.16 | | A.8.16 | Monitoring activities | Partial | AppSignal APM is active; reporter controllers use an ignored namespace and session-data transmission is disabled. On 2026-09-23 the namespace exclusion was checked from the supplier side rather than from our configuration: an inventory of every action AppSignal holds for the production app returned 27 web actions and 13 background jobs, all of them handler, organization, admin or public-widget paths, with no reporter-portal controller among them. One-time sign-in codes and SAML assertions are filtered from the request parameters sent. **Not yet verified:** the contents of individual stored samples --- request parameters and headers --- which the supplier's API does not expose under the token used. Attachment delivery and supplier-side logs also remain unverified (TP-01, [Subprocessors](https://ethicsportal.eu/subprocessors/)) | | A.8.17 | Clock synchronization | Implemented | NTP via the host operating system; all timestamps recorded in UTC | | A.8.18 | Use of privileged utility programs | Self-assessed | Operator has shell access to production for non-routine maintenance; use is recorded in the operator's incident/maintenance log. No shared admin accounts | | A.8.19 | Installation of software on operational systems | Implemented | Production installations only via the Kamal deployment configuration. No manual package installation on production hosts. The production image carries only runtime code: the static sites, tests and development scripts are excluded, and ImageMagick was removed in favour of libvips | | A.8.20 | Networks security | Inherited + Implemented | Network-level protection inherited from Hetzner; application-level TLS termination and rate-limiting implemented in the application ([Security#rate-limiting](https://ethicsportal.eu/security/#rate-limiting)); the reverse proxy refuses request bodies above the size of the largest legitimate report before the application buffers them | | A.8.21 | Security of network services | Inherited | Hetzner network services | | A.8.22 | Segregation of networks | Self-assessed | Production is isolated from operator workstation by network boundary; non-production environments do not contain production personal data ([Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle)) | | A.8.23 | Web filtering | Not applicable | No employee egress network to filter | | A.8.24 | Use of cryptography | Implemented | Non-deterministic encryption at rest via Rails ActiveRecord Encryption, which also covers stored real-time notification payloads; file attachments encrypted with AES-256 under a separate key per file (A.8.13); signed and encrypted messages are serialized as JSON only, so a leaked application secret cannot be turned into code execution through Ruby's Marshal format; HTTPS/TLS in transit; bcrypt for reporter passwords ([Security#data-encryption](https://ethicsportal.eu/security/#data-encryption)). Customer-managed keys not supported and the reason is stated in [DPA §6.11](https://ethicsportal.eu/dpa/) | | A.8.25 | Secure development life cycle | Implemented | [Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle) | | A.8.26 | Application security requirements | Implemented | Encryption coverage, authorization scope, audit-log emission, and input-validation requirements are on the pre-deploy checklist for every change and are covered by automated tests that block the deploy on failure. Encryption coverage is enforced structurally: the build fails if any text column on a report table, including one added later, is not encrypted non-deterministically or explicitly listed as a fixed vocabulary ([Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle)) | | A.8.27 | Secure system architecture and engineering principles | Implemented | Encryption boundary, append-only audit log, RBAC at the request boundary, and reporter-anonymity properties are architectural commitments documented on [Security](https://ethicsportal.eu/security/) | | A.8.28 | Secure coding | Implemented | Framework-level defaults (parameterized queries, strong parameters, output escaping, CSRF) are the floor; static analysis enforces non-negotiable items ([Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle)) | | A.8.29 | Security testing in development and acceptance | Implemented | Brakeman + bundler-audit + importmap audit on every change; automated test coverage of authorization paths, encryption invariants, audit-log emission, and rate-limit enforcement, with the report, document and whistleblowing-channel access policies mutation-tested on 2026-10-17; periodic manual testing with scope, findings, and remediation published at [Self-conducted security testing](https://ethicsportal.eu/security-testing/) | | A.8.30 | Outsourced development | Not applicable | All development is by the sole operator; no outsourced development | | A.8.31 | Separation of development, test and production environments | Implemented | Production is isolated; non-production environments use synthetic fixtures; no production personal data is used outside production ([Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle)) | | A.8.32 | Change management | Implemented | Every production change is committed to version control, passes the full automated suite and static analysis before deploy, and is recorded --- deploy path in the CI run history, rationale in a per-change decision log. A failing suite blocks the deploy. Roughly the last five deploys are retained for rollback, and a rollback was drilled in production on 2026-10-17. Approval follows the documented pre-deploy checklist; approval roles are described during procurement review ([Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle)) | | A.8.33 | Test information | Implemented | Non-production environments use synthetic data only | | A.8.34 | Protection of information systems during audit testing | Implemented | The independent penetration test of October 2026 ran under a written per-audit plan, which also covers retests. The assessor has read-only access to a code-only copy of the source, with no production credentials, infrastructure access or customer data, and tests the application locally against synthetic data. Against production, testing is limited to a network exposure scan: no sign-in, submissions or email. The assessor keeps this access between engagements so a retest runs against a current copy; each copy is cut from the deployed revision | --- ## Summary Of the 93 controls in ISO/IEC 27001:2022 Annex A: | Status | Count | Read as | |---|---|---| | Implemented | 51 | In place and operating; evidence published or available during procurement review | | Partial | 5 | Material scope or evidence still outstanding (A.5.14, A.5.30, A.5.35, A.8.12, A.8.16) | | Self-assessed | 17 | In place and operating substantively as the control describes, but not independently audited | | Inherited | 8 | Provided by named sub-processor (primarily Hetzner) under its own certification regime | | Not applicable | 8 | Does not apply given the sole-operator structure (the remaining A.6 People controls and one-off cases) | | Compensating | 4 | Primary form not applicable; alternative arrangement achieves the same objective (A.5.3 segregation of duties, A.5.10 acceptable use, A.6.1 screening, A.6.3 awareness) | A.5.35 is **Partial**: an independent penetration test is on record, an independent review of the management system is not. The other four **Partial** controls require supplier-chain and end-to-end continuity evidence. First-party testing is published at [Self-conducted security testing](https://ethicsportal.eu/security-testing/); it does not establish independence or close the partial controls. Against Clauses 4--10, two positions remain open and both are structural: the ISMS is resourced by one person (7.1), and internal audit cannot be impartial while the auditor is the person who built the system (9.2). Neither is closed by adding a control. Both are properties of the single-operator structure and are disclosed as such; an independent external review is what moves 9.2, and it is dated at TP-05 of the [treatment plan](https://ethicsportal.eu/policies/risk-register/). --- ## Nonconformity and corrective-action log Clause 10.2 requires that a nonconformity be recorded with the correction applied and the effect of that correction verified. The entries below are that record. Each revision states what was found inaccurate, incomplete or unsupported, what was changed, and what was re-verified. Entries are retained rather than overwritten, so a reviewer can see what the page used to claim. ### v3.12 --- 2026-11-08 A control change. A.5.35 moves from **In treatment** to **Partial**. - **A.5.35** --- the independent penetration test is complete: Spektr Security LLC, 26--30 October 2026, 3 medium and 2 low issues, none high or critical, all fixed and confirmed by the assessor's retest. The control reviews the management system as well as its technical implementation, and no independent review of the management system is on record, so it moves to **Partial** rather than Implemented. - **A.8.34 --- correction.** The row said the assessor's access is revoked when the engagement closes. The access is kept between engagements so retests run against a current copy of the source; the row now says so. - **Summary tally.** 51 Implemented, 5 Partial, 17 Self-assessed, 8 Inherited, 8 Not applicable, 4 Compensating; none In treatment. ### v3.11 --- 2026-10-20 A nonconformity. No control changed status. - **A.8.11 --- nonconformity.** The row, the [DPIA](https://ethicsportal.eu/dpia/) and the reporting form described voice recordings as anonymized, and the DPIA said irreversibly. Every recording is pitch-shifted by the same fixed factor, so anyone who knows or estimates the factor can reverse the shift and recover the reporter's pitch and voice character. The original recording is still deleted after processing. The row now calls the shift a reversible disguise, and the reporting form tells reporters whose voice could identify them to type instead. ### v3.10 --- 2026-10-18 An evidence update. No control changed status. - **A.5.17** --- reporters chose their own six-digit passcode, so a common choice such as 123456 was accepted. The system now generates the password when the report is submitted: 16 random digits, stored only as a bcrypt digest. A password that staff pass on for a report they log works once; the reporter's first sign-in replaces it with one only the reporter sees. Passcodes chosen before 2026-10-18 still work. Recorded on [Self-conducted security testing](https://ethicsportal.eu/security-testing/). ### v3.9 --- 2026-10-18 A nonconformity. No control changed status. - **A.5.18 --- nonconformity.** The row, and the role table on [Security](https://ethicsportal.eu/security/#access-control), describe the viewer role as read-only. A viewer assigned to a case or added as a participant could act on it: message the reporter, acknowledge, give feedback and close it. A member made a viewer kept that access to the cases they held. Viewers can now be neither assigned nor added, and a member made a viewer is released from their cases the way a deactivated member is. A read-only check of production the same day found no viewer membership, so no case was exposed. ### v3.8 --- 2026-10-18 Two nonconformities and an evidence update, found in a code-level review ahead of the independent assessment. No control changed status. - **A.8.11 --- nonconformity.** The row stated that metadata is stripped from uploaded PDFs. ExifTool removes PDF metadata by appending a new revision, so the earlier revision, with the original author and creating application, stayed in the file, and ExifTool's own revert restored it. A PDF exported from Word carries the author's account name. The claim was false for PDFs from launch until 2026-10-18. Each PDF is now rewritten without its earlier revisions, and the check counts the revisions in the file itself rather than reading the latest one. Re-verified the same day by a read-only check of production: no report PDF is stored, so no stored file carries a recoverable author. - **A.8.7 --- nonconformity.** The row states that uploads are gated from delivery until scanned clean. The organization data export included files whatever their scan status, including files that had failed the scan. A file whose scan was never queued, for example after a failure at the moment of upload, had no status and was served. The export now leaves out files not scanned clean and lists each with its status. A file with no recorded scan counts as unscanned, and an hourly job queues the scans that never ran. The same production check found every stored report file scanned clean. The row also said every uploaded file is scanned. That holds for files attached to reports, messages and notes; voice recordings are re-encoded rather than scanned, and the row now says so. - **A.8.2** --- the in-app admin panel and staff dashboards now refuse an account without two-factor authentication, so signing in with the emailed link alone no longer reaches them. - **A.8.15** --- rejected sign-in codes, rejected Case ID and passcode lookups, and tripped rate limits are now logged. Each line names the limit, never the email address, Case ID or IP address it was keyed on. - **A.8.16** --- one-time sign-in codes and SAML assertions are now filtered from the request parameters sent to AppSignal. ### v3.7 --- 2026-10-18 A control change. A.8.34 moves from **Not applicable** to **Implemented**. - **A.8.34** --- the row was Not applicable because no third-party testing was scoped. An independent whitebox assessment began on 2026-10-18, and the per-audit plan the row promised now exists: read-only access to a code-only copy of the source, no production credentials or customer data, local testing against synthetic data, and a network exposure scan as the only activity against production. - **A.5.35** --- stays **In treatment** until the assessment's report is issued. The row now states that it is under way. - **Summary tally --- correction.** The summary counted 51 Implemented and 16 Self-assessed; the control tables hold 50 and 17. One row had been counted under the wrong status. The tally now matches the tables, with A.8.34 added: 51 Implemented, 17 Self-assessed, 8 Not applicable. ### v3.6 --- 2026-10-17 A nonconformity and an evidence update. No control changed status. - **A.8.11 --- nonconformity.** The row stated that metadata is stripped from uploaded images. Stripping chose its method from the type the browser declared, so an image uploaded as a generic file (`application/octet-stream`, which some browsers and mobile pickers send) was stored as an image with its EXIF data, including location and device, intact. The claim was false for that path from launch until 2026-10-16. Stripping now follows the detected type, and images are decoded only by the loader named for that type. Re-verified the same day by a read-only check of production: no report image still carries identifying metadata. Recorded on [Self-conducted security testing](https://ethicsportal.eu/security-testing/). - **A.8.24** --- stored real-time notification payloads, which carry the report's Case ID, were written unencrypted and kept for a day; they are now encrypted. Signed and encrypted messages no longer accept the Marshal format. Per-file attachment encryption, stated at A.8.13 since v3.3, is now named here too. - **A.8.15** --- application request logs no longer record attachment file names, download tokens or reporter IP addresses. Attachment download paths no longer carry the file name either, so new entries in the reverse proxy's own request log hold none. - **A.8.13 --- overstatement corrected.** The row, and the v3.4 entry below, said the drill confirms that every settled attachment has an *intact* copy in Falkenstein. The drill confirms that every one has a copy, and opens one and checks it against its checksum. The row now says that. - **A.8.5, A.8.8, A.8.19, A.8.20, A.8.26, A.8.29, A.8.32** --- evidence added for controls that strengthened since v3.5: random session tokens, weekly container image scanning, a runtime-only production image, a request-size ceiling at the proxy, a build-failing check for unencrypted report columns, mutation testing of the access policies, and a drilled rollback. Each was verified against the repository or production on 2026-10-17. - **What did not change.** No independent penetration test or audit is on record, so A.5.35 stays **In treatment**. ### v3.5 --- 2026-10-16 An evidence update. No control changed status. - **A.5.21** --- the row cited dependency scanning only. Three further supply-chain controls are now stated: a release cooldown before new gem versions are adopted, commit-SHA pinning of every CI action, and checksum verification of binaries downloaded during the image build. Each was verified against the repository on 2026-10-16. ### v3.4 --- 2026-10-06 A control change. A.8.13 moves from **Partial** to **Implemented**. - **A.8.13** --- after v3.3, attachments were encrypted but held once, in the Nuremberg bucket. Every encrypted attachment is now copied, under its own per-file key, to a versioned bucket in Hetzner Falkenstein. The monthly drill now fails if any attachment older than an hour lacks an intact copy there, or if the bucket's versioning is off. Verified against production on 2026-10-06. - **What did not change.** Both locations belong to one provider, so recovery outside Hetzner remains unmeasured. A.5.30 stays **Partial** and [TP-04](https://ethicsportal.eu/policies/risk-register/#treatment-plan) stays open. ### v3.3 --- 2026-10-06 A control change. The attachment half of the A.8.13 gap is closed and the remainder restated. - **A.8.13** --- file attachments were stored in Object Storage without encryption at rest, which v3.1 disclosed. Files attached to reports, messages and notes, voice recordings and case data exports are now encrypted with AES-256 under a separate random key per file, supplied to the storage provider with each request and held only in the application database under field encryption. Existing files were re-encrypted on 2026-10-06 and their unencrypted copies, including retained prior versions, deleted. Verified in production: a read without the key is refused, and a file above the multipart-upload threshold round-trips intact. - **The drill now proves the dump can open attachments.** The per-file keys exist nowhere but the database, so a dump that restored without them would leave every attachment unreadable. The drill now opens one encrypted attachment with the key from the restored dump. Verified end to end against a production backup on 2026-10-06. - **What did not change.** Attachment objects are still held once in Object Storage, with no copy outside it, so A.8.13 stays **Partial**. [Treatment item TP-02](https://ethicsportal.eu/policies/risk-register/#treatment-plan) is closed; off-provider recovery (TP-04) is not. ### v3.2 --- 2026-09-23 - **Clauses 6.1.3 and 8.3** --- both were **Partial** because treatment was recorded per risk with no completion date against any of it, so an item being worked was indistinguishable from an item being tolerated. The [risk register](https://ethicsportal.eu/policies/risk-register/) now carries a treatment plan: five dated items covering the supplier chain, attachment encryption, the operator-incapacity protocol, a measured off-provider restore, and the independent review. 6.1.3 moves to **Implemented**; 8.3 to **Self-assessed**, because the plan is executing and its first results are due at the 2027-09 review. Closes audit finding OFI-01. - The plan states what happens when a target slips: it is recorded as missed at the next management review with a reason and a new date. Dates that move quietly would make the plan worse than its absence. ### v3.1 --- 2026-09-23 A control change rather than a documentation correction. The open item at A.8.13 was closed for the database and is restated precisely for what remains. - **A.8.13 and A.5.30** --- database dumps were uploaded to Object Storage in plaintext apart from the application-encrypted columns inside them, which every version of this page since v2.0 has disclosed as an open gap. Dumps are now encrypted with GnuPG symmetric AES-256 on the host before upload. The backup process fails closed without the key, so the failure mode is a missing backup that the 36-hour freshness alarm catches, not a silent plaintext one. - **The monthly drill now proves the restored data is readable.** It compared table sets and row counts, which cannot distinguish a usable backup from ciphertext whose key no longer matches --- an encryption-key mismatch would have passed every assertion while every report was unrecoverable. The drill decrypts, restores, compares, and then boots the application against the restored database to force an encrypted column to decrypt. Verified end to end against a production backup on 2026-09-23. - **What did not change.** File attachments are still uploaded without encryption at rest and are not carried in the dump. A.8.13 stays **Partial** for that reason, which is a different reason than it carried before. Cross-provider recovery is still unmeasured, so [risk register R-02](https://ethicsportal.eu/policies/risk-register/) stays **In treatment**. ### v3.0 --- 2026-09-23 This revision closes the largest gap in the document itself: it assessed only Annex A, and said nothing about the Clauses 4--10 requirements that certification is actually awarded against. - **Scope of the page** --- Clauses 4--10 are now assessed sub-clause by sub-clause, and the Annex A tables are framed as the Statement of Applicability that Clause 6.1.3 d) requires, with the basis for inclusion and the risk-to-control mapping stated. Assessing the control set without the management system that selects it was the defect. - **A.6.1 and A.6.3** --- both were marked **Not applicable** on the grounds that there are no employees. That is the right answer for a hiring process and the wrong one for the operator, who is the person these controls exist to assure and whose competence Clause 7.2 requires regardless of headcount. Both are now **Compensating** with the substitute assurance named. The tally moves two controls from Not applicable to Compensating; no control changed its substantive position. - **A.8.13** --- the row described only the object-storage dump layer. The host-snapshot layer and the continuous 36-hour backup-freshness check were already operating and already documented on [Security#backups-and-restore](https://ethicsportal.eu/security/#backups-and-restore); this row understated the control. - **Restore-drill cadence** --- the [business continuity plan §9](https://ethicsportal.eu/policies/business-continuity/) said quarterly and [risk register R-05](https://ethicsportal.eu/policies/risk-register/) said "at least quarterly". The drill has been running monthly, as R-02, this page and [Security#backups-and-restore](https://ethicsportal.eu/security/#backups-and-restore) all state. Both documents now say monthly. Two published documents had understated a control that was already stronger than claimed. - **Clause 6.2 objectives** --- the three objectives in [IS policy §3](https://ethicsportal.eu/policies/information-security/) were qualitative. Each now carries a measure, a target and the source the result is read from, which is what Clause 6.2 asks for and what makes a management review capable of concluding anything. - **A.5.3 and A.8.15** --- both stated that individual reads are not logged. Report views are logged, per handler, deduplicated to one entry per report per 24 hours, and reporter follow-up views with them. Three further surfaces carried the same understatement and are corrected with it: the [Privacy notice](https://ethicsportal.eu/privacy/), the [DPIA template](https://ethicsportal.eu/dpia/) and the [DORA map](https://ethicsportal.eu/dora/). On the privacy surfaces this was an under-disclosure of processing as much as an understated control. - **Clauses 9.2 and 9.3** --- neither an internal audit nor a management review existed in any form. Both are now published at [Internal audit record](https://ethicsportal.eu/policies/internal-audit/) and [Management review record](https://ethicsportal.eu/policies/management-review/). The first audit found no control failures; the impartiality limit of a single-operator audit is stated on the page and holds 9.2 at partial. ### v2.6 --- 2026-09-05 This revision cites the newly published record of first-party security testing from the controls it bears on. - **A.5.35** --- the control stays in treatment, and the new page does not change that: testing scoped, run and reported by the operator carries no independence. The row now names it so a reviewer sees what does exist alongside what does not. - **A.8.8 and A.8.29** --- both described automated scanning and test coverage only. Periodic manual testing has been performed since May 2026, and its scope, findings and remediation are now published, so both rows cite it. No control changed status; the tally is unchanged from v2.5. --- ### v2.5 --- 2026-08-15 This revision codifies the backup lifecycle and aligns the published retention statement with the enforced policy. - **A.8.13** --- the repository now defines the complete Object Storage lifecycle, production is checked for drift during the monthly restore workflow, and PostgreSQL backups have 21 days of current versions followed by 7 days of recoverable noncurrent versions. That enforced lifecycle supports the DPA's description of backup expiry no later than 28 days after production deletion. No control changed status; the tally is unchanged from v2.4. --- ### v2.4 --- 2026-08-15 This revision narrows the audit-integrity wording to the control the Service actually operates. - **A.5.28 and A.8.15** --- PostgreSQL triggers reject changes to core audit content and table truncation, while deliberately allowing foreign-key nullification when a related record is erased. Application deletion paths remain limited to retention and GDPR Art. 17 erasure flows, but a privileged database operator could disable the triggers or issue a direct deletion. That residual risk is now stated explicitly rather than calling the rows unconditionally immutable; this supersedes the broader audit-integrity wording recorded in v2.2. No control changed status; the tally is unchanged from v2.3. --- ### v2.3 --- 2026-08-15 This revision follows a change to how the test suite gates a deploy, and corrects the rows that described the previous arrangement. - **A.5.3 and A.5.36** --- both stated that static analysis enforces invariants *at merge*. There are no merges: changes go to the main branch directly and the gate is the deploy, not a merge. A.5.36 additionally said "CI-enforced"; the suite now runs either on a hosted runner or on a developer workstation, with the completed run recorded as a commit status that the pipeline verifies before it will skip the hosted run. Both rows now describe the deploy gate. A.5.3 is the compensating control standing in for segregation of duties, so its accuracy carries weight. - **A.8.4** --- commits and tags are now signed with an SSH key and verified against a pinned allowed-signers list. Authorship of a revision is cryptographically attributable rather than asserted, which also strengthens the evidence position under A.5.28 and A.8.32. - **A.8.26 and A.8.32** --- restated in the same pass. Both previously described peer "code review", which the operating structure does not provide; they now describe the written pre-deploy checklist with the automated suite as the enforcing gate. The checklist is a maintained document, available during procurement review. No control changed status; the tally is unchanged from v2.2. --- ### v2.2 --- 2026-07-18 This revision re-verified every control against the running code and the companion documents. One correction was found: - **A.8.13** --- database-backup retention is **30 days**, not the 7 days stated in v2.1 (`BACKUP_KEEP_DAYS=30` in the Kamal backup accessory, matched by the prune step in the backup script). The restore-verification cadence (automated monthly in CI) and every other backup statement are unchanged and re-confirmed. Every other technical claim was re-confirmed against code: the non-deterministic ActiveRecord encryption model (A.8.24) and the encrypted fields it covers (A.5.12--A.5.13); the append-only audit log enforced by Postgres triggers, with DELETE permitted only for the Art. 17 erasure cascade (A.5.28, A.8.15); the three-role admin/member/viewer RBAC with a read-only viewer (A.5.15, A.5.18); Pundit authorization on every controller action (A.8.3); the retention lifecycle --- 12/24/36/48/60-month options, country-minimum enforcement, 18-month inactivity auto-close, and retention-aware organization purge (A.8.10); asynchronous ClamAV scanning with 403 delivery-gating until clean (A.8.7); libvips + exiftool metadata stripping and local pitch-shifting of oral-report audio (A.8.11); the AppSignal anonymity configuration --- session-data transmission disabled and parameters filtered (A.8.16); and the no-AI/LLM-sub-processor position (A.8.12). No control changed status; the tally is unchanged from v2.1. --- ### v2.1 --- 2026-06-18 This revision corrects one overstatement found during a documentation accuracy review: - **A.5.34** --- GDPR Art. 14 notice to third parties named in a report is documented as the **controller's (customer's) responsibility**, not a platform feature. The v2.0 wording below ("Art. 14 third-party notice handling ... added") overstated it; the control row now states the accurate position. --- ### v2.0 --- 2026-06-17 This revision re-verified every control against the running code and the companion documents. Substantive changes since v1.0: - **A.8.7** --- malware scanning re-described accurately: the ClamAV scan runs asynchronously after upload through a swappable AntivirusScanner client, and uploads are gated from delivery (HTTP 403) until scanned clean. The earlier "scanned before delivery" wording was imprecise. - **A.5.17 / A.8.5 / A.5.15** --- handler TOTP 2FA is **opt-in and recommended at onboarding, not enforced** (it is no longer a hard gate on report handling). Mandatory hardware-key 2FA remains on operator production accounts. - **A.5.15 / A.5.18** --- RBAC now has three roles: admin, member, and a read-only **viewer** role for auditors and legal counsel. - **A.8.10** --- a **48-month** retention option was added (now 12/24/36/48/60); 18-month inactivity auto-close and retention-aware organization soft-delete/auto-purge were added. - **A.8.11** --- metadata stripping (libvips + exiftool) and local pitch-shifting of oral-report audio were added. - **A.8.13 / A.5.30** --- historical backup-encryption assertion withdrawn: Hetzner does not encrypt Object Storage objects at rest by default, and the backup upload does not request it. The restore-verification drill is **automated monthly in CI**, not quarterly. - **A.8.16 / A.8.15** --- AppSignal APM runs across the application; reporter anonymity is preserved by disabling session-data transmission and filtering parameters, not by excluding the reporter portal from instrumentation. - **A.5.34** --- Art. 14 third-party notice handling and documented data-subject rights (Art. 20 portability, Art. 77 complaint) were added. *(Superseded by v2.1 above: Art. 14 third-party notice is the controller's responsibility, not a platform feature.)* The status tally is unchanged from v1.0: the single **In treatment** control remains A.5.35 (independent review). No new control moved into or out of scope. --- ## Document control | Field | Value | |---|---| | Document title | EthicsPortal ISO/IEC 27001:2022 Self-Assessment and Statement of Applicability | | Version | 3.11 | | Effective date | 2026-10-20 | | Last reviewed | 2026-09-23 | | Next scheduled review | 2027-09-23 | | Review trigger (interim) | Material change to the [Information security policy](https://ethicsportal.eu/policies/information-security/), [Business continuity plan](https://ethicsportal.eu/policies/business-continuity/), or [Risk register](https://ethicsportal.eu/policies/risk-register/); addition or replacement of a sub-processor; engagement of external review; a finding raised by the [internal audit](https://ethicsportal.eu/policies/internal-audit/) or [management review](https://ethicsportal.eu/policies/management-review/) | | Owner | Yaroslav Shmarov, operator | This page is not an attestation of certification. It is a self-assessment covering the Clause 4--10 requirements and the Annex A control set, published so a procurement reviewer can evaluate the same evidence an external auditor would. Material discrepancies between this page and the actual operation of the Service should be reported to [security@ethicsportal.eu](mailto:security@ethicsportal.eu). --- # ISO 37002 whistleblowing standard: can you be certified? > ISO 37002:2021 gives guidelines for whistleblowing management, not certifiable requirements. What it covers, where to get it, and how EthicsPortal maps to each clause. Canonical: https://ethicsportal.eu/iso-37002/ Last updated: 2026-10-28 ISO 37002:2021 *Whistleblowing management systems --- Guidelines* is the international standard for how an organization should receive, assess, address, and conclude reports of wrongdoing. It is the best-practice companion to the legal obligation in [EU Directive 2019/1937](https://ethicsportal.eu/directive-coverage/): the Directive says you must operate an internal reporting channel; ISO 37002 describes what a good one looks like. **ISO 37002 is a guidelines standard, not a requirements standard.** It carries recommendations, not auditable requirements, so there is no certification to ISO 37002 requirements --- for an organization or a platform. The honest position any provider can hold is *alignment with the guidance*. This page is that alignment, stated openly and clause by clause. EthicsPortal does not hold, and does not claim, certification against any ISO 37002-related standard. When EthicsPortal pursues accredited certification against a *certifiable* standard, the certificate scope and date will be published on [/trust/](https://ethicsportal.eu/trust/#certification-status). ## ISO 37002 in brief **What it covers.** Guidelines for setting up, running, evaluating and improving a whistleblowing management system, built on principles including trust, impartiality and protection. It applies to any organization, whatever its size or sector. **Can you be certified?** Not to ISO requirements: 37002 is published as guidance. Some certification bodies still sell an "ISO 37002 certificate". That is the body's own assessment against the guidance, not certification to an ISO requirements standard. The certifiable standards that include a whistleblowing channel are ISO 37301 and ISO 37001 (see [related standards](https://ethicsportal.eu/iso-37002/#related-standards-where-the-channel-fits)). **Where to get the text.** ISO 37002 is sold, not free: from [ISO](https://www.iso.org/standard/65035.html) or a national standards body, such as UNE-ISO 37002 from AENOR in Spain or DIN ISO 37002 from DIN Media in Germany. **Law or standard?** EU Directive 2019/1937 is the legal obligation for organizations with 50 or more workers. ISO 37002 is voluntary. Following it helps show the channel is run well; it does not replace the Directive or national law. Last updated: 2026-10-28. --- ## Who operates what: the shared-responsibility boundary ISO 37002 is written for the **organization that operates a whistleblowing management system** --- in EthicsPortal's model, that is the *customer* (the controller). EthicsPortal is the software and infrastructure the customer uses to run that system; in GDPR terms, the processor. That split matters for reading this page. The management-system clauses --- leadership commitment, organizational culture, internal audit, management review --- are *operated by the customer organization* and cannot be discharged by software. What EthicsPortal can do is **provide the operational machinery** the standard's process clauses describe (Clause 8: receiving, assessing, addressing, concluding) and **enable** the surrounding management-system clauses with configurable tooling, records, and generated policy documents. | Status | Meaning | |---|---| | **Provided** | EthicsPortal implements this directly as a product capability; the customer gets it by operating the whistleblowing channel | | **Enabled** | The customer operates this clause as part of their management system; EthicsPortal supplies the tooling, configuration, records, or evidence that supports conformance | | **Self-assessed** | Provided substantively as the clause describes, but not independently audited | | **Customer responsibility** | Operated entirely within the customer organization, outside the software (e.g. leadership tone, staff culture); EthicsPortal documents the boundary so the gap is not mistaken for a product gap | The companion documents this page cites: - [Directive 2019/1937 coverage map](https://ethicsportal.eu/directive-coverage/) --- article-by-article legal mapping that overlaps heavily with ISO 37002 Clause 8 - [Directive interpretations](https://ethicsportal.eu/directive-interpretations/) --- how the ambiguous provisions are read - [Product](https://ethicsportal.eu/product/) --- the reporting, handler, and case-management surfaces referenced below - [Security](https://ethicsportal.eu/security/) --- technical and organizational measures behind the protection guarantees - [ISO/IEC 27001:2022 self-assessment](https://ethicsportal.eu/iso-27001/) --- the information-security substrate ISO 37002 §7 relies on --- ## Guiding principles (Clause 4.4) ISO 37002 builds the whole system on a small set of principles. The three that bear directly on the software: | Principle | Status | How EthicsPortal supports it | |---|---|---| | **Trust** | Provided | Reporters get a secure whistleblowing channel unique to each organization, acknowledgement of receipt, and a tracked channel for two-way communication --- so reporting is credible and visibly acted on. The audit trail makes handling demonstrable to the reporter and to auditors | | **Impartiality** | Enabled | A handler with a conflict steps off by reassigning the case and recording the reason in an internal, audit-logged note --- the procedure the case-handler manual prescribes. Admins control assignment, and a read-only **viewer** role lets an independent party or legal counsel review the case and its audit trail without altering it | | **Protection** | Provided | Reporter confidentiality is enforced in the data model: anonymous reporting collects no identity at all; in identified reporting the identity fields are encrypted at rest; no reporter IP address is stored with reports or in application logs; metadata is stripped from uploads; oral-report audio is pitch-shifted locally and the raw recording purged; and the handler's name is withheld from the reporter (shown as "Case handler") ([Security](https://ethicsportal.eu/security/#anonymity-and-privacy)). Protection from detriment is supported too: a reporter can flag a follow-up as being about retaliation, raising a prominent handler alert | --- ## Clause 5 --- Leadership and commitment | Clause | Title | Status | How EthicsPortal addresses it | |---|---|---|---| | 5.1 | Leadership and commitment | Customer responsibility | Top-management commitment is set inside the customer organization. EthicsPortal makes the commitment operable: the whistleblowing channel is the visible artifact of that commitment, deployed under the organization's own branding | | 5.2 | Whistleblowing policy | Enabled | The customer adopts the policy; the whistleblowing channel presents a standard report-category taxonomy and is deployed under the organization's own branding, and the published [Directive coverage map](https://ethicsportal.eu/directive-coverage/) gives the customer a drafting reference | | 5.3 | Roles, responsibilities and authorities | Enabled | Three-role RBAC (admin / member / viewer) lets the customer assign handling authority and a read-only audit role; assignment and reassignment are recorded in the audit log | --- ## Clause 6 --- Planning | Clause | Title | Status | How EthicsPortal addresses it | |---|---|---|---| | 6.1 | Actions to address risks and opportunities | Customer responsibility | Risk identification for the customer's own reporting system is theirs; EthicsPortal's platform-level risk posture is published separately in the [risk register](https://ethicsportal.eu/policies/risk-register/) | | 6.2 | Whistleblowing management system objectives | Enabled | Case status, deadline tracking, and exportable records give the customer the measurement base to set and track objectives (e.g. acknowledgement and feedback timeliness) | --- ## Clause 7 --- Support | Clause | Title | Status | How EthicsPortal addresses it | |---|---|---|---| | 7.1 | Resources | Enabled | The platform is the operational resource for the whistleblowing channel; EU hosting, backup, and continuity are documented on [Trust](https://ethicsportal.eu/trust/) and the [business continuity plan](https://ethicsportal.eu/policies/business-continuity/) | | 7.2 | Competence | Customer responsibility | Handler competence is developed by the customer; EthicsPortal keeps the handler interface simple enough that handling does not require specialist software training | | 7.3 | Awareness | Customer responsibility | Staff awareness campaigns are the customer's to run; the whistleblowing channel is the reporter-facing surface those campaigns point to | | 7.4 | Communication | Provided | Two-way communication between handler and reporter is built in and preserves anonymity --- the reporter can respond and receive feedback without ever revealing identity, and (when they chose to leave an address) is notified by email of new handler messages | | 7.5 | Documented information | Provided | Every action is captured in an append-only audit log; cases export to a PDF record; retention is configurable and country-minimum enforced ([Security](https://ethicsportal.eu/security/#audit-and-compliance)) | --- ## Clause 8 --- Operation (the core process) Clause 8 is where ISO 37002 stops being a management-system frame and describes the actual handling lifecycle. This is the clause EthicsPortal implements most directly, and it overlaps heavily with Articles 8--9 of the Directive --- see the [Directive coverage map](https://ethicsportal.eu/directive-coverage/) for the legal mirror of the same capabilities. ### 8.2 Receiving reports of wrongdoing | Guidance area | Status | How EthicsPortal addresses it | |---|---|---| | Multiple, accessible whistleblowing channels | Provided | Online reporting form (any device, no app or account required) plus voice messages, which the organization can enable; reports are filed against a standard report-category taxonomy | | Anonymous and identified reporting | Provided | The reporter chooses anonymous (no identity collected) or identified (identity fields encrypted at rest); either way a Case ID and a password generated by the system (bcrypt-hashed, non-recoverable) let the reporter return to their case; no reporter IP address is stored | | Acknowledgement of receipt | Provided | The reporter sees an immediate on-screen submission receipt; the Directive's 7-day acknowledgement of receipt is a tracked handler obligation, with due-soon and overdue cases surfaced on the handler dashboard | | Secure intake | Provided | Encrypted transport and at-rest field encryption; metadata stripped from uploaded files; uploads virus-scanned and gated until clean ([Security](https://ethicsportal.eu/security/#virus-scanning)) | ### 8.3 Assessing reports of wrongdoing | Guidance area | Status | How EthicsPortal addresses it | |---|---|---| | Initial assessment and triage | Provided | The handler sets a case priority (low/normal/high/urgent) at assessment, recorded in the audit trail; category, status, and case fields support triage | | Managing conflicts of interest | Enabled | A handler who identifies a conflict reassigns the case and records the reason in an internal, audit-logged note, as the case-handler manual instructs; reassignment is itself recorded in the audit trail. The read-only **viewer** role supports independent oversight. The control is the documented procedure plus these primitives, not a dedicated recusal widget | | Deciding the handling route | Customer responsibility | Whether a report is investigated internally, escalated, or referred is the customer's decision; the case record captures the decision and its timestamp | ### 8.4 Addressing reports of wrongdoing | Guidance area | Status | How EthicsPortal addresses it | |---|---|---| | Investigation and follow-up | Enabled | Case workflow tracks status through handling; the handler can request more information from an anonymous reporter and document findings against the case | | Protecting the whistleblower | Provided | The handler's name is withheld from the reporter ("Case handler"); reporter identity, when given, is encrypted at rest; access is scoped by role. The reporter can flag retaliation at intake or on any later follow-up, which raises a prominent handler alert (Art. 19 detriment). **Note:** GDPR Art. 14 notice to third parties named in a report is the customer's (controller's) responsibility --- the platform does not automate it | | Communication with the reporter during handling | Provided | The two-way anonymous channel stays open through the life of the case | ### 8.5 Concluding whistleblowing cases | Guidance area | Status | How EthicsPortal addresses it | |---|---|---| | Providing feedback to the reporter | Provided | The 3-month feedback obligation is tracked; feedback is delivered through the same anonymous channel | | Closing the case and recording the outcome | Provided | Case closure with recorded outcome; the full handling history is preserved in the audit log and the PDF case export | | Record retention and disposal | Provided | Configurable retention (12/24/36/48/60 months, country-minimum enforced); 18-month inactivity auto-close starts the retention clock; data export and deletion on contract exit per the [DPA](https://ethicsportal.eu/dpa/) ([Security](https://ethicsportal.eu/security/#audit-and-compliance)) | --- ## Clause 9 --- Performance evaluation | Clause | Title | Status | How EthicsPortal addresses it | |---|---|---|---| | 9.1 | Monitoring, measurement, analysis and evaluation | Enabled | An exportable compliance report aggregates the programme: report volumes (open/closed), acknowledgement and feedback on-time rates with currently-overdue counts, a breakdown of reports by priority and by category, a breakdown of closed reports by outcome, and audit-trail activity. Case status and deadline tracking surface the same data live | | 9.2 | Internal audit | Enabled | The read-only **viewer** role lets an internal auditor or external reviewer inspect cases and the audit trail without altering them | | 9.3 | Management review | Customer responsibility | Conducted by the customer's management; the exportable compliance report — volumes, SLA timeliness, priority/category/outcome breakdowns, audit-trail activity — is the artifact that feeds the review | --- ## Clause 10 --- Improvement | Clause | Title | Status | How EthicsPortal addresses it | |---|---|---|---| | 10.1 | Nonconformity and corrective action | Customer responsibility | Corrective action on the customer's own system is theirs; platform-level incidents affecting the service are recorded openly in the [incident register](https://ethicsportal.eu/incidents/) | | 10.2 | Continual improvement | Enabled | Product changes that affect the handling lifecycle are released continuously; material changes are noted in the revision history of the relevant evidence pages | --- ## Summary ISO 37002 splits cleanly along the software/operator boundary: - **Clause 8 (the handling lifecycle)** --- receiving, assessing, addressing, and concluding reports --- is where EthicsPortal does the substantive work, and most of it is **Provided** directly by the product. - **Clauses 5--7, 9--10 (the management-system frame)** --- leadership, planning, performance evaluation, improvement --- are **operated by the customer organization**, with EthicsPortal supplying the tooling, records, and evidence that make conformance achievable. The honest summary a procurement reviewer should take away: EthicsPortal is the infrastructure on which a customer's ISO 37002-aligned whistleblowing management system runs. The software cannot make an organization conform on its own --- no software can --- but it provides the operational core the standard describes, and it does not overstate the position by claiming a certification that the standard does not offer. --- ## Related standards: where the channel fits ISO 37002 governs the whistleblowing channel itself. Two adjacent management-system standards *require* such a channel as one of their clauses, and EthicsPortal is the component that satisfies that clause: - **ISO 37301:2021 (Compliance management systems)** --- §8.3 *Raising concerns* requires an accessible reporting process that allows anonymous reporting, keeps reports confidential, ensures concerns are addressed, and protects reporters from retaliation. - **ISO 37001 (Anti-bribery management systems)** --- §8.9 *Raising concerns* requires a procedure to report suspected or actual bribery, with confidentiality, anonymous reporting, and protection from retaliation. EthicsPortal is the **raising-concerns / speak-up component** of either system --- the operational channel those standards oblige the organization to provide. It does not, on its own, constitute a compliance or anti-bribery management system: those are far broader (obligations registers, compliance risk assessment, controls across every compliance domain) and are operated by the organization itself. Unlike ISO 37002, both 37301 and 37001 are *certifiable* requirements standards --- but certification belongs to the **organization** that runs the management system, not to a software tool used within it. A vendor's 37301/37001 certificate attests to how that vendor runs *its own* compliance function; it does not transfer to the customer's system or describe what the software does. --- ## Document control | Field | Value | |---|---| | Document title | EthicsPortal ISO 37002:2021 Guidance Alignment Map | | Version | 1.0 | | Effective date | 2026-06-18 | | Last reviewed | 2026-07-18 | | Next scheduled review | 2027-07-18 | | Review trigger (interim) | Material change to the report-handling lifecycle (intake, assessment, communication, closure, or retention); publication of a revised ISO 37002 | | Owner | Yaroslav Shmarov, operator | This page is not an attestation of certification --- ISO 37002 does not offer one. It is a self-assessment of how the Service aligns with the standard's guidance. Material discrepancies between this page and the actual operation of the Service should be reported to [support@ethicsportal.eu](mailto:support@ethicsportal.eu). --- # EU Whistleblower Directive Penalties by Country > Fines and penalties for non-compliance with EU Directive 2019/1937 in every member state. Updated regularly with enforcement actions. Canonical: https://ethicsportal.eu/penalties/ Last updated: 2026-10-17 EU Directive 2019/1937 requires all companies with 50+ employees to establish internal reporting channels. Every EU member state has transposed the directive into national law with its own penalty regime. Non-compliance is not theoretical. In March 2025, the [EU Court of Justice fined five member states a combined €38.9 million](https://curia.europa.eu/site/upload/docs/application/pdf/2025-03/cp250029en.pdf) just for being late to implement the law. Companies that fail to comply face their own penalties under national law. --- ## Penalties at a glance | Country | No whistleblowing channel | Retaliation | Criminal liability | Law | | --- | --- | --- | --- | --- | | [Spain](https://ethicsportal.eu/whistleblower-laws/spain/) | Up to €1,000,000 | Up to €1,000,000 | No | [Ley 2/2023](https://www.boe.es/buscar/act.php?id=BOE-A-2023-4513) | | [France](https://ethicsportal.eu/whistleblower-laws/france/) | — | €45,000 + 3 years prison (€225,000 for companies) | Yes | [Loi Waserman (2022-401)](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000045388745) | | [Poland](https://ethicsportal.eu/whistleblower-laws/poland/) | Fine up to PLN 5,000 (~€1,200), imposed by a court | Obstruction: fine, restriction of liberty or up to 1 year prison (3 with violence/threats). Retaliation: up to 2 years (3 if persistent) | Yes | [Ustawa z dnia 14 czerwca 2024](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20240000928) | | [Portugal](https://ethicsportal.eu/whistleblower-laws/portugal/) | Up to €125,000 | Up to €250,000 | No | [Lei 93/2021](https://diariodarepublica.pt/dr/detalhe/lei/93-2021-175659849) | | [Italy](https://ethicsportal.eu/whistleblower-laws/italy/) | €10,000--€50,000 | €10,000--€50,000 | No | [D.Lgs. 24/2023](https://www.gazzettaufficiale.it/eli/id/2023/03/15/23G00032/sg) | | [Germany](https://ethicsportal.eu/whistleblower-laws/germany/) | Up to €20,000 | Up to €50,000 (×10 for legal entities, up to €500,000) | No | [HinSchG](https://www.gesetze-im-internet.de/hinschg/) | | [Belgium](https://ethicsportal.eu/whistleblower-laws/belgium/) | Companies: criminal fine €24,000–€576,000 or administrative fine €2,400–€28,000, both +25% surcharge | Obstruction, retaliation or breach of confidentiality: 6 months–3 years prison and/or fine €4,800–€48,000 | Yes | [Loi du 28 novembre 2022](https://www.ejustice.just.fgov.be/eli/loi/2022/11/28/2022042980/justel) | | [Romania](https://ethicsportal.eu/whistleblower-laws/romania/) | RON 3,000--30,000 (~€600--6,000) | Obstruction by the designated report recipient: RON 2,000--20,000 (~€400--4,000) | No | [Legea 361/2022](https://legislatie.just.ro/public/DetaliiDocument/262872) | | [Slovenia](https://ethicsportal.eu/whistleblower-laws/slovenia/) | €2,000--€6,000 | €5,000--€60,000 | No | [ZZPri](https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2023-01-0301/zakon-o-zasciti-prijaviteljev-zzpri) | --- ## Country details ### [Spain](https://ethicsportal.eu/whistleblower-laws/spain/) --- Law 2/2023 {#spain} **Law:** [Ley 2/2023, de 20 de febrero](https://www.boe.es/buscar/act.php?id=BOE-A-2023-4513) --- protection of persons who report regulatory infringements and the fight against corruption. **Applies to:** Companies with 50+ employees. Deadline was June 13, 2023 (250+ employees) and December 1, 2023 (50--249 employees). [Source: Garrigues](https://www.garrigues.com/en_GB/new/spain-whistleblowing-law-published) **Penalties:** - Not having an internal information system, retaliation, obstruction of reporting, or breach of confidentiality (very serious infringements, Art. 63): €600,001--€1,000,000 for legal persons. [Source: Ley 2/2023, arts. 63 and 65](https://www.boe.es/buscar/act.php?id=BOE-A-2023-4513) - Fine tiers (Art. 65): legal persons up to €100,000 for minor infringements, €100,001--€600,000 for serious and €600,001--€1,000,000 for very serious ones; natural persons from €1,001 for minor infringements up to €300,000 for very serious ones. [Source: Ley 2/2023, art. 65](https://www.boe.es/buscar/act.php?id=BOE-A-2023-4513) - Accessory sanctions for very serious infringements: public reprimand, a ban on public subsidies or tax benefits for up to 4 years, and a ban on public-sector contracting for up to 3 years. [Source: Ley 2/2023, art. 65](https://www.boe.es/buscar/act.php?id=BOE-A-2023-4513) **Enforcement authority:** Autoridad Independiente de Protección del Informante (A.A.I.) Spain has the harshest penalties in the EU for whistleblower non-compliance. --- ### [France](https://ethicsportal.eu/whistleblower-laws/france/) --- Loi Waserman {#france} **Law:** [Loi n° 2022-401 du 21 mars 2022 (Loi Waserman)](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000045388745), amending [Loi Sapin II (2016-1691)](https://www.legifrance.gouv.fr/loda/id/JORFTEXT000033558528). **Applies to:** Companies with 50+ employees. In effect since September 2022. [Source: Loi n° 2022-401](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000045388745) **Penalties:** - Obstructing a report: up to 1 year imprisonment and a €15,000 fine (€75,000 for companies). [Source: Loi 2016-1691, art. 13](https://www.legifrance.gouv.fr/loda/id/JORFTEXT000033558528/) - Retaliation or discrimination against a whistleblower: up to 3 years imprisonment and a €45,000 fine (€225,000 for companies), under Code pénal art. 225-2. [Source: Code pénal, art. 225-2](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000033975382) France is one of the few EU countries where obstruction and retaliation carry **criminal penalties including prison time**. **Key difference:** Whistleblowers in France are no longer required to use internal channels before going to external authorities (end of "cascade reporting"). [Source: Loi n° 2022-401](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000045388745) --- ### [Germany](https://ethicsportal.eu/whistleblower-laws/germany/) --- HinSchG {#germany} **Law:** [Hinweisgeberschutzgesetz (HinSchG)](https://www.gesetze-im-internet.de/hinschg/) --- entered into force July 2, 2023. **Applies to:** Companies with 50+ employees. Deadline was July 2, 2023 (250+ employees) and December 17, 2023 (50--249 employees). [Source: Library of Congress](https://www.loc.gov/item/global-legal-monitor/2023-07-13/germany-whistleblower-protection-act-enters-into-force/) The fine for not establishing an internal reporting office has applied since December 1, 2023 (Section 42(2) HinSchG); the other fines since July 2, 2023. **Penalties:** - Not establishing or operating an internal reporting office: up to €20,000 (Section 40(2) no. 2 and (6) HinSchG). The tenfold uplift for legal entities does not apply to this offence. [Source: HinSchG §40](https://www.gesetze-im-internet.de/hinschg/__40.html) - Obstructing a report, retaliation, or intentional or reckless breach of confidentiality: up to €50,000. For legal entities the ceiling increases **tenfold**, to up to €500,000 (Section 40(6) HinSchG with Section 30(2) sentence 3 OWiG). [Source: HinSchG §40](https://www.gesetze-im-internet.de/hinschg/__40.html) **Note:** Germany was fined €34,000,000 by the EU Court of Justice in March 2025 for late transposition of the directive. [Source: eucrim](https://eucrim.eu/news/ecj-ordered-several-member-states-to-financial-penalties-for-failing-to-transpose-whistleblowers-directive/) --- ### [Italy](https://ethicsportal.eu/whistleblower-laws/italy/) --- D.Lgs. 24/2023 {#italy} **Law:** [Decreto Legislativo 10 marzo 2023, n. 24](https://www.gazzettaufficiale.it/eli/id/2023/03/15/23G00032/sg). **Applies to:** Companies with 50+ employees (and all companies with a Model 231 compliance program regardless of size). Deadline was July 15, 2023 (250+ employees) and December 17, 2023 (50--249 employees). [Source: Norton Rose Fulbright](https://www.nortonrosefulbright.com/en-it/knowledge/publications/5ff4d59b/whistleblowing-i-nuovi-obblighi-per-le-imprese) **Penalties:** - Not establishing whistleblowing channels or non-compliant procedures: €10,000--€50,000. [Source: Norton Rose Fulbright](https://www.nortonrosefulbright.com/en-it/knowledge/publications/5ff4d59b/whistleblowing-i-nuovi-obblighi-per-le-imprese) - Retaliation or obstruction of reporting: €10,000--€50,000. [Source: Hogan Lovells](https://www.hoganlovells.com/en/publications/italy-implements-eu-whistleblower-directive-the-new-obligations-for-companies) - Breaching confidentiality of reporter identity: €10,000--€50,000. [Source: Norton Rose Fulbright](https://www.nortonrosefulbright.com/en-it/knowledge/publications/5ff4d59b/whistleblowing-i-nuovi-obblighi-per-le-imprese) - False reporting by whistleblower: €500--€2,500, only where the reporter's civil liability for defamation or slander is established (art. 16(3)). [Source: Norton Rose Fulbright](https://www.nortonrosefulbright.com/en-it/knowledge/publications/5ff4d59b/whistleblowing-i-nuovi-obblighi-per-le-imprese) **Enforcement authority:** ANAC (Autorità Nazionale Anticorruzione). ANAC issued its first enforcement action in July 2024 (Decision No. 380, retaliation case). [Source: ANAC via Cleary Gottlieb](https://www.clearygottlieb.com/news-and-insights/publication-listing/whistleblowing-in-focus-part-two) --- ### [Poland](https://ethicsportal.eu/whistleblower-laws/poland/) --- Act of 14 June 2024 {#poland} **Law:** [Ustawa z dnia 14 czerwca 2024 r. o ochronie sygnalistów](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20240000928) --- entered into force September 25, 2024. **Applies to:** Legal entities for which at least 50 persons perform gainful work (art. 23). Internal procedures required since September 25, 2024. [Source: Ustawa z dnia 14 czerwca 2024, art. 23](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20240000928) **Penalties:** - Not establishing internal reporting procedures, or establishing them in material breach of the Act: a fine of PLN 20--5,000 (~€5--€1,200) for a petty offence, imposed on the person responsible for establishing the procedure, not on the company. [Source: Ustawa z dnia 14 czerwca 2024, art. 58](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20240000928) - Preventing or obstructing reporting: a fine, restriction of liberty, or up to 1 year imprisonment. With violence or threats: up to 3 years. [Source: Ustawa z dnia 14 czerwca 2024, art. 54](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20240000928) - Retaliation: a fine, restriction of liberty, or up to 2 years imprisonment; up to 3 years if persistent. [Source: Ustawa z dnia 14 czerwca 2024, art. 55](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20240000928) - Disclosing whistleblower identity: fine, restriction of liberty, or up to 1 year imprisonment. [Source: DLA Piper](https://knowledge.dlapiper.com/dlapiperknowledge/globalemploymentlatestdevelopments/2024/poland-whistleblower-protection-act.html) **Enforcement authority:** The courts, which try the offences in arts. 54--58. External reports go to the Rzecznik Praw Obywatelskich (Ombudsman), which has received them since December 25, 2024 and imposes no penalties. [Source: Rzecznik Praw Obywatelskich](https://bip.brpo.gov.pl/pl/sygnalisci) Poland is one of the few EU countries where obstruction and retaliation carry **criminal penalties including prison time**. --- ### [Portugal](https://ethicsportal.eu/whistleblower-laws/portugal/) --- Law 93/2021 {#portugal} **Law:** [Lei n.º 93/2021, de 20 de dezembro](https://diariodarepublica.pt/dr/detalhe/lei/93-2021-175659849) --- General Regime for the Protection of Whistleblowers. **Applies to:** Companies with 50+ employees. In force since 18 June 2022, 180 days after publication. [Source: Lei 93/2021, art. 31.º](https://diariodarepublica.pt/dr/detalhe/lei/93-2021-175659849) **Penalties:** - Not establishing whistleblowing channels (serious offence): fines up to €125,000. [Source: Lei 93/2021, art. 27.º](https://diariodarepublica.pt/dr/detalhe/lei/93-2021-175659849) - Retaliation, obstruction, or breach of confidentiality (very serious offence): fines up to €250,000. [Source: Lei 93/2021, art. 27.º](https://diariodarepublica.pt/dr/detalhe/lei/93-2021-175659849) **Enforcement authority:** MENAC (Mecanismo Nacional Anticorrupção). Electronic platform became operational November 2024. Received 152 reports in 2024. Focus shifting to private sector enforcement in 2025. [Source: European Commission Rule of Law Report 2025](https://commission.europa.eu/document/download/5a482f87-1f24-47bd-8595-d25f1ca29c6a_en) MENAC's proceedings so far concern the separate corruption-prevention regime (RGPC); no fine has been imposed for whistleblowing-channel non-compliance. --- ### [Romania](https://ethicsportal.eu/whistleblower-laws/romania/) --- Legea 361/2022 {#romania} **Law:** [Legea nr. 361/2022 privind protecția avertizorilor în interes public](https://legislatie.just.ro/public/DetaliiDocument/262872) --- transposing Directive (EU) 2019/1937. **Applies to:** All public-sector entities regardless of headcount; private-law entities with 50+ employees; certain Annex 3 sector entities (financial services, AML, insurance) regardless of size. Deadline was December 22, 2022 (public sector and 250+ employees) and December 17, 2023 (50--249 employees). [Source: ANI](https://integritate.eu/comunicat-privind-obligatia-persoanelor-juridice-de-drept-privat-care-au-intre-50-si-249-de-angajati-de-a-identifica-sau-institui-canale-interne-de-raportare-legea-nr-361-2022-privind-protectia-ave/) **Penalties (administrative contraventions under Art. 28--29):** - Not establishing internal reporting channels: RON 3,000--30,000 (~€600--6,000). [Source: Legea 361/2022, Art. 28(2)(c)](https://legislatie.just.ro/public/DetaliiDocument/262872) - Obstructing or preventing a report, by the person designated to receive and register reports: RON 2,000--20,000 (~€400--4,000). [Source: Legea 361/2022, Art. 28(2)(a)](https://legislatie.just.ro/public/DetaliiDocument/262872) - Breaching whistleblower confidentiality: RON 4,000--40,000 (~€800--8,000). - Knowingly false reporting: RON 2,500--30,000 (~€500--6,000). **Enforcement authority:** [Agenția Națională de Integritate (ANI)](https://integritate.eu/competente/avertizori-in-interes-public/). **Honest assessment of enforcement:** No public record of any company being fined specifically for a missing internal channel has surfaced, and enforcement to date appears reactive rather than audit-driven. ANI [registered 329 external reports in 2025](https://agerpres.ro/justitie/2026/05/18/ani-anul-trecut-au-crescut-semnificativ-raportarile-avertizorilor-de-integritate-privind-incalcari-a--1557362) (188 in domains regulated by Legea 361/2022) --- reports received by the authority, not sanctions issued against employers. Independent analysis ([CEELI Institute, 2023](https://ceeliinstitute.org/resource/beyond-paper-rights-implementing-whistleblower-protections-in-central-and-eastern-europe)) documents a gap between the law on paper and its implementation. The real exposure is a report reaching ANI with no internal channel in place, not a large fine. --- ### [Slovenia](https://ethicsportal.eu/whistleblower-laws/slovenia/) --- ZZPri {#slovenia} **Law:** [Zakon o zaščiti prijaviteljev (ZZPri)](https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2023-01-0301/zakon-o-zasciti-prijaviteljev-zzpri), Uradni list RS no. 16/23 --- in force 22 February 2023. **Applies to:** Public and private sector entities with 50+ employees (Art. 9(2)), dropping to 10+ employees where the principal registered activity is healthcare, or water supply, sewerage and waste management (Art. 9(3)). Deadlines were 23 May 2023 (public sector and 250+ employees) and 17 December 2023 (50--249 employees). **Penalties (Slovenia bands fines by offender size as well as by offence):** - No internal reporting channel, channel not described in the internal act, or a missed annual return: €3,000--€6,000 for medium and large companies, €2,000--€4,000 for other legal entities, €1,000--€2,000 for sole traders, €300--€2,000 for the responsible person. - Trying to establish the reporter's identity, or threatening or attempting retaliation: the same bands. - Carrying out a retaliatory measure: €10,000--€60,000 for medium and large companies, €5,000--€20,000 for other legal entities, €3,000--€15,000 for sole traders, €500--€2,500 for the responsible person. - Disclosing the identity of a reporter, facilitator or connected person: €300--€2,500. - Knowingly false reporting by the reporter: €400--€1,200, prosecuted by the external reporting authority that handled the report. [Source: KPK official guidance on ZZPri (PDF)](https://www.kpk-rs.si/storage/uploads/cd75a022-7e97-4497-85e0-fff75c493673/ZZPri.pdf) **Enforcement authority:** [Komisija za preprečevanje korupcije (KPK)](https://www.kpk-rs.si/), which prosecutes the systemic offences and is the catch-all external reporting authority where no sectoral regulator has jurisdiction. **The obligation most often missed:** Art. 9(16) requires every obliged employer to file an annual return to the KPK **by 1 March** for the preceding year --- reports received, how many anonymous, how many well-founded, retaliation cases handled, and who the zaupnik is. Missing it is the same offence band as having no channel at all. Slovenia also requires the zaupnik to be appointed from among the employer's own employees; the role cannot be outsourced. --- ## EU Court of Justice fines against member states (March 2025) Five EU countries were fined by the Court of Justice for failing to transpose the directive on time: | Country | Lump sum fine | Daily penalty | |---|---|---| | [Germany](https://ethicsportal.eu/whistleblower-laws/germany/) | €34,000,000 | --- | | [Czech Republic](https://ethicsportal.eu/whistleblower-laws/czech-republic/) | €2,300,000 | --- | | [Hungary](https://ethicsportal.eu/whistleblower-laws/hungary/) | €1,750,000 | --- | | [Estonia](https://ethicsportal.eu/whistleblower-laws/estonia/) | €500,000 | €1,500/day | | [Luxembourg](https://ethicsportal.eu/whistleblower-laws/luxembourg/) | €375,000 | --- | [Source: eucrim](https://eucrim.eu/news/ecj-ordered-several-member-states-to-financial-penalties-for-failing-to-transpose-whistleblowers-directive/) --- [Source: CJEU press release (PDF)](https://curia.europa.eu/site/upload/docs/application/pdf/2025-03/cp250029en.pdf) --- ## All 27 member states All EU member states have now transposed the directive. See our complete reference: **[Whistleblower laws in all 27 EU member states →](https://ethicsportal.eu/whistleblower-laws/)** Every country's national law name, link to official text, penalties, deadlines, and enforcement authority. --- ## Where enforcement stands Most member states only finished transposing the directive in 2023--2024. Enforcement authorities are now operational and actively issuing guidance: - **Italy:** ANAC issued its first retaliation fine in July 2024 and published updated enforcement guidelines in November 2025. - **Portugal:** MENAC's electronic enforcement platform went live in November 2024, with private sector focus in 2025. Its proceedings so far concern the separate corruption-prevention regime (RGPC); no fine has been imposed for whistleblowing-channel non-compliance. - **Poland:** The Ombudsman has received external reports since December 2024; the offences are tried by the courts, and no administrative authority imposes fines. - **Germany:** Fines for a missing internal reporting office enforceable since December 2023; obstruction, retaliation and confidentiality fines since July 2023. - **Spain:** The national authority (AIPI) has operated since September 1, 2025; no company has been fined to date. - **Slovenia:** The KPK prosecutes the systemic offences and collects an annual return from every obliged employer, which gives it a direct view of who has not established a channel. - **Romania:** ANI is the enforcement authority, but no public record of a company fined for a missing channel has surfaced; enforcement remains reactive and complaint-driven. ANI logged 329 external reports in 2025. Fines for a missing channel are still rare. The authorities that will impose them are now operating. --- ## Get compliant now EthicsPortal gives your organization a secure internal reporting channel for EU Directive 2019/1937 compliance: encrypted, anonymous, and deadline-tracked. [See how we meet every requirement](https://ethicsportal.eu/directive-coverage/) | [Deploy your internal reporting channel](https://secure.ethicsportal.eu/session/new) --- *Last updated: April 2026. Penalty amounts and enforcement status are based on publicly available legal sources linked above. Contact [legal@ethicsportal.eu](mailto:legal@ethicsportal.eu) if you spot an error.* --- # Policies > Read EthicsPortal policies on information security, business continuity and risk management, with links to internal audit and management review records. Canonical: https://ethicsportal.eu/policies/ Last updated: 2026-11-04 Last updated: 2026-09-24. Named policy documents that codify how EthicsPortal operates. Each is dated, signed, and reviewed annually. The full document catalog --- including these policies alongside contractual and operational documents --- is on [/trust/](https://ethicsportal.eu/trust/#public-documents). - [Information security policy](https://ethicsportal.eu/policies/information-security/) - [Business continuity plan](https://ethicsportal.eu/policies/business-continuity/) - [Risk register](https://ethicsportal.eu/policies/risk-register/) - [Internal audit record](https://ethicsportal.eu/policies/internal-audit/) - [Management review record](https://ethicsportal.eu/policies/management-review/) - [Anti-corruption and business ethics policy](https://ethicsportal.eu/policies/anti-corruption/) ## Pages - [Anti-corruption and business ethics policy](https://ethicsportal.eu/policies/anti-corruption/): EthicsPortal's anti-corruption policy. Prohibited conduct, gifts and hospitality thresholds, conflicts of interest, referral fees, and the limits of a single-operator control environment. - [Business continuity plan](https://ethicsportal.eu/policies/business-continuity/): How EthicsPortal responds to outages, sub-processor failures, restore events, and operator incapacity. Activation triggers, decision authority, and customer-communication protocol. - [Information security policy](https://ethicsportal.eu/policies/information-security/): EthicsPortal's information security policy. Scope, roles, control commitments, review cadence, and document control. - [Internal audit record](https://ethicsportal.eu/policies/internal-audit/): First internal audit of EthicsPortal against ISO/IEC 27001:2022 found no control failures. Six documentation defects were raised and all six were corrected before the audit closed. Programme, findings, and the limits of a self-performed audit. - [Management review record](https://ethicsportal.eu/policies/management-review/): ISO/IEC 27001 Clause 9.3 management review of EthicsPortal. No reportable security incident in the period; two risks re-assessed to a worse residual position after supplier assurances were found unverified. Inputs, conclusions, and the decisions taken. - [Risk register](https://ethicsportal.eu/policies/risk-register/): EthicsPortal's information-security risk register. Top risks assessed against the Service, current treatment, and residual position. --- # Anti-corruption and business ethics policy > EthicsPortal's anti-corruption policy. Prohibited conduct, gifts and hospitality thresholds, conflicts of interest, referral fees, and the limits of a single-operator control environment. Canonical: https://ethicsportal.eu/policies/anti-corruption/ Last updated: 2026-09-30 **Effective date:** 2026-09-24 **Last reviewed:** 2026-09-24 **Next review:** 2027-09-24 **Owner:** Yaroslav Shmarov, operator **Version:** 1.0 --- ## 1. Purpose This policy states the standards of business conduct that govern EthicsPortal, the specific practices they prohibit, and the arrangements that make a breach visible. It exists so that a customer, a partner, or a procurement reviewer performing third-party diligence can refer to a single named document rather than infer a position from silence. EthicsPortal sells infrastructure for reporting wrongdoing. A vendor in that position is held to the standard it sells, and the sections below are written to be checked rather than admired. --- ## 2. Scope This policy applies to the operator, to anyone acting for or on behalf of EthicsPortal, and to every commercial relationship the business enters: customers, prospects, resellers and referral partners, sub-processors, suppliers, and public authorities. It applies in every country where EthicsPortal does business. Where a national law sets a stricter standard than this policy, the stricter standard applies. --- ## 3. Prohibited conduct The following are prohibited without exception, and no commercial objective justifies any of them: | Conduct | Position | |---|---| | Bribery | Offering, promising, giving, requesting, or accepting anything of value to influence a decision or secure an improper advantage, whether directly or through an intermediary | | Commercial bribery | Any payment or benefit to an employee, officer, or adviser of a customer or prospect that is not disclosed to their employer | | Kickbacks | Returning any part of a contract value to a person who influenced the award | | Facilitation payments | Small payments to expedite a routine administrative act. Prohibited even where local practice tolerates them and even where the amount is trivial | | Trading in influence | Offering or accepting a benefit in exchange for exercising influence over a decision-maker | | Money laundering | Accepting, transferring, or concealing funds known or suspected to derive from criminal conduct | | Retaliation | Any detriment to a person who raises a concern under this policy in good faith | A breach does not require that the improper advantage was actually obtained. Offering and requesting are prohibited on the same terms as giving and accepting. --- ## 4. Laws that apply EthicsPortal is operated by a Polish sole proprietorship and sells across the European Union. The following apply directly or by extraterritorial reach: - **Polish Criminal Code**, Articles 229 and 230a (bribery of and trading in influence with public officials) and Article 296a (bribery in commercial dealings). - **Polish Act of 14 June 2024 on the protection of whistleblowers**, transposing EU Directive 2019/1937. - **UK Bribery Act 2010**, Section 7, which reaches a non-UK organization carrying on part of its business in the United Kingdom, and which recognizes no facilitation-payment exemption. - **US Foreign Corrupt Practices Act**, where any element of a transaction has a United States nexus. - **French Law 2016-1691 (Sapin II)**, which does not bind EthicsPortal directly but governs the third-party diligence obligations of French customers. Declarations made to those customers are made on that footing. - **OECD Anti-Bribery Convention** and **UNCAC**, as the instruments the above implement. EthicsPortal does not fall within the scope of Article 17 of Sapin II or of the Polish Act's obligation to operate an internal reporting channel, neither of which reaches an organization of this size. The channel described in §10 is operated regardless. --- ## 5. Gifts and hospitality Gifts and hospitality are permitted only where they are modest, infrequent, transparent, proportionate to a normal business courtesy, and incapable of being read as an attempt to influence a decision. | Rule | Threshold | |---|---| | Single gift or hospitality item | EUR 50 | | Aggregate per person per twelve months | EUR 150 | | Cash, cash equivalents, vouchers, or securities | Prohibited at any value, given or received | | Anything offered while a tender, procurement decision, renewal, or dispute is open with that party | Prohibited at any value | | Anything offered to a public official or their family | Prohibited without prior written assessment against the relevant national law | | Travel or accommodation paid for a customer or prospect | Prohibited | Anything above the single-item threshold, and anything at all involving a public official, is recorded in a gifts and hospitality register maintained by the operator. The register is available to a customer or auditor on request during procurement review. Where a gift cannot be declined without causing offence, it is accepted, recorded, and donated or otherwise disposed of so that the operator derives no personal benefit. --- ## 6. Conflicts of interest A conflict of interest is any circumstance in which a personal, financial, or professional interest could reasonably be seen to influence a decision taken for EthicsPortal. Perception is sufficient. An interest does not have to have caused a distorted decision to require disclosure. The operator holds professional interests outside EthicsPortal. Where any such interest touches a customer, prospect, partner, or supplier of EthicsPortal, it is disclosed to that party in writing before the relationship is entered into, and the nature of the interest is disclosed on request during procurement diligence. The following are disclosed without being asked: - Any employment, directorship, shareholding, or advisory role held by the operator in an organization that is a customer, prospect, competitor, reseller, or supplier of EthicsPortal. - Any personal or family relationship with a person who influences a purchasing decision affecting EthicsPortal. - Any financial interest in an organization that would benefit from a recommendation EthicsPortal makes. Because EthicsPortal has one decision-maker, a conflict cannot be managed by recusal. It is managed by disclosure and, where disclosure is not sufficient to protect the counterparty, by declining the engagement. --- ## 7. Referral fees, commissions, and partner arrangements This is the area where a business of this kind is most exposed, and it is stated in more detail for that reason. EthicsPortal pays and receives referral fees and reseller commissions. Such an arrangement is legitimate when the buyer knows it exists and improper when they do not: an undisclosed payment to a person who influences a purchasing decision is commercial bribery, regardless of what it is called. The following apply to every partner, reseller, affiliate, and referral arrangement: - The commercial relationship and the existence of a fee are **disclosed to the end customer** before the customer commits. - No fee, commission, or benefit is paid to an individual employee, officer, or adviser of a customer organization. Fees are paid to the partner organization, against an invoice, on written terms. - No fee is contingent on a specific individual inside the customer recommending EthicsPortal. - Consultants, advisers, and intermediaries paid by EthicsPortal are engaged on written terms that incorporate this policy, and are paid at a rate justifiable as the market value of the service actually performed. - Where a prospective partner declines to allow disclosure of the arrangement to end customers, the arrangement is not entered into. Free or discounted deployments offered for evaluation, pilot, or launch reasons are offered to the customer organization on published or written terms, never to an individual, and never as a personal benefit to the person who signs. --- ## 8. Political and charitable contributions EthicsPortal makes no political contributions of any kind: no donations to parties, candidates, campaigns, or political organizations, in cash or in kind, in any country. Charitable contributions are permitted only where the recipient is a genuine charity, no decision-maker of a customer or prospect requested the contribution, and it could not reasonably be read as a benefit conferred to secure business. --- ## 9. Sanctions, export control, and financial records EthicsPortal does not deal with parties in, or controlled from, a jurisdiction subject to EU restrictive measures. Sub-processors are established in the European Union and are published on the [subprocessors](https://ethicsportal.eu/subprocessors/) page. Customer payments are processed by Stripe, which applies its own sanctions and anti-money-laundering screening. All transactions are recorded accurately in the accounting records required under Polish law. No undisclosed account, unrecorded transaction, false entry, or misdescribed expense is created or permitted. Invoices describe what was actually supplied. --- ## 10. Raising a concern Anyone — a customer, a partner, a supplier, or a member of the public — may report a suspected breach of this policy, in confidence or anonymously, through EthicsPortal's own internal reporting channel, operated on EthicsPortal's own product under Directive 2019/1937: [secure.ethicsportal.eu/p/R8HXGNHO](https://secure.ethicsportal.eu/p/R8HXGNHO) Reports may also be sent to [legal@ethicsportal.eu](mailto:legal@ethicsportal.eu), though that route is not anonymous. A report is acknowledged within seven days and given feedback within three months, in line with the Directive's own timescales. No person who reports in good faith suffers any detriment for having done so, and that protection holds even where the report turns out to be mistaken. A reporter who does not wish to raise the matter with EthicsPortal may report externally to the competent national authority. For customers of EthicsPortal, the authorities for each Member State are listed under [whistleblower laws by country](https://ethicsportal.eu/whistleblower-laws/). --- ## 11. Structural limitations This policy is operated by one person, and the ordinary controls against corruption assume more than one. That limitation is stated here rather than disguised by procedure: | Control a larger organization would have | Position at EthicsPortal | |---|---| | Segregation of duties between the person who negotiates and the person who approves | Not achievable. One person performs both roles | | Independent approval of payments above a threshold | Not achievable. No second signatory exists | | Compliance function independent of commercial management | Not achievable. The operator owns this policy and the revenue it constrains | | Internal audit of the control environment by a different function | Self-performed, with the same impartiality limitation stated in the [internal audit record](https://ethicsportal.eu/policies/internal-audit/) | What substitutes for these is external visibility rather than internal separation: published pricing, written terms for every partner arrangement, transactions recorded through Stripe and the statutory accounting records, disclosure obligations that run to the counterparty rather than to an internal committee, and a whistleblowing channel open to anyone outside the business. This is a compensating position, not an equivalent one. A customer whose diligence standard requires segregation of duties at the supplier should record this as an open finding. --- ## 12. Enforcement and review A breach of this policy by the operator is a breach of the commitments made to customers under the [Terms](https://ethicsportal.eu/terms/) and may constitute a criminal offence under the laws in §4. Where a breach is suspected or reported, the operator records it, investigates it, remediates it, and discloses it to any affected counterparty. Where EthicsPortal engages personnel, resellers, or intermediaries in future, this policy is a term of that engagement, and this document is updated to state the training and monitoring that apply to them. --- ## 13. Document control | Field | Value | |---|---| | Document title | EthicsPortal Anti-corruption and Business Ethics Policy | | Version | 1.0 | | Effective date | 2026-09-24 | | Last reviewed | 2026-09-24 | | Next scheduled review | 2027-09-24 | | Review trigger (interim) | Engagement of personnel or intermediaries; entry into a new reseller or referral arrangement; any reported breach; material change to the laws in §4 | | Owner | Yaroslav Shmarov, operator | | Distribution | Published on [ethicsportal.eu/policies/](https://ethicsportal.eu/policies/) | Signed: Yaroslav Shmarov, on behalf of EthicsPortal --- 2026-09-24. --- # Business continuity plan > How EthicsPortal responds to outages, sub-processor failures, restore events, and operator incapacity. Activation triggers, decision authority, and customer-communication protocol. Canonical: https://ethicsportal.eu/policies/business-continuity/ Last updated: 2026-10-28 **Effective date:** 2026-05-21 **Last reviewed:** 2026-10-28 **Next review:** 2027-05-21 **Owner:** Yaroslav Shmarov, operator **Version:** 1.5 This document states what EthicsPortal does when the Service, a sub-processor, or the operator themselves becomes unable to deliver the Service at the level customers depend on. It is the named plan referenced by the [Information security policy](https://ethicsportal.eu/policies/information-security/) §6 and by the [ISO/IEC 27001:2022 self-assessment](https://ethicsportal.eu/iso-27001/) for controls A.5.29--A.5.30. The recovery *outcomes* this plan produces (recovery point objective, recovery time objective, monthly availability target) are stated in the [Service level agreement](https://ethicsportal.eu/sla/). This page states the *process* that produces them. --- ## 1. Scope and objectives This plan covers continuity of the EthicsPortal Service in the event of: - An infrastructure failure affecting the application host, database, file storage, or transactional email pipeline - A sub-processor outage that degrades a covered surface ([Subprocessors](https://ethicsportal.eu/subprocessors/)) - A security incident requiring a covered surface to be taken offline - Operator incapacity, prolonged unavailability, or business cessation The continuity objectives, in order of priority, are: 1. Preserve the confidentiality and integrity of personal data already in the system. The reporter portal will be taken offline rather than continue to operate in a degraded confidentiality state. 2. Restore reporter access to existing cases (status, messaging, follow-up) so that protected reporting under EU Directive 2019/1937 is not silently interrupted. 3. Restore handler and admin access to case management. 4. Restore the marketing site and documentation surfaces. --- ## 2. Recovery objectives | Objective | Target | Surface | |---|---|---| | Recovery point objective (RPO) | 24 hours | Reporter portal, handler portal | | Recovery time objective (RTO) | 4 hours | Reporter portal, handler portal | | Monthly availability target | 99.5% | Reporter portal, handler portal | Marketing and documentation surfaces are best-effort and are not covered by an availability target. Backup mechanism, storage location, retention, and restore-testing cadence are documented at [Security#backups-and-restore](https://ethicsportal.eu/security/#backups-and-restore). --- ## 3. Activation triggers The continuity process is activated when any of the following is observed: - The reporter portal or handler portal is unreachable for more than 15 minutes, confirmed by external monitoring - A sub-processor reports an outage that affects a covered surface - A security incident is suspected or confirmed, including a credible report from external researchers - A personal data breach is suspected ([Art. 4(12)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) GDPR definition) - The operator becomes unable to access production systems for any reason exceeding 4 hours Activation does not require a formal declaration --- the trigger conditions automatically open the response process. --- ## 4. Decision authority The operator (Yaroslav Shmarov) is the sole decision authority for: - Taking a covered surface offline - Initiating a restore from backup - Notifying affected controllers of a personal data breach under [DPA §6.6](https://ethicsportal.eu/dpa/) - Creating an entry in the [incident register](https://ethicsportal.eu/incidents/) - Engaging additional sub-processors or alternative infrastructure on an emergency basis Decisions are recorded in a written incident log retained for audit purposes. --- ## 5. Customer communication | Event | Channel | Timing | |---|---|---| | Active outage on a covered surface | Live status indicator at [secure.ethicsportal.eu/up](https://secure.ethicsportal.eu/up); email to organization admins for material outages | Within 60 minutes of detection | | Personal data breach | Direct email to affected controllers | Without undue delay after awareness, per [DPA §6.6](https://ethicsportal.eu/dpa/) | | Material incident (post-containment) | Preliminary entry in [incident register](https://ethicsportal.eu/incidents/) | Within 7 days of containment | | Material incident (final disclosure) | Final entry in [incident register](https://ethicsportal.eu/incidents/) | Within 30 days of containment | | Planned maintenance | Status page and (where it affects business hours) admin email | At least 48 hours in advance | Communications go to the organization-administrator contact on file. Controllers are responsible for keeping their administrator contact information current. --- ## 6. Restore procedure (summary) When a database or full-system restore is required: 1. The operator declares the incident, takes the covered surface offline if not already down, and freezes write traffic. 2. The most recent database dump is retrieved from Hetzner Object Storage (Nuremberg, EU; 21 current daily backups, with deleted versions expiring after 7 additional days) and decrypted inside the backup container, which alone holds the GnuPG passphrase. Application-encrypted fields remain separately encrypted in the restored data. 3. The dump is restored into a fresh database instance and integrity-checked. 4. The application host is rebuilt from a current Kamal deployment configuration; if the host itself is lost, a Hetzner server-level snapshot (7-day retention) is the fallback. If the Nuremberg object storage is lost, the Falkenstein copy of the file attachments becomes the primary storage location; the per-file keys in the restored database open it. 5. The covered surfaces are brought back online incrementally, with the reporter portal restored before the handler portal where they are independently recoverable. 6. The event is logged to the [incident register](https://ethicsportal.eu/incidents/) if it meets the register's scope criteria. The full restore mechanism, storage locations, retention, and drill cadence are documented at [Security#backups-and-restore](https://ethicsportal.eu/security/#backups-and-restore). A restore drill runs automatically every month into a disposable environment and confirms the application can read the restored data. --- ## 7. Supplier failure The Service depends on the sub-processors listed on the [Subprocessors](https://ethicsportal.eu/subprocessors/) page and on the other suppliers named in the [Privacy Notice](https://ethicsportal.eu/privacy/). Stripe and Cloudflare are not sub-processors for report data. Continuity posture for each: | Supplier | Function | Continuity response | |---|---|---| | Hetzner (DE) | Application host, database, file storage | Restore from off-host backup (database dump in Hetzner Object Storage; server-level snapshots; file attachment copy in Hetzner Falkenstein). For prolonged Hetzner outage, the application is portable to another EU-based provider; cutover would be coordinated with affected controllers and disclosed in the [incident register](https://ethicsportal.eu/incidents/). | | Mailjet (FR) | Transactional email | Handler notifications are delayed during a Mailjet outage; the in-app surface remains functional. No data is lost. | | Stripe (IE) | Subscription billing | Billing functions are interrupted; the Service itself continues to operate. | | Cloudflare (US) | Marketing-site CDN | Marketing site degrades to direct origin or is unreachable; reporter and handler portals are not affected (they do not load Cloudflare). | | AppSignal (NL) | Error and performance monitoring | Loss of telemetry; no customer-facing impact. | Sub-processor outage affecting a covered surface counts against the [SLA](https://ethicsportal.eu/sla/) target. --- ## 8. Operator-incapacity protocol **Current state.** A formal operator-incapacity protocol --- a named legal contact holding emergency credentials with authority to notify customers and execute a controlled wind-down --- is **in treatment** (see [Risk register R-01](https://ethicsportal.eu/policies/risk-register/)). This section states what is in place today, openly, so that controllers can assess the risk and plan accordingly. **What is in place today:** - **Self-service data export.** Every organization admin can produce a full PDF case export from within the Service for any case at any time. This does not require operator intervention and continues to function for as long as the Service is reachable. Self-service export is the primary continuity guarantee against operator unavailability. - **Customer rights under the DPA.** [DPA §6.8](https://ethicsportal.eu/dpa/) gives the controller rights to receive or delete personal data on subscription termination, subject to the stated production and backup lifecycle. Exercising rights that require operator action depends on the current continuity arrangements described here; this policy does not promise execution during operator incapacity. - **Cloud-hosted infrastructure on standard providers.** The Service runs on Hetzner using Kamal deployment configuration that is portable to an alternative operator. A third party with access to the deployment configuration and customer authorization could, in principle, take over operation. **What is not yet in place:** - A named legal contact or law firm holding emergency credentials and notification authority - A pre-arranged escrow of deployment credentials with a third party - A pre-arranged customer-notification mechanism that operates without the operator **Planned addition.** A formal protocol with a named legal contact and pre-arranged customer-notification authority is on the operator's roadmap. When in place, this section will be updated to name the contact, the trigger conditions, and the authority granted. The change will be reflected in this plan's version number and effective date. **Recommended controller practice** while this protocol is being formalised: - Take regular self-service exports of active cases for local archival - Configure organization-admin contacts redundantly (more than one admin per organization) - Raise continuity requirements during procurement review; bespoke arrangements are available on enterprise terms --- ## 9. Plan testing | Test | Cadence | Last performed | |---|---|---| | Database restore drill into disposable environment (decrypt, restore, application read-back) | Monthly, automated | See [Security#backups-and-restore](https://ethicsportal.eu/security/#backups-and-restore) | | Failover walk-through (paper exercise) | Annual | 2026-05 | | Sub-processor outage tabletop | Annual | 2026-05 | | Operator-incapacity tabletop | Deferred pending formal protocol | --- | Test results inform the [risk register](https://ethicsportal.eu/policies/risk-register/) and any required updates to this plan. --- ## 10. Document control | Field | Value | |---|---| | Document title | EthicsPortal Business Continuity Plan | | Version | 1.5 | | Effective date | 2026-05-21 | | Last reviewed | 2026-10-28 | | Next scheduled review | 2027-05-21 | | Review trigger (interim) | Formalization of the operator-incapacity protocol, addition or change of a sub-processor that affects continuity, material restore-drill outcome, material change to the [risk register](https://ethicsportal.eu/policies/risk-register/) | | Owner | Yaroslav Shmarov, operator | | Distribution | Published on [ethicsportal.eu/policies/](https://ethicsportal.eu/policies/) | Signed: Yaroslav Shmarov, on behalf of EthicsPortal --- 2026-10-28. --- # Information security policy > EthicsPortal's information security policy. Scope, roles, control commitments, review cadence, and document control. Canonical: https://ethicsportal.eu/policies/information-security/ Last updated: 2026-11-10 **Effective date:** 2026-05-21 **Last reviewed:** 2026-09-23 **Next review:** 2027-05-21 **Owner:** Yaroslav Shmarov, operator **Version:** 1.1 --- ## 1. Purpose This policy states the information-security objectives that govern EthicsPortal, the controls that satisfy them, and the responsibilities that maintain them. It exists so that customers, controllers under GDPR, regulators, and procurement reviewers can refer to a single named document for the security posture of the Service. This policy is the parent document for the [business continuity plan](https://ethicsportal.eu/policies/business-continuity/), the [risk register](https://ethicsportal.eu/policies/risk-register/), the [internal audit record](https://ethicsportal.eu/policies/internal-audit/), the [management review record](https://ethicsportal.eu/policies/management-review/), and the [ISO/IEC 27001:2022 self-assessment](https://ethicsportal.eu/iso-27001/). --- ## 2. Scope This policy applies to: - The EthicsPortal Service --- the reporter portal, handler portal, and supporting infrastructure listed on the [Security](https://ethicsportal.eu/security/#infrastructure) page. - All personal data processed by the Service on behalf of customer organizations (controllers under GDPR), including report content, reporter identity, handler messages, file attachments, and audit-log entries. - The operator and all sub-processors listed on the [subprocessors](https://ethicsportal.eu/subprocessors/) page. This policy does not extend to systems operated by the controller (the customer organization) outside the Service. --- ## 3. Objectives EthicsPortal commits to three primary security objectives, in order of priority: 1. **Confidentiality of reporter identity.** Personal data identifying or reasonably capable of identifying a whistleblower is protected against unauthorized disclosure to any party --- including controller-side personnel who are not designated handlers, sub-processors, and the operator's own infrastructure providers --- to the extent technically feasible. 2. **Integrity of the audit trail.** Records of who did what, when, are preserved in an append-only form that cannot be altered by any user, including organization administrators. 3. **Availability of the whistleblowing channel.** The reporter portal is available to whistleblowers under the [SLA](https://ethicsportal.eu/sla/) target so that the protected reporting right under EU Directive 2019/1937 is not silently degraded. Confidentiality takes precedence over availability where the two conflict --- the reporter portal will be taken offline in the event of a credible threat to reporter identity, with disclosure under the [incident register](https://ethicsportal.eu/incidents/). Each objective carries a measure and a target, so that a [management review](https://ethicsportal.eu/policies/management-review/) can conclude whether it was met rather than only that work was done: | Objective | Measure | Target | Read from | |---|---|---|---| | Confidentiality of reporter identity | Confirmed disclosures of reporter identity to any party outside the organization's designated handlers | Zero | [Incident register](https://ethicsportal.eu/incidents/), which records every material security event and carries a 7-day disclosure obligation | | Integrity of the audit trail | Presence of the append-only triggers on the deployed `audit_logs` table, queried against the running database rather than inferred from migration history | Present at every check | The production check set published at [secure.ethicsportal.eu/up](https://secure.ethicsportal.eu/up), which runs continuously and fails the check if either trigger is absent | | Availability of the whistleblowing channel | Monthly uptime of the reporter and handler portals | 99.5% | [SLA#measurement](https://ethicsportal.eu/sla/#measurement); monthly figures available to operators on request | These targets are reviewed annually alongside this policy. A missed target is a nonconformity, recorded and corrected under the [internal audit](https://ethicsportal.eu/policies/internal-audit/) programme, not a number quietly restated. --- ## 4. Roles and responsibilities EthicsPortal is operated by a single named individual, Yaroslav Shmarov, who holds all of the following responsibilities: | Role | Responsibility | |---|---| | Information security officer | Owns this policy and its review | | Data protection contact | Privacy and data-subject-rights inquiries; reachable at [privacy@ethicsportal.eu](mailto:privacy@ethicsportal.eu) | | Incident response lead | Owns the response process for events meeting the [incident register](https://ethicsportal.eu/incidents/) scope | | Authorized signatory | Signs DPAs, security questionnaires, and commercial agreements | | Sub-processor manager | Reviews sub-processor relationships and publishes the list on the [subprocessors](https://ethicsportal.eu/subprocessors/) page | The single-operator structure is documented openly on the [Trust](https://ethicsportal.eu/trust/#continuity-and-personnel) page. Continuity arrangements that compensate for this structure are stated in the [business continuity plan](https://ethicsportal.eu/policies/business-continuity/). --- ## 5. Control commitments The technical and organizational measures implementing this policy are documented on the [Security](https://ethicsportal.eu/security/) page and are summarized below. Each commitment maps to one or more ISO/IEC 27001:2022 Annex A controls in the [control map](https://ethicsportal.eu/iso-27001/). | Domain | Commitment | Detail | |---|---|---| | Encryption at rest | Non-deterministic encryption of defined report, identity and communication database fields; database dumps encrypted with GnuPG AES-256 before upload; file attachments encrypted at rest under a separate key per file | [Security#data-encryption](https://ethicsportal.eu/security/#data-encryption) | | Encryption in transit | HTTPS/TLS for all connections; unencrypted HTTP is redirected | [Security#data-encryption](https://ethicsportal.eu/security/#data-encryption) | | Reporter anonymity | No reporter IP storage with reports or in application logs; keyed hashing for rate limiting; metadata stripped from uploads, except comment author names and embedded-photo metadata inside PDFs | [Security#anonymity-and-privacy](https://ethicsportal.eu/security/#anonymity-and-privacy) | | Access control | Role-based access (admin/member/viewer) enforced at the controller boundary via Pundit policies; least-privilege defaults; opt-in two-factor authentication for handler accounts (recommended at onboarding); mandatory hardware-key 2FA on operator production accounts | [Security#access-control](https://ethicsportal.eu/security/#access-control) | | Session management | 14-day idle timeout; per-session revocation; nightly sweep | [Security#access-control](https://ethicsportal.eu/security/#access-control) | | Audit trail | Append-only, actor + action + timestamp, cannot be edited by any user | [Security#audit-and-compliance](https://ethicsportal.eu/security/#audit-and-compliance) | | Retention | Customer-configurable 12/24/36/48/60-month retention with automatic deletion after closure | [Security#audit-and-compliance](https://ethicsportal.eu/security/#audit-and-compliance) | | Secure development | Documented lifecycle covering design review, change review, static analysis, dependency management, environment separation, vulnerability response | [Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle) | | Vulnerability management | Continuous SCA in CI; weekly Dependabot; no end-of-life components | [Security#dependency-and-patch-management](https://ethicsportal.eu/security/#dependency-and-patch-management) | | Backup and restore | Daily database dumps encrypted with GnuPG AES-256 before upload, plus server-level snapshots, all in the EU; file attachments are encrypted at rest and copied to a second Hetzner location (Falkenstein); RPO 24h and RTO 4h are objectives; the monthly drill proves the restored database is readable by the application but does not prove full-service recovery | [Security#backups-and-restore](https://ethicsportal.eu/security/#backups-and-restore) | | Sub-processor management | Published list, 30-day change notice, controller objection right | [Subprocessors](https://ethicsportal.eu/subprocessors/), [DPA §6.4](https://ethicsportal.eu/dpa/) | | No AI / LLM processing | EthicsPortal does not transmit personal data covered by the DPA to any LLM, generative-AI, or AI-classifier service | [DPA §6.10](https://ethicsportal.eu/dpa/) | | No BYOK | Customer-managed encryption keys are not supported; deliberate architectural choice | [DPA §6.11](https://ethicsportal.eu/dpa/) | | Incident response | Material incidents recorded publicly within 7 days of containment; final report within 30 days | [Incident register](https://ethicsportal.eu/incidents/) | | Personal data breach notification | Notification to affected controllers without undue delay after awareness | [DPA §6.6](https://ethicsportal.eu/dpa/) | --- ## 6. Risk management, internal audit and management review Information-security risks are assessed against the Service annually and after any material change to architecture, sub-processors, or the threat landscape. The current assessment, treatment, and residual-position decisions are published in the [risk register](https://ethicsportal.eu/policies/risk-register/). Risks accepted as residual are stated openly with a justification; risks not yet treated are stated openly with a target. The management system is audited annually against ISO/IEC 27001:2022 and against the commitments published on this site. The programme, the audits performed, and every finding they raise are published in the [internal audit record](https://ethicsportal.eu/policies/internal-audit/). Audit findings, monitoring results, and progress against the objectives in §3 are then reviewed by the operator as top management and recorded in the [management review record](https://ethicsportal.eu/policies/management-review/). Both are self-performed. A single-person organization cannot produce an impartial internal audit, and that limitation is stated on each page rather than worked around. It is the reason an independent external review remains the principal open item on the [ISO/IEC 27001:2022 self-assessment](https://ethicsportal.eu/iso-27001/). --- ## 7. Sub-processor management EthicsPortal engages sub-processors only where the function cannot reasonably be performed in-house and where the sub-processor materially improves availability, confidentiality, or compliance for the customer. The current list, the data each sub-processor receives, and the legal jurisdiction of each are published on the [subprocessors](https://ethicsportal.eu/subprocessors/) page. No large language model, generative-AI service, or AI-based classifier is engaged as a sub-processor. This is a documented product commitment ([DPA §6.10](https://ethicsportal.eu/dpa/)) and a confidentiality-grade decision ([Coverage map §5](https://ethicsportal.eu/directive-coverage/)), not a configuration default. Controllers are notified at least 30 days before any sub-processor is added or replaced. A controller that objects to a proposed change may terminate the agreement under [DPA §6.4](https://ethicsportal.eu/dpa/) without penalty. --- ## 8. Personnel security EthicsPortal has no employees or contractors. All personal data is processed exclusively by the named operator. Having no employees removes a hiring process, not the operator. ISO/IEC 27001:2022 Clause 7.2 requires the competence of the people doing the work to be determined and recorded regardless of headcount, so screening (A.6.1) and awareness (A.6.3) are marked **Compensating** in the [self-assessment](https://ethicsportal.eu/iso-27001/#a6-people-controls) rather than not applicable, and the compensating arrangements are these: - **Identity and accountability in place of screening.** The contracting party, registry number, and tax registration are published on [Trust](https://ethicsportal.eu/trust/#contracting-party) and the registry extract is available during procurement review. A privileged-production-access summary is available on the same basis. - **Competence.** The operator's background is professional Ruby on Rails development, including public technical teaching on the framework. Security-relevant competence is maintained through the feeds listed at ISO 27001 A.5.6 --- CVE feeds, the Rails security mailing list, and the Ruby Advisory Database --- and is exercised and evidenced through the testing published at [self-conducted security testing](https://ethicsportal.eu/security-testing/). This is a self-declaration; no third-party security certification is held or claimed. - **Continuity in place of succession.** Arrangements are stated in the [business continuity plan](https://ethicsportal.eu/policies/business-continuity/) and the residual gap is carried openly as [risk register R-01](https://ethicsportal.eu/policies/risk-register/). A.6.4 (disciplinary process) and the remaining employment-lifecycle controls stay **Not applicable**: there is no employment relationship for them to govern. If EthicsPortal engages additional personnel in the future, this policy will be updated to state the screening, training, and offboarding procedures that apply. --- ## 9. Physical security EthicsPortal does not operate its own physical infrastructure. Server, database, and object-storage hosting are provided by Hetzner Online GmbH in Nuremberg, Germany, with the file attachment backup copy in Hetzner's Falkenstein location. Physical security controls (data-center access, environmental controls, media destruction) are inherited from Hetzner and documented in their published certifications. See [subprocessors](https://ethicsportal.eu/subprocessors/). The operator does not maintain a physical office that processes customer data. Operator workstations used for production access are protected by full-disk encryption and screen-lock controls. --- ## 10. Compliance EthicsPortal commits to compliance with: - **GDPR (Regulation 2016/679)**, particularly Articles 5, 28, 32, and 33. - **EU Directive 2019/1937** on the protection of persons who report breaches of Union law. - **National transpositions** of the Directive in the customer's country of operation. See [whistleblower laws by country](https://ethicsportal.eu/whistleblower-laws/). - **EU Accessibility Act / EN 301 549** for the reporter-facing portal. See [accessibility](https://ethicsportal.eu/accessibility/) and the [EN 301 549 conformance statement](https://ethicsportal.eu/en-301-549-conformance/). EthicsPortal does not currently hold ISO/IEC 27001 certification. The platform publishes a structured self-assessment at [/iso-27001/](https://ethicsportal.eu/iso-27001/) covering both the mandatory Clause 4--10 requirements and all 93 Annex A controls, in the form of a Statement of Applicability. When accreditation is obtained, the certificate scope and date will be published on [/trust/](https://ethicsportal.eu/trust/#certification-status). --- ## 11. Policy violations and enforcement A violation of this policy by the operator is a violation of the contractual commitments to controllers and may trigger: - A reportable entry in the [incident register](https://ethicsportal.eu/incidents/) - Notification to affected controllers under [DPA §6.6](https://ethicsportal.eu/dpa/) - Notification to the competent supervisory authority where [Art. 33](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) GDPR requires it Where a violation is suspected or reported, the operator is required to record, investigate, remediate, and disclose under the same process as any other security incident. --- ## 12. Document control | Field | Value | |---|---| | Document title | EthicsPortal Information Security Policy | | Version | 1.1 | | Effective date | 2026-05-21 | | Last reviewed | 2026-09-23 | | Next scheduled review | 2027-05-21 | | Review trigger (interim) | Any material change to architecture, sub-processors, regulatory obligations, or the [risk register](https://ethicsportal.eu/policies/risk-register/) | | Owner | Yaroslav Shmarov, operator | | Distribution | Published on [ethicsportal.eu/policies/](https://ethicsportal.eu/policies/) | This policy is reviewed annually and after any of the interim triggers above. The effective date and version are incremented when the policy is materially revised. Signed: Yaroslav Shmarov, on behalf of EthicsPortal --- 2026-09-23. --- # Internal audit record > First internal audit of EthicsPortal against ISO/IEC 27001:2022 found no control failures. Six documentation defects were raised and all six were corrected before the audit closed. Programme, findings, and the limits of a self-performed audit. Canonical: https://ethicsportal.eu/policies/internal-audit/ Last updated: 2026-09-23 **Effective date:** 2026-09-23 **Last reviewed:** 2026-09-23 **Next review:** 2027-09-23 **Owner:** Yaroslav Shmarov, operator **Version:** 1.0 Clause 9.2 of ISO/IEC 27001:2022 requires internal audits at planned intervals, to determine whether the information security management system conforms to the organization's own requirements and to the standard, and whether it is effectively implemented and maintained. This page is the programme and the record of audits performed against it. **Current position.** One audit has been performed, in September 2026, across the full management system. It found **no control failures**. It raised six findings, all of them defects in how a control was described rather than in how it operates, and all six were corrected before the audit closed. Three opportunities for improvement remain open and are listed with their status. --- ## Independence of this audit Clause 9.2 requires that auditors be selected and audits conducted in a way that ensures the objectivity and impartiality of the audit process. A single-operator organization cannot meet that requirement: the person auditing the system is the person who designed and operates it, and no choice of auditor changes that. This is why [Annex A control A.5.35](https://ethicsportal.eu/iso-27001/) (independent review of information security) is recorded as **In treatment** and [Clause 9.2](https://ethicsportal.eu/iso-27001/) as **Partial**. An independent external review is what closes both. The audit is still performed and published, because a dated pass over the published claims against the running system catches defects that would otherwise reach a customer. The same limit applies to [self-conducted security testing](https://ethicsportal.eu/security-testing/). --- ## Audit programme | Element | Definition | |---|---| | Frequency | Annually, and additionally on any material change to architecture, sub-processors, or the regulatory obligations the Service is built against | | Scope | The full ISMS: Clauses 4--10 and all 93 Annex A controls as published in the [ISO/IEC 27001:2022 self-assessment](https://ethicsportal.eu/iso-27001/), together with the [information security policy](https://ethicsportal.eu/policies/information-security/), [business continuity plan](https://ethicsportal.eu/policies/business-continuity/), and [risk register](https://ethicsportal.eu/policies/risk-register/) | | Criteria | ISO/IEC 27001:2022; the commitments EthicsPortal has published on its own Trust surfaces; and the [DPA](https://ethicsportal.eu/dpa/) | | Method | Every published claim is checked against the running code and deployed configuration, not against sibling documents or plausible behaviour. Infrastructure claims are checked against deployed state --- the continuously running production check set at [secure.ethicsportal.eu/up](https://secure.ethicsportal.eu/up) queries the database for the presence of the append-only audit triggers rather than inferring them from migration history | | Auditor | The operator. See the impartiality limitation above | | Reporting | Findings are published on this page. Corrections are recorded in the [corrective-action log](https://ethicsportal.eu/iso-27001/) of the document they change, and their status is reviewed at the next [management review](https://ethicsportal.eu/policies/management-review/) | | Classification | **Finding** (a *nonconformity* in the standard's own vocabulary) --- a published claim that is inaccurate or unsupported, or a requirement of the standard that is not met. **Observation** --- a conformity that holds but rests on weaker evidence than it should. **Opportunity for improvement** --- no finding, but a gap worth closing | A finding that would leave a customer or regulator misinformed about the security of their data is material, and is corrected before the audit closes rather than scheduled. --- ## Audit 2026-09 --- first full audit **Conducted:** 2026-09-23 · **Scope:** full ISMS as defined above · **Result:** no control failures. Six findings raised, all corrected before close; three opportunities for improvement, one of them since closed. ### Findings | Ref | Clause | Finding | Correction | Verified | |---|---|---|---|---| | NC-01 | 4--10, 6.1.3 | The published ISO/IEC 27001 self-assessment covered Annex A only. Clauses 4--10 --- the mandatory requirements certification is awarded against --- were not assessed, and no Statement of Applicability existed under that name, so the link from assessed risk to selected control was not visible to a reviewer | Clauses 4--10 assessed sub-clause by sub-clause; the Annex A tables framed as the Statement of Applicability, with the basis for inclusion and the risk-to-control mapping stated | Published at [/iso-27001/](https://ethicsportal.eu/iso-27001/) v3.0 | | NC-02 | 7.2, A.6.1, A.6.3 | Screening and awareness were marked **Not applicable** on the grounds that there are no employees. Correct for a hiring process, wrong for the operator, whose competence Clause 7.2 requires irrespective of headcount | Both reclassified **Compensating** with the substitute assurance named; a competence basis recorded in [IS policy §8](https://ethicsportal.eu/policies/information-security/) | [/iso-27001/](https://ethicsportal.eu/iso-27001/) v3.0, [IS policy](https://ethicsportal.eu/policies/information-security/) v1.1 | | NC-03 | A.5.30, A.8.13 | [Business continuity plan §9](https://ethicsportal.eu/policies/business-continuity/) stated the restore drill runs quarterly and [risk register R-05](https://ethicsportal.eu/policies/risk-register/) stated "at least quarterly". The drill has been running monthly, so both documents understated a control that was stronger than claimed | Both corrected to monthly, matching what the [Security](https://ethicsportal.eu/security/#backups-and-restore) page and risk register R-02 already stated | [BCP](https://ethicsportal.eu/policies/business-continuity/) v1.1, [risk register](https://ethicsportal.eu/policies/risk-register/) v1.3 | | NC-04 | A.8.13 | The Annex A backup row described only the object-storage dump layer, omitting the host-snapshot layer and the continuous backup-freshness check, both already operating and already documented on [Security](https://ethicsportal.eu/security/#backups-and-restore) | Row restated to cover both layers and the freshness check | [/iso-27001/](https://ethicsportal.eu/iso-27001/) v3.0 | | NC-05 | 6.2 | The three information security objectives were qualitative. Clause 6.2 requires objectives to be measurable where practicable, with the means of evaluation stated. As written, no management review could have concluded whether any of them had been met | Each objective given a measure, a target, and the source the result is read from | [IS policy §3](https://ethicsportal.eu/policies/information-security/) v1.1 | | NC-06 | A.5.3, A.8.15 | Four published surfaces stated that individual reads are not logged. Handler views of a report are logged, per handler, deduplicated to one entry per report per 24 hours, and reporter follow-up views with them. On the [Privacy notice](https://ethicsportal.eu/privacy/) and [DPIA template](https://ethicsportal.eu/dpia/) this was an under-disclosure of processing, not only an understated control | All four corrected to describe what is logged and what is not | [/iso-27001/](https://ethicsportal.eu/iso-27001/), [Privacy notice](https://ethicsportal.eu/privacy/), [DPIA](https://ethicsportal.eu/dpia/), [DORA map](https://ethicsportal.eu/dora/) | ### Opportunities for improvement | Ref | Clause | Finding | Position | |---|---|---|---| | OFI-01 | 6.1.3, 8.3 | There is no consolidated risk treatment plan. Treatment is recorded per risk in the register, but the three risks carrying an **In treatment** residual position have no completion date against them | **Closed 2026-09-23.** A [treatment plan](https://ethicsportal.eu/policies/risk-register/) now dates every open item, with a stated rule for a missed target. Clause 6.1.3 moves to Implemented and 8.3 off Partial | | OFI-02 | 4.2 | Interested parties and their expectations are addressed per relationship --- controllers in the DPA, reporters in the privacy notice, authorities and sub-processors elsewhere --- rather than consolidated into a single view | Open. Low materiality; the distributed form serves the party reading it better | | OFI-03 | 9.1 | The production check set runs continuously and alerts on failure, but no schedule defines when the collected data is *analysed*. Clause 9.1 asks when results are evaluated, not only when they are gathered | Open. The annual management review is the current analysis point | ### Areas examined with no finding Tenant and role boundaries; the append-only audit trail and its database-level enforcement; the encryption boundary and what it does and does not cover; retention and erasure paths; the deploy gate and its enforcement of the automated suite; sub-processor disclosure against the published list; and the accuracy of the open gaps recorded on [Trust](https://ethicsportal.eu/trust/) and [Self-conducted security testing](https://ethicsportal.eu/security-testing/). --- ## Document control | Field | Value | |---|---| | Document title | EthicsPortal Internal Audit Record | | Version | 1.0 | | Effective date | 2026-09-23 | | Last reviewed | 2026-09-23 | | Next scheduled review | 2027-09-23 | | Review trigger (interim) | Material change to architecture, sub-processors, or regulatory obligations; a finding raised at [management review](https://ethicsportal.eu/policies/management-review/) | | Owner | Yaroslav Shmarov, operator | | Distribution | Published on [ethicsportal.eu/policies/](https://ethicsportal.eu/policies/) | Signed: Yaroslav Shmarov, on behalf of EthicsPortal --- 2026-09-23. --- # Management review record > ISO/IEC 27001 Clause 9.3 management review of EthicsPortal. No reportable security incident in the period; two risks re-assessed to a worse residual position after supplier assurances were found unverified. Inputs, conclusions, and the decisions taken. Canonical: https://ethicsportal.eu/policies/management-review/ Last updated: 2026-09-23 **Effective date:** 2026-09-23 **Last reviewed:** 2026-09-23 **Next review:** 2027-09-23 **Owner:** Yaroslav Shmarov, operator **Version:** 1.0 Clause 9.3 of ISO/IEC 27001:2022 requires that top management review the information security management system at planned intervals, against a defined list of inputs, and record the decisions that follow. This page is that record. **Current position.** One review has been conducted, in September 2026. No reportable security incident occurred in the period, and the management system was found suitable and adequate for the Service. Two risks were re-assessed to a worse residual position during the period, which is recorded at input (f) below. Five decisions were taken; the principal one is to commission an independent external security review. The review is conducted by the operator as top management, against evidence the same operator produced. The independence limit set out on the [internal audit record](https://ethicsportal.eu/policies/internal-audit/) applies here too. --- ## Review 2026-09 --- first review **Conducted:** 2026-09-23 · **Period under review:** 2026-05-21 (ISMS established) to 2026-09-23 · **Conducted by:** Yaroslav Shmarov, operator, as top management ### Inputs considered | Clause 9.3 input | Position | |---|---| | **(a) Status of actions from previous reviews** | None. This is the first management review; there is no prior action list to carry forward. Establishing the baseline is the principal output | | **(b) Changes in external and internal issues** | One sub-processor removed in the period (Crisp, in-app support chat, removed 2026-07-25 and replaced with self-hosted chat, reducing the number of parties with access to handler communications). No sub-processor added. The regulatory context is unchanged in substance: Directive 2019/1937 transpositions continue to evolve at Member-State level, which is carried as [risk register R-10](https://ethicsportal.eu/policies/risk-register/) rather than as a change requiring re-architecture | | **(c) Changes in the needs and expectations of interested parties** | No change was recorded in the period. Controller expectations are expressed during procurement review, but they are not captured as a tracked input to this review, so this row reports the absence of a record rather than an absence of change --- the practical consequence of OFI-02. Independent assurance is the expectation the ISMS itself identifies as unmet, at A.5.35 and Clause 9.2 | | **(d) Feedback on information security performance** | See the four sub-rows below | | — Findings and corrective actions | Six findings raised at the [2026-09 internal audit](https://ethicsportal.eu/policies/internal-audit/), all corrected before the audit closed. All six were documentation defects --- claims that were incomplete, misclassified, or understated relative to what the system does. None was a control failure | | — Monitoring and measurement results | No reportable security incident occurred in the period; the [incident register](https://ethicsportal.eu/incidents/) has no entries. The production check set ran continuously, covering the presence of the append-only audit triggers on the deployed database, backup freshness, and completion of the GDPR retention, deadline and inactivity-close jobs. Five rounds of [first-party security testing](https://ethicsportal.eu/security-testing/) were performed between 2026-05-26 and 2026-08-27; the material finding --- forwarding headers trusted on a directly internet-facing origin, which would have allowed per-IP rate limits to be bypassed --- was fixed the same day | | — Audit results | [Internal audit 2026-09](https://ethicsportal.eu/policies/internal-audit/): no control failures, six findings corrected, three opportunities for improvement left open. The audit could not satisfy the impartiality requirement of Clause 9.2 | | — Fulfilment of objectives | Not concludable for this period. The three objectives in [IS policy §3](https://ethicsportal.eu/policies/information-security/) carried no measure or target until this review cycle made them measurable (audit finding NC-05), so there is no baseline to conclude against. Availability is the exception: it has been measured against the published 99.5% monthly target throughout, per [SLA#measurement](https://ethicsportal.eu/sla/#measurement). The next review is the first that can report on all three | | **(e) Feedback from interested parties** | No material security event reached the [incident register](https://ethicsportal.eu/incidents/), which remains empty. Traffic to the [responsible disclosure](https://ethicsportal.eu/security/#responsible-disclosure) inbox and controller correspondence under the [DPA](https://ethicsportal.eu/dpa/) are not counted as a measured input, so nothing is claimed about them here. Establishing that count is folded into OFI-02 | | **(f) Results of risk assessment and status of treatment** | The [risk register](https://ethicsportal.eu/policies/risk-register/) was reviewed on 2026-09-05. Ten risks are assessed: three **In treatment** (operator incapacity, provider outage, sub-processor chain), three **Monitored**, four **Accepted** including one accepted by design. Two risks moved to a worse residual position during the period: R-02 (provider outage) and R-03 (sub-processor chain) were re-assessed from **Accepted** to **In treatment** on 2026-09-13, after assurances about the supplier chain and backup encryption that had been carried as settled were found to be unverified. No new risk category entered the register | | **(g) Opportunities for continual improvement** | The three opportunities recorded at the internal audit: a consolidated risk treatment plan with dates (OFI-01), a single view of interested parties (OFI-02), and a defined schedule for analysing monitoring data as distinct from collecting it (OFI-03) | ### Conclusions 1. **The ISMS is suitable and adequate for the Service, and its open items are structural rather than operational.** Every finding this period was a documentation defect. None was a control that failed, and one --- the restore-drill cadence --- was a control operating more often than the documents claimed. Documentation is what a customer relies on, so the gap between the two is worth closing on the cadence the audit programme now sets. 2. **Re-assessing R-02 and R-03 downward is the register working, not failing.** Both had been accepted on assurances that a closer look did not support. A register that only ever improves is a register nobody is testing. The corollary is that the accepted positions still carrying inherited assurance --- rather than verified evidence --- are the ones most likely to move next. 3. **The binding constraint is independence, not controls.** The largest open items on the ISMS --- A.5.35, Clause 9.2, and the recurring procurement ask at (c) --- are the same item. No further self-assessment closes any of them. Adding controls would not change the answer; commissioning an independent review would. 4. **The second constraint is the single-operator structure**, which holds Clause 7.1 (resources) at **Partial** and makes an impartial internal audit impossible. It is disclosed on [Trust](https://ethicsportal.eu/trust/#continuity-and-personnel) and carried as [risk register R-01](https://ethicsportal.eu/policies/risk-register/). 5. **The objectives carried no measures, so performance against them could not be concluded.** Corrected for the next cycle: each now has a target and a source. This is the finding with the longest tail, because it is what makes every future review capable of a conclusion. ### Decisions and actions | Ref | Decision | Owner | Target | |---|---|---|---| | MR-01 | Commission an independent external security review. It is the single action that closes A.5.35, moves Clause 9.2 off Partial, and answers the recurring procurement question. Scope, date and remediation summary to be published on [Trust](https://ethicsportal.eu/trust/#certification-status) when performed | Operator | 2027-06-30 (TP-05) | | MR-02 | Give each **In treatment** risk a dated completion target, closing OFI-01 and moving Clauses 6.1.3 and 8.3 off Partial | Operator | **Done 2026-09-23** --- [treatment plan](https://ethicsportal.eu/policies/risk-register/), five dated items | | MR-03 | Report each of the three objectives against its measure at the next management review, now that targets exist | Operator | 2027-09 review | | MR-04 | No change to the ISMS scope, the information security policy's substance, or the resourcing position. The scope at [IS policy §2](https://ethicsportal.eu/policies/information-security/) remains correct for the Service, and the resourcing constraint is disclosed rather than resolvable at present | Operator | — | | MR-05 | OFI-02 and OFI-03 accepted as open with no action this cycle. Both are presentational, and MR-01 takes priority over either | Operator | Reconsider at 2027-09 review | Accredited certification remains unpursued, and this review did not change that. Certification follows from the independence decision at MR-01; the [certification status](https://ethicsportal.eu/trust/#certification-status) page carries the current position in the meantime. --- ## Document control | Field | Value | |---|---| | Document title | EthicsPortal Management Review Record | | Version | 1.0 | | Effective date | 2026-09-23 | | Last reviewed | 2026-09-23 | | Next scheduled review | 2027-09-23 | | Review trigger (interim) | A material security incident; an audit finding that cannot be corrected within the audit that raised it; a change to the ISMS scope | | Owner | Yaroslav Shmarov, operator | | Distribution | Published on [ethicsportal.eu/policies/](https://ethicsportal.eu/policies/) | Signed: Yaroslav Shmarov, on behalf of EthicsPortal --- 2026-09-23. --- # Risk register > EthicsPortal's information-security risk register. Top risks assessed against the Service, current treatment, and residual position. Canonical: https://ethicsportal.eu/policies/risk-register/ Last updated: 2026-10-24 **Effective date:** 2026-05-21 **Last reviewed:** 2026-09-23 **Next review:** 2027-05-21 **Owner:** Yaroslav Shmarov, operator **Version:** 1.4 This register lists the top information-security risks assessed against EthicsPortal, the treatment in place, and the residual position the operator has consciously accepted. It exists so that a controller, auditor, or procurement reviewer can verify that the most material risks have been thought about, not just the ones convenient to mention. The register is a summary. The substantive treatment for each risk is documented on the [Security](https://ethicsportal.eu/security/) page, in the [Data Processing Agreement](https://ethicsportal.eu/dpa/), in the [Business continuity plan](https://ethicsportal.eu/policies/business-continuity/), or in the [Information security policy](https://ethicsportal.eu/policies/information-security/). The register's job is to make the trade-offs visible in one place. --- ## Assessment scale | Level | Impact | Likelihood | |---|---|---| | Low | Single-customer inconvenience; no personal-data exposure | Not expected during the review window | | Medium | Multi-customer service degradation, or personal-data exposure confined to operational metadata | Plausible during the review window | | High | Confidentiality breach of reporter identity or report content; or extended unavailability of a covered surface | Reasonably foreseeable in absence of treatment | The review window is twelve months from the effective date above. --- ## Residual-position vocabulary - **Accepted.** The residual risk after treatment is acknowledged and accepted by the operator as a deliberate trade-off. The reasoning is stated. - **Monitored.** The residual risk is acceptable today but is actively watched for change; specific indicators that would trigger re-treatment are stated. - **In treatment.** The risk is not yet treated to the operator's target level. The current state, the target, and the timeline are stated openly. --- ## Register ### R-01. Operator incapacity / single point of failure | Field | Value | |---|---| | Inherent impact | High | | Inherent likelihood | Medium | | Treatment | Self-service PDF case export is available while the Service remains reachable. [DPA §6.8](https://ethicsportal.eu/dpa/) preserves the Controller's deletion-and-return rights, but fulfilling an off-platform request currently depends on the sole operator. The deployment configuration is portable in principle, not a proven operator-incapacity handoff. | | Residual position | **In treatment.** A formal operator-incapacity protocol with a named legal contact is on the roadmap and not yet in place. See the [Business continuity plan §8](https://ethicsportal.eu/policies/business-continuity/) for what is and is not in place today. Self-service in-product export requires no operator involvement and is the primary continuity control against operator unavailability. | ### R-02. Hetzner outage (primary infrastructure provider) | Field | Value | |---|---| | Inherent impact | High | | Inherent likelihood | Low | | Treatment | Daily database dumps to Hetzner Object Storage (separate from compute host), encrypted with GnuPG symmetric AES-256 before upload, plus server-level snapshots; monthly restore drill into a disposable environment that decrypts, restores and confirms the application can read the restored data ([Security#backups-and-restore](https://ethicsportal.eu/security/#backups-and-restore)). Off-provider recovery remains unverified. | | Residual position | **In treatment.** Cross-provider hot failover is absent. A provider-wide outage and sole-operator unavailability could prevent the published four-hour recovery objective; the current drill has not measured full-service recovery. Whole-dump encryption was established on 2026-09-23 and attachment-at-rest encryption on 2026-10-06; the monthly drill exercises both. Since 2026-10-06 attachments are also copied to Hetzner Falkenstein, which covers the loss of one location but not of the provider, so a measured off-provider recovery is still required before this risk can be accepted as controlled. | ### R-03. Sub-processor personal-data breach | Field | Value | |---|---| | Inherent impact | Medium--High (varies by sub-processor and data category) | | Inherent likelihood | Low | | Treatment | Defined database fields use application encryption; supplier disclosures and the 30-day sub-processor notice/objection mechanism are published ([Security#data-encryption](https://ethicsportal.eu/security/#data-encryption), [DPA §6.4](https://ethicsportal.eu/dpa/)). Mailjet receives reporter email, the Case ID and a link when reporter notifications are chosen, and also a one-time password in the receipt for a report sent by email. AppSignal receives telemetry; the reporter-controller namespace exclusion was confirmed against AppSignal's own action inventory on 2026-09-23, but sample contents and other paths remain to be checked (TP-01). | | Residual position | **In treatment.** An EU-based direct supplier does not prove an EU-only downstream chain. Mailjet's sensitive-data permission, account DPAs, support access, restricted transfers, whole-object encryption and telemetry samples remain unverified. Do not assert that every supplier receives only non-identifying data. | ### R-04. Operator credential theft / account compromise | Field | Value | |---|---| | Inherent impact | High | | Inherent likelihood | Low | | Treatment | Hardware-backed two-factor authentication on operator accounts with production access. Production database access requires the operator's authenticated session; credentials are not embedded in code or shared. An append-only audit log records defined report and account events, not every read or action; a privileged database operator could still alter the database-level control ([Security#audit-and-compliance](https://ethicsportal.eu/security/#audit-and-compliance)). | | Residual position | **Monitored.** The risk is materially lower than typical SaaS because there are no employee credentials to compromise --- the attack surface reduces to one identity. Monitored via AppSignal alerts for anomalous handler-portal authentication patterns. Trigger for re-treatment: a credible phishing attempt against the operator, or a CVE affecting the hardware-key path. | ### R-05. Restore failure during disaster recovery | Field | Value | |---|---| | Inherent impact | High | | Inherent likelihood | Low | | Treatment | Three complementary backup layers (database dump, server-level snapshot, and a copy of every encrypted file attachment in a second Hetzner location) in independent retention scopes. Restore drill performed monthly, automated, into a disposable environment; it decrypts the dump, restores it, compares every table against production, and boots the application against the restored data to confirm an encrypted column still decrypts and that attachments open, from both locations, with the keys in the dump --- row counts alone would not reveal a dump whose encryption key no longer matches. Restore procedure documented in the [Business continuity plan §6](https://ethicsportal.eu/policies/business-continuity/). | | Residual position | **Accepted.** RPO 24 hours and RTO 4 hours are stated in the [SLA](https://ethicsportal.eu/sla/#recovery-objectives). Data written within the 24 hours preceding a catastrophic failure may be lost; this trade-off is disclosed. | ### R-06. Reporter network-side attribution leak (outside processor boundary) | Field | Value | |---|---| | Inherent impact | Medium | | Inherent likelihood | Medium | | Treatment | The Service does not store reporter IP addresses with reports, messages or audit records, and application logs for reporter routes contain no IP addresses; rate limiting uses a keyed, pseudonymous hash kept only for the rate-limit window. The TLS proxy's own connection logs include IP addresses and request paths; the path of a reporter's report page contains its Case ID. File uploads have metadata stripped (EXIF / GPS / author) server-side before storage. See [Security#anonymity-and-privacy](https://ethicsportal.eu/security/#anonymity-and-privacy). | | Residual position | **Accepted.** Network-side attribution (the reporter's ISP, the reporter's employer's egress proxy, a man-in-the-middle, or a corporate-device endpoint agent) is outside the processor boundary and cannot be controlled by the Service. Reporters are informed of this in the whistleblowing channel and may choose to report from a personal device on an external network, or via Tor. This residual is disclosed to reporters at the point of submission, which is the only place the trade-off can be acted upon. | ### R-07. Critical vulnerability in upstream dependency | Field | Value | |---|---| | Inherent impact | Medium--High | | Inherent likelihood | Medium | | Treatment | Continuous SCA on every change: [Brakeman](https://brakemanscanner.org) for Rails-specific issues, [bundler-audit](https://github.com/rubysec/bundler-audit) for Ruby advisories, `importmap audit` for JavaScript imports, [Dependabot](https://docs.github.com/en/code-security/dependabot) for weekly grouped updates. End-of-life components are replaced before their upstream support window closes. See [Security#secure-development-lifecycle](https://ethicsportal.eu/security/#secure-development-lifecycle) and [Security#dependency-and-patch-management](https://ethicsportal.eu/security/#dependency-and-patch-management). Documented vulnerability-response timelines: critical 7 days, high 30 days, medium 90 days. | | Residual position | **Monitored.** The Rails ecosystem is well-staffed for security disclosures. Trigger for re-treatment: a zero-day affecting Rails request-handling, ActiveRecord encryption, or PostgreSQL with no available patch. | ### R-08. Audit-log integrity compromise | Field | Value | |---|---| | Inherent impact | High | | Inherent likelihood | Low | | Treatment | Audit-log entries are append-only and cannot be edited or selectively deleted by any application user, including organization administrators. PostgreSQL triggers reject changes to core audit content and table truncation even when Rails callbacks are bypassed; their presence is checked against the deployed database through the authenticated operational healthcheck. Required foreign-key nullification remains possible when a related record is erased, and entries are included in PDF case exports for regulatory review. See [Security#audit-and-compliance](https://ethicsportal.eu/security/#audit-and-compliance). | | Residual position | **Accepted.** The trail is not hash-chained, WORM-backed, or independently replicated. A privileged database operator could disable or drop the triggers, or issue a direct deletion outside the application-controlled retention and GDPR erasure paths. Production database access controls and the privileged-access procedure govern that residual risk; the public append-only claim is limited to application users and the protected database write paths described above. | ### R-09. Reporter password loss | Field | Value | |---|---| | Inherent impact | Medium | | Inherent likelihood | Medium (reporters are anonymous and may not have password-recovery channels) | | Treatment | The password is generated by the system, stored only as a bcrypt digest, so nobody can recover it, and EthicsPortal has no feature that lets the operator or a handler reset it. Reporters are informed at submission that the password is non-recoverable. A reporter who loses it submits a new report and mentions the Case ID. Handlers may invite a reporter to re-submit or continue the conversation by an alternative channel. | | Residual position | **Accepted by design.** Recoverability of the password is incompatible with the reporter-anonymity model: a recovery channel would require an identifier (email, phone) that defeats anonymity, or an operator-side reset that would allow the operator to impersonate the reporter. The trade-off is disclosed to reporters when the password is shown at submission. | ### R-10. Regulatory change requiring re-architecture | Field | Value | |---|---| | Inherent impact | Medium--High | | Inherent likelihood | Medium (Member-State transpositions and AI-Act delegated acts continue to evolve) | | Treatment | Interpretive positions on ambiguous Directive 2019/1937 provisions are documented openly in the [Directive 2019/1937 interpretations](https://ethicsportal.eu/directive-interpretations/), so a controller can verify alignment with their counsel's reading before subscribing. Per-country law summaries are published in [whistleblower laws by country](https://ethicsportal.eu/whistleblower-laws/) and reviewed when national-law text changes. Material changes to processing (sub-processors, AI use, transfers) are notified to controllers under [DPA §6.4](https://ethicsportal.eu/dpa/). | | Residual position | **Monitored.** Trigger for re-treatment: ECJ judgment on a Directive 2019/1937 question that contradicts a published interpretation; CJEU judgment on international-transfer adequacy affecting an EU sub-processor; AI-Act delegated act extending obligations to AI-free processors. | --- ## Risks consciously not in this register The following are recognized risk categories that this register deliberately omits because they are eliminated by design rather than treated: - **AI / LLM exposure of report content.** No LLM, generative-AI, or AI-classifier service is engaged as a sub-processor. Report content is not transmitted to such services for any purpose. The attack surface (prompt injection, hallucinated compliance evidence, unauthorized retention by third parties) is therefore not present. Source: [DPA §6.10](https://ethicsportal.eu/dpa/). - **Reporter PII shared with handlers without justification.** The Service does not surface reporter IP, browser fingerprint, or device identifiers to handlers, because none of these are collected or stored. - **Cross-tenant data leakage at the application layer.** Pundit-policy authorization is checked on every controller action; multi-tenant isolation is enforced at the request boundary, not via row-level visibility filters that can be bypassed. If any of these design constraints changes, the risk re-enters this register. --- ## Treatment plan Clause 6.1.3 requires a risk treatment plan, and a residual position of **In treatment** means nothing without a date against it: an open item with no target is indistinguishable from one nobody intends to close. Every risk carrying that position appears below, with the control it moves and the date it is owned to. | Ref | Risk / control | Action | Target | |---|---|---|---| | TP-01 | R-03; A.5.14, A.8.12, A.8.16 | Verify the supplier chain at account level: executed DPAs, current sub-processor lists, transfer mechanisms, Mailjet's sensitive-data permission, and a sample of the telemetry AppSignal actually receives. *Part done 2026-09-23:* AppSignal's own records confirm no reporter-portal controller is instrumented; the contents of stored samples, and both other suppliers, remain outstanding | 2026-11-30 | | TP-02 | R-02; A.8.13 | Encryption at rest for file attachments, the remaining half of the backup gap now that database dumps are encrypted. *Done 2026-10-06:* per-file keys, existing files re-encrypted, and the drill opens one attachment from the restored dump | 2027-01-31 | | TP-03 | R-01 | Operator-incapacity protocol with a named legal contact, replacing the present position that self-service export is the only control | 2027-03-31 | | TP-04 | R-02; A.5.30 | Restore into a provider other than Hetzner and measure it against the published four-hour RTO | 2027-03-31 | | TP-05 | A.5.35; Clause 9.2 | Commission an independent external security review, per [management review MR-01](https://ethicsportal.eu/policies/management-review/). *Started 2026-10-18:* an independent whitebox assessment is under way; the item closes when its report is issued | 2027-06-30 | All five are owned by the operator; there is nobody else to assign them to, which is the substance of R-01 and of the Clause 7.1 resourcing position. **When a target is missed.** It is recorded as missed at the next [management review](https://ethicsportal.eu/policies/management-review/), with the reason and a new date, and this table is updated to show both. A target that quietly moves is worse than no target, because it converts a commitment into a decoration. --- ## Review cadence | Trigger | Action | |---|---| | Annual | Full review of every register row; residual positions re-affirmed or revised | | Material architecture change | Affected rows reviewed and revised in the same change | | Sub-processor added or replaced | R-03 reviewed; new row added if the change introduces a category not already represented | | Material incident in the [incident register](https://ethicsportal.eu/incidents/) | Root-cause-relevant rows reviewed; treatment updated if the incident revealed a control gap | | Material change to the [Information security policy](https://ethicsportal.eu/policies/information-security/) or [Business continuity plan](https://ethicsportal.eu/policies/business-continuity/) | Affected rows reviewed for consistency | | Finding raised at [internal audit](https://ethicsportal.eu/policies/internal-audit/) or [management review](https://ethicsportal.eu/policies/management-review/) | Affected rows reviewed; a decision recorded against the register is actioned here | Review actions are recorded in the document-control section below. --- ## Document control | Field | Value | |---|---| | Document title | EthicsPortal Risk Register | | Version | 1.4 | | Effective date | 2026-05-21 | | Last reviewed | 2026-09-23 | | Next scheduled review | 2027-05-21 | | Owner | Yaroslav Shmarov, operator | | Distribution | Published on [ethicsportal.eu/policies/](https://ethicsportal.eu/policies/) | Signed: Yaroslav Shmarov, on behalf of EthicsPortal --- 2026-09-23. --- # Pricing > Review current EthicsPortal pricing for EU whistleblower software, including billing options, included features and the refund policy for new subscriptions. Canonical: https://ethicsportal.eu/pricing/ Last updated: 2026-11-10 One plan. Everything included. No per-employee fees, no add-ons. | Pricing | EUR | | --- | --- | | Monthly | 60 /month | | Yearly | 500 / year (41.67 / month) | Excluding VAT 30-day money-back guarantee. ## Everything included - Unlimited reports, users, and file uploads - Anonymous reporting with encrypted two-way messaging - Reports by email to each whistleblowing channel's own address - EU deadline tracking (7-day acknowledgement, 3-month feedback) - Complete, append-only audit trail - Configurable data retention with automatic deletion - PDF case export - Automatic file metadata stripping (EXIF and GPS) - Whistleblowing channel in 14 languages - Your logo, brand color, and QR code - Single sign-on (SSO) and SCIM provisioning --- # Privacy policy > Privacy policy for EthicsPortal — how we collect, use, store, and protect your personal information. Canonical: https://ethicsportal.eu/privacy/ Last updated: 2026-10-30 **Effective date:** February 17, 2026 **Last updated:** October 28, 2026 ## 1. Introduction EthicsPortal ("we", "us", "our") is a trade name used by Yaroslav Shmarov, a sole proprietor (jednoosobowa działalność gospodarcza) registered in Poland (NIP: 5272755790), at ul. Obrzeżna 1A, 02-691 Warsaw, Poland. This Privacy Policy describes how we collect, use, store, and protect your personal information when you use EthicsPortal at [ethicsportal.eu](https://ethicsportal.eu) (the "Service"). This notice explains our processing; it is not a request for consent. The only processing based on consent is optional marketing email, which you opt into separately and may withdraw at any time. **Contact:** [privacy@ethicsportal.eu](mailto:privacy@ethicsportal.eu) Baseline contracting-party information is published on the [trust](https://ethicsportal.eu/trust/) page. ## 2. Information we collect ### 2.1 Account information When you create an account, we collect: - Email address - Display name (if provided) - Locale preference Staff sign in without a password --- we use magic links (one-time codes sent to your email), so we do not collect or store staff passwords. A reporter who wants to follow their report online gets a password generated by the system, which is stored only as a bcrypt hash. We use registration-source information to understand how customers discover EthicsPortal and measure the effectiveness of our marketing. ### 2.2 Payment information Subscription and billing payments are handled through Stripe-hosted Checkout and Billing Portal. We provide Stripe with the account email address and internal organization and customer identifiers needed to create and manage the subscription. Stripe directly collects the payer's name, billing address, tax ID, and payment-method details. We do **not** receive or store full card or bank-account numbers. For payment facilitation, Stripe processes personal data on our behalf. Stripe also processes some data as an independent controller for purposes it determines, including fraud prevention, regulatory compliance, and payment-network operation. Those activities are governed by [Stripe's Privacy Policy](https://stripe.com/privacy). ### 2.3 Server logs Our servers automatically record information when you access the Service, including: - IP address - Browser type and version - Pages visited and timestamps - Referring URL Server logs are used for security monitoring and debugging. They are not used for advertising or tracking. For the whistleblowing channel specifically, application logs contain no reporter IP addresses. The TLS proxy in front of the application keeps short-lived connection logs, including IP addresses, for security purposes. ### 2.4 Whistleblower report data When a whistleblower submits a report through an organization's whistleblowing channel, we collect: - Report description, category, and source - Reporter name and contact information (if voluntarily provided) - Messages exchanged between the reporter and the organization Report descriptions, reporter names, reporter contact details, and message contents are **encrypted in the database** using application-level encryption. Reporter IP addresses are not stored with reports, messages or audit records. Rate limiting uses a **pseudonymized**, keyed hash of the IP that is kept only for the rate-limit window. Application logs for the whistleblowing channel contain no IP addresses. ### 2.5 Personal data of third parties named in reports A whistleblower report may contain personal data about other people --- for example, the person a report concerns, or witnesses. For this report data, EthicsPortal acts as a **processor** on behalf of the customer organization, which is the **controller**. The organization is responsible for the lawfulness of this processing and for providing any information required under Article 14 GDPR to the individuals concerned. In line with Article 14(5)(b) GDPR and the confidentiality requirements of the EU Whistleblower Directive (2019/1937), notifying a named individual may be deferred or restricted where doing so would prejudice an investigation or compromise the protection of the whistleblower's identity. ## 3. How we use your information and our legal basis | Purpose | Data | Legal basis (Art. 6(1) GDPR) | |---|---|---| | Create and operate your account and your organization's workspace | Account information, organization settings | (b) contract | | Send emails about your account and your organization's cases | Email address, name, notification content | (b) contract | | Bill subscriptions and keep invoices and payment records | Account email, billing identifiers; payer details collected by Stripe | (b) contract; (c) legal obligation for tax and accounting records | | Keep the Service secure and prevent fraud, abuse and unauthorized access | Server logs, sign-in and session records, audit logs, pseudonymized IP hashes for rate limiting | (f) legitimate interest in protecting the Service and its users | | Keep the organization's audit trail of handling activity | Audit entries with actor name, email and IP for authenticated actions | (f) legitimate interest of the customer organization and of EthicsPortal in proving how cases were handled | | Diagnose errors and improve the Service | Error reports and request metadata (AppSignal) | (f) legitimate interest in a working Service | | Send product news and marketing emails, only if you opted in | Email address, time of opt-in | (a) consent, withdrawn at any time in your account settings | | Learn how customers found EthicsPortal | Registration source, campaign tags, your optional answer to "how did you hear about us" | (f) legitimate interest in measuring our marketing | | Count visits to the public website | Plausible statistics (section 4) | (f) legitimate interest in audience measurement; you can opt out (section 5) | | Answer requests to exercise your rights | Your request and the data needed to verify it | (c) legal obligation | | Assess job applications | See section 12 | (b) pre-contract steps; (f) legitimate interest | Where we rely on legitimate interest, you may object at any time (section 8). We do **not** sell your personal information. We do **not** use your data for personalized advertising. We do not use automated decision-making that has legal or similarly significant effects on you. ## 4. Third-party services We share data with the following third-party services, only as necessary to provide the Service: | Service | Purpose | Data shared | |---------|---------|-------------| | **Stripe** | Subscription billing and payment processing | Account email and internal organization/customer identifiers; payer name, billing address, tax ID, and payment-method details collected directly by Stripe | | **Hetzner** | Hosting, database and file storage (Germany) | All application data, including uploaded files, and the IP addresses of people using the application | | **Mailjet** | Transactional email delivery, including optional reporter receipts and new-message notices | Recipient email address and message content; reporter notices include the Case ID and a link but not the report narrative; the receipt for a report sent by email also includes a one-time password | | **Cloudflare** | Public-site CDN and DDoS protection | Visitor IP address and request headers for delivery and security | | **Plausible Analytics** | Website audience measurement (EU-hosted, Germany) | Page views, referrer, browser type, country and site events such as demo bookings. No cookies; IP addresses are not stored. Loaded only on the public marketing website --- never on the application or the whistleblowing channel. See [Plausible's Data Policy](https://plausible.io/data-policy) | | **Zoho** | Email, customer records and demo booking calendar | Emails you send us, your contact details and meeting bookings | | **AppSignal** | Error and exception tracking, application performance monitoring | Error details and request context from production; reporter portal requests are configured to be excluded from AppSignal transaction monitoring | Each third-party service is governed by its own privacy policy. We encourage you to review them. ## 5. Cookies and website analytics The application ([secure.ethicsportal.eu](https://secure.ethicsportal.eu/)) uses only first-party cookies needed to sign you in, keep you signed in, and remember your settings: | Cookie | Purpose | Duration | |--------|---------|----------| | `_ethicsportal_session` | Session management (authentication) | 30 days | | `session_token` | Signed session identifier for persistent login | Server-side session expires after 14 days of inactivity | | `remembered_email` | Pre-fills your email address on the sign-in page (encrypted) | 1 year | | `locale` | Stores your language preference | 1 year | | `timezone` | Shows dates and times in your local time zone | Until you close the browser | | `pending_authentication_token` | Links a magic-link sign-in to the browser that requested it | 15 minutes | | `pending_two_factor_token` | Carries a sign-in through the two-factor step | 5 minutes | | `pending_email_change_token` | Links an email change to the browser that requested it | Until the verification link expires | | `saml_flow` | Carries a single sign-on (SAML) handshake back from your identity provider (encrypted) | 10 minutes | We do **not** use third-party tracking cookies or advertising cookies. The public website sets no cookies. Its audience measurement (Plausible, section 4) works without cookies, and you can exclude your visits in this browser: To exclude your visits from website analytics, use the button on the web version of this page. ## 6. Data storage and security - **Server location:** Core application data is hosted by Hetzner in Nuremberg, Germany (European Union) - **Encryption in transit:** All connections use HTTPS/TLS - **Encryption at rest:** Whistleblower report data (descriptions, reporter names, contact details, messages) is encrypted in the database using Active Record Encryption - **Passwordless staff sign-in:** Staff use magic links, so no staff passwords are stored. Reporter passwords are generated by the system and stored only as a bcrypt hash - **Access control:** Database access is restricted to authorized personnel only While we take reasonable measures to protect your data, no method of transmission or storage is 100% secure. If you discover a security vulnerability, please contact us at [security@ethicsportal.eu](mailto:security@ethicsportal.eu). ## 7. Data retention - **Account data** is retained for as long as your account is active - **Organization data** is retained while your organization is active - **Whistleblower reports** --- closed or dismissed reports are automatically deleted after the retention period configured by the customer organization (12, 24, 36, 48, or 60 months). Active and ongoing reports are retained until closed; a report left with no activity for 18 months is closed automatically, which starts the retention period - **Email send records** --- for invitations and notifications to staff: the encrypted recipient address, the type of email and the send time, never the subject or content. Records linked to an organization are deleted with it; records linked to no organization are deleted 90 days after sending. Sign-in emails and emails to reporters are not recorded - **Server logs** are overwritten as they fill. The proxy log, which holds IP addresses, is currently overwritten after about two days. Application logs hold no IP addresses - **Payment records** are retained as required by applicable tax and accounting laws - **Audit logs** --- defined report and account events are retained for compliance purposes, including which handler viewed which report (one entry per handler per report per 24 hours); reads of other pages are not logged. Audit entries are kept for as long as the organization exists and are deleted with it When you close your account, account-access data is removed. Limited attributed records may remain under the Controller's documented retention instructions, applicable legal obligations, or the establishment, exercise or defence of legal claims. Section 9 sets out what remains and why. ## 8. Your rights under GDPR Because we are based in the European Union, the General Data Protection Regulation (GDPR) applies. You have the right to: - **Access** --- request a copy of the personal data we hold about you - **Rectification** --- request correction of inaccurate data - **Erasure** --- request deletion of your data ("right to be forgotten") - **Restriction** --- request that we limit how we process your data - **Data portability** --- request your data in a structured, machine-readable format - **Object** --- object to processing of your data - **Withdraw consent** --- withdraw consent at any time where processing is based on consent - **Lodge a complaint** --- lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or with our lead authority, the Polish President of the Personal Data Protection Office ([UODO](https://uodo.gov.pl/en), ul. Stawki 2, 00-193 Warsaw) **How to exercise your rights:** You can manage most of your data directly through your account settings. To delete your account, visit your account settings page. For any other requests, email us at [privacy@ethicsportal.eu](mailto:privacy@ethicsportal.eu). **If you submitted a whistleblower report:** the organization whose whistleblowing channel you used is the controller of that report, and EthicsPortal acts as its processor. You can access and download a full copy of your report at any time through the online reporting form using your Case ID and password. To correct information, add a message to your report; for any other request, contact the organization (we will assist it as processor). Erasure may be limited by the Controller's documented retention decision and any applicable legal obligation or legal-claims exception. **Data protection contact:** Inquiries regarding our data protection practices may be directed to [privacy@ethicsportal.eu](mailto:privacy@ethicsportal.eu). ## 9. Account and data deletion You can close your account at any time from your account settings. Your email address is replaced with a non-routable placeholder, and your two-factor credentials, active sessions, API tokens, language preference, and marketing preferences are permanently removed. You can no longer sign in, and we can no longer contact you through the Service. If your account never acted inside an organization, the account record is deleted outright. If it did, your memberships are deactivated rather than deleted, and the case notes, messages, and audit entries attributed to them remain to preserve attribution in the organization's compliance record. The Controller determines the retention period under its documented instructions and applicable law; GDPR erasure rights remain subject to any applicable exceptions for legal obligations or legal claims. Three things therefore survive closure: - **Your profile picture is deleted when you close the account. Your name remains with attributed activity** while the relevant organization retains that compliance record. It is retained only to identify who handled the recorded activity, not for authentication or contact. - **Audit entries retain your name, email address, and the request IP address for authenticated actions.** Reporter IP addresses are excluded. Organization administrators cannot edit or individually delete the append-only audit trail; entries are deleted with the organization. - **Data exports created before your request persist for up to 7 days**, after which they are deleted automatically. Deletion is refused while you own an organization, are its only administrator, or are its designated compliance officer. Transfer or reassign the role first. ## 10. Children's privacy Customer accounts are not directed at children under 16. An organization's whistleblowing channel may nevertheless receive a report from a minor where the organization makes that channel available. The organization is the Controller of report data and decides how a deletion request is handled; we assist it as processor. For personal data that we control directly, contact [privacy@ethicsportal.eu](mailto:privacy@ethicsportal.eu) and we will assess and act on the request under applicable law. ## 11. International data transfers Core whistleblower report data is stored on servers in Germany (EU). The public marketing site is delivered through Cloudflare (United States); the whistleblowing channel and handler portal are not. This public-site processing is outside the customer-instructed reporting-data processing chain covered by the DPA. For transfers of public-site data from the EEA to the United States, Cloudflare states that it relies on the EU-U.S. Data Privacy Framework and, if its certification lapses or is invalid, Standard Contractual Clauses with supplementary measures under the [Cloudflare Customer DPA](https://www.cloudflare.com/cloudflare-customer-dpa/). Mailjet and AppSignal are EU-based. Where their own providers process data outside the EEA, those transfers are subject to the safeguards of GDPR Chapter V (see the [DPA](https://ethicsportal.eu/dpa/#9-international-data-transfers)). Our email, customer records and demo booking calendar are hosted by Zoho in the United States. Transfers to Zoho are subject to the safeguards of GDPR Chapter V. Stripe Payments Europe is established in Ireland, but Stripe may process billing and payment data in other countries. Stripe states that it uses the applicable lawful transfer mechanisms, including adequacy decisions and Standard Contractual Clauses, as described in the [Stripe Data Processing Agreement](https://stripe.com/legal/dpa). ## 12. Job applicants When you apply for a role with us (for example, by emailing [careers@ethicsportal.eu](mailto:careers@ethicsportal.eu)), we collect and process: - Your name and contact details - Your CV, application message, and anything you choose to tell us about your experience - Notes from any interviews or conversations during the hiring process **Legal basis:** processing is necessary to take steps at your request prior to entering a contract, and our legitimate interest in assessing candidates and running a fair hiring process. We do not ask for, and ask that you do not send, special-category data (such as health, religion, or trade union membership) or your pay history from previous roles. **Retention:** we keep application data only as long as needed to assess your application and fill the role. If you are not hired, we delete your application data after the process closes, unless you ask us to keep it on file for future roles, in which case we hold it for up to 12 months. You have the same GDPR rights over your application data as set out in section 8. To exercise them, or to ask us to delete your application, email [privacy@ethicsportal.eu](mailto:privacy@ethicsportal.eu). ## 13. Changes to this policy We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through an in-app notification. The "Last updated" date at the top of this page indicates when the policy was last revised. This policy is a notice, not a contract, and does not require acceptance. Changes apply from the stated effective or last-updated date, subject to any notice required by applicable law. ## 14. Contact us If you have questions about this Privacy Policy or want to exercise your data rights, contact us at: **General:** [support@ethicsportal.eu](mailto:support@ethicsportal.eu) **Privacy / GDPR rights:** [privacy@ethicsportal.eu](mailto:privacy@ethicsportal.eu) **Data protection contact:** [privacy@ethicsportal.eu](mailto:privacy@ethicsportal.eu) **Security disclosures:** [security@ethicsportal.eu](mailto:security@ethicsportal.eu) **Legal / DPA:** [legal@ethicsportal.eu](mailto:legal@ethicsportal.eu) **Location:** Warsaw, Poland --- # How EthicsPortal works > Deploy a secure whistleblowing channel for EU Directive 2019/1937 compliance, with whistleblowing channel configuration, case management, and audit exports included. Canonical: https://ethicsportal.eu/product/ Last updated: 2026-11-04 ## Deployment workflow ### 1. Configure your whistleblowing channel Set up the organization account, then configure: - **Organization name and logo:** your whistleblowing channel, your identity - **Report categories:** fraud, harassment, safety, or define your own - **Data retention period:** 12, 24, 36, 48, or 60 months, then auto-deleted Your whistleblowing channel is assigned a unique URL as soon as configuration is saved. ![Whistleblowing channel configuration screen](https://ethicsportal.eu/images/screenshots/en-portal-edit.webp) ### 2. Share the link Every whistleblowing channel gets a **shareable link** and a **QR code**. Put the QR code in break rooms, bathroom stalls, the employee handbook, onboarding packs. Employees access it from any browser. No app, account, or company network is required. Every whistleblowing channel also has its own **email address**. Reporters who prefer to write from their own mail app send their report there, and it arrives as a case like any other. See EthicsPortal's own whistleblowing channel in production: [secure.ethicsportal.eu/p/R8HXGNHO](https://secure.ethicsportal.eu/p/R8HXGNHO). ![Share whistleblowing channel link and QR code](https://ethicsportal.eu/images/screenshots/en-portal-public-desktop.webp) ### 3. Operate the case workflow When a report comes in, you get an email notification. From the dashboard, manage every case in one view: - **Assign and triage:** route cases to the right handler and set a priority (low, normal, high, urgent) at assessment - **Filter and search:** find cases by status, category, or deadline - **Reports by email:** emails sent to the channel's address become cases automatically. Handlers never see the sender's address, and the reporter gets a Case ID and password for the secure inbox. It is on by default, and the organization can switch it off. [How it works](https://ethicsportal.eu/security/#reports-by-email) - **Log external reports:** received a report by phone, by letter, or in person? Create it manually so everything lives in one place. If the reporter wants to follow the case online, EthicsPortal generates a one-time password for you to pass on ![Reports dashboard with case list, filters, and status](https://ethicsportal.eu/images/screenshots/en-reports.webp) Open a case to handle it end-to-end: - **Read the full report:** description, category, structured intake answers, and uploaded files. Reports flagging a retaliation concern carry a prominent urgency badge (Directive Art. 19) - **Acknowledge receipt:** the Directive requires this within 7 days. EthicsPortal tracks the deadline and flags overdue cases automatically - **Communicate with the reporter:** secure two-way messaging, which the reporter opens with a Case ID and password. The reporter stays anonymous, your handler names are never revealed - **Provide feedback:** the Directive requires this within 3 months. Tracked automatically - **Add internal notes:** notes invisible to the reporter, visible to your team - **Export to PDF:** generate a complete case file for legal review, auditors, or compliance documentation ![Individual case view with secure messaging, deadlines, and audit trail](https://ethicsportal.eu/images/screenshots/en-report.webp) --- ## What reporters experience The reporter's experience matters because it determines whether people actually use the channel. - **No account, no app, no login.** Just a browser on any device, including a personal phone on mobile data - **Fully anonymous by default.** No reporter IP addresses stored with reports or in application logs. File metadata (EXIF, GPS, author) stripped automatically before storage - **Optional identity disclosure.** Reporters can share their name if they choose to. It is never required - **Or send an email.** Reporters can also email the channel's address. Email is not anonymous, so the reply they get points to the online reporting form for anyone who needs anonymity - **Optional guided questions.** A short, skippable set of Directive-aligned questions — relationship to the organization (Art. 4), how they know, when it happened, whether it was reported before, and whether they fear retaliation (Art. 19) — helps handlers triage. Every question is optional, so anonymity is never compromised by a required answer - **Case ID and password.** After submission the reporter receives a Case ID (`WB-XXXX-XXXX`) and a password generated by the system. Both are required to check back for updates and respond to handler messages - **Handler names are never shown.** The reporter sees "Case handler" and nothing more ![Anonymous reporting form](https://ethicsportal.eu/images/screenshots/en-guide-new-report.webp) **1** Description · **2** Attachments (optional) · **3** I have read and understood the privacy notice · **4** Submit report ![Report submitted: Where to come back, Case ID, Password](https://ethicsportal.eu/images/screenshots/en-guide-receipt.webp) **1** Where to come back · **2** Case ID · **3** Password When reporters return to check their case, they enter their Case ID and password and see only what they need: status, handler messages, and any files they uploaded. Handler identities stay hidden behind a generic "Case handler" label. ![Reporter's view of their submitted case with secure two-way messaging](https://ethicsportal.eu/images/screenshots/en-guide-report.webp) **1** Messages · **2** Message · **3** Exit The [reporter guide](https://ethicsportal.eu/blog/how-to-report-anonymously/) walks through the whole flow in five steps. Send it to your staff together with the link to your whistleblowing channel. --- ## What's under the hood Every technical decision serves one purpose: keeping you compliant and your reporters protected. - **Encrypted at rest.** Report text, reporter details and messages are encrypted in the database, and attached files are encrypted with a separate key per file - **Virus scanning.** All uploaded files are scanned for malware server-side. Infected files are removed automatically - **Append-only audit trail.** Every action is logged. Entries cannot be modified after creation. Auditors get who did what, when - **Two-factor authentication.** TOTP-based 2FA for handler and admin accounts, via any standard authenticator app. Reporters sign in with their Case ID and a password generated by the system, stored only as a bcrypt digest - **Automatic deadline tracking.** 7-day acknowledgment and 3-month feedback deadlines with overdue notifications - **EU-hosted report data.** Core report data is stored on Hetzner servers in Nuremberg, Germany, with a backup copy of file attachments in Falkenstein, Germany. The marketing site is delivered via Cloudflare (CDN, United States); the whistleblowing channel and handler portal are not. Separate public-site processing is disclosed in the [Privacy Notice](https://ethicsportal.eu/privacy/) - **SCIM 2.0 provisioning.** Connect your identity provider — Okta, Microsoft Entra ID, or any SCIM 2.0 directory — to provision case handlers automatically and deprovision them the moment they leave your organization, closing their access to reports. Generate and rotate the connection token in organization settings and set the role new users receive - **SAML 2.0 single sign-on (SSO).** Let your team authenticate through your identity provider — Okta, Microsoft Entra ID, or any SAML 2.0 provider. Configured per organization across one or more email domains, with optional enforcement (require SSO for those domains) and optional just-in-time provisioning of members on first sign-in - **No tracking.** No analytics, no tracking cookies, no third-party scripts on the whistleblowing channel --- For the article-by-article map of how each feature satisfies the Directive, see the [Directive 2019/1937 coverage map](https://ethicsportal.eu/directive-coverage/). For interpretive positions on the Directive's ambiguous provisions, see the [Directive 2019/1937 interpretations](https://ethicsportal.eu/directive-interpretations/). --- # Refund policy > Read the EthicsPortal refund policy for new subscriptions: eligibility for the 30-day money-back guarantee, how to request a refund and processing times. Canonical: https://ethicsportal.eu/refunds/ Last updated: 2026-10-27 EthicsPortal offers a 30-day money-back guarantee on new subscriptions. ## Eligibility - The guarantee covers the first paid subscription per organization, monthly or annual. - The refund window is 30 days from the date of the first paid charge. - The guarantee applies once per organization. Subsequent renewals are not covered. ## How to request a refund Email [support@ethicsportal.eu](mailto:support@ethicsportal.eu) from the address associated with your organization account, within the 30-day window. Include the organization name and the date of the charge. Refunds are processed to the original payment method via Stripe and typically appear within 5--10 business days, depending on your bank. ## After the 30-day window After 30 days, subscriptions are non-refundable. You can cancel at any time from your billing settings; the cancellation takes effect at the end of the current billing period, and you retain access until then. ## Free trial EthicsPortal does not offer a free trial. The 30-day money-back guarantee serves the same purpose: set up your whistleblowing channel, evaluate it in production, and request a refund within 30 days if it does not meet your needs. ## Related - [Terms of Service §5](https://ethicsportal.eu/terms/) - [Pricing](https://ethicsportal.eu/pricing/) --- # Self-conducted security testing > Scope, dates, findings, and remediation for the security testing EthicsPortal performs on itself. First-party testing, not an independent audit. Canonical: https://ethicsportal.eu/security-testing/ Last updated: 2026-11-08 **This is first-party testing.** It is performed by the operator, not by an independent assessor, and it does not substitute for the independent external penetration test recorded on [Trust](https://ethicsportal.eu/trust/#certification-status). It is published because the substance is useful to a reviewer even where the independence is missing. Last updated: 2026-10-18. --- ## Testing performed | Date | Type | Scope | Outcome | |---|---|---|---| | 2026-05-26 | Code-level security assessment | Static analysis, dependency audit, and manual review of authentication, authorization, and file handling | Upload handling identified as the highest-risk area. Findings tracked in the issue tracker and remediated: server-side attachment-count limits, direct-upload authorization, and parameter and IP scrubbing in logs | | 2026-05-26 | External production test, non-destructive | Response headers, TLS configuration, public pages, and metadata probes against the production host | Response-header coverage gaps and missing security-contact metadata; reliance on third-party asset CDNs assessed as medium risk. Remediated 2026-05-27: security-contact metadata published, content-type sniffing protection extended to static assets | | 2026-06-09 | Authentication review | Cookie handling, session lifecycle, magic-link and invitation flows | Two informational findings. Remediated 2026-06-14: the pending-authentication cookie moved to an encrypted store so the address is not readable client-side; the session cookie's stated expiry now matches the 14-day server-side idle timeout. One low-severity finding: whistleblowing channel addresses were derived from sequential identifiers, so the set of customer organizations could be enumerated. Remediated 2026-08-12: each channel has a private random address, and the page shown for an inactive channel no longer names the organization | | 2026-08-27 | Authenticated graybox test | Cross-tenant access, privilege escalation, mass assignment, within-tenant report access, attachment confidentiality, SCIM isolation, SAML assertion trust | No authorization defects found. Tenant and role boundaries held in every case tested | | 2026-08-27 | Production exposure review | Network exposure, host hardening, proxy header handling, secret handling | Client-supplied forwarding headers were trusted on a directly internet-facing origin, which would have allowed the per-IP rate limits to be bypassed. Fixed the same day. A per-request server-timing header was also removed. The superseded `Feature-Policy` header was replaced with `Permissions-Policy` on 2026-09-05 | | 2026-09-08 | Authenticated review of file delivery and browser retention | Direct download of data exports and voice recordings, access with known file URLs across tenants and after membership removal, browser Back after sign-out | Three findings, each requiring a user who was already authorized and held a signed file URL, or a shared browser. An expired data export could still be downloaded from a retained URL without fresh authentication. A handler could download an original voice recording before its anonymization completed. After a session was revoked, the browser's Back button could redisplay a report from its cache. Remediated 2026-09-10: file delivery now enforces the same expiry, re-authentication and processing rules as the page that links to it, and sensitive pages and private files are no longer stored by the browser. Cross-tenant and removed-member access was refused in every case tested | | 2026-09-26 | Code-level review of session handling | Session identification and its behavior after a database restore | Sessions were identified by their database identifier. A restore rewinds identifiers, so a new sign-in could receive one that a surviving cookie still held and resume that user's session. Remediated the same day: sessions are identified by a random token, and every existing session was ended | | 2026-09-28 | Log review of the whistleblowing channel | Application-side logs written while a reporter uses the whistleblowing channel | Two components still wrote reporter IP addresses: the web server's request log and the spam-protection warning. Both removed the same day. The TLS proxy's own request log, which records the IP address of every request, is unchanged and described on [Security#ip-addresses](https://ethicsportal.eu/security/#ip-addresses) | | 2026-10-16 | Code-level review against current Rails attack research | Upload processing, image decoding, signed-message handling, request logs, stored real-time messages, generated authorization code | Metadata stripping chose its method from the type the browser declared, so a photo uploaded as a generic file kept its location and device metadata. The image library's SVG decoder, blocked at startup, was re-enabled for the whole process once a link-preview image had been generated. Signed and encrypted messages still accepted a serialization format that turns a leaked application secret into code execution. Request logs recorded attachment file names and short-lived download tokens. Real-time notifications, which carry the report's Case ID, were stored unencrypted for a day. The template for new authorization policies left out the organization filter; no existing policy was affected. All remediated the same day | | 2026-10-16 | Production forensic check (CVE-2026-66066) | Read-only inspection of every file stored before the fix for crafted image headers, images whose pixels decode as server files, and leftover identifying metadata | No evidence of exploitation in retained data, and no report image still carrying identifying metadata. Files that could have been uploaded through the exposed direct-upload path, open from 2026-04-13 to 2026-05-12, were purged by the daily cleanup of unattached files and can no longer be examined | | 2026-10-17 | Production exposure review | Reverse-proxy request log, request size limits, container image vulnerability scanning | The reverse proxy logs every request path, and attachment download paths included the file name. Request bodies of up to 1 GB were buffered to disk before the application validated them. The container image was scanned for operating-system vulnerabilities monthly, against a 7-day commitment for critical fixes. Remediated the same day: neither step of an attachment download carries the file name in its path, request bodies are capped just above the largest legitimate report, and the image is scanned weekly | | 2026-10-17 | Mutation testing of authorization rules | The access policies for reports, report documents and whistleblowing channels, each rule deliberately altered to confirm the test suite detects the change | Every alteration to those policies was detected. No authorization defect found | | 2026-10-18 | Code-level review ahead of the independent assessment | Upload fields and file access, metadata removal, malware-scan gating, case roles, platform administration, authentication logging, error reporting, reporter passwords | Ten findings. Nine fixed the same day: an upload field accepted the identifier of a file already stored, so a user could attach a file they had not uploaded and then open it (file links now also expire after an hour); removing metadata from a PDF left the original author recoverable from an earlier revision of the file; the data export included files that had not passed the malware scan, and a file whose scan was never queued was served unscanned; a viewer assigned to a case could act on it; the platform admin panel did not require a second factor; one-time sign-in codes and SAML assertions reached the error-monitoring service; failed sign-ins, failed case lookups and rate-limit hits left no record; reporters chose their own six-digit passcode, so a common choice such as 123456 was accepted (new reports get a 16-digit password generated by the system; reports submitted earlier keep theirs, see Known open findings). A read-only check of production found no stored report PDF and no viewer account, so neither of those two had affected a case. The remaining one is listed under known open findings | ## Known open findings | Finding | Position | |---|---| | No web application firewall or CDN in front of the application origin | Deliberate. Direct application and file hosting is in the EU, while the email and telemetry chain may involve downstream processing outside the EEA. Network-level DDoS protection at the hosting provider plus application-layer rate limiting is the current trade-off. | | Staff profile photos are stored with their original file metadata | Deliberate. Metadata removal protects reporters and their evidence. A profile photo is chosen and uploaded by the staff member it shows. | | Reports submitted before 18 October 2026 keep the 6-digit password chosen when they were submitted, by the reporter or, for a report staff logged, by the handler | Accepted. These passwords still work and are not replaced. Sign-in allows 10 password attempts per Case ID per 10 minutes, from any IP. | ## What this does not establish - The operator chose the scope, ran the tests, and reported the results. Nothing here has been independently verified. - A pass with no findings is evidence about the cases tested, not about the cases that were not tested. - Control A.5.35 of the [ISO/IEC 27001:2022 self-assessment](https://ethicsportal.eu/iso-27001/) --- independent review of information security --- remains open for this reason. It is the only Annex A control on that page recorded as in treatment, and the same limitation holds Clause 9.2 (internal audit) at partial; see the [internal audit record](https://ethicsportal.eu/policies/internal-audit/). --- # Security > Technical security measures in EthicsPortal, including encryption, anonymity, access control, audit logging, and infrastructure details for compliance review. Canonical: https://ethicsportal.eu/security/ Last updated: 2026-11-08 EthicsPortal handles sensitive whistleblower data. This page documents the specific technical and organizational measures we have in place. It is written for compliance officers, DPOs, and legal teams evaluating the platform. Last updated: 2026-11-04. --- ## Data encryption The sensitive database fields listed below are encrypted at rest using Rails ActiveRecord Encryption with **non-deterministic encryption** (each encryption produces a unique ciphertext, preventing pattern analysis). Field encryption does not cover whole database dumps or file attachments; those are encrypted separately, as described under [file attachments](https://ethicsportal.eu/security/#file-attachments) and [backups](https://ethicsportal.eu/security/#backups-and-restore). | Field | Encrypted | Deterministic | |---|---|---| | Report description | Yes | No | | Reporter name | Yes | No | | Reporter contact details | Yes | No | | Structured intake answers (relationship, source, timing, prior reporting, retaliation concern) | Yes | No | | Message body (reporter--handler communication) | Yes | No | | Internal case notes | Yes | No | | Handler two-factor secrets and backup codes | Yes | No | Non-deterministic encryption means these fields cannot be queried by value at the database level. Even with full database access, an attacker cannot search for a specific reporter name across records. ### File attachments Files attached to reports, messages and internal notes, voice recordings, and case data exports are encrypted at rest in Hetzner Object Storage with AES-256, under a separate random key for every file (server-side encryption with customer-provided keys). The key is sent with each storage request, and Hetzner refuses any read made without it. EthicsPortal stores it in the database under the ActiveRecord Encryption described above, so the storage credentials alone cannot read a file: the database and the application's encryption keys are needed as well. Files reach authorised users by streaming through the application, never through a direct storage link. Files uploaded before 6 October 2026 were re-encrypted on that date, and their unencrypted copies, including retained prior versions, were deleted. Files that are not report data, such as profile pictures and organisation share images, are not encrypted this way. None of this protects against a compromise of the application server, which holds the storage credentials, the database and the keys together. All connections to EthicsPortal use **HTTPS/TLS**. Unencrypted HTTP requests are redirected. --- ## Anonymity and privacy ### IP addresses EthicsPortal does not record a reporter's IP address with reports, messages or audit records, and the application's logs for the whistleblowing channel contain no IP addresses. Rate limiting on the whistleblowing channel (report submission, case lookup, messaging) keys on a truncated, keyed SHA-256 hash of the request IP. The hash is pseudonymous, not anonymous: it cannot be read back as an address, but anyone holding the application secret could test candidate addresses against it. It is used only for the rate-limit window (at most 10 minutes), and a job deletes it from the cache within 5 minutes after the window ends. The TLS proxy in front of the application keeps its own request log: IP address, request path, user agent and response status. The path of a reporter's report page contains its Case ID, so an entry for that page can be tied to the report. They are held in a single 10 MB log file that is overwritten as it fills, currently after about two days; the 7-day server snapshots described under [backups](https://ethicsportal.eu/security/#backups-and-restore) can contain a copy. ### File metadata stripping Uploaded files are automatically stripped of identifying metadata **before** storage: | File type | Metadata removed | Method | |---|---|---| | Images (JPEG, PNG, WebP, GIF, AVIF) | EXIF data: GPS coordinates, camera model, device serial number, author, timestamps | Vips image processing | | PDF documents | Author, creator application, modification history. **Not removed:** comment author names, and the metadata of photos embedded in the PDF | exiftool + qpdf in the standard production setup | | Video files | GPS, device info, recording software | exiftool in the standard production setup | | Audio files | Recording device, GPS, software tags | exiftool in the standard production setup | Metadata removal is performed server-side before storage. For file types handled by `exiftool`, this depends on the standard production tooling being present. Inside a PDF, the names on comments and the metadata of embedded photos, such as GPS position and camera serial number, are kept. A reporter who wants these gone should upload photos as separate image files and remove comments before uploading a PDF. ### Virus scanning Files attached to reports, messages and internal notes are automatically scanned for malware using [ClamAV](https://www.clamav.net), an open-source antivirus engine. Scanning happens server-side in a background process after upload. Files that have not passed scanning are blocked from delivery, and infected files are removed automatically. Files are scanned on EthicsPortal infrastructure --- no file data is sent to third-party scanning services. ### Reports by email Every whistleblowing channel has its own email address on `report.ethicsportal.eu`. An email sent to it becomes a case in that channel, the same as a report through the online reporting form. Email reports are on by default. An organization can switch them off in the channel settings, and the address then refuses new mail within a minute. - **Own mail server.** Mail for these addresses is received by EthicsPortal's own mail server on the same infrastructure in Germany, not by a third-party email provider. It accepts mail only for channel addresses, refuses every other address, and relays nothing. - **Transport encryption.** The server offers TLS 1.2 or later with a Let's Encrypt certificate. TLS is opportunistic: a sending server that does not support it delivers unencrypted. - **Sender address hidden from handlers.** The sender's address is stored encrypted and is never shown to case handlers, in the case, its PDF or exports. EthicsPortal uses it only to send the reporter's receipt and new-message notices. - **Access without email.** The receipt contains the Case ID and a one-time password for the secure inbox, replaced at first sign-in. Follow-up questions and answers stay in the inbox, not in email. When the sender's own domain rejects the address in its DMARC policy, the report is kept but no password is sent. After 10 emailed reports to one organization, or 50 across EthicsPortal, within 24 hours, further emailed reports are kept but no email is sent: no receipt to the reporter and no email notice to administrators, who still see the case in the app. - **Attachments.** Files get the same metadata stripping and virus scanning as uploads through the form. Files that cannot be accepted (another type, too large, or impossible to clean) are left out, and the reporter is told how many. - **Copies.** A message waits in the mail server's queue on the same server only until the application accepts it. The application keeps the raw email encrypted until the case is saved, then deletes it. Mail-server logs record channel addresses, never the sender's address. - **Sender checks.** SPF, DKIM and DMARC are checked on EthicsPortal infrastructure. No message data is sent to an outside spam or reputation service. Email is not anonymous: the reporter's own mail provider, and the organization's mail systems if they write from a work account, can keep copies and records of the message. The receipt says so and links to the online reporting form for reporters who want to stay anonymous. ### Email for updates The online reporting form has an optional email field for updates. The address receives the receipt and a notice when a handler writes, never the report content. It is stored encrypted and, like the sender address of an emailed report, no handler page, PDF or export shows it. It stays available when the reporter submits anonymously. Only a reporter who turns off anonymous submission and ticks "also show my email address to the case handlers" turns it into a contact address that handlers see. ### Handler anonymity Whistleblowers never see the real names or email addresses of the people handling their report. All messages from handlers are displayed as **"Case handler"**. This protects handler identity and prevents social engineering. ### No tracking EthicsPortal does not use third-party tracking cookies, advertising pixels, or fingerprinting scripts. We use [Plausible Analytics](https://plausible.io/data-policy) on the marketing website only, served through our own domain. It sets no cookies and does not store IP addresses. Cloudflare, which delivers the marketing website, processes request metadata including IP addresses, as described in the [Privacy Notice](https://ethicsportal.eu/privacy/). The whistleblowing channel itself has no analytics. ### Current assurance status EthicsPortal does not currently claim accredited ISO 27001 certification on this site. It also does not currently publish an independent third-party audit of the anonymity architecture. If that changes, the scope and date will be published here. ### Security review materials Customers that require procurement or legal review materials can request them during procurement. Available materials may include a signed DPA, registry and tax evidence, a completed security questionnaire, and written answers covering backup and restore procedures, privileged production access, and incident-response handling. --- ## Access control Authorization is enforced at the application level using [Pundit](https://github.com/varvet/pundit) policies. | Role | Can view reports | Can manage organization settings | Can assign handlers | |---|---|---|---| | Admin | All reports | Yes | Yes | | Handler | Reports they are assigned to or participating in | No | No | | Viewer | Read-only, for auditors and legal counsel | No | No | - Handlers cannot see reports they are neither assigned to nor participating in. Participants are explicitly added by an admin or the primary assignee (for example, looping in legal or HR). - Reporters have no user account --- they open their report with a Case ID (`WB-XXXX-XXXX`) and a password that the system generates when the report is submitted. - Every controller action checks authorization. Unauthorized access attempts are blocked and logged. ### Two-factor authentication Handler and admin accounts can enable TOTP-based two-factor authentication via any standard authenticator app (Google Authenticator, 1Password, Authy, and compatible alternatives). Once enabled, sign-in requires both the primary credential and a rotating 6-digit code. ### Reporter sign-in Reporters sign in with their Case ID and a password. The Case ID identifies the case and is not secret. The password is 16 random digits, generated by the system when the report is submitted; the reporter does not choose it. It is stored only as a bcrypt digest, so nobody can recover it, and EthicsPortal has no feature that lets the reporter, the case handler or the operator reset it. A reporter who loses it submits a new report and mentions the Case ID. Reports submitted before 18 October 2026 keep the 6-digit password the reporter chose at the time, and it still works. The follow-up inbox and message-posting are session-gated behind this check, so a leaked Case ID alone cannot read the report or impersonate the reporter. Right after submission, a receipt page shows the address of the secure inbox, the Case ID and the password. It stays available on that browser only until the inbox locks after 30 minutes without activity, or until the reporter exits. On the sign-in page the password field is a visible text field with autocomplete off, rather than a masked password field, so that browsers do not offer to save the password, which a work-managed browser could otherwise sync to the employer's account. Pasting works, and spaces are ignored. When staff log a report received by phone, at an in-person meeting, by letter or by email, and the reporter wants to follow the case online, the system generates a one-time password for the handler to pass on. It works once: at the reporter's first sign-in it is replaced, on the server, by a new password that only the reporter sees. A reporter's access ends when they select Exit, or after 30 minutes without activity. About two minutes before the lock, a warning offers to keep the inbox open; if nobody responds, the case is removed from the screen. Access is held in an encrypted cookie in the reporter's browser, and the server keeps no reporter session. ### Session lifecycle Each authenticated session records `last_seen_at` on every request (debounced). Users can review their active sessions, see when each was last active, revoke any session individually, or sign out of all other sessions at once from the account settings. Sessions expire automatically after **14 days of inactivity**. The next request from an idle session destroys the server-side record, clears the cookie, and forces re-authentication via a fresh magic link. A nightly job sweeps abandoned sessions on the same timeout, so `user_agent` and `ip_address` are not retained beyond the idle window even when the user never returns. Magic-link authentication limits the blast radius of long-lived sessions: a stolen session cookie does not yield a reusable credential, and re-authentication requires email access. ### Member access and offboarding Organization access is enforced at the request boundary. When a member is deactivated: - Access to the organization is rejected immediately, including on previously bookmarked URLs. - Open report assignments are unassigned. - Participantships are removed. - The audit-log history attributable to the member is preserved. - The deactivated member is notified. - Reactivation does not automatically restore prior case access. The organization owner, the last active admin, and the designated compliance officer for the whistleblowing channel cannot be deactivated. All deactivation and reactivation events are written to the append-only audit log. Removing a member deactivates the membership rather than deleting it, so the audit trail and report history stay resolvable. A membership is hard-deleted only when the member's own account or the organization itself is erased. ### Account erasure A member who closes their own account has their email address replaced with a non-routable placeholder and their avatar, two-factor credentials, sessions, API tokens, and preferences permanently removed; the account can no longer authenticate or be contacted. If the account never acted inside an organization, the record is deleted outright. If it did, the member's name remains while their memberships are deactivated so retained case notes, messages, and audit entries stay attributable. The Controller determines the retention period under its documented instructions and applicable law; GDPR erasure rights remain subject to any applicable exceptions for legal obligations or legal claims. A scrubbed account cannot authenticate by any route: magic link, SSO assertion, or API token. ### Rate limiting Public endpoints of the whistleblowing channel are rate-limited to prevent abuse and enumeration attacks: | Endpoint | Limit | |---|---| | Report submission | 5 per 10 minutes per hashed IP | | Case lookup (Case ID + password) | 10 per 3 minutes per hashed IP | | Case lookup (Case ID + password) | 10 per 10 minutes per Case ID and hashed IP | | Message submission | 10 per 3 minutes per hashed IP | Rate limiting uses the keyed IP hash described above --- no IP address is stored for it. The per-Case-ID limit keys on the Case ID itself, which is deleted from the same cache within 15 minutes. --- ## Audit and compliance ### Append-only audit trail Defined report and account events are logged with: - **Timestamp** (UTC) - **Actor** (which user or system process performed the action) - **Action type** (for example, report created, status changed, message sent, handler assigned, report exported or report deleted). Each handler's view of a given report is logged, deduplicated to one entry per handler per report per 24 hours, and reporter follow-up views are logged the same way. Reads of other resources are not logged. Audit log entries are append-only. No user, including an organization admin, can edit an entry or delete one selectively: PostgreSQL triggers reject modification and truncation at the database level. Entries are removed only by the retention lifecycle or when the organization itself is deleted, and privileged database intervention remains a documented residual risk ([risk register R-08](https://ethicsportal.eu/policies/risk-register/#r-08-audit-log-integrity-compromise)). The full audit trail is included in PDF case exports for regulatory review. ### Data retention Organizations configure their own retention period: **12, 24, 36, 48, or 60 months** after a report is closed. When the retention period expires, a background job deletes the report and associated data from production; backup copies expire under the separate documented lifecycle. Emails to a reporter leave no record in EthicsPortal's send history, so no reporter address remains after the report is deleted. The Controller remains responsible for selecting a period that satisfies GDPR storage limitation and applicable national record-keeping rules. ### CSRF protection All form submissions are protected against cross-site request forgery using Rails' built-in CSRF tokens. --- ## Secure development lifecycle EthicsPortal follows a documented development lifecycle for changes that touch the Service. The stages are stated here so a procurement reviewer can map them to ISO/IEC 27001:2022 controls A.8.25--A.8.29 (see the [control map](https://ethicsportal.eu/iso-27001/) for the full mapping). | Stage | Practice | |---|---| | Architecture and design | Features that introduce new personal-data flows, sub-processors, or authorization scopes are evaluated against the encryption, access-control, and audit-trail commitments documented on this page before implementation. | | Change review | Every production change is checked against a written checklist (encryption coverage, authorization scope, audit-log emission, input validation, secret handling) before deploy. Enforcement is automated rather than discretionary: the full test suite and static analysis run on every change and block the deploy on failure. The suite runs on a hosted CI runner, or on a developer workstation with the completed run recorded as a commit status the pipeline verifies before it will skip the hosted run. Change-approval roles are described during procurement review. | | Secure coding | The codebase uses framework-level defenses by default --- parameterized queries via ActiveRecord, strong parameters, output escaping in views, CSRF tokens, attribute-level encryption, Pundit authorization at the controller boundary. Deviations require a written justification. | | Security testing in development | Static analysis ([Brakeman](https://brakemanscanner.org), [bundler-audit](https://github.com/rubysec/bundler-audit), `importmap audit`) runs on every change. Tests cover authorization paths, encryption-at-rest invariants, audit-log emission, and rate-limit enforcement. See [dependency and patch management](https://ethicsportal.eu/security/#dependency-and-patch-management) for the full toolchain. | | Environment separation | Production and non-production environments are isolated. No production personal data is used outside production; staging and development use synthetic fixtures. | | Vulnerability response | Reports acknowledged within 2 business days (see [responsible disclosure](https://ethicsportal.eu/security/#responsible-disclosure)). Targets: critical issues remediated within 7 days, high within 30, medium within 90. Confirmed issues affecting deployed customers are reported through the [incident register](https://ethicsportal.eu/incidents/) when they meet the register's scope criteria. | --- ## Dependency and patch management EthicsPortal does not deploy end-of-life software components. The application runs on actively supported releases of Rails, Ruby, PostgreSQL, and the underlying operating system; upstream security releases are applied on a rolling basis. Dependencies are scanned continuously in continuous integration: - **[Brakeman](https://brakemanscanner.org)** flags Rails-specific vulnerabilities on every change. - **[bundler-audit](https://github.com/rubysec/bundler-audit)** checks the Gemfile against the Ruby Advisory Database on every change and again on a daily schedule, so newly disclosed advisories are caught even when no code has changed. - **`importmap audit`** scans JavaScript imports for known vulnerabilities on every change and again on a daily schedule. - **[Dependabot](https://docs.github.com/en/code-security/dependabot)** opens pull requests weekly for outdated Ruby gems and GitHub Actions, grouped by minor/patch updates. Supply-chain controls limit what a compromised dependency release can reach: - **Release cooldown.** New gem versions are adopted only after they have been public for three days; Dependabot version updates wait 3, 7 or 14 days for patch, minor and major releases. Hijacked releases are usually yanked within that window. - **Pinned CI actions.** Every GitHub Actions step is pinned to a full commit SHA, so a re-pointed tag cannot change what runs. - **Verified downloads.** Binaries fetched while building the container image are checked against a pinned SHA-256 checksum. - **Gated automatic updates.** Dependabot pull requests merge automatically only after the full test suite and static analysis pass. Components reaching end-of-life upstream are replaced or upgraded before their support window closes. --- ## Infrastructure | Component | Provider | Location | |---|---|---| | Application server and database | [Hetzner](https://www.hetzner.com) | Nuremberg, Germany (EU) | | File storage | [Hetzner Object Storage](https://www.hetzner.com/storage/object-storage) | Nuremberg, Germany (EU) | | File attachment backup copy | [Hetzner Object Storage](https://www.hetzner.com/storage/object-storage) | Falkenstein, Germany (EU) | | Transactional email | [Mailjet](https://www.mailjet.com) | France (EU) | | Payment processing | [Stripe](https://stripe.com) | Ireland; other countries under applicable safeguards — see [Privacy Notice](https://ethicsportal.eu/privacy/) | - Core report and case-data storage is in the European Union. Email delivery and application telemetry have separate downstream supplier chains; see the [DPA](https://ethicsportal.eu/dpa/#9-international-data-transfers). - No credit card numbers or payment credentials are stored on EthicsPortal servers. All payment data is handled by Stripe. - Mailjet sends handler notifications and optional reporter receipts and new-message notices. Reporter notices contain the recipient email address, the Case ID and a link, but not the report narrative. The receipt for a report sent by email also contains a one-time password for the secure inbox, which is replaced when the reporter first signs in. Mailjet's downstream support chain may involve access outside the EEA; see the [DPA](https://ethicsportal.eu/dpa/#9-international-data-transfers). - The marketing site is served via Cloudflare (CDN, United States); the whistleblowing channel and handler portal are not. This separate public-site processing and its transfer safeguards are described in the [Privacy Notice](https://ethicsportal.eu/privacy/), not the customer DPA subprocessor list. --- ## Backups and restore EthicsPortal operates three complementary backup layers, all retained within the EU: | Layer | What | Where | Retention | |---|---|---|---| | Database | Daily PostgreSQL dumps via a Kamal accessory, encrypted with GnuPG symmetric AES-256 on the host before upload | Hetzner Object Storage, Nuremberg (EU) | 21 days for current versions; deleted versions expire after 7 additional days | | Server | Full disk snapshots of the application host | Hetzner Cloud, Nuremberg (EU) | 7 days | | File attachments | Every encrypted attachment copied, under its own per-file key, to a second bucket with versioning | Hetzner Object Storage, Falkenstein (EU) | For as long as the attachment exists; prior versions 28 days. Original voice recordings are deleted completely, with no prior versions kept | **Recovery objectives.** Recovery point objective (RPO) is 24 hours. Recovery time objective (RTO) is 4 hours. These objectives also appear in the [service level agreement](https://ethicsportal.eu/sla/#recovery-objectives). **Restore testing.** A restore drill runs automatically every month via a CI workflow, and on demand, restoring the latest dump into a disposable environment. It decrypts the dump, restores it, compares every table against live production, and then boots the application against the restored database to confirm an encrypted column still decrypts, that one encrypted file attachment opens with the key held in the restored dump, and that every attachment older than an hour has a copy in the backup location, with one copy opened and checked against its checksum --- row counts alone cannot distinguish a usable backup from ciphertext whose key no longer matches. Backup freshness is monitored continuously (alert if the most recent dump is older than 36 hours). **Encryption.** Hetzner states that Object Storage does not encrypt objects at rest by default, so database dumps are encrypted before they leave the host: GnuPG symmetric AES-256, with the passphrase held only by the backup process and escrowed off-machine. Application-layer fields encrypted under Rails ActiveRecord Encryption remain separately encrypted inside each dump. File attachments are encrypted at rest with per-file keys (see [file attachments](https://ethicsportal.eu/security/#file-attachments)). Those keys exist only in the database, so each encrypted dump carries them. The files themselves are not copied into the dump. Each one is stored in Nuremberg and copied, under the same key, to a second bucket in Falkenstein; both keep prior versions for 28 days. --- ## Operational review Some operational materials are shared during procurement review rather than published in full on the open web, because they contain infrastructure and response detail that is more appropriate for controlled disclosure. Topics available on request during procurement include: - Privileged production-access summary - Incident-response workflow and escalation contacts - Business continuity and customer offboarding/export responses --- ## Responsible disclosure If you discover a security vulnerability in EthicsPortal, please report it to [security@ethicsportal.eu](mailto:security@ethicsportal.eu). We ask that you: 1. Do not publicly disclose the vulnerability before we have had a chance to address it. 2. Provide enough detail for us to reproduce and fix the issue. 3. Do not access or modify other customers' data. 4. Do not run denial-of-service attacks or high-volume automated scans, attempt social engineering against our staff, or submit reports to a customer's whistleblowing channel. We will acknowledge your report within 2 business days and aim to resolve confirmed vulnerabilities promptly. **No paid bug bounty.** Disclosure is unrewarded: we do not pay for vulnerability reports, and we do not sign NDAs, agree commercial terms, or take calls as a precondition to receiving one. Send the affected asset, reproduction steps, and the impact you have established to the address above. --- # Service level agreement > Monthly availability target for EthicsPortal's reporter and operator portals, how it is measured, and what is excluded. Canonical: https://ethicsportal.eu/sla/ Last updated: 2026-09-30 EthicsPortal commits to a monthly availability target for the reporter and operator portals. This page states the target, how it is measured, and what is excluded. Last updated: 2026-05-17. This SLA is the standard offering. A regulated-customer order changes it only where a bilateral signed order expressly identifies the replacement target or remedy. Public status and incident pages are operational disclosures, not admissions of liability or amendments to this SLA. --- ## Availability target **99.5% monthly uptime** for: - The whistleblowing channel --- the surface where reporters submit and follow up on cases. - The operator and handler portal --- the surface where designated handlers access and work cases. 99.5% monthly allows approximately 3 hours 36 minutes of unplanned downtime per calendar month. The marketing site and documentation are best-effort and not covered. --- ## Measurement Uptime is measured monthly as the percentage of minutes during which the covered surfaces respond to HTTP requests with a non-error status. Measurement is taken from an external monitoring service, not self-reported. --- ## What counts against availability - Outages of EthicsPortal application infrastructure. - Outages of a subprocessor (hosting, email, object storage) that degrade a covered surface. - Security incidents requiring a covered surface to be taken offline. Subprocessor outages are not excluded. The commitment reflects what operators and reporters actually experience. --- ## Exclusions Availability is measured excluding: - **Planned maintenance** announced at least 48 hours in advance. Scheduled outside European business hours and typically under 30 minutes. - **Force majeure** --- regional internet disruptions, natural disasters, failures of DNS or certificate authorities outside our vendor chain. - **Unauthorized use or abuse** requiring protective measures such as rate limiting or account suspension. --- ## Recovery objectives In a disaster-recovery scenario, EthicsPortal targets: - **Recovery point objective (RPO): 24 hours.** Data written within the 24 hours preceding a catastrophic failure may be lost. - **Recovery time objective (RTO): 4 hours.** We aim to restore the covered surfaces to a working state within four hours of a declared incident. This is an objective, not a guaranteed recovery time. The current database-restore drill has not demonstrated four-hour end-to-end recovery, recovery from a provider-wide outage, or recovery during operator incapacity. Backup mechanism, storage location, retention, and restore-testing cadence are documented on the [security page](https://ethicsportal.eu/security/#backups-and-restore). --- ## Downtime disclosure Live availability for the covered surfaces is published at [secure.ethicsportal.eu/up](https://secure.ethicsportal.eu/up). Material outages are recorded in the [incident register](https://ethicsportal.eu/incidents/). Any outage exceeding two hours on a covered surface results in a register entry. Monthly uptime figures are available to operators on request. --- ## Service credits Standard plans do not include monetary service credits. To the maximum extent permitted by law, the customer's exclusive contractual remedies for failure to meet the availability target are reasonable corrective action and, for a material or repeated failure that remains uncured after written notice, termination of the affected subscription with a pro-rated refund of prepaid fees for the unused period. This does not exclude a remedy that applicable law does not permit the parties to exclude. All claims arising out of or relating to this SLA form part of the single aggregate liability cap in the [Terms of Service](https://ethicsportal.eu/terms/); no separate or additional SLA cap applies. --- ## Questions For questions about availability or to request monthly uptime figures, contact [support@ethicsportal.eu](mailto:support@ethicsportal.eu). --- # Subprocessors > Third-party services that process personal data on behalf of EthicsPortal. Published per GDPR Article 28. Canonical: https://ethicsportal.eu/subprocessors/ Last updated: 2026-11-10 Subprocessors are third parties that process personal data on behalf of EthicsPortal when EthicsPortal acts as processor for operator-organizations (controllers). This list is published per Article 28(2) GDPR and the Data Processing Agreement. Last updated: 2026-11-10. --- ## Current subprocessors | Subprocessor | Jurisdiction | Purpose | Data categories | |---|---|---|---| | <img src="/images/subprocessors/hetzner.png" alt="" width="20" height="20" style="display:inline;vertical-align:middle;margin:0 8px 0 0"> Hetzner Online GmbH | 🇩🇪 Germany (EU) | Server, database hosting, and file attachment storage | All application data: reports, handler identity, messages, audit logs; uploaded attachments (metadata stripped before upload) | | <img src="/images/subprocessors/mailjet.png" alt="" width="20" height="20" style="display:inline;vertical-align:middle;margin:0 8px 0 0"> Mailjet SAS | 🇫🇷 France (EU) | Transactional email delivery | Handler addresses and notifications; reporter email, Case ID and link when the reporter elects email notices; one-time password in the receipt for a report sent by email; billing emails | | <img src="/images/subprocessors/appsignal.png" alt="" width="20" height="20" style="display:inline;vertical-align:middle;margin:0 8px 0 0"> AppSignal B.V. | 🇳🇱 Netherlands (EU) | Error and application-performance monitoring | Stack traces and request metadata; reporter portal requests are configured to be excluded from transaction monitoring | **Whistleblower reporter privacy.** No third-party script, cookie, or identifier reaches the whistleblowing channel --- the surface where reporters submit and follow up on their reports. In-app support chat for handlers is built into EthicsPortal and self-hosted; it involves no external chat vendor. **No AI or LLM sub-processor.** No large language model, generative AI service, or AI-based classifier is a sub-processor of EthicsPortal. EthicsPortal does not transmit report content, reporter identity, handler messages, or audit logs to OpenAI, Anthropic, Google, Mistral, or any other AI inference provider. An AI assistant or other service that a customer connects to the API is engaged by the customer, not by EthicsPortal ([DPA §6.10](https://ethicsportal.eu/dpa/)). This is a product commitment, not a configuration default --- see [§5 of the Directive coverage map](https://ethicsportal.eu/directive-coverage/#5-confidentiality-of-identity-art-16) for the legal framing. The direct reporting-service subprocessors are EU-based. Their downstream support, email and telemetry chains may involve providers outside the EEA; EU incorporation alone is not an EU-only processing guarantee. See the [DPA transfer section](https://ethicsportal.eu/dpa/#9-international-data-transfers). Account, billing, and public-site providers outside this DPA chain are disclosed in the [Privacy Notice](https://ethicsportal.eu/privacy/). --- ## What counts as a subprocessor A subprocessor is any third-party service that processes personal data on behalf of EthicsPortal under a written processing agreement. Services appear here only if they receive, store, or transmit personal data. Internal libraries, package registries, and build-time dependencies are not subprocessors. --- ## Notification of changes Operators are notified by email at least 30 days before a new subprocessor begins processing personal data, and may object within 14 days on data-protection grounds. Where a subprocessor must be replaced sooner to protect personal data or keep EthicsPortal running, operators are notified without undue delay. Objections are handled under the Data Processing Agreement. --- ## Questions For questions about subprocessor data-handling, contact [privacy@ethicsportal.eu](mailto:privacy@ethicsportal.eu). --- # Terms of service > Read the EthicsPortal terms of service, covering subscriptions, billing, customer responsibilities, data protection, service limits and contract termination. Canonical: https://ethicsportal.eu/terms/ Last updated: 2026-10-27 **Effective date:** September 13, 2026 **Last updated:** September 13, 2026 ## 1. Introduction These Terms of Service ("Terms") govern business use of EthicsPortal at [ethicsportal.eu](https://ethicsportal.eu) (the "Service"). EthicsPortal is a trade name used by Yaroslav Shmarov, a sole proprietor (jednoosobowa działalność gospodarcza) registered in Poland (NIP: 5272755790), at ul. Obrzeżna 1A, 02-691 Warsaw, Poland ("we", "us", "our"). Baseline contracting-party information is published on the [trust](https://ethicsportal.eu/trust/) page. An account holder accepts these Terms through the in-app acceptance step. An organization is bound only when its authorized owner accepts the applicable organization agreement. Merely visiting the site or submitting a whistleblower report does not accept these Terms. If you do not agree, do not use an operator account or the Service. ## 2. Description of service EthicsPortal is a secure whistleblower reporting platform. The Service allows organizations to manage whistleblowing channels and protect whistleblowers. ## 3. Eligibility The Service is offered only to organizations and natural persons acting for purposes relating to their trade, business, craft or profession. It is not offered for personal or household use. This restriction concerns customer and operator accounts; it does not prevent an individual from submitting a report through an organization's whistleblowing channel. To create or use an account, you must: - Be at least 18 years of age - Provide a valid email address - Have the legal capacity to enter into a binding agreement - If acting for an organization, have authority to bind or administer that organization for the relevant action We reserve the right to refuse service to anyone for any reason. ## 4. Your account - You are responsible for maintaining the confidentiality of your login credentials - You are responsible for all activity that occurs under your account - You must provide accurate and complete information when creating your account - You must keep your organization, authority and billing information accurate - You must not create multiple accounts for the same person - You must notify us immediately if you suspect unauthorized access to your account ## 5. Subscriptions and payments - Paid features require an active subscription - Subscriptions are billed on a recurring basis (monthly or annually) through [Stripe](https://stripe.com) - We do not store credit card numbers or bank account details on our servers --- all payment processing is handled by Stripe - Prices are listed in the Service and may change with notice ### Cancellation and refunds You can cancel your subscription at any time from your billing settings. Cancellation takes effect at the end of the current billing period --- you retain access until then. **30-day money-back guarantee.** If you cancel within 30 days of your first paid charge, you can request a full refund of that initial payment by emailing [support@ethicsportal.eu](mailto:support@ethicsportal.eu). The guarantee applies once per organization to the first paid subscription and does not apply to renewals. After the 30-day window, subscriptions are non-refundable. We do not refund the unused portion of a billing period after cancellation. See the [refund policy](https://ethicsportal.eu/refunds/) for details. ## 6. User content "User content" includes any text, images, files, or other materials you submit to the Service (profile information, uploaded files). - By submitting content to the Service (profile information, etc.), you grant us a non-exclusive, worldwide, royalty-free license to use, display, and distribute that content solely as necessary to provide the Service - This license lasts only while the content is retained under the agreement, the Controller's documented instructions, or applicable law, and ends when the content is deleted from the Service - You must not submit content that is illegal, infringing, defamatory, obscene, or otherwise harmful We reserve the right to remove content that violates these Terms. You represent that you and the organization have the rights, lawful basis and authority needed to submit and instruct us to process user content. You remain responsible for the legality, accuracy and use of that content and for decisions made from it. ## 7. Prohibited conduct You agree not to: - Use the Service for any illegal purpose - Scrape, crawl, or use automated means to access the Service without our permission - Create fake accounts or misrepresent your identity - Interfere with or disrupt the Service or its infrastructure - Attempt to gain unauthorized access to other users' accounts or data - Use the Service to send spam, phishing, or unsolicited messages - Circumvent any security measures or access controls - Reverse-engineer, decompile, or disassemble any part of the Service - Resell or redistribute the Service without our permission You are also responsible for configuring the Service for your organization, appointing authorized personnel, maintaining endpoint and account security, complying with laws applicable to your whistleblowing channel, preserving exports or records you independently require, cooperating with incident response, and taking reasonable steps to mitigate avoidable loss. ## 8. Intellectual property - **Our property:** The Service, including its design, code, branding, and documentation, is owned by us and protected by applicable intellectual property laws. You may not copy, modify, or distribute any part of the Service without our permission. - **Your property:** You retain all rights to the content you submit. We claim no ownership over your content. ## 9. Termination - **By you:** You can close your account at any time from your account settings. This removes your data as described in our [Privacy Policy](https://ethicsportal.eu/privacy/), which sets out the limited records we must retain. - **By us:** We may suspend or terminate your account if you violate these Terms, engage in prohibited conduct, or if required by law. We will make reasonable efforts to notify you before termination, except where immediate action is necessary (e.g., fraud, security threats). Upon termination, your right to use the Service ceases immediately. ## 10. Disclaimer of warranties Except for express commitments in a signed order, the [Service level agreement](https://ethicsportal.eu/sla/), or the [Data Processing Agreement](https://ethicsportal.eu/dpa/), the Service is provided **"as is"** and **"as available"** without additional warranties to the maximum extent permitted by law. EthicsPortal provides software and operational information, not legal advice or a certification of your compliance. You remain responsible for deciding which laws apply, configuring and operating your whistleblowing channel, meeting regulatory deadlines, and obtaining professional advice where needed. We do not warrant that: - The Service will be uninterrupted, timely, secure, or error-free - The Service will meet your specific requirements - Use of the Service, documentation, templates or published mappings will by itself satisfy any legal or regulatory obligation ## 11. Limitation of liability To the maximum extent permitted by law, we shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, data, or business opportunities. To the maximum extent permitted by law, our total aggregate liability arising out of or relating to the Service, these Terms, any order, the [Data Processing Agreement](https://ethicsportal.eu/dpa/), the [Service level agreement](https://ethicsportal.eu/sla/), or any DORA addendum will not exceed the fees you paid us for the affected Service in the 12 months preceding the first event giving rise to the claims. This is one combined cap across all claims, events, legal theories, documents and orders; the caps do not stack. Nothing in these Terms excludes or limits liability for fraud, willful misconduct, or any liability that cannot be excluded or limited under applicable law. ## 12. Intellectual-property claims These standard Terms do not provide a duty to defend or indemnify the customer against third-party intellectual-property claims. Any such obligation requires a separate signed order specifying its scope, defense control, exclusions, costs and liability limit. If we become aware of a credible claim concerning the Service, we may seek the right to continue providing it, modify or replace the affected functionality, or terminate that functionality and refund prepaid fees for its unused billing period. This does not limit remedies that cannot lawfully be excluded. ## 13. Governing law and disputes These Terms are governed by the laws of Poland. Subject to any mandatory jurisdiction rules applicable to the customer, disputes arising from or related to these Terms or the Service shall be submitted to the courts of Warsaw, Poland. ## 14. Changes to these Terms We may update these Terms from time to time. When we make material changes, we will notify you by email or through an in-app notification at least 14 days before the changes take effect. Material changes require a new in-app acceptance before continued operator-account use. Publishing an update, sending notice or merely continuing to use the Service does not by itself record acceptance of a new agreement version. If you do not agree, you may stop using the Service and request an orderly export or deletion under the Data Processing Agreement. ## 15. Severability If any provision of these Terms is found to be unenforceable, the remaining provisions will continue in full force and effect. ## 16. Entire agreement, order of precedence and language These Terms, the applicable order and documents expressly incorporated by them form the entire agreement for the Service and replace prior statements on the same subject. Marketing pages, trust materials, policy pages, questionnaires and later website changes do not create warranties or amend the agreement unless an authorized representative of each party agrees in writing. If documents conflict, a signed order prevails only for the specific Service and subject it expressly addresses; then the DPA prevails for personal-data processing; then these Terms prevail. A DORA template or addendum has no effect unless incorporated through a bilateral signed DORA order. The English version of these Terms controls. Translations are provided for convenience only. ## 17. Contact us If you have questions about these Terms, contact us at: **Email:** [support@ethicsportal.eu](mailto:support@ethicsportal.eu) **Security:** [security@ethicsportal.eu](mailto:security@ethicsportal.eu) **Location:** Warsaw, Poland The DPA template, registry evidence, and available procurement-review materials can be requested during procurement. A signed DPA is provided after it is executed with that customer. --- # Transposition: recorded conversations on national whistleblower law > A recorded series on Directive 2019/1937, national transpositions, and neighbouring whistleblower laws, with the people who drafted them, run the authorities, or litigate under them. One jurisdiction at a time, published as audio and full transcript. Canonical: https://ethicsportal.eu/transposition/ Last updated: 2026-10-06 Every EU member state had to turn [Directive (EU) 2019/1937](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937) into its own national law. The results differ far more than a minimum-standards directive suggests: the employee threshold that triggers the obligation, who supervises it, what the designated authority is actually competent to do, and whether anything happens at all when an employer ignores the duty. Transposition records how that went, one jurisdiction at a time, with the people who drafted the law, run the authority, or litigate under it. Each conversation is published as audio and as a full written transcript, so it can be read and cited rather than only listened to. ## Which jurisdictions The series follows the 27 EU member states and five other European jurisdictions with distinct whistleblower frameworks. [Whistleblower laws across Europe](https://ethicsportal.eu/whistleblower-laws/) covers the EU states and four of those neighbours. Moldova has partially aligned [Legea nr. 165/2023](https://ethicsportal.eu/whistleblower-laws/moldova/) with the Directive ahead of accession. Ukraine's whistleblower protections sit in its [Law on Prevention of Corruption, amended by Law No. 198-IX](https://zakon.rada.gov.ua/laws/show/198-20), in force since 1 January 2020. Neither country's law is a national transposition of the Directive. The United Kingdom left before the deadline and keeps a regime two decades older than the Directive. Norway is an EEA state the Directive was never extended to, yet requires internal procedures from five employees rather than fifty. Switzerland has no general whistleblower protection law. For the authorities themselves, what they can and cannot do, see [national whistleblower authorities](https://ethicsportal.eu/authorities/). ## What taking part involves If you have been invited to record an episode: - **25 minutes, remote.** Recorded over video, published as audio. - **Questions in advance.** You see them before the recording, and nothing outside them comes up. - **You approve the published cut.** Nothing goes out until you have reviewed it and confirmed it. - **Your own jurisdiction only.** No preparation beyond what you already work with. - **A written transcript** published alongside the audio, which you also see first. ## Who publishes it Transposition is published by EthicsPortal, which operates whistleblowing channels for organisations across the EU. Episodes carry no product discussion, and guests approve the published cut before it goes out. ## Published conversations The first recordings are scheduled for November 2026. Episodes are listed here as they are published. To propose a jurisdiction, or someone who should be recorded, write to yaro@ethicsportal.eu. --- # Trust > Review EthicsPortal’s contracting party, data locations, certification status and procurement documents for legal, security and data protection assessments. Canonical: https://ethicsportal.eu/trust/ Last updated: 2026-11-11 Everything a procurement reviewer, DPO, or legal team needs to evaluate EthicsPortal. Last updated: 2026-10-18. --- ## Contracting party - **Service name:** EthicsPortal (a trade name) - **Operator:** Yaroslav Shmarov, sole proprietor (jednoosobowa działalność gospodarcza) registered in Poland - **Registered address:** ul. Obrzeżna 1A, 02-691 Warsaw, Poland - **Tax identification number (NIP):** 5272755790 - **Authorized signatory for commercial agreements, DPAs, and security questionnaires:** Yaroslav Shmarov - **Commercial contact:** [support@ethicsportal.eu](mailto:support@ethicsportal.eu) - **Security contact:** [security@ethicsportal.eu](mailto:security@ethicsportal.eu) - **Privacy and data protection contact:** [privacy@ethicsportal.eu](mailto:privacy@ethicsportal.eu) Registry evidence and the proposed contracting documents can be requested during procurement. Executed documents depend on the agreement reached with the customer. --- ## Data residency and processor relationship In the standard subscription model, the customer is the controller and EthicsPortal acts as processor for customer report data. Core whistleblower report data, including the application, database, and file storage, is hosted in Nuremberg, Germany on [Hetzner](https://www.hetzner.com), with a backup copy of file attachments in Falkenstein, Germany. Transactional email runs through Mailjet (France). Vendors used for account, billing, and public-website processing are disclosed in the [Privacy Notice](https://ethicsportal.eu/privacy/) but are outside the customer-instructed processing chain covered by the DPA. The whistleblowing channel and handler portal do not load Cloudflare. --- ## Continuity and personnel **Customer data export and continuity.** While the Service is reachable, organization administrators can export individual cases as PDF, and the full organization data set as a machine-readable ZIP file, without operator intervention. The [Data Processing Agreement](https://ethicsportal.eu/dpa/) and [business continuity plan](https://ethicsportal.eu/policies/business-continuity/) state the applicable rights, operational dependencies, activation triggers, **RPO 24 hours / RTO 4 hours**, and current operator-incapacity limitations. **Backups.** Daily PostgreSQL dumps to Hetzner Object Storage (EU, maximum 28-day retention), Hetzner server-level snapshots (7-day retention), and a copy of every encrypted file attachment in a second Hetzner location (Falkenstein). Last restore drill: 2026-10-06. **Personnel controls.** Access to customer data is limited to specifically authorized personnel and named sub-processors on a need-to-know basis. Privileged-access controls and the current personnel-access scope are documented and available during procurement review. --- ## Certification status EthicsPortal does not currently claim accredited ISO 27001 certification on this site. When that changes, the certification name will be published here. **Independent penetration test.** [Spektr Security LLC](https://spektr-security.com/) tested EthicsPortal from 26 to 30 October 2026: a code audit against a copy of the source code and a penetration test following the OWASP Web Security Testing Guide, without an account and at each user role, plus a network exposure scan of the production host. The test found 3 medium and 2 low issues, and none high or critical. All are fixed, and the assessor's retest confirmed the fixes. The assessor's letter of attestation is available on request. In place of accredited certification, EthicsPortal publishes a structured self-assessment against the same control sets that an external audit would evaluate: - An [ISO/IEC 27001:2022 self-assessment](https://ethicsportal.eu/iso-27001/) covering both halves of the standard: the mandatory management-system requirements in Clauses 4--10, and all 93 Annex A controls as a Statement of Applicability, each with status and evidence pointers. - An [ISO 37002:2021 guidance alignment map](https://ethicsportal.eu/iso-37002/) covering the whistleblowing-management lifecycle clause by clause, with the software/operator boundary stated. (ISO 37002 is a guidelines standard --- no organization can be certified against it; alignment is the only honest claim any vendor can make.) - Named policy documents at [/policies/](https://ethicsportal.eu/policies/): [information security policy](https://ethicsportal.eu/policies/information-security/), [business continuity plan](https://ethicsportal.eu/policies/business-continuity/), [risk register](https://ethicsportal.eu/policies/risk-register/), [internal audit record](https://ethicsportal.eu/policies/internal-audit/), [management review record](https://ethicsportal.eu/policies/management-review/), [anti-corruption and business ethics policy](https://ethicsportal.eu/policies/anti-corruption/). - A [pre-filled CAIQ-aligned questionnaire](https://ethicsportal.eu/caiq/) for the questions whose answers are already documented publicly. - A [DORA ICT third-party map](https://ethicsportal.eu/dora/) for financial entities — Article 30 provisions, provider-side register fields, stated supply-chain limitations, and the withdrawn UKNF cloud communication. These materials provide evidence for procurement review. They are self-assessments, not certification, assurance, or an independent audit opinion. --- ## Operational lifecycle | Question | Answer | |---|---| | Live availability | Published at [secure.ethicsportal.eu/up](https://secure.ethicsportal.eu/up) for the covered surfaces. See [Service level agreement](https://ethicsportal.eu/sla/) for measurement methodology and exclusions. | | Session and access lifecycle | Sessions expire automatically after 14 days of inactivity and are swept nightly. Users can review and revoke their own sessions at any time. Each session records `last_seen_at` so stale devices are identifiable. Member deactivation cuts access at the request boundary, unassigns open reports, and removes participantships while preserving audit history. See [Security](https://ethicsportal.eu/security/#access-control). | | Backups and restore | Daily PostgreSQL dumps to Hetzner Object Storage (EU, maximum 28-day retention), Hetzner server-level snapshots (7-day retention), and a copy of every encrypted file attachment in a second Hetzner location (Falkenstein). **RPO 24 hours, RTO 4 hours.** Last restore drill: 2026-10-06. See [Security](https://ethicsportal.eu/security/#backups-and-restore). | | Dependency and patch management | Continuous SCA in CI (Brakeman, bundler-audit, importmap audit) plus weekly Dependabot updates. No end-of-life components deployed. See [Security](https://ethicsportal.eu/security/#dependency-and-patch-management). | | Export and deletion | PDF case export is available in-app for every case (description, messages, audit trail, attachments). Administrators can also export the full organization data set in-app as a ZIP file: JSON for the organization, members, channel settings and every report with its messages and notes, plus all attachments. Downloading it requires a fresh identity confirmation and is recorded in the audit trail, and the file is deleted after 7 days. Contractual commitments are in the [Data Processing Agreement](https://ethicsportal.eu/dpa/). | | Recovery objectives | See [Service level agreement](https://ethicsportal.eu/sla/#recovery-objectives). | --- ## Contracting positions A single source of truth for the contractual questions enterprise procurement teams most often ask. Each row links to the document that controls. | Item | EthicsPortal position | |---|---| | Aggregate liability cap | 12 months of fees paid in the 12 months preceding the event giving rise to the claim ([Terms §11](https://ethicsportal.eu/terms/)). Claims under the Data Processing Agreement, Service Level Agreement and any signed order fall within the same aggregate cap, subject to mandatory law and any express signed exception. | | Intellectual-property claims | The standard Terms do not provide a duty to defend or indemnify the customer. Any such obligation requires a separate signed order ([Terms §12](https://ethicsportal.eu/terms/)). | | Breach notification window | Without undue delay after becoming aware, as required of a processor by [Art. 33(2)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) GDPR ([DPA §6.6](https://ethicsportal.eu/dpa/)). Available material information is supplied with the initial notice and supplemented as it becomes available. | | Audit rights | The ordinary DPA provides the information and audit cooperation required by [Art. 28(3)(h)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32019L1937) GDPR, subject to reasonable scope, confidentiality, security, scheduling, and cost safeguards ([DPA §6.9](https://ethicsportal.eu/dpa/)). Any DORA-specific authority access, inspection, audit, or cooperation terms require a separate bilateral signed DORA order that defines their scope and logistics. A customer's unilateral classification does not amend the contract. | | Service credits | Standard plans do not include monetary service credits. Remedies for material or repeated availability failures are governed by the aggregate liability cap ([SLA](https://ethicsportal.eu/sla/)). | | Customer-managed encryption keys (BYOK / external KMS) | Not supported. Processor-managed keys maintain the current reporter--handler encryption design. Deletion follows the production and backup lifecycle stated in [DPA §6.8 and §6.11](https://ethicsportal.eu/dpa/); no instantaneous deletion from every backup copy is promised. | | Source code escrow | Not offered. Continuity is handled through the operator-incapacity provisions of the [business continuity plan](https://ethicsportal.eu/policies/business-continuity/) and the Controller's data-export and deletion rights under [DPA §6.8](https://ethicsportal.eu/dpa/). | | Sub-processor change notice | At least 30 days before adding or replacing a sub-processor; the Controller may object and terminate if no resolution is reached ([DPA §6.4](https://ethicsportal.eu/dpa/)). | | Data export and deletion on exit | Self-service PDF case export and a self-service machine-readable export of the full organization data set (ZIP of JSON files and attachments), both in-product. After the Service ends, data is returned or deleted at the Controller's choice; backups expire under the stated lifecycle, currently no later than 28 days after production deletion ([DPA §6.8](https://ethicsportal.eu/dpa/)). | | Cyber liability insurance | Under review. Coverage amount and carrier will be published here when in place. | | Independent external penetration test | Completed by Spektr Security LLC, 26–30 October 2026; all findings fixed and confirmed by retest ([summary](https://ethicsportal.eu/trust/#certification-status)). Letter of attestation available on request. First-party testing is summarized under [self-conducted security testing](https://ethicsportal.eu/security-testing/) and is not a substitute. | | Governing law and venue | Laws of Poland; courts of Warsaw ([Terms §13](https://ethicsportal.eu/terms/)). The Service is offered only for organizational business or professional use. | These positions are reflected in the published [Terms of Service](https://ethicsportal.eu/terms/), [Data Processing Agreement](https://ethicsportal.eu/dpa/), and [Service level agreement](https://ethicsportal.eu/sla/). Material deviations are not granted on standard plans. --- ## Public documents Everything a procurement reviewer needs is published openly. Grouped by what the document does. ### Contractual What governs the relationship between EthicsPortal and the customer. | Document | Purpose | |---|---| | [Terms of service](https://ethicsportal.eu/terms/) | Subscription terms, cancellation, refunds, liability cap, IP-claim position | | [Data Processing Agreement](https://ethicsportal.eu/dpa/) | Processor terms under GDPR Art. 28 | | [Service level agreement](https://ethicsportal.eu/sla/) | Availability target and measurement | | [DORA contracting template](https://ethicsportal.eu/dora-addendum/) | Non-binding starting point for a customer-specific bilateral DORA order; publication does not create obligations | | [Privacy policy](https://ethicsportal.eu/privacy/) | How personal data is handled | ### Operational How the Service runs day-to-day and who else is involved. | Document | Purpose | |---|---| | [Security](https://ethicsportal.eu/security/) | Technical and organizational measures | | [Subprocessors](https://ethicsportal.eu/subprocessors/) | Named subprocessors and their scope | | [Incident register](https://ethicsportal.eu/incidents/) | Material incidents affecting personal data | | [Accessibility](https://ethicsportal.eu/accessibility/) | EAA / EN 301 549 conformance status | ### Directive reference How EthicsPortal maps to, and reads, EU Directive 2019/1937. | Document | Purpose | |---|---| | [Directive 2019/1937 coverage map](https://ethicsportal.eu/directive-coverage/) | Feature-to-Directive 2019/1937 article map | | [Directive 2019/1937 interpretations](https://ethicsportal.eu/directive-interpretations/) | Interpretive positions on ambiguous Directive provisions | | [Whistleblower laws by country](https://ethicsportal.eu/whistleblower-laws/) | National transpositions, enforcement authorities | | [Penalties by country](https://ethicsportal.eu/penalties/) | Fines and criminal liability per Member State | ### Self-assessment Named policy documents and the control mappings an external audit would evaluate. | Document | Purpose | |---|---| | [Information security policy](https://ethicsportal.eu/policies/information-security/) | Statement of intent, scope, roles, control commitments | | [Business continuity plan](https://ethicsportal.eu/policies/business-continuity/) | Activation triggers, recovery objectives, operator-incapacity disclosure | | [Risk register](https://ethicsportal.eu/policies/risk-register/) | Top risks, treatment, residual position | | [Internal audit record](https://ethicsportal.eu/policies/internal-audit/) | Audit programme, findings, and the impartiality limitation of a self-performed audit | | [Management review record](https://ethicsportal.eu/policies/management-review/) | Inputs considered, conclusions, and decisions taken on the management system | | [Anti-corruption and business ethics policy](https://ethicsportal.eu/policies/anti-corruption/) | Prohibited conduct, gifts and hospitality thresholds, conflicts of interest, referral-fee disclosure | | [ISO/IEC 27001:2022 self-assessment](https://ethicsportal.eu/iso-27001/) | Clause 4--10 requirements and all 93 Annex A controls, as a Statement of Applicability | | [Self-conducted security testing](https://ethicsportal.eu/security-testing/) | Scope, dates, findings, and remediation for first-party testing | | [CAIQ-aligned questionnaire](https://ethicsportal.eu/caiq/) | Pre-filled vendor security assessment (CSA CAIQ v4 domain structure) | | [DPIA template for whistleblowing](https://ethicsportal.eu/dpia/) | Pre-filled GDPR Art. 35 assessment for the Controller to adapt and sign | | [DORA ICT third-party map](https://ethicsportal.eu/dora/) | Article 28--30 map and register-of-information data for financial entities | --- ## Available during procurement review The following materials are shared in controlled disclosure rather than published openly: - DPA template and, when executed with that customer, its signed copy - Registry extract and NIP / tax proof - Completed security questionnaire - Privileged production-access summary - Incident-response summary - Business continuity, exit, and customer-export responses - Letter of attestation for the external penetration test To request these, email [support@ethicsportal.eu](mailto:support@ethicsportal.eu). For security-review questions, email [security@ethicsportal.eu](mailto:security@ethicsportal.eu). --- # Whistleblowing video tutorials > Short English tutorials for case handlers and whistleblowers. Learn how to handle cases, report securely, save your access details, and track your case. Canonical: https://ethicsportal.eu/tutorials/ Last updated: 2026-11-03 These tutorials use a fictional organisation and case. They explain the EU minimum rules of [Directive (EU) 2019/1937](https://eur-lex.europa.eu/eli/dir/2019/1937/oj/eng). National law and your organisation’s procedure also apply. The tutorials do not decide if a report qualifies for legal protection. See also the [guidance of the European Commission](https://commission.europa.eu/topics/human-rights/your-fundamental-rights-eu/protection-whistleblowers_en). ## Pages - [Does EU law require a whistleblowing channel? Video](https://ethicsportal.eu/tutorials/does-eu-law-require-a-whistleblowing-channel/): Four questions show whether EU law requires your organisation to run a whistleblowing channel. Three steps show how to set one up with EthicsPortal. - [How to handle a whistleblowing case: video tutorial](https://ethicsportal.eu/tutorials/how-to-handle-a-whistleblowing-case/): For case handlers: assign the case, acknowledge receipt, ask focused questions, give feedback within 3 months, and close it with a complete record. - [How to report a concern securely: video tutorial](https://ethicsportal.eu/tutorials/how-to-report-a-concern-securely/): For whistleblowers: report from a safe place, save your three access details, protect the password, and return to read the replies. - [What to report as a whistleblower: video tutorial](https://ethicsportal.eu/tutorials/what-to-report-as-a-whistleblower/): For whistleblowers: fictional examples of concerns to report, what to include, what not to collect, and when another route is better. --- # Does EU law require a whistleblowing channel? Video > Four questions show whether EU law requires your organisation to run a whistleblowing channel. Three steps show how to set one up with EthicsPortal. Canonical: https://ethicsportal.eu/tutorials/does-eu-law-require-a-whistleblowing-channel/ Last updated: 2026-11-03 For organisations in the EU. Four questions show whether EU law requires you to run a whistleblowing channel, and three steps show how to set one up with EthicsPortal. ## Transcript Your organisation may be breaking EU law right now. Let's see if this applies to you. Do you have fifty or more workers? Are you in financial services, or do you have anti-money-laundering duties? Then size does not matter. Are you a public body, a municipality, or a company the state controls? Are you in aviation, shipping, or offshore oil and gas? Then size does not matter either. Yes to any question? Then EU law requires you to have a whistleblowing channel. All twenty-seven EU countries have made it national law. And not just any inbox. It must be secure and confidential. Seven days to confirm. Three months to give feedback. Reporters who don't trust your channel can go straight to the authorities. The law protects them. Punishing a reporter, or revealing who they are, is illegal in every EU country. So, how do you become compliant? Step one. Go to EthicsPortal dot EU and create an account. Step two. Fill in your company details. Step three. Share your secure whistleblowing channel link with your employees. That's it. Your whistleblowing channel is live. Reports stay in the EU. Encrypted. Never sent to an AI. Set up your whistleblowing channel today, at EthicsPortal dot EU. --- # How to handle a whistleblowing case: video tutorial > For case handlers: assign the case, acknowledge receipt, ask focused questions, give feedback within 3 months, and close it with a complete record. Canonical: https://ethicsportal.eu/tutorials/how-to-handle-a-whistleblowing-case/ Last updated: 2026-11-03 For case handlers. A fictional case in EthicsPortal, from receipt to closure: assign an impartial handler, acknowledge receipt, assess the risk, ask questions, keep internal notes separate, give feedback in time, and close with a complete record. ## Handle a whistleblowing case 3:03 · English · captions included [Download video](https://ethicsportal.eu/tutorial-media/handlers-bacb08b4f25d.en.mp4) ### 0:00 — From receipt to closed case Handle a report from receipt to closure, and keep a complete record. These are the EU minimum rules. Your procedure and national law also apply. ### 0:12 — Start with the case list Sign in with your own account. Select the correct organisation. Open Reports. Check which cases wait for acknowledgment, which deadlines are near, and which cases have new replies. Read the full report and all files before you act. ### 0:28 — Assign an impartial handler First, check for conflicts of interest. An administrator selects the assignee and adds participants. Give access only to authorised people. Administrators and viewers can see all cases. Assignment does not hide a case from them. ### 0:45 — Acknowledge within 7 days Select Acknowledge. This records receipt and informs the reporter. The EU minimum is seven days. Check your national rules. Acknowledgment confirms receipt. It does not mean that the allegation is proven. ### 1:00 — Assess the risk first Check for immediate safety risks, retaliation, and evidence that can disappear. Escalate urgent risks to the correct emergency or specialist service. Decide if the procedure applies, and who will investigate. Treat every allegation as unproven. ### 1:17 — Ask focused questions In Messages, ask for the missing facts. Here, we ask for the supplier and the delivery date. Then select Send to reporter. Ask neutral questions. Never ask for the reporter’s identity. Never ask them to collect evidence unlawfully. Explain the next step, but promise no result. ### 1:36 — Keep your reasoning in Notes Record your assessment in Notes. The reporter never sees Notes. Record the evidence, the decision, the reasons, and the next step. Include only relevant personal data. The Audit trail records case events. It does not replace your investigation record. ### 1:54 — Give useful feedback In Messages, tell the reporter what action was taken or is planned, and why. Protect identities, third parties, and the investigation. If the work continues, report the progress and the date of the next update. The investigation does not need to be finished at the feedback deadline. ### 2:12 — Check the feedback deadline Feedback is due three months after acknowledgment. If there was no acknowledgment, it is due three months after the first seven days. EthicsPortal uses the earlier date. A late acknowledgment never extends the deadline. ### 2:26 — Record the feedback, then close After you give feedback, select Record feedback sent. This only marks a step. It does not write the response. When appropriate, choose the outcome, and whether the concern was confirmed. Send the outcome and the reasons before you close. A closed case does not prove compliance. ### 2:44 — Keep a complete record Review the Audit trail. Keep the case for your legal retention period. Ask the responsible person about legal holds and deletion. Treat every downloaded PDF as sensitive. Reopen the case when new facts arrive. Continue to address any retaliation. --- # How to report a concern securely: video tutorial > For whistleblowers: report from a safe place, save your three access details, protect the password, and return to read the replies. Canonical: https://ethicsportal.eu/tutorials/how-to-report-a-concern-securely/ Last updated: 2026-11-03 For whistleblowers. Report from a safe device, check who receives the report, protect your identity, save the three access details, and return to reply. The password is the only key to your case. ## Report securely and track your case 2:36 · English · captions included [Download video](https://ethicsportal.eu/tutorial-media/reporting-6343b0bfba8a.en.mp4) ### 0:00 — Report. Save. Return. Report safely. Save the three details that open your case. Return to read the replies. In immediate danger, call the emergency services. This inbox is not an emergency service. ### 0:14 — Report from a safer place Use your own device and an internet connection that you control. Do not use work devices, workplace Wi-Fi, or shared browser profiles. Private browsing does not hide your activity from your employer. No website can remove every risk. ### 0:31 — Check who receives the report Open the whistleblowing channel with the official link or QR code from your organisation. Check the organisation name and the web address. The authorised case handlers of the organisation receive your report. EthicsPortal only provides the software. Select Make a report. ### 0:51 — Describe what happened Select the closest category. Describe what happened, when, where, and how you know it. Keep the facts that you saw separate from your suspicions. ### 1:02 — Check files and identity Attach only evidence that you can access lawfully. Check file names, document properties, and photos for details that identify you. Your voice can also identify you. You can report anonymously. Email alerts are optional. Case handlers do not see your address unless you share it. The service still processes it. ### 1:24 — Save your three access details Submit, and wait for the receipt. If you see an error, the report was not received. Save all three details: where to return, your Case ID, and your sixteen-digit password. Use paper that you keep away from work, or a personal password manager. Never use work email or work printers. ### 1:44 — The password is the key Anyone with these details can open your case. The details can also connect you to the report. Keep them private. Nobody can recover the password, not even the case handler. If you lose it, report again and mention the old Case ID. ### 2:01 — Return and reply Return regularly, especially if you gave no email address. Sign in with your Case ID and password. Read the questions from the case handler. To reply in the same case, select Send message. You never need to give your name. ### 2:16 — Retaliation and exit If you experience retaliation because you reported, describe it and select the retaliation option. When finished, select Exit to lock the inbox. Exit does not delete your browser history or downloads. You can also report directly to a competent authority. --- # What to report as a whistleblower: video tutorial > For whistleblowers: fictional examples of concerns to report, what to include, what not to collect, and when another route is better. Canonical: https://ethicsportal.eu/tutorials/what-to-report-as-a-whistleblower/ Last updated: 2026-11-03 For whistleblowers. Fictional examples from public procurement, safety, the environment, and personal data show how to describe what you know without exaggeration, and when a personal complaint needs another route. ## What should you report? 2:33 · English · captions included [Download video](https://ethicsportal.eu/tutorial-media/examples-7cf15d3891e8.en.mp4) ### 0:00 — What you can report You can report wrongdoing that you learned about at work, if you have reasonable grounds to believe it is true. You do not need to prove everything. Describe the facts. Do not present a suspicion as a fact. ### 0:15 — Example: public procurement Two bids contain the same unusual errors. One supplier received a competitor’s price before the deadline. Report the tender, the dates, and what you saw. Explain why you suspect coordination. Do not say that bribery happened if you cannot prove it. ### 0:32 — Example: safety and environment A failed safety test is recorded as passed. Or waste goes into a river. Give the product or the site, the dates, what you saw, and any continuing risk. If people are in danger now, call the emergency services. Do not wait for a reply. ### 0:50 — Example: personal data misuse Customer records are sent to a personal account without a business reason. Describe what happened and where the evidence is. Do not upload the whole database as proof. Share only the minimum information. ### 1:04 — Check national law and policy The EU Directive covers specific areas of EU law. National law often covers more. Fraud, harassment, or discrimination can also be protected, or be covered by your organisation’s policy. The category that you select does not decide if legal protection applies. ### 1:24 — A personal complaint may need another route A dispute about your own pay, leave, or work relationship usually belongs to HR. But a problem that affects you can still be wrongdoing. If it involves wider misconduct, discrimination, or retaliation, report the facts and ask for advice about the right route. ### 1:42 — Make the report useful On the twenty-first of October, I saw invoices one hundred and four and one hundred and five for the same delivery. Both appeared approved. I do not know whether both were paid. This report says what you saw, why it is a concern, and what you do not know. ### 2:00 — Report honestly Never invent or exaggerate. Say when information is second-hand, and why you trust it. Do not hack accounts. Do not access information that you are not allowed to access. An honest mistake is not the same as false information given on purpose. ### 2:16 — Choose your route Read the procedure of your organisation. You can also report directly to a competent authority. Public disclosure has separate conditions. If you report here, save your access details, and return to answer questions. --- # Whistleblower laws in Europe: country guide > National whistleblower protection laws across the EU and the rest of Europe, with links to official texts, external authorities, and country-specific implementation notes. Canonical: https://ethicsportal.eu/whistleblower-laws/ Last updated: 2026-10-27 Every EU country has transposed [Directive 2019/1937](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32019L1937) into national law, but the operational details differ by country: private-sector threshold, public-sector scope, shared channels, external reporting authority, and data protection authority. Four European jurisdictions outside the EU are covered too, each on its own terms rather than as a transposition. Moldova, an accession candidate, has partially aligned its Legea 165/2023 with the Directive ahead of accession. The United Kingdom left before the transposition deadline and keeps a regime that predates the Directive by two decades. Norway is an EEA state the Directive has not been extended to, yet requires internal procedures from five employees rather than fifty. Switzerland has no general whistleblower protection law at all. For the authorities that run each external channel — what they can do, the deadlines they work to, and how a report reaches them — see [national whistleblower authorities](https://ethicsportal.eu/authorities/). This section prioritizes official law texts and authority guidance over vendor summaries. Select a country below to see the applicable law, the competent authority, and the main compliance points that matter in practice. ## Pages - [D.Lgs. 24/2023: whistleblower law in Italy](https://ethicsportal.eu/whistleblower-laws/italy/): Italy's Legislative Decree 24/2023: who needs a whistleblowing channel, what can be reported, the 7-day and 3-month deadlines, records and ANAC fines. - [Whistleblower law in France: Sapin 2 and Waserman](https://ethicsportal.eu/whistleblower-laws/france/): France's whistleblower framework under Loi Sapin 2 as amended by Loi Waserman: who needs an internal channel, how external reporting works, which official authorities matter, and how the Sapin 2 anti-corruption duty differs. - [Whistleblower law in Germany — HinSchG](https://ethicsportal.eu/whistleblower-laws/germany/): Germany's Hinweisgeberschutzgesetz (HinSchG): who needs an internal reporting office, what can be reported, the 7-day and 3-month deadlines, records, and fines. - [Whistleblower law in Poland: requirements](https://ethicsportal.eu/whistleblower-laws/poland/): Poland's 2024 whistleblower act: the 50-person threshold, what the internal procedure must contain, the 7-day and 3-month deadlines, the register, and penalties. - [Whistleblowing in Portugal: Lei 93/2021 requirements](https://ethicsportal.eu/whistleblower-laws/portugal/): Portugal's Lei 93/2021: who needs a whistleblowing channel, anonymous reports, the 7-day and 3-month deadlines, 5-year records and fines up to €250,000. - [Whistleblower law in Denmark: employer requirements](https://ethicsportal.eu/whistleblower-laws/denmark/): Denmark’s whistleblower law: the 50-employee threshold, internal procedures, seven-day acknowledgement and the National Whistleblower Scheme. - [Whistleblower law in Belgium — Act of 28 November 2022](https://ethicsportal.eu/whistleblower-laws/belgium/): Belgium's whistleblower framework: the private-sector 50-worker rule, the federal ombudsman route, and the official sources that matter. - [Whistleblower law in Romania — Legea 361/2022](https://ethicsportal.eu/whistleblower-laws/romania/): Romania's Legea 361/2022: who needs an internal channel, ANI's role as the external authority, and the official Romanian compliance sources. - [Whistleblower law in Switzerland — no general statute](https://ethicsportal.eu/whistleblower-laws/switzerland/): Switzerland has no general whistleblower protection law: the Code of Obligations reform failed in 2020 and a 2024 motion to revive it was rejected. What actually governs, which companies must still run a reporting procedure, and why EU subsidiaries put a Swiss group in scope anyway. - [Whistleblower law in Bulgaria — ЗЗЛПСПОИН](https://ethicsportal.eu/whistleblower-laws/bulgaria/): Bulgaria's whistleblowing act: the 50-worker rule, CPDP's dual role, and the official implementation guidance for obliged entities. - [Whistleblower law in Croatia — Zakon o zaštiti prijavitelja nepravilnosti](https://ethicsportal.eu/whistleblower-laws/croatia/): Croatia's Whistleblower Protection Act: the 50-worker rule, the Ombudswoman's role as external authority, and the official Croatian sources. - [Whistleblower law in Greece — Law 4990/2022](https://ethicsportal.eu/whistleblower-laws/greece/): Greece's Law 4990/2022: who needs an internal channel, the role of the National Transparency Authority, and the official Greek compliance framework. - [Whistleblower law in Ireland: protected disclosures](https://ethicsportal.eu/whistleblower-laws/ireland/): Ireland's protected disclosures framework: the 50-worker rule, the Protected Disclosures Commissioner, and the official Irish sources. - [Whistleblower law in Lithuania: requirements](https://ethicsportal.eu/whistleblower-laws/lithuania/): Lithuania's whistleblower law: the 50-worker rule, the central role of the Public Prosecutor's Office, and the official Lithuanian sources. - [Whistleblower law in Slovakia — Act No. 54/2019](https://ethicsportal.eu/whistleblower-laws/slovakia/): Slovakia's whistleblower law: the 50-worker rule, the Whistleblower Protection Office, and the official Slovak sources. - [Whistleblower law in Slovenia — ZZPri](https://ethicsportal.eu/whistleblower-laws/slovenia/): Slovenia's Reporting Persons Protection Act (ZZPri): the 50-worker rule, the 10-worker sectoral rule, the zaupnik, the 1 March return to the KPK, the fine bands, and the official Slovenian sources. - [Whistleblower law in Norway — Working Environment Act chapter 2 A](https://ethicsportal.eu/whistleblower-laws/norway/): Norway is outside the Directive, and its internal-routines duty starts at five employees rather than fifty. Chapter 2 A of the Working Environment Act, the retaliation rules, and how the duty is enforced. - [Whistleblower law in the United Kingdom — PIDA 1998](https://ethicsportal.eu/whistleblower-laws/united-kingdom/): The UK protected disclosure regime under Part IVA of the Employment Rights Act 1996: no general duty to operate an internal channel, the prescribed-persons route, and why Directive (EU) 2019/1937 does not apply. - [Whistleblower law in Czech Republic — Act No. 171/2023](https://ethicsportal.eu/whistleblower-laws/czech-republic/): Czech whistleblower law under Act No. 171/2023: the 50-worker threshold, the Ministry of Justice external system, and the official Czech sources. - [Whistleblower law in Luxembourg — Loi du 16 mai 2023](https://ethicsportal.eu/whistleblower-laws/luxembourg/): Luxembourg's whistleblower law: the 50-worker rule, the 22-authority structure, and the official CNPD and reporting-office sources. - [Whistleblower law in Moldova — Legea 165/2023](https://ethicsportal.eu/whistleblower-laws/moldova/): Moldova's Legea 165/2023 on integrity whistleblowers: who needs an internal channel, the CNA and Ombudsman roles, and the law's partial alignment with Directive (EU) 2019/1937. - [Whistleblower law in Spain — Ley 2/2023](https://ethicsportal.eu/whistleblower-laws/spain/): Spain's Ley 2/2023: the private-sector threshold, public-sector scope, regional authority nuance, and the official Spanish reporting authorities. - [Whistleblower law in Cyprus — Law 6(I)/2022](https://ethicsportal.eu/whistleblower-laws/cyprus/): Cyprus's Law 6(I)/2022: the 50-worker rule, Cyprus's competent-authority structure, and the official implementation sources. - [Whistleblower law in Malta — Cap. 527](https://ethicsportal.eu/whistleblower-laws/malta/): Malta's Protection of the Whistleblower Act: the 50-worker rule, Malta's reporting-officer model, and the official sources. - [Whistleblower law in Austria — HSchG](https://ethicsportal.eu/whistleblower-laws/austria/): Austria's HinweisgeberInnenschutzgesetz (HSchG): the 50-worker trigger, Austria's designated external reporting offices, and the official BAK and DSB sources. - [Whistleblower law in Estonia — RTKS](https://ethicsportal.eu/whistleblower-laws/estonia/): Estonia's Rikkumisest teavitaja kaitse seadus (RTKS): the 50-worker rule, Estonia's still-young reporting framework, and the official state sources. - [Whistleblower law in Finland — Act 1171/2022](https://ethicsportal.eu/whistleblower-laws/finland/): Finland's Whistleblower Protection Act: the 50-worker rule, the centralised external reporting channel, and the official Finnish sources. - [Whistleblower law in Hungary — Act XXV/2023](https://ethicsportal.eu/whistleblower-laws/hungary/): Hungary's whistleblowing framework under Act XXV of 2023: the 50-worker rule, the Commissioner for Fundamental Rights system, and the official sources. - [Whistleblower law in Latvia — Trauksmes celšanas likums](https://ethicsportal.eu/whistleblower-laws/latvia/): Latvia's Whistleblowing Law: the 50-worker rule, KNAB's contact-point role, and the official Latvian sources. - [Whistleblower law in Sweden — SFS 2021:890](https://ethicsportal.eu/whistleblower-laws/sweden/): Sweden's whistleblower act: the 50-worker rule, Sweden's sectoral external-authority model, and the official Swedish sources. - [Whistleblower law in the Netherlands — Wbk](https://ethicsportal.eu/whistleblower-laws/netherlands/): The Dutch Whistleblower Protection Act: the 50-worker rule, the Dutch Whistleblowers Authority, and the official Dutch sources. --- # Whistleblower law in Austria — HSchG > Austria's HinweisgeberInnenschutzgesetz (HSchG): the 50-worker trigger, Austria's designated external reporting offices, and the official BAK and DSB sources. Canonical: https://ethicsportal.eu/whistleblower-laws/austria/ Last updated: 2026-04-24 Austria implemented Directive (EU) 2019/1937 through the **HinweisgeberInnenschutzgesetz (HSchG)**, promulgated on **24 February 2023** and in force since **25 February 2023**. The Austrian regime is more statute-bound than some broader national systems because the act ties protection and whistleblowing channels to the material scope defined in the HSchG. ## Applicable law - [HinweisgeberInnenschutzgesetz (HSchG) — official RIS text](https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20012541) - [BAK overview of Austrian reporting offices](https://www.bak.gv.at/701/start.aspx) ## Who must establish an internal channel Many private legal entities with **at least 50 employees** must establish an internal reporting channel. Public legal entities and certain specially regulated bodies are also covered under the act's own rules. Entities in the financial-services and anti-money-laundering, transport-safety, and environmental sectors are in scope **regardless of headcount**. ## External reporting authority Austria uses **several designated external reporting offices** rather than one universal national authority. The [Federal Bureau of Anti-Corruption (BAK)](https://www.bak.gv.at/701/start.aspx) operates an official external reporting office under the HSchG and is the clearest federal reference point for general guidance. ## Data protection authority For data-protection complaints relating to the handling of whistleblower reports, the relevant authority is the [Austrian Data Protection Authority (DSB)](https://dsb.gv.at/sites/site0344/media/downloads/beschwerde_an_die_datenschutzbehoerde_complaint_to_the_austrian_data_protection_authority_art15-18_20-22_dsgvo_gdpr.pdf). ## Key compliance points - Austria's whistleblower regime follows the material scope listed in the HSchG, so employers should not market a channel as covering everything unless their own internal policy clearly says so. - The official BAK materials stress confidential handling, secure communication and the possibility of anonymous reporting through the external system. - In practice, Austrian organisations should point reporters to the correct external office for the relevant subject matter rather than assuming one central state inbox. ## Official sources - [HSchG — official RIS text](https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=20012541) - [BAK — reporting offices under the HSchG](https://www.bak.gv.at/701/start.aspx) - [BAK — newly established reporting offices](https://bak.gv.at/en/news.aspx?id=576273413155337839546B3D) - [BAK — HSchG FAQ](https://www.bak.gv.at/601/FAQ.aspx) - [DSB — complaint form](https://dsb.gv.at/sites/site0344/media/downloads/beschwerde_an_die_datenschutzbehoerde_complaint_to_the_austrian_data_protection_authority_art15-18_20-22_dsgvo_gdpr.pdf) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Belgium — Act of 28 November 2022 > Belgium's whistleblower framework: the private-sector 50-worker rule, the federal ombudsman route, and the official sources that matter. Canonical: https://ethicsportal.eu/whistleblower-laws/belgium/ Last updated: 2026-10-18 Belgium implemented Directive (EU) 2019/1937 through the **Act of 28 November 2022** for the private sector, alongside parallel public-sector and regional arrangements. For private companies, the main business trigger remains **50 workers**, but Belgium's structure is more fragmented than in unitary systems. ## Applicable law - [Act of 28 November 2022 — official text on eJustice](https://www.ejustice.just.fgov.be/cgi/article_body.pl?language=nl&pub_date=2022-12-15&caller=summary&numac=2022042980) - [Federal Ombudsman guide for whistleblowers](https://www.federalombudsman.be/en/leitfaden-fur-hinweisgeber) ## Who must establish an internal channel Private legal entities with **at least 50 workers** must establish an internal reporting channel. Belgium also has public-sector and regional whistleblowing frameworks, so public bodies should check the regime that applies to their level of government. Entities in the financial-services and anti-money-laundering, transport-safety, and environmental sectors are in scope **regardless of headcount**. ## Penalties - **No internal channel:** a level-4 offence under the Social Penal Code (art. 133/1). A company faces a criminal fine of €24,000 to €576,000 (art. 101/1) or an administrative fine of €2,400 to €28,000 (art. 101). An employer, agent or representative who is an individual faces six months to three years in prison, a criminal fine of €4,800 to €56,000, or both. Every fine is raised by 2.5 décimes, or 25% (Act of 5 March 1952, art. 1; Social Penal Code, art. 102). [Source: Social Penal Code](https://www.ejustice.just.fgov.be/eli/loi/2010/06/06/2010A09589/justel) - **Obstruction, retaliation, abusive proceedings or breach of confidentiality:** six months to three years in prison and/or a fine of €4,800 to €48,000. The Act sets €600 to €6,000, which art. 78 of the Criminal Code multiplies by eight. [Source: Act of 28 November 2022, art. 33](https://www.ejustice.just.fgov.be/eli/loi/2022/11/28/2022042980/justel) - Where a sector authority can impose its own sanctions, the Social Penal Code route does not apply (art. 33 §1). Amounts as in force since 1 September 2026, when the new Criminal Code took effect. ## External reporting authority Belgium does not operate with one single whistleblowing authority for every case. The [Federal Ombudsman](https://www.federalombudsman.be/en/contact-us) is a key federal external route, while sectoral and regional channels can also be relevant depending on the entity and the subject matter of the report. ## Data protection authority For complaints about unlawful processing of whistleblower data, the relevant authority is the [Belgian Data Protection Authority](https://www.dataprotectionauthority.be/citizen). ## Key compliance points - Belgium's whistleblowing framework is legally fragmented across private-sector, federal public-sector and regional layers, so organisations should be explicit about which regime they are following. - The Federal Ombudsman explicitly accepts direct whistleblower reports and retaliation complaints. - Internal policies should make clear which external authority is appropriate for the organisation's sector and constitutional level. ## Official sources - [Act of 28 November 2022 — official private-sector law text](https://www.ejustice.just.fgov.be/cgi/article_body.pl?language=nl&pub_date=2022-12-15&caller=summary&numac=2022042980) - [Federal Ombudsman — contact and whistleblower reporting](https://www.federalombudsman.be/en/contact-us) - [Federal Ombudsman — guide for whistleblowers](https://www.federalombudsman.be/en/leitfaden-fur-hinweisgeber) - [Federal Ombudsman — direct external reporting is possible](https://www.federalombudsman.be/en/should-i-have-reported-the-facts-in-house-first) - [Belgian Data Protection Authority — citizen complaints](https://www.dataprotectionauthority.be/citizen) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Bulgaria — ЗЗЛПСПОИН > Bulgaria's whistleblowing act: the 50-worker rule, CPDP's dual role, and the official implementation guidance for obliged entities. Canonical: https://ethicsportal.eu/whistleblower-laws/bulgaria/ Last updated: 2026-10-06 Bulgaria implemented Directive (EU) 2019/1937 through the **Act on the Protection of Persons Reporting Information or Publicly Disclosing Information about Breaches**, in force since **4 May 2023**. The Bulgarian system is notable because the CPDP acts both as the central external authority and as the data protection authority. ## Applicable law - [ЗЗЛПСПОИН — full consolidated text (lex.bg)](https://lex.bg/bg/laws/ldoc/2137231156) - [ЗЗЛПСПОИН — official text PDF (gov.bg)](https://www.navet.government.bg/bg/media/zakon_za_zasita_na_licata_podavasi_signali_ili_publicno_opovestqvasi_informaciq_za_naruseniq-19052023.pdf) - [Bulgarian whistleblowing act — official CPDP law page](https://cpdp.bg/%D0%BF%D1%80%D0%B0%D0%B2%D0%BD%D0%B0-%D1%80%D0%B0%D0%BC%D0%BA%D0%B0-%D0%BD%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%B0%D0%BB%D0%BD%D0%B0/%D0%B7%D0%B0%D0%BA%D0%BE%D0%BD-%D0%B7%D0%B0-%D0%B7%D0%B0%D1%89%D0%B8%D1%82%D0%B0-%D0%BD%D0%B0-%D0%BB%D0%B8%D1%86%D0%B0%D1%82%D0%B0-%D0%BF%D0%BE%D0%B4%D0%B0%D0%B2%D0%B0%D1%89%D0%B8-%D1%81%D0%B8%D0%B3/?hilite=%D0%B7%D0%B0%D0%BF%D0%BE%D0%B2%D0%B5%D0%B4+%E2%84%960496+04.05.2023) - [CPDP implementation guidance](https://cpdp.bg/en/whistleblowers-protection/implementation-of-the-system-for-protection-of-persons-reporting-or-publicly-disclosing-information-about-breaches/) ## Who must establish an internal channel - **All in-scope public-sector bodies** (obliged organisations under the Financial Management and Control in the Public Sector Act) — regardless of headcount. - **Private employers with 50 or more workers.** - Phased: public sector and private employers with 250+ workers from **4 May 2023**; the **50-249** band from **17 December 2023**. A 2025 amendment (in force May 2025) **removed the option to use a shared group-level internal channel** — each obligated entity must now establish and maintain its own. ## Penalties and enforcement Unlike most member states, Bulgaria fixes an **explicit fine for failing to establish a channel** — Article 41 ([Чл. 41](https://lex.bg/bg/laws/ldoc/2137231156)) penalises any entity that does not fulfil the channel-establishment duty under Article 13(1)–(2). The structure is dual-tier (natural vs. legal person) and escalates on repeat. EUR figures use the fixed peg (1.95583 BGN/€). | Conduct | Article | Fine | ≈ EUR | | --- | --- | --- | --- | | **No internal channel — legal person / sole trader, first violation** | Чл. 41(2) | **BGN 5,000–20,000** | **~€2,500–10,000** | | No internal channel — legal person, repeat violation | Чл. 41(3) | BGN 10,000–30,000 | ~€5,000–15,000 | | No internal channel — natural person | Чл. 41(1) | BGN 1,000–5,000 | ~€500–2,500 | | Obstructing a report or failing to act on / report follow-up | Чл. 42 | BGN 400–4,000 | ~€200–2,045 | | Retaliation against a reporter, or malicious proceedings | Чл. 43 | BGN 2,000–8,000 | ~€1,000–4,090 | Verbatim, Art. 41(1)–(2): *"Наказва се с глоба в размер от 1000 до 5000 лв. … лице, което не изпълни задължение по чл. 13, ал. 1 и 2. … Когато нарушението … е извършено от юридическо лице или едноличен търговец, се налага имуществена санкция в размер от 5000 до 20 000 лв."* **An honest assessment of enforcement.** The fines above are what the law provides. In practice, enforcement to date is modest and largely reactive. The CPDP's official 2024 figures record [97 reports received](https://cpdp.bg/28300-2/) (35 within the Directive's scope), seven inspections closed for lack of sufficient evidence, and **only one resulting in a sanction**, with total sanctions for the year of **BGN 17,400 (~€8,900)**. No company has been publicly named, and none of these is identified as a specific failure-to-establish-channel case. The practical conclusion mirrors the rest of the region: the obligation is real, but the exposure is a report reaching the CPDP with no channel in place — not a large fine. ## External reporting authority The central external channel is the [Commission for Personal Data Protection (CPDP)](https://cpdp.bg/en/whistleblowers-protection/implementation-of-the-system-for-protection-of-persons-reporting-or-publicly-disclosing-information-about-breaches/), which also publishes forms, register guidance and FAQs for obliged entities. ## Data protection authority The same [CPDP](https://cpdp.bg/%D0%BF%D0%BE%D0%B4%D0%B0%D0%B2%D0%B0%D0%BD%D0%B5-%D0%BD%D0%B0-%D0%B6%D0%B0%D0%BB%D0%B1%D0%B8-%D0%B8-%D1%81%D0%B8%D0%B3%D0%BD%D0%B0%D0%BB%D0%B8-%D0%B4%D0%BE-%D0%BA%D0%B7%D0%BB%D0%B4/) is Bulgaria's GDPR supervisory authority. ## Key compliance points - Municipalities with fewer than 10,000 inhabitants or fewer than 50 workers may share resources for intake and follow-up. - Private entities with 50-249 workers may also share resources for receiving and handling reports. - CPDP's official materials expect a non-public register of reports and clear public information about how to use the channel. ## Official sources - [ЗЗЛПСПОИН — full consolidated text (lex.bg)](https://lex.bg/bg/laws/ldoc/2137231156) — penalties in Chapter Four, *Административнонаказателни разпоредби* (Art. 41 = failure to establish a channel) - [ЗЗЛПСПОИН — official text PDF (gov.bg)](https://www.navet.government.bg/bg/media/zakon_za_zasita_na_licata_podavasi_signali_ili_publicno_opovestqvasi_informaciq_za_naruseniq-19052023.pdf) - [Bulgarian whistleblowing act — official CPDP law page](https://cpdp.bg/%D0%BF%D1%80%D0%B0%D0%B2%D0%BD%D0%B0-%D1%80%D0%B0%D0%BC%D0%BA%D0%B0-%D0%BD%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%B0%D0%BB%D0%BD%D0%B0/%D0%B7%D0%B0%D0%BA%D0%BE%D0%BD-%D0%B7%D0%B0-%D0%B7%D0%B0%D1%89%D0%B8%D1%82%D0%B0-%D0%BD%D0%B0-%D0%BB%D0%B8%D1%86%D0%B0%D1%82%D0%B0-%D0%BF%D0%BE%D0%B4%D0%B0%D0%B2%D0%B0%D1%89%D0%B8-%D1%81%D0%B8%D0%B3/?hilite=%D0%B7%D0%B0%D0%BF%D0%BE%D0%B2%D0%B5%D0%B4+%E2%84%960496+04.05.2023) - [CPDP — implementation of the protection system](https://cpdp.bg/en/whistleblowers-protection/implementation-of-the-system-for-protection-of-persons-reporting-or-publicly-disclosing-information-about-breaches/) - [CPDP — frequently asked questions](https://cpdp.bg/en/frequently-asked-questions-on-the-wpa/) - [CPDP — complaints and signals](https://cpdp.bg/%D0%BF%D0%BE%D0%B4%D0%B0%D0%B2%D0%B0%D0%BD%D0%B5-%D0%BD%D0%B0-%D0%B6%D0%B0%D0%BB%D0%B1%D0%B8-%D0%B8-%D1%81%D0%B8%D0%B3%D0%BD%D0%B0%D0%BB%D0%B8-%D0%B4%D0%BE-%D0%BA%D0%B7%D0%BB%D0%B4/) - [CPDP — 2024 whistleblower enforcement statistics](https://cpdp.bg/28300-2/) - [EU Whistleblowing Monitor — Bulgaria](https://whistleblowingmonitor.eu/country/bulgaria/) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Croatia — Zakon o zaštiti prijavitelja nepravilnosti > Croatia's Whistleblower Protection Act: the 50-worker rule, the Ombudswoman's role as external authority, and the official Croatian sources. Canonical: https://ethicsportal.eu/whistleblower-laws/croatia/ Last updated: 2026-10-06 Croatia implemented Directive (EU) 2019/1937 through the **Zakon o zaštiti prijavitelja nepravilnosti** (Act on the Protection of Persons Reporting Irregularities), published in **Narodne novine 46/2022** and in force since **23 April 2022**. The Croatian framework combines the standard **50-worker** employer trigger with a strong coordinating role for the Ombudswoman. ## Applicable law - [Whistleblower Protection Act — official text in Narodne novine](https://narodne-novine.nn.hr/eli/sluzbeni/2022/46/572) - [Croatian Ombudswoman key implementation guidance](https://www.ombudsman.hr/en/the-new-act-for-the-protection-of-persons-reporting-irregularities-whistleblowers-key-information-for-reporting-persons-and-confidential-persons/) ## Who must establish an internal channel Private employers with **at least 50 workers** must establish an internal reporting channel. Croatian public authorities are also covered by the act's internal-reporting rules. Entities in the financial-services and anti-money-laundering, transport-safety, and environmental sectors are in scope **regardless of headcount**. ## External reporting authority The [Croatian Ombudswoman](https://www.ombudsman.hr/en/the-new-act-for-the-protection-of-persons-reporting-irregularities-whistleblowers-key-information-for-reporting-persons-and-confidential-persons/) is the external reporting authority. The Ombudswoman receives reports, protects the reporting person's position and forwards the substance of the case to the competent authority where needed. ## Data protection authority For complaints about the processing of personal data in the whistleblowing process, the relevant authority is the [Croatian Personal Data Protection Agency (AZOP)](https://azop.hr/zahtjev-za-utvrdivanje-povrede-prava-2/). ## Key compliance points - Croatian law requires the employer to appoint a confidential person and a deputy for internal handling. - Anonymous reporters can still obtain protection if their identity is later established and retaliation follows. - The Ombudswoman's official guidance emphasizes identity protection, emotional support and timely communication with the reporting person. ## Official sources - [Whistleblower Protection Act — official law text](https://narodne-novine.nn.hr/eli/sluzbeni/2022/46/572) - [Ombudswoman — key information for reporting persons and confidential persons](https://www.ombudsman.hr/en/the-new-act-for-the-protection-of-persons-reporting-irregularities-whistleblowers-key-information-for-reporting-persons-and-confidential-persons/) - [Ombudswoman — public disclosure guidance](https://www.ombudsman.hr/en/public-disclosure-what-it-is-when-it-is-used-and-how-it-supports-the-fight-against-corruption/) - [AZOP — request to determine infringement of rights](https://azop.hr/zahtjev-za-utvrdivanje-povrede-prava-2/) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Cyprus — Law 6(I)/2022 > Cyprus's Law 6(I)/2022: the 50-worker rule, Cyprus's competent-authority structure, and the official implementation sources. Canonical: https://ethicsportal.eu/whistleblower-laws/cyprus/ Last updated: 2026-06-01 Cyprus implemented Directive (EU) 2019/1937 through **Law 6(I)/2022**, published on **4 February 2022**. The basic private-sector trigger is **50 employees**, but Cyprus organises external reporting through a **competent-authority structure** rather than one universal state inbox. ## Applicable law - [Law 6(I)/2022 — official text PDF](https://www.cylaw.org/nomoi/arith/2022_1_006.pdf) - [Ministry of Health whistleblower explainer](https://www.gov.cy/moh/en/whistleblowers/) ## Who must establish an internal channel - **All public-sector entities** (with limited statutory exceptions). - **Private employers with 50 or more employees.** - **Entities in certain regulated industries** (notably financial services) regardless of headcount. Private firms with 50-249 employees had until **17 December 2023** to establish their internal channels. ## Penalties and enforcement Cyprus enforces through a **single criminal-penalty tier** rather than a graded administrative-fine schedule. The enumerated offences — obstructing or hindering a report, retaliating against a reporter, bringing malicious or vexatious proceedings, breaching the confidentiality of a reporter's identity, and knowingly making false reports — are punishable by **up to 3 years' imprisonment and/or a fine of up to €30,000**. | Conduct | Penalty | | --- | --- | | Obstruction, retaliation, malicious proceedings, breach of confidentiality, or knowingly false reports | Up to 3 years' imprisonment and/or a fine up to **€30,000** | | Legal entity — offences committed on its behalf, or lack of supervision/control enabling them | Fine up to **€30,000** (imprisonment applies only to natural persons) | **An honest assessment of enforcement.** Note what the penalty schedule targets: it attaches to *misconduct toward a reporter* (obstruction, retaliation, breaking confidentiality), not to the bare administrative fact of not having set up a channel. The obligation to establish a channel is mandatory, but the research found **no distinct fine for simply lacking one**, and **no public record of any company being prosecuted, fined, or sanctioned** under Law 6(I)/2022 to date. Enforcement is decentralised across sector-specific authorities, and no proactive inspection regime has surfaced. The real exposure is criminal liability the moment a reporter is silenced or retaliated against — which a functioning internal channel is designed to prevent. ## External reporting authority Cyprus uses a list of **competent authorities** for external reporting, depending on the subject matter and sector. The official central guidance is the [government whistleblower explainer](https://www.gov.cy/moh/en/whistleblowers/), which points to guides for competent authorities rather than one single cross-sector authority. ## Data protection authority For data-protection complaints relating to report handling, the relevant authority is the [Office of the Commissioner for Personal Data Protection](https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/home_en/home_en%3Fopendocument). The office has also issued a [whistleblower-specific announcement](https://www.dataprotection.gov.cy/DATAPROTECTION/DATAPROTECTION.NSF/All/D174BEEE706A7B67C2258BB1003C4C8B). ## Key compliance points - Cyprus expects obliged entities to publish both worker-facing guidance and internal handling rules. - The law also covers anonymous reports where the whistleblower is later identified and suffers retaliation. - In practice, Cypriot organisations should tell reporters which external authority fits the topic instead of treating "external reporting" as one generic route. ## Official sources - [Law 6(I)/2022 — official text PDF](https://www.cylaw.org/nomoi/arith/2022_1_006.pdf) - [Law 6(I)/2022 — consolidated text](https://www.cylaw.org/nomoi/enop/non-ind/2022_1_6/full.html) - [Government whistleblower explainer](https://www.gov.cy/moh/en/whistleblowers/) - [Whistleblowers Guide for employees (gov.cy, April 2024)](https://www.gov.cy/media/sites/18/2024/06/Whistleblowers-Guide-for-employees-April-2024.pdf) - [Audit Office — competent authorities for receiving and investigating complaints](https://www.research.org.cy/en/investigation-of-complaints-competent-authorities-for-receiving-and-investigating-complaints/) - [CyPAOB — whistleblowing channels](https://cypaob.gov.cy/en/whistleblowers/) - [Office of the Commissioner for Personal Data Protection — home page](https://www.dataprotection.gov.cy/dataprotection/dataprotection.nsf/home_en/home_en%3Fopendocument) - [Office of the Commissioner for Personal Data Protection — whistleblower announcement](https://www.dataprotection.gov.cy/DATAPROTECTION/DATAPROTECTION.NSF/All/D174BEEE706A7B67C2258BB1003C4C8B) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Czech Republic — Act No. 171/2023 > Czech whistleblower law under Act No. 171/2023: the 50-worker threshold, the Ministry of Justice external system, and the official Czech sources. Canonical: https://ethicsportal.eu/whistleblower-laws/czech-republic/ Last updated: 2026-08-19 The Czech Republic implemented Directive (EU) 2019/1937 through **Act No. 171/2023 Coll. on the protection of whistleblowers**, effective from **1 August 2023**. The Czech model gives the Ministry of Justice a visible role through its public `Oznamovatel` portal and external reporting system. ## Applicable law - [Ministry of Justice whistleblower portal](https://oznamovatel.justice.cz/) - [Ministry note on Act No. 171/2023 entering into force](https://oznamovatel.justice.cz/zakon-o-ochrane-oznamovatelu-a-souvisejici-zmenovy-zakon-nabyvaji-ucinnosti/) ## Who must establish an internal channel Private employers with **at least 50 employees** must establish an internal reporting channel. Public authorities, municipalities with **at least 10,000 inhabitants**, and a range of other public bodies are also covered. Entities in the financial-services and anti-money-laundering, transport-safety, and environmental sectors are in scope **regardless of headcount**. ## External reporting authority The official external reporting system is operated by the [Ministry of Justice](https://oznamovatel.justice.cz/informace-pro-oznamovatele/). Czech official guidance also notes that a whistleblower may report directly to the public authority that is substantively competent to address the unlawful conduct. ## Data protection authority For data-protection complaints connected to whistleblower handling, the relevant authority is the [Office for Personal Data Protection (UOOU)](https://www.uoou.cz/). ## Key compliance points - Czech law is narrower than a generic ethics hotline because the official ministry guidance ties protection to defined types of unlawful conduct. - The Ministry of Justice publishes model forms, methodology and sample internal rules, which makes the Czech market relatively documentation-heavy. - Internal systems should clearly explain when a reporter may prefer the ministry's external route instead of the employer's own channel. ## The framework in practice The Ministry of Justice publishes an annual report on its whistleblower-protection activity. Its report for **2024** — the first full calendar year of the external channel under Act No. 171/2023 — records: - **156 reports** received through the external reporting channel. - **59 of those fell within the scope of the Act**, chiefly suspected offences reaching the minimum-penalty threshold the Act sets. - Systematic verification of compliance across selected public-administration bodies, covering internal reporting systems, appointment of the responsible person, and record-keeping. - Nine educational events, including a conference with more than 560 participants, alongside 30 written enquiries answered and 5 direct consultations with prospective reporters. Two inferences for Czech obligated entities. First, roughly **two in three external reports fell outside the Act's scope** — consistent with the narrow material scope described above, and a practical argument for internal intake that screens and explains scope rather than routing everything onward. Second, the Ministry actively checks obligated entities, so the documentation the Act requires is inspected in practice and not merely expected on paper. ## Official sources - [Oznamovatel — Ministry of Justice portal](https://oznamovatel.justice.cz/) - [Ministry of Justice — information for whistleblowers](https://oznamovatel.justice.cz/informace-pro-oznamovatele/) - [Ministry of Justice — Act No. 171/2023 enters into force](https://oznamovatel.justice.cz/zakon-o-ochrane-oznamovatelu-a-souvisejici-zmenovy-zakon-nabyvaji-ucinnosti/) - [Ministry of Justice — annual reports and methodology section](https://oznamovatel.justice.cz/vyrocni-zpravy/) - [UOOU — Office for Personal Data Protection](https://www.uoou.cz/) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Denmark: employer requirements > Denmark’s whistleblower law: the 50-employee threshold, internal procedures, seven-day acknowledgement and the National Whistleblower Scheme. Canonical: https://ethicsportal.eu/whistleblower-laws/denmark/ Last updated: 2026-10-25 **Employers in Denmark with 50 or more employees must establish a whistleblowing channel** (an “internal reporting channel” under Article 8 of Directive (EU) 2019/1937). The requirement comes from § 9 of **Act No. 1436 of 29 June 2021**. The employer’s channel is separate from the **National Whistleblower Scheme**, which provides an external reporting route. [Official law, §§ 9 and 17](https://www.retsinformation.dk/eli/lta/2021/1436/pdf). ## Applicable law - [Act No. 1436 of 29 June 2021 — official text](https://www.retsinformation.dk/eli/lta/2021/1436) - [National Whistleblower Scheme — English overview](https://whistleblower.dk/english) ## Which employers must establish a whistleblowing channel? Public authorities and private employers with **at least 50 workers** must establish an internal whistleblower scheme. For employers below 50 employees, check the applicable sector rules: § 2 preserves special EU-derived reporting regimes, and § 9(2) permits additional obligations following a risk assessment. The general 50-employee threshold is not a universal exemption. ## What must an employer put in place? | Requirement | Legal basis | | --- | --- | | Designate an impartial person or department; permitted tasks may be handled by a third party | § 11 | | Protect identities and prevent unauthorized access | § 12(1) | | Acknowledge receipt within seven days and follow up diligently | § 12(2) | | Provide feedback as soon as possible and no later than three months after acknowledgement | § 12(2) | | Give workers accessible information about internal and external reporting | § 13 | | Keep written documentation of the scheme and procedures | § 16 | The law took effect on **17 December 2021**. For private employers with **50–249 employees**, the internal-channel provisions took effect on **17 December 2023** (§ 31). ## External reporting authority The official external route is the [National Whistleblower Scheme](https://whistleblower.dk/english), which is established within Datatilsynet but operates as a separate national external channel. ## Data protection authority The GDPR supervisory authority is [Datatilsynet](https://www.datatilsynet.dk/om-datatilsynet/den-nationale-whistleblowerordning), which also hosts the National Whistleblower Scheme institutionally. ## Key compliance points - Denmark's national scheme accepts written, oral and in-person reports and explicitly allows anonymous reporting. - The national scheme is not limited to GDPR issues; official Danish materials say it also covers serious legal breaches and other serious matters within the law's scope. - Internal procedures should make clear when a worker should use the employer's channel and when the national external route is more appropriate. ## Official sources - [Act No. 1436 of 29 June 2021 — official text](https://www.retsinformation.dk/eli/lta/2021/1436) - [National Whistleblower Scheme — English overview](https://whistleblower.dk/english) - [Datatilsynet — National Whistleblower Scheme](https://www.datatilsynet.dk/om-datatilsynet/den-nationale-whistleblowerordning) - [Justitsministeriet — guidance for private workplaces](https://www.justitsministeriet.dk/wp-content/uploads/2021/12/Vejledning-for-whistleblowerordninger-paa-private-arbejdspladser.pdf) - [Justitsministeriet — guidance for public workplaces](https://www.justitsministeriet.dk/wp-content/uploads/2022/02/Vejledning-for-whistleblowerordninger-paa-offentlige-arbejdspladser.pdf) --- Evaluating a whistleblowing channel for Denmark? Review [how EthicsPortal works](https://ethicsportal.eu/product/) and [pricing](https://ethicsportal.eu/pricing/). The employer remains responsible for its procedure, designated handlers and follow-up. **See EthicsPortal in a live demo** A short online call: you see the whistleblowing channel your workers would use and the case handling behind it, and get answers to your questions. - [Book a demo](https://calendar.zoho.com/zc/view/slot-booking/zz08011220cdfa69864e9cefc2ca0e49dffa95e504c0265f6717484ebe19cbe7f6f38d5c7a) - [Deploy](https://secure.ethicsportal.eu/session/new?intent=start) - or email yaro@ethicsportal.eu --- # Whistleblower law in Estonia — RTKS > Estonia's Rikkumisest teavitaja kaitse seadus (RTKS): the 50-worker rule, Estonia's still-young reporting framework, and the official state sources. Canonical: https://ethicsportal.eu/whistleblower-laws/estonia/ Last updated: 2026-04-24 Estonia implemented Directive (EU) 2019/1937 through the **Rikkumisest teavitaja kaitse seadus (RTKS)**, which entered into force on **1 September 2024**. Estonia's framework is still relatively new, so the official law text matters more than mature administrative guidance pages. ## Applicable law - [Rikkumisest teavitaja kaitse seadus (RTKS) — official text](https://www.riigiteataja.ee/akt/108052024001) ## Who must establish an internal channel Private employers with **at least 50 workers** are the main business group required to establish an internal reporting channel. Public-sector coverage is broader under the act. Entities in the financial-services and anti-money-laundering, transport-safety, and environmental sectors are in scope **regardless of headcount**. ## External reporting authority Estonia's act works through **competent authorities** that handle the underlying subject matter of the breach rather than through one highly visible universal whistleblowing channel. In practice, organisations should therefore explain which authority is competent for the issues they cover instead of treating external reporting as a single generic route. ## Data protection authority For GDPR complaints about the handling of report data, the relevant authority is the [Estonian Data Protection Inspectorate (AKI)](https://www.aki.ee/en). ## Key compliance points - Estonia's law protects work-related reporting of breaches within the statutory scope, so companies should distinguish the legal whistleblowing process from any broader speak-up or HR intake. - Because the regime is new, clear published instructions on scope, intake format and follow-up matter more than in older whistleblowing markets. - Organisations handling sensitive reports should also pay attention to AKI guidance and breach-reporting expectations. ## Official sources - [RTKS — official text](https://www.riigiteataja.ee/akt/108052024001) - [Chancellor of Justice — application page](https://www.oiguskantsler.ee/en/contacts/application-chancellor-justice) - [AKI — Estonian Data Protection Inspectorate](https://www.aki.ee/en) - [AKI — contact page](https://www.aki.ee/vota-uhendust) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Finland — Act 1171/2022 > Finland's Whistleblower Protection Act: the 50-worker rule, the centralised external reporting channel, and the official Finnish sources. Canonical: https://ethicsportal.eu/whistleblower-laws/finland/ Last updated: 2026-04-24 Finland implemented Directive (EU) 2019/1937 through **Act 1171/2022 on the protection of persons reporting breaches of European Union and national law**, in force since **1 January 2023**. Finland combines the standard **50-worker** threshold with a clearly identified **centralised external reporting channel** at the Office of the Chancellor of Justice. ## Applicable law - [Act 1171/2022 — official text on Finlex](https://www.finlex.fi/en/legislation/2022/1171) - [Office of the Chancellor of Justice — whistleblower protection](https://oikeuskansleri.fi/en/whistleblower-protection) ## Who must establish an internal channel Private employers with **at least 50 employees** must establish an internal reporting channel. Public authorities and certain specifically regulated entities are also covered under the act. Entities in the financial-services and anti-money-laundering, transport-safety, and environmental sectors are in scope **regardless of headcount**. ## External reporting authority The official external route is the [centralised external reporting channel of the Office of the Chancellor of Justice](https://oikeuskansleri.fi/en/centralised-external-reporting-channel). The Chancellor of Justice receives the report and forwards it to the competent authority for follow-up. ## Data protection authority For GDPR complaints about how whistleblower data are processed, the relevant authority is the [Office of the Data Protection Ombudsman](https://tietosuoja.fi/en/home). ## Key compliance points - Finnish organisations must inform potential reporters not only about the internal process, but also about the external reporting procedure and the conditions for obtaining statutory protection. - Finland's law is narrower than a generic ethics line, so companies should separate statutory whistleblowing from broader misconduct intake if they choose to cover both. - The Chancellor of Justice model makes Finland one of the clearer countries for explaining the external route to reporters. ## Official sources - [Act 1171/2022 — official Finlex text](https://www.finlex.fi/en/legislation/2022/1171) - [Office of the Chancellor of Justice — whistleblower protection](https://oikeuskansleri.fi/en/whistleblower-protection) - [Office of the Chancellor of Justice — centralised external reporting channel](https://oikeuskansleri.fi/en/centralised-external-reporting-channel) - [Office of the Data Protection Ombudsman](https://tietosuoja.fi/en/home) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in France: Sapin 2 and Waserman > France's whistleblower framework under Loi Sapin 2 as amended by Loi Waserman: who needs an internal channel, how external reporting works, which official authorities matter, and how the Sapin 2 anti-corruption duty differs. Canonical: https://ethicsportal.eu/whistleblower-laws/france/ Last updated: 2026-11-04 France implemented Directive (EU) 2019/1937 through **Loi n° 2022-401 du 21 mars 2022** ("Loi Waserman"), which amended the existing **Loi Sapin 2** framework, with the October 2022 decree setting the practical framework for internal and external reporting procedures. For most employers, the central threshold remains **50 employees**. ## Loi Sapin 2 or Loi Waserman? {#sapin-2-or-waserman} They are one framework, not two competing laws. **Loi n° 2016-1691 du 9 décembre 2016** ("Loi Sapin 2", also written Sapin II) created France's first whistleblower statute. Loi Waserman did not replace it --- it **amended** it, in order to transpose Directive (EU) 2019/1937. The protections in force today therefore sit in Sapin 2 *as amended*, which is why the penalty provisions below cite Article 13 of the 2016 text rather than the 2022 one. One distinction does real work in practice. Sapin 2 **Article 17** imposes an anti-corruption *compliance-programme* duty on companies with 500 or more employees and €100M+ turnover, enforced by the Agence française anticorruption (AFA). That is a **different obligation** from the reporting-channel duty described on this page, it catches far fewer companies, and satisfying one does not satisfy the other. A 60-person firm has the channel duty and not the Article 17 duty; a 900-person firm has both. ## What Loi Waserman protects, and whom Loi Waserman protects **whistleblowers**: natural persons who report or disclose, in good faith and without direct financial reward, information about a crime, an offence, a threat or harm to the public interest, or a breach of French, European or international law. It widened the earlier Sapin 2 framework: - **A wider definition**: in a work context, the whistleblower no longer needs to have *personal* knowledge of the facts reported. - **No duty to report internally first**: the whistleblower may go straight to an external authority (see below). - **Protection for people around the whistleblower**: "facilitators", including legal persons such as trade unions and associations, and colleagues and relatives exposed to retaliation are now covered. ## What can be reported A report may concern a **crime**, an **offence**, a **threat or harm to the public interest**, or a **breach of law**: French law, EU law, or an international commitment ratified by France (Article 6, I of Loi Sapin 2). The whistleblower must act in good faith and without direct financial reward. Some facts are **excluded** from the regime, whatever their form or medium (Article 6, II): those covered by - national defence secrecy; - medical secrecy; - the secrecy of judicial deliberations; - the secrecy of judicial investigations; - lawyer–client privilege. In practice, a breach of an internal rule alone, with no breach of law and no harm to the public interest, does not give whistleblower status. A company may still open its channel to such reports. ## Anonymous reports A report may be made anonymously. If the reporter's identity is revealed later, they receive **the same protections** as any whistleblower (Article 7-1 of Loi Sapin 2). The statutory duty to give feedback does not apply to anonymous reports. The internal procedure must state **how anonymous reports are handled** (décret n° 2022-1284, art. 4). On the difference between anonymity and confidentiality, see [anonymous vs confidential reporting](https://ethicsportal.eu/blog/anonymous-vs-confidential-reporting/). ## What the internal procedure must include {#internal-procedure} The content of the procedure is set by **décret n° 2022-1284 du 3 octobre 2022**. The procedure is adopted after **consulting the staff representative bodies** (Article 8, I, B of Loi Sapin 2). | Requirement | Rule | Source | | --- | --- | --- | | Reporting channel | In writing or orally. Orally: by telephone or voicemail and, at the reporter's request, by video call or in-person meeting **no later than 20 working days** after the request. | Decree, art. 4 I | | Acknowledgement | In writing, **within 7 working days**. | Decree, art. 4 I | | Feedback | In writing, within a reasonable time **not exceeding 3 months** from the acknowledgement (or, without one, from the end of a 7-working-day period). | Decree, art. 4 III | | People who receive reports | Sufficient competence, authority and means; guarantees of **impartiality**. Receiving reports may be entrusted to a **third party**, for example an external provider. | Decree, arts. 5 and 7 | | Oral reports | Recording, transcript or minutes as applicable, with the required consent; the reporter can check and sign. | Decree, art. 6 II | | Confidentiality | Strict confidentiality of the identity of the reporter, the people named in the report and third parties mentioned. | Law, art. 9 I | | Retention | Only as long as **strictly necessary and proportionate** to handle the report and to protect the reporter, the people named and third parties mentioned. After that, only if the data no longer identifies anyone. | Law, art. 9 III | | Publication | By any means that gives sufficient publicity (notification, posting, publication, website), **permanently and accessibly**, with information on external reporting procedures. | Decree, art. 8 | **Groups and small employers.** One procedure may cover several or all companies in a group (Article 8, I, C of the law). Employers with fewer than 250 employees may, after matching decisions by their competent bodies, **pool** the channel and the assessment of reports; their other obligations stay with each employer (decree, art. 7 II). ## Applicable law - [Loi n° 2016-1691 du 9 décembre 2016 (Loi Sapin 2)](https://www.legifrance.gouv.fr/loda/id/JORFTEXT000033558528/) --- the framework Loi Waserman amends - [Loi n° 2022-401 du 21 mars 2022 (Loi Waserman)](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000045388745) - [Service Public explainer for whistleblowers](https://www.service-public.gouv.fr/particuliers/vosdroits/F32031) ## Who must establish an internal channel - **Private employers with 50 or more employees** must establish an internal reporting procedure (headcount assessed at the close of two consecutive financial years). - **Public legal entities and state administrations with at least 50 agents** — excluding municipalities under 10,000 inhabitants. - Some entities with fewer than 250 workers may pool the collection and processing arrangement. - **Financial / AML, transport-safety, and environmental entities** — regardless of headcount. The obligation has applied since **1 September 2022** (implementing décret 2022-1284 of 3 October 2022). This 50-employee channel duty is separate from the Sapin II anti-corruption *compliance-programme* obligation (500 employees / €100M turnover, Art. 17), which the AFA enforces with much larger sanctions. ## Penalties and enforcement France's framework is unusual: **there is no direct fine for simply failing to establish a channel.** The current Sapin II / Loi Waserman text imposes no sanction on a company for not setting one up, and the implementing decree contains no penalty provisions. Instead, penalties attach to specific *conduct*: | Conduct | Individuals | Legal entities | | --- | --- | --- | | Obstructing the transmission of a report ("in any way whatsoever") | 1 year imprisonment + **€15,000** | **€75,000** | | Discrimination / retaliation based on whistleblower status (Code pénal arts. 225-1/225-2) | 3 years imprisonment + **€45,000** | **€225,000** | | Disclosing confidential information (identity of the reporter, the people named, third parties), Article 9, II of Loi Sapin 2 | 2 years imprisonment + **€30,000** | **€150,000** | | Abusive or dilatory ("SLAPP") proceedings against a whistleblower | civil fine up to **€60,000** (plus damages) | — | Verbatim, Article 13, I of [Loi 2016-1691](https://www.legifrance.gouv.fr/loda/id/JORFTEXT000033558528/): *"Toute personne qui fait obstacle, de quelque façon que ce soit, à la transmission d'un signalement … est punie d'un an d'emprisonnement et de 15 000 euros d'amende."* The same Article 13 (II) raises the *amende civile* for an abusive or dilatory action against a whistleblower to **60 000 euros**. There is **no article anywhere in the Sapin II / Waserman framework that fines an employer for failing to establish a channel** — confirmed against the consolidated Légifrance text and décret 2022-1284. **An honest assessment of enforcement.** Not having a channel is not directly fined — but it is far from risk-free. A missing or defective channel creates **indirect exposure**: it strengthens a retaliation or wrongful-dismissal claim before the Conseil de prud'hommes, and feeds AFA scrutiny for large firms under the anti-corruption regime. Enforcement of whistleblower protection is primarily **reactive and judicial**: retaliatory dismissals are null and void by operation of law, and the labour court's summary judge can order reinstatement (Cass. soc., 1 Feb 2023, *Thales*, n°21-24.271, with the burden of proof shifting to the employer). The Défenseur des droits oversees protection. The practical lesson: the real cost of not having a proper channel shows up as litigation and reinstatement liability, not a fixed administrative fine. ## External reporting authority France does not rely on one universal whistleblowing authority. **Décret n° 2022-1284 du 3 octobre 2022** publishes a schedule of competent external authorities — twenty-three sectoral headings — each receiving reports within its own remit. The [Défenseur des droits](https://ethicsportal.eu/authorities/france-defenseur-des-droits/) sits alongside that schedule with a different role: it orients a whistleblower to the right authority, issues an opinion on whistleblower status within six months, and protects against retaliation. That page covers what it can and cannot do, the external deadlines, and how a report reaches it. The practical consequence for an employer is that there is no single regulator to name in an internal procedure. ## Data protection authority For concerns about unlawful processing of [personal data](https://ethicsportal.eu/blog/gdpr-and-whistleblower-reporting/) or confidentiality failures in the reporting process, the relevant authority is the [CNIL](https://www.cnil.fr/fr/saisir-la-cnil/lanceurs-dalerte-adresser-une-alerte-la-cnil). ## Key compliance points - France no longer requires whistleblowers to report internally before using an external channel. - The procedure must keep the identity of the reporting person, the person concerned, and named third parties [confidential](https://ethicsportal.eu/blog/anonymous-vs-confidential-reporting/). - Décret 2022-1284 (art. 4) sets acknowledgement within 7 working days and feedback within 3 months. ## The framework in practice The Défenseur des droits — France's designated external reporting authority — published its first two-yearly review of the regime, *La protection des lanceurs d'alerte en France : un dispositif à l'épreuve de son appropriation*, on 28 May 2026. Two of its findings bear directly on how an internal procedure should be run: - **External reporting has grown roughly fivefold.** The review records **more than 10,000 signalements in 2025**, against about **2,000 in 2023** — reports made to external authorities rather than through an employer's internal procedure. - **Retaliation, not intake, is the recurring failure.** The Défenseur des droits reports witnessing frequent breaches of the statutory prohibition on retaliation, particularly in the employment relationship. Reports cluster in health and medico-social services, environmental matters, and public integrity. The practical inference for a French employer: since 2022 a reporter may go straight to an external authority, and the volume figures show they increasingly do. The question is no longer whether people will report, but whether the internal procedure is credible enough to be used first — and whether what happens after a report protects the person who made it. A procedure that satisfies the 7-working-day acknowledgment and 3-month feedback timeline but leaves a reporter exposed to retaliation fails on the axis the Défenseur des droits actually reports on. ## Official sources - [Loi Waserman — official text](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000045388745) - [Service Public — lancer une alerte](https://www.service-public.gouv.fr/particuliers/vosdroits/F32031) - [Loi Sapin II (Loi 2016-1691) — official text](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000033558528) - [Décret 2022-1284 (internal/external reporting procedures)](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000046357368) - [Défenseur des droits — orienter et protéger les lanceurs d'alerte](https://www.defenseurdesdroits.fr/orienter-et-proteger-les-lanceurs-dalerte-180) - [Défenseur des droits — rapport bisannuel sur la protection des lanceurs d'alerte (28 May 2026)](https://www.defenseurdesdroits.fr/rapport-bisannuel-la-protection-des-lanceurs-dalerte-en-france-un-dispositif-lepreuve-de-son-1150) - [Agence Française Anticorruption — les contrôles de l'AFA](https://www.agence-francaise-anticorruption.gouv.fr/fr/controles-lafa) - [CNIL — adresser une alerte](https://www.cnil.fr/fr/saisir-la-cnil/lanceurs-dalerte-adresser-une-alerte-la-cnil) ## Frequently asked questions ### What is the difference between Loi Sapin 2 and Loi Waserman? They are two texts of one framework, not two competing regimes. Loi Sapin 2 (Loi n° 2016-1691 of 9 December 2016) created the French whistleblower status; Loi Waserman (Loi n° 2022-401 of 21 March 2022) amended it to transpose Directive (EU) 2019/1937. The protections in force today sit in Sapin 2 as amended. Do not confuse this with the anti-corruption *compliance-programme* duty in Article 17 of Sapin 2, which applies only to companies with at least 500 employees and more than €100M turnover. ### From how many employees is a whistleblowing channel mandatory in France? From **50 employees**, with headcount assessed at the close of two consecutive financial years. The threshold also applies to public legal entities with at least 50 agents, except municipalities under 10,000 inhabitants. Entities in financial services and AML, transport safety and the environment must comply **regardless of headcount**. The duty has applied since 1 September 2022. ### What is the penalty for having no whistleblowing channel? No direct fine. This is particular to France: neither Sapin 2 as amended nor décret 2022-1284 penalises an employer only for not having an internal procedure. Penalties target specific conduct: obstructing a report (1 year in prison and €15,000 for an individual, €75,000 for a legal entity) and retaliation (3 years and €45,000, €225,000 for a legal entity). An employer without a channel is therefore exposed through litigation: it strengthens a retaliatory-dismissal claim before the Conseil de prud'hommes, where any retaliatory dismissal is void. ### Must an employee report internally before going to an external authority? No. Since Loi Waserman, a whistleblower may go straight to an external authority without first using the employer's internal procedure. This is a real change from the earlier regime, and it is why an internal procedure only helps if it is credible enough to be used first. ### What deadlines must the internal procedure meet? An **acknowledgement within 7 working days** of the report, and **feedback to the reporter within no more than 3 months** of the acknowledgement (décret n° 2022-1284, art. 4). These deadlines follow the model of Directive (EU) 2019/1937. ### Who is the competent external authority in France? France has no single external authority. The [Défenseur des droits](https://ethicsportal.eu/authorities/france-defenseur-des-droits/) orients and protects whistleblowers, and the sectoral authorities listed in décret n° 2022-1284 receive reports within their remit. The Défenseur des droits counted more than 10,000 external reports in 2025, against about 2,000 in 2023. ### Can a whistleblower stay anonymous? Yes. A report may be made anonymously, and if the reporter's identity is revealed later, they receive the same protections (Article 7-1 of Loi Sapin 2). The employer's internal procedure must state how anonymous reports are handled. ### Which facts are excluded from protection? Facts covered by national defence secrecy, medical secrecy, the secrecy of judicial deliberations, the secrecy of judicial investigations, and lawyer–client privilege (Article 6, II of Loi Sapin 2). ### How do you set up the whistleblowing procedure? First consult the staff representative bodies. Then appoint the people who will receive reports, with sufficient competence, authority and means, or entrust this to a third party. Open a written or oral reporting channel, with a meeting within 20 working days if the reporter asks. Plan acknowledgement within 7 working days and feedback within 3 months. Finally, publish the procedure permanently and accessibly (décret n° 2022-1284). ### Does the GDPR apply to reports? Yes. A report contains personal data about the reporter, the person concerned and third parties mentioned, and processing it falls under the GDPR. The procedure must keep all three categories confidential. The competent authority for problems is the CNIL. --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Germany — HinSchG > Germany's Hinweisgeberschutzgesetz (HinSchG): who needs an internal reporting office, what can be reported, the 7-day and 3-month deadlines, records, and fines. Canonical: https://ethicsportal.eu/whistleblower-laws/germany/ Last updated: 2026-11-04 Germany implemented Directive (EU) 2019/1937 through the **Hinweisgeberschutzgesetz (HinSchG)**, in force since **2 July 2023**. It requires employers with, as a rule, at least **50 employees** to set up an internal reporting office, and it protects people who report breaches from retaliation. ## The HinSchG at a glance | Question | Answer | | --- | --- | | In force since? | 2 July 2023. For private employers with 50 to 249 employees, the duty to have a reporting office applies from 17 December 2023 (§ 42(1)). | | Who needs a reporting office? | Employers with, as a rule, at least 50 employees (§ 12(2)); listed financial entities at any size (§ 12(3)). | | Which channels? | Oral or written; one of the two is enough. On request, also an in-person meeting (§ 16(3)). | | Deadlines? | Acknowledgement within 7 days, feedback within 3 months (§ 17). | | Anonymous reports? | Should be handled; there is no duty to offer an anonymous channel (§ 16(1)). | | How long to keep records? | Deleted three years after the case is closed; longer only where necessary and proportionate (§ 11(5)). | | Fine for having no office? | Up to €20,000 (§ 40(2) no. 2, § 40(6)). | ## Applicable law - [Hinweisgeberschutzgesetz (HinSchG)](https://www.gesetze-im-internet.de/hinschg/BJNR08C0B0023.html) ## Who must establish an internal channel Private employers with **50 or more employees** must establish and operate at least one internal reporting office (§ 12(1) and (2)). The act also allows private employers with **50 to 249 employees** to establish and operate a joint internal reporting office. Only the financial entities listed in [§ 12(3) HinSchG](https://www.gesetze-im-internet.de/hinschg/__12.html) are in scope **regardless of headcount**: securities firms, credit, payment and crypto-asset institutions, insurers, investment management companies, stock exchange operators and data reporting services. Unlike some other member states, Germany does not extend this to the transport or environmental sectors. The federal government, the Länder and municipalities have their own rules. For municipalities, the duty follows the law of the relevant Land (§ 12(1) sentence 4). ## What can be reported [§ 2 HinSchG](https://www.gesetze-im-internet.de/hinschg/__2.html) sets the material scope. It covers information about: - **all criminal offences**; - **administrative offences** where the rule protects life, physical safety or health, or the rights of employees or their representative bodies, for example occupational health and safety; - breaches in specific fields of law, among them **anti-money laundering, product safety, transport safety, environmental protection, food safety, consumer protection and data protection**, plus shareholder rights, audits of public-interest entities and the financial reporting of listed companies; - breaches of **public procurement** law, of **tax law** for corporations and commercial partnerships, and of **competition law**; - breaches of the Digital Markets Act and of the **AI Act** (Regulation (EU) 2024/1689); - statements by civil servants that breach their **duty of loyalty to the constitution**. A breach under the act must be unlawful (§ 3(2)). A breach of an internal policy alone, with no breach of law, is not covered. A company may still open its channel to such reports. [§ 5](https://www.gesetze-im-internet.de/hinschg/__5.html) **excludes**, among other things, national security information, classified information (with narrow exceptions), the secrecy of judicial deliberations, and the confidentiality duties of lawyers, notaries, doctors and other professionals bound by secrecy. ## Who is protected The act protects **natural persons** who obtained information about breaches in connection with their work, or before starting work (§ 1(1)). That covers not only employees but also, for example, job applicants, agency workers, self-employed people and people working for suppliers. It also protects people who are the subject of a report or affected by it (§ 1(2)). Protection applies when the person reported internally or externally and, at the time, had **reasonable grounds to believe** that the information was true and within the scope of the act (§ 33). The reporter may choose freely between the internal office and an external one (§ 7(1)). | Protection | Provision | | --- | --- | | Retaliation is prohibited, including threats and attempts | § 36(1) | | **Reversed burden of proof**: if the person suffers a disadvantage after a report, it is presumed to be retaliation. The employer must prove otherwise. | § 36(2) | | Damages for retaliation (no right to be hired or promoted) | § 37 | | No liability for obtaining the reported information, unless obtaining it is itself a crime | § 35(1) | ## Requirements for the internal reporting office - **Who can run it:** an employee, a unit of several employees, or a **third party**, for example an ombudsperson or a law firm (§ 14(1)). The duty to stop a breach always stays with the employer. - **Independence and expertise:** the people in charge are independent in this role. They may have other tasks as long as these cause no conflict of interest. The employer ensures they have the necessary expertise (§ 15) and gives the office the powers it needs (§ 12(4)). - **Channels:** reports must be possible orally or in text form. According to the [explanatory memorandum (BT-Drs. 20/3442, p. 81)](https://dserver.bundestag.de/btd/20/034/2003442.pdf), one of the two is enough; for external offices, the act requires both. Oral reports must be possible by telephone or another form of voice transmission. On request, an in-person meeting must be offered within a reasonable time, or by video with the reporter's consent (§ 16(3)). - **Access:** only the people responsible for reports and those who support them may access incoming reports (§ 16(2)). - **Who can report:** at least employees and agency workers. The channel may also be opened to other people in professional contact with the company, for example people working for suppliers (§ 16(1)). - **Anonymous reports:** the office *should* also handle anonymous reports. There is no duty to design the channels so that anonymous reports are possible (§ 16(1)). See also [anonymous and confidential reporting](https://ethicsportal.eu/blog/anonymous-vs-confidential-reporting/). - **Information for employees:** clear and easily accessible information on the internal procedure (§ 7(3)) and on external reporting offices (§ 13(2)). ## Deadlines and what happens after a report | Step | Deadline | | --- | --- | | Acknowledge receipt to the reporter | within **7 days** at the latest (§ 17(1) no. 1) | | Feedback on planned and completed follow-up actions and the reasons for them | within **3 months** of the acknowledgement; without one, at the latest 3 months and 7 days after receipt (§ 17(2)) | The act says seven *days*, not working days. Between receipt and feedback, the office checks whether the breach falls within scope and whether the report is well founded. It stays in contact with the reporter and asks for more information where needed (§ 17(1)). Follow-up actions under [§ 18](https://www.gesetze-im-internet.de/hinschg/__18.html) include internal investigations, referring the reporter to another competent body, closing the case for lack of evidence, or handing it to an internal investigation unit or an authority. Feedback must not affect internal investigations or the rights of the people concerned (§ 17(2)). ## Confidentiality and records **Confidentiality (§ 8).** The office protects the identity of the reporter, of the people who are the subject of the report, and of everyone else named in it. Only the people responsible and those who support them may know these identities. This applies even when the office is not competent for the report. **Exceptions (§ 9).** The reporter's identity may be disclosed, for example, in criminal proceedings at the request of the prosecuting authorities, or on a court decision. For follow-up actions, disclosure requires the reporter's consent in text form, separately for each disclosure. The identity of a person who reports false information intentionally or through gross negligence is not protected. **Records (§ 11).** - All incoming reports are recorded in a durable, retrievable form. - For telephone reports, an audio recording or a word-for-word transcript requires consent. Otherwise a summary of the content is recorded. - The reporter may check, correct and confirm the record. - Records are **deleted three years after the case is closed**. They may be kept longer only while this is necessary and proportionate under the HinSchG or other laws. ## Joint offices and groups of companies **Joint office.** Several private employers with, as a rule, 50 to 249 employees may set up a joint office. The duty to stop the breach and to give feedback to the reporter stays with each employer (§ 14(2)). **Groups of companies.** The act itself does not regulate groups. According to the [explanatory memorandum (BT-Drs. 20/3442, p. 79)](https://dserver.bundestag.de/btd/20/034/2003442.pdf), another group company, such as the parent, can act as a "third party" under § 14(1) and run the reporting office for several group companies. Three conditions apply: - The responsibility to stop a breach stays with each subsidiary. - Reports must be possible in the working language of the subsidiary. - The central office must not create extra barriers for reporters. ## Works council and data protection If a company introduces a software-based reporting office, the works council may have a right of co-determination, in particular under § 87(1) no. 1 and no. 6 of the Works Constitution Act (BetrVG). Reports contain personal data, so also check whether a data protection impact assessment under Art. 35 GDPR is needed. See [GDPR and whistleblower reporting](https://ethicsportal.eu/blog/gdpr-and-whistleblower-reporting/). ## Penalties and enforcement Germany fines a missing internal reporting office, but at a lower ceiling than is often reported. The fines are administrative offences (*Ordnungswidrigkeiten*) under [§ 40 HinSchG](https://www.gesetze-im-internet.de/hinschg/__40.html), in three tiers set by § 40(6): | Conduct | Maximum fine | | --- | --- | | Obstructing a report or the communication that follows it (§ 40(2) no. 1), retaliation (no. 3), intentional or reckless breach of confidentiality (§ 40(3)), attempted obstruction or retaliation (§ 40(5)) | **€50,000** | | **Not establishing or operating an internal reporting office** (§ 40(2) no. 2); knowingly disclosing false information (§ 40(1)) | **€20,000** | | All other cases, in particular negligent breach of confidentiality (§ 40(4)) | **€10,000** | For legal persons, § 40(6) applies § 30(2) sentence 3 OWiG to obstruction, retaliation and breaches of confidentiality, intentional or negligent, which multiplies the ceiling **tenfold**: up to **€500,000** for the €50,000 offences. The uplift does not reach the no-office fine or the false-disclosure fine. The no-office fine has applied since **1 December 2023** (§ 42(2)); the other fines since the Act entered into force on 2 July 2023. **An honest assessment of enforcement.** The fine for having no internal reporting office is widely reported as €50,000. The Act sets **€20,000**, and the tenfold uplift is reserved for obstruction, retaliation and confidentiality breaches. The larger statutory exposure therefore lies in how reports are handled once a channel exists, not in failing to set one up. ## External reporting authority The federal external channel is the [external reporting office of the Federal Office of Justice](https://ethicsportal.eu/authorities/germany-bfj/). BaFin and the Federal Cartel Office are external reporting offices for their own fields, and each Land may set up its own external office for its administration. Employers should encourage employees to report internally first, but must not restrict or hinder external reporting (§ 7(3)). ## Data protection authority For private-sector GDPR complaints, the competent authority is usually the state-level data protection authority of the relevant Bundesland. The federal [BfDI complaints guidance](https://www.bfdi.bund.de/DE/Buerger/Inhalte/Allgemein/Datenschutz/BeschwerdeBeiDatenschutzbehoereden.html) explains this split. ## Setting up in six steps 1. **Check the duty:** as a rule, at least 50 employees; listed financial entities at any size. 2. **Staff the office:** internally, as a joint office (50 to 249 employees), at a group company, or with a third party. Ensure independence, expertise and powers. 3. **Set up channels:** oral or written, an in-person meeting on request, access only for the people responsible. Decide whether to accept anonymous reports. 4. **Involve the works council and data protection:** settle co-determination; check whether a data protection impact assessment is needed. 5. **Inform employees:** about the internal procedure and the external reporting offices. 6. **Set the procedure:** acknowledgement within 7 days, feedback within 3 months, records, and deletion after three years. ## Official sources - [HinSchG — official text](https://www.gesetze-im-internet.de/hinschg/BJNR08C0B0023.html) - [Government bill with explanatory memorandum, BT-Drs. 20/3442](https://dserver.bundestag.de/btd/20/034/2003442.pdf) - [Federal Office of Justice — external reporting office](https://formulare.bfj.bund.de/ffw/action/invoke.do?id=externeMeldestelle) - [BfDI — complaints about data protection authorities](https://www.bfdi.bund.de/DE/Buerger/Inhalte/Allgemein/Datenschutz/BeschwerdeBeiDatenschutzbehoereden.html) ## Frequently asked questions ### What does HinSchG stand for? HinSchG is short for Hinweisgeberschutzgesetz, the "Act for Better Protection of Whistleblowers". It transposes Directive (EU) 2019/1937 into German law. It protects people who report breaches and requires employers with 50 or more employees to have an internal reporting office. ### When did the HinSchG enter into force? On 2 July 2023. For private employers with 50 to 249 employees, the duty to have an internal reporting office applies from 17 December 2023. The fine for a missing office applies from 1 December 2023. ### What does § 2 HinSchG cover? § 2 sets which breaches the act covers: all criminal offences, certain administrative offences that protect life, health and employee rights, and breaches in fields such as money laundering, product safety, environmental protection, consumer protection, data protection, procurement, tax and competition law, and the AI Act. ### Must companies accept anonymous reports? No. The internal office should handle anonymous reports it receives, but there is no duty to design the channels so that anonymous reports are possible (§ 16(1)). ### What deadlines apply after a report? The office acknowledges receipt within 7 days. Within 3 months of the acknowledgement, it gives feedback on planned and completed follow-up actions (§ 17). ### How long may a report be kept? Records are deleted three years after the case is closed. They may be kept longer only where this is necessary and proportionate under the HinSchG or other laws (§ 11(5)). ### What is the fine for having no internal reporting office? Up to €20,000 (§ 40(2) no. 2, § 40(6)). Higher fines of up to €50,000, or €500,000 for companies, apply to obstructing reports, retaliation, and intentional or reckless breaches of confidentiality. ### May an external provider run the reporting office? Yes. A third party, such as an ombudsperson, a law firm or another group company, may run the internal reporting office. The duty to stop a breach stays with the employer (§ 14(1)). --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Greece — Law 4990/2022 > Greece's Law 4990/2022: who needs an internal channel, the role of the National Transparency Authority, and the official Greek compliance framework. Canonical: https://ethicsportal.eu/whistleblower-laws/greece/ Last updated: 2026-10-06 Greece implemented Directive (EU) 2019/1937 through **Law 4990/2022**, in force since **11 November 2022**, with phased deadlines for establishing internal channels. The Greek framework combines the standard private-sector threshold with a named internal reporting officer and an external channel operated by the National Transparency Authority. ## Applicable law - [Law 4990/2022 — official gazette copy](https://www.apdhp-dm.gov.gr/images/yppa/yppa-n4990-2022.pdf) - [National Transparency Authority presentation on Law 4990/2022](https://aead.gr/images/imerides/2023/87TIF_10-9-23/Karapidakis_87TIF_1.pdf) ## Who must establish an internal channel - **Private-sector employers with 50 or more workers** must establish an internal channel and appoint a reporting officer (ΥΠΠΑ — Υπεύθυνος Παραλαβής και Παρακολούθησης Αναφορών). - **Entities in the financial-services, transport, and environmental sectors** are in scope regardless of headcount. - **Public bodies** are also in scope. Deadlines: **11 May 2023** for employers with 250+ workers, **17 December 2023** for the 50-249 band; the public sector had six months from entry into force. The appointment of the reporting officer must be notified to the Labour Inspectorate within two months. ## Penalties and enforcement Greece operates **two distinct penalty tracks**, and they are frequently confused — the distinction matters. - **Failing to establish the channel / designate the reporting officer ([Art. 9(13)](https://www.lawspot.gr/nomothesia/n-4990-2022/arthro-9-nomos-4990-2022-ypohreosi-kathierosis-esoterikon/)):** the statute fixes **no specific amount**. It states only *"Η παραβίαση της υποχρέωσης ορισμού Υ.Π.Π.Α. συνεπάγεται επιβολή προστίμου"* ("breach of the obligation to designate a Υ.Π.Π.Α. results in the imposition of a fine"), with the amount and criteria delegated by [Art. 24](https://www.lawspot.gr/nomothesia/n-4990-2022/arthro-24-nomos-4990-2022-exoysiodotikes-diataxeis/) to a joint ministerial decision (Justice, Finance, Development & Investment) that had **not been issued** as of early 2025 — so this penalty was not yet operational. It is imposed by the **Labour Inspectorate**, not the National Transparency Authority. - **Obstruction, retaliation, malicious proceedings, or breaching a reporter's confidentiality ([Art. 23](https://www.lawspot.gr/nomothesia/n-4990-2022/arthro-23-nomos-4990-2022-kyroseis-par-1-kai-2-arthroy-23/)):** natural persons face **imprisonment plus a fine** (Art. 23(1); knowingly false reports carry a minimum 2-year term under Art. 23(3)). Where the violation is committed *"προς όφελος ή για λογαριασμό νομικού προσώπου"* (for the benefit of or on account of a legal entity), Art. 23(5) imposes an administrative fine on the entity of **€10,000–500,000**. **An honest assessment of enforcement.** Read the trigger carefully: the often-quoted "€500,000" ceiling attaches to a violation committed *for the benefit of the legal entity* — obstruction, retaliation, breaking confidentiality — **not** to simply lacking a channel, whose penalty amount remained undefined pending secondary legislation. No company has been publicly identified as fined or sanctioned under either track. The National Transparency Authority received 79 external reports in 2023, so the external channel is operating, but no public sanction outcomes have surfaced. The real exposure is therefore reputational and operational — a report reaching the external authority with no internal channel in place — rather than a predictable fine. ## External reporting authority The official external channel is the [National Transparency Authority](https://aead.gr/submit-complaint), which receives reports under Law 4990/2022 and publishes implementation material for obliged entities. ## Data protection authority For complaints about unlawful handling of personal data or confidentiality issues, the relevant authority is the [Hellenic Data Protection Authority](https://www.dpa.gr/el/syndesi/polites/kataggelia/general). ## Key compliance points - Greek implementation material expects written, oral and meeting-based intake options. - The reporting officer is a named compliance role, not just a generic mailbox. - Official Greek guidance states that private entities in the 50-249 band may use shared reporting officers for intake. ## Official sources - [Law 4990/2022 — official gazette copy](https://www.apdhp-dm.gov.gr/images/yppa/yppa-n4990-2022.pdf) - [National Transparency Authority — submit a complaint](https://aead.gr/submit-complaint) - [National Transparency Authority — implementation material](https://aead.gr/images/imerides/2023/87TIF_10-9-23/Karapidakis_87TIF_1.pdf) - [Law 4990/2022 — Article 9 (private-sector channel obligation, lawspot.gr)](https://www.lawspot.gr/nomothesia/n-4990-2022/arthro-9-nomos-4990-2022-ypohreosi-kathierosis-esoterikon/) - [Law 4990/2022 — Article 23 (sanctions, lawspot.gr)](https://www.lawspot.gr/nomothesia/n-4990-2022/arthro-23-nomos-4990-2022-kyroseis-par-1-kai-2-arthroy-23/) - [Law 4990/2022 — Article 24 (enabling provisions, lawspot.gr)](https://www.lawspot.gr/nomothesia/n-4990-2022/arthro-24-nomos-4990-2022-exoysiodotikes-diataxeis/) - [Hellenic Data Protection Authority — complaints](https://www.dpa.gr/el/syndesi/polites/kataggelia/general) - [EU Whistleblowing Monitor — Greece](https://whistleblowingmonitor.eu/country/greece/resources/) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Hungary — Act XXV/2023 > Hungary's whistleblowing framework under Act XXV of 2023: the 50-worker rule, the Commissioner for Fundamental Rights system, and the official sources. Canonical: https://ethicsportal.eu/whistleblower-laws/hungary/ Last updated: 2026-04-24 Hungary implemented Directive (EU) 2019/1937 through **Act XXV of 2023** on complaints, public interest disclosures and rules related to reporting abuses, in force since **24 July 2023**. The Hungarian framework places the official external channel with the **Commissioner for Fundamental Rights**. ## Applicable law - [Act XXV of 2023 — official text](https://njt.hu/jogszabaly/2023-25-00-00) - [Commissioner for Fundamental Rights — public interest disclosure / whistleblower report](https://www.ajbh.hu/en/web/ajbh-en/public-interest-disclosure-whistleblower-report) ## Who must establish an internal channel Private employers with **at least 50 employees** must establish an internal reporting system. Public-sector bodies and certain specifically regulated entities also follow the act's whistleblowing rules. Entities in the financial-services and anti-money-laundering, transport-safety, and environmental sectors are in scope **regardless of headcount**. ## External reporting authority The official external reporting system is operated by the [Commissioner for Fundamental Rights](https://www.ajbh.hu/web/ajbh-en/submitting-public-interest-disclosure-whistleblower-report), which accepts public interest disclosures and whistleblower reports through its dedicated system. ## Data protection authority For GDPR complaints relating to the handling of report data, the relevant authority is the [Hungarian National Authority for Data Protection and Freedom of Information (NAIH)](https://www.naih.hu/). ## Key compliance points - Hungary's official terminology still strongly links whistleblowing to the public-interest disclosure framework. - The official external system accepts reports with or without identification, but the handling consequences differ depending on whether the reporter identifies themselves. - Organisations entering Hungary should be careful to separate statutory whistleblower handling from any broader ethics or grievance channel. ## Official sources - [Act XXV of 2023 — official text](https://njt.hu/jogszabaly/2023-25-00-00) - [Commissioner for Fundamental Rights — public interest disclosure / whistleblower report](https://www.ajbh.hu/en/web/ajbh-en/public-interest-disclosure-whistleblower-report) - [Commissioner for Fundamental Rights — submitting a report](https://www.ajbh.hu/web/ajbh-en/submitting-public-interest-disclosure-whistleblower-report) - [NAIH — Hungarian data protection authority](https://www.naih.hu/) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Ireland: protected disclosures > Ireland's protected disclosures framework: the 50-worker rule, the Protected Disclosures Commissioner, and the official Irish sources. Canonical: https://ethicsportal.eu/whistleblower-laws/ireland/ Last updated: 2026-10-06 Ireland implemented Directive (EU) 2019/1937 through the **Protected Disclosures (Amendment) Act 2022**, in force since **1 January 2023**, building on the older Irish protected disclosures regime. For most private organisations, the main trigger is **50 workers**, while Ireland's external reporting structure combines a **Protected Disclosures Commissioner** with a long list of sectoral **prescribed persons**. ## Applicable law - [Protected Disclosures (Amendment) Act 2022 — official Irish Statute Book text](https://www.irishstatutebook.ie/eli/2022/act/27/enacted/en/html) - [Commencement table — Irish Statute Book](https://www.irishstatutebook.ie/eli/isbc/2022_27.html) - [Department of Justice — protected disclosures guidance](https://www.gov.ie/en/department-of-justice-home-affairs-and-migration/organisation-information/department-of-justice-protected-disclosures/) ## Who must establish an internal channel Private organisations with **at least 50 workers** must establish an internal reporting channel. Public bodies are also covered under the Irish protected disclosures framework. Entities in the financial-services and anti-money-laundering, transport-safety, and environmental sectors are in scope **regardless of headcount**. ## External reporting authority Ireland does not rely on a single universal subject-matter authority. The [Office of the Protected Disclosures Commissioner](https://www.gov.ie/en/department-of-justice-home-affairs-and-migration/organisation-information/department-of-justice-protected-disclosures/) acts as a routing channel when the worker is unsure of the correct recipient, while many sectoral **prescribed persons** also receive external disclosures directly. ## Data protection authority For complaints about the processing of whistleblower data, the relevant authority is the [Data Protection Commission](https://www.dataprotection.ie/en/faqs/initial-contact-dpc/making-complaint-dpc). ## Key compliance points - Irish law still uses the "protected disclosures" terminology rather than "whistleblowing" as the primary legal label. - The external-reporting map is broad, so internal procedures should tell workers whether they should go to a prescribed person, the Commissioner, or another route set out in the Act. - The Data Protection Commission expects complainants to first raise the data issue with the organisation where appropriate before escalating. ## Official sources - [Protected Disclosures (Amendment) Act 2022 — official law text](https://www.irishstatutebook.ie/eli/2022/act/27/enacted/en/html) - [Commencement table — Irish Statute Book](https://www.irishstatutebook.ie/eli/isbc/2022_27.html) - [Department of Justice — protected disclosures](https://www.gov.ie/en/department-of-justice-home-affairs-and-migration/organisation-information/department-of-justice-protected-disclosures/) - [Government list of prescribed persons](https://www.gov.ie/en/department-of-public-expenditure-infrastructure-public-service-reform-and-digitalisation/collections/protected-disclosures-whistleblowing-list-of-prescribed-persons/) - [Data Protection Commission — making a complaint](https://www.dataprotection.ie/en/faqs/initial-contact-dpc/making-complaint-dpc) - [Data Protection Commission — complaint handling](https://www.dataprotection.ie/en/individuals/exercising-your-rights/complaints-handling-investigations-and-enforcement-individuals) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # D.Lgs. 24/2023: whistleblower law in Italy > Italy's Legislative Decree 24/2023: who needs a whistleblowing channel, what can be reported, the 7-day and 3-month deadlines, records and ANAC fines. Canonical: https://ethicsportal.eu/whistleblower-laws/italy/ Last updated: 2026-11-04 Italy implemented Directive (EU) 2019/1937 through **Legislative Decree No. 24 of 10 March 2023** (D.Lgs. 24/2023). Its provisions apply from **15 July 2023**. The decree requires public-sector bodies and private entities with an average of at least **50 employees** to set up a whistleblowing channel. The same duty applies, at any size, to entities that have adopted a **Model 231** and to some sectors regulated by EU law. The decree also protects people who report from any retaliation. **Does your organisation need a whistleblowing channel?** - **Fewer than 50 employees:** For private entities, usually not. Public-sector bodies need one at any size. A private entity also needs one at any size if it has adopted a Model 231 or falls within the EU acts in Parts I.B and II of the annex: financial services and anti-money laundering, and some acts on transport safety and environmental protection (art. 2(1)(p) and (q)). - **50 to 249:** Yes, since 17 December 2023 (art. 24(2)). Private entities with up to 249 employees may share the channel and its management (art. 4(4)). ANAC fines a missing channel €10,000 to €50,000 (art. 21). - **250 or more:** Yes, since 15 July 2023 (art. 24(1)). ANAC fines a missing channel, or a failure to verify the reports received, €10,000 to €50,000 (art. 21). ## D.Lgs. 24/2023 at a glance | Question | Answer | | --- | --- | | Applies since? | 15 July 2023. For private entities with an average of up to 249 employees, the duty to have an internal channel applies from 17 December 2023 (art. 24(1) and (2)). | | Who needs a channel? | Public-sector bodies; private entities with an average of at least 50 employees in the last year; at any size, entities with a Model 231 and entities in the sectors of Parts I.B and II of the annex (art. 2(1)(p) and (q)). | | Which channels? | Written and oral: according to ANAC, the entity must offer both. On request, also an in-person meeting (art. 4(3)). | | Must trade unions be consulted? | Yes, before the channel is set up (art. 4(1)). | | Deadlines? | Acknowledgement within 7 days, feedback within 3 months (art. 5(1)). | | Anonymous reports? | The decree does not require them to be accepted. If they arrive, the entity records them and keeps the file (ANAC guidelines). | | How long to keep records? | As long as needed, and no longer than 5 years after the final outcome is communicated (art. 14(1)). | | Fine for having no channel? | €10,000 to €50,000 (art. 21(1)(b)). | ## Applicable law - [Legislative Decree No. 24 of 10 March 2023 — current text on Normattiva](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2023-03-10;24) - [ANAC guidelines on external reports (resolution No. 311 of 12 July 2023, updated by resolution No. 479/2025)](https://www.anticorruzione.it/-/del.311.2023.linee.guida.whistleblowing) - [ANAC guidelines No. 1/2025 on internal channels (resolution No. 478 of 26 November 2025)](https://www.anticorruzione.it/-/del.n.478-26.11.2025.llgg.wb) ## Who must set up a whistleblowing channel **Private sector.** Art. 2(1)(q) names three groups of entities: 1. entities that employed an average of at least **50 employees** in the last year, on permanent or fixed-term contracts; 2. entities within the scope of the EU acts in **Parts I.B and II of the annex** to the decree, even below 50 employees. These are the acts on financial services, products and markets and on the prevention of money laundering and terrorist financing, plus some acts on transport safety (civil aviation and shipping) and on the safety of offshore oil and gas operations; 3. entities within the scope of Legislative Decree 231/2001 that **adopt a Model 231**, even below 50 employees. To calculate the average, ANAC uses the last calendar year before the current one and the average staff figure in the company's registry extract (*visura camerale*). For newly formed companies, the current year counts (guidelines, resolution No. 311/2023, § 1.3). The Model 231 must include the internal reporting channels (art. 4(1), and art. 6(2-bis) of Legislative Decree 231/2001 as replaced by art. 24(5)). **Public sector.** The duty applies to all public-sector bodies defined in art. 2(1)(p), with no size threshold. Where the body must have an anti-corruption and transparency officer (RPCT), that officer manages the channel (art. 4(5)). ## What can be reported The decree protects people who report breaches of national or EU law that harm the public interest or the integrity of the organisation, learned in a work context (art. 1(1)). Art. 2(1)(a) lists six categories: 1. administrative, accounting, civil or criminal offences; 2. unlawful conduct relevant under Legislative Decree 231/2001, or breaches of Model 231; 3. breaches in the fields of the EU acts listed in the annex: public procurement, financial services and anti-money laundering, product safety, transport safety, environmental protection, radiation protection and nuclear safety, food safety and animal welfare, public health, consumer protection, privacy and network security; 4. acts or omissions that harm the financial interests of the EU; 5. breaches relating to the internal market, including competition, state aid and corporate tax; 6. acts or conduct that defeat the purpose of EU rules in the fields of points 3, 4 and 5. Since 24 January 2026, the decree also covers reports of breaches of **EU restrictive measures** (sanctions) as defined in the Criminal Code and in art. 12(1-bis) of Legislative Decree 286/1998 (art. 1(1), as amended by Legislative Decree No. 211 of 30 December 2025). Reasonable suspicions and conduct aimed at hiding a breach can also be reported (art. 2(1)(b)). **In the private sector, protection depends on the type of entity** (art. 3(2)): | Private entity | Breaches covered | Channels | | --- | --- | --- | | 50 or more employees, or sectors of Parts I.B and II of the annex | Breaches of EU law (points 3–6) | Internal, external (ANAC), public disclosure, complaint to the authorities | | Model 231, fewer than 50 employees | Model 231 conduct and breaches of the model (point 2) | Internal channel only | | Model 231, 50 or more employees | Model 231 conduct (point 2) and breaches of EU law (points 3–6) | Point 2: internal channel only. Points 3–6: all channels | Purely national offences (point 1) are covered only in the public sector (art. 3(1)). A private entity may still open its channel to other reports. According to ANAC, reports outside the scope of the decree can be handled as ordinary reports (guidelines No. 1/2025, § 3.5). **Excluded** (art. 1(2) and (3)): - complaints and claims of personal interest that relate only to the reporter's own employment or to their relations with superiors; - breaches already covered by mandatory procedures in the acts of Part II of the annex; - breaches relating to national security and to defence or national-security procurement, unless EU law covers them. The rules on classified information, legal and medical professional secrecy and the secrecy of judicial deliberations continue to apply. ## Who is protected Art. 3(3) protects people who report information learned in their work context, in particular: - employees in the public and private sector, including those on the contracts of Legislative Decree 81/2015; - self-employed workers, collaborators, freelance professionals and consultants; - workers and collaborators of suppliers of goods, services and works; - volunteers and trainees, paid or unpaid; - shareholders and people with administrative, management, control, supervisory or representative functions, even de facto. Protection also applies during recruitment, during the probation period, and after the relationship ends for information learned during it (art. 3(4)). It extends to facilitators, to colleagues with a regular working relationship, to relatives up to the fourth degree and people with a stable emotional bond in the same work context, and to entities the reporter owns or works for (art. 3(5)). The person is protected if, at the time of the report, they had **reasonable grounds to believe** that the information was true and within the scope of the decree, and if they used the channels the decree provides (art. 16(1)). Their motives do not matter (art. 16(2)). Protection is lost if the reporter's criminal liability for defamation or malicious accusation is established, even at first instance, or their civil liability on the same grounds, in cases of intent or gross negligence. In that case a disciplinary sanction is also imposed (art. 16(3)). | Protection | Provision | | --- | --- | | Retaliation is prohibited, including attempts and threats: for example dismissal, demotion, transfer, negative appraisals, non-renewal of a fixed-term contract | art. 17(1) and (4); art. 2(1)(m) | | **Reversed burden of proof**: the measure is presumed to be caused by the report. The person who took it must prove other reasons. | art. 17(2) | | In a claim for damages, the damage is presumed to result from the report | art. 17(3) | | Retaliatory acts are void; a dismissed reporter has the right to reinstatement | art. 19(3) | | No liability for disclosing information covered by certain secrecy duties, where needed to reveal the breach, or for obtaining the information, unless obtaining it is a crime | art. 20 | | Waivers and settlements of the rights under the decree are invalid, unless signed in the protected settings of art. 2113(4) of the Civil Code | art. 22 | | Free support from third-sector organisations on ANAC's list | art. 18 | Retaliation is reported to ANAC, which can work with the National Labour Inspectorate (art. 19(1) and (2)). ## Requirements for the whistleblowing channel - **Trade unions.** The channel is set up after "hearing" the union representatives or organisations under art. 51 of Legislative Decree 81/2015 (art. 4(1)). For ANAC, this step is for information and the unions' opinion is not binding. The notice goes out before the organisational act or the Model 231 update is approved: to the company union representatives (RSA or RSU), or, where there are none, to the local branches of the most representative unions. Without this step, the procedure does not comply and can be fined (guidelines No. 1/2025, § 2.1). - **Confidentiality.** The channel protects, also through encryption, the identity of the reporter, of the person concerned and of anyone named, and the content of the report (art. 4(1)). - **Who runs it.** A person or an autonomous, dedicated internal office with specifically trained staff, or an external party that is also autonomous and trained (art. 4(2)). For ANAC, the handler must have no conflict of interest. With an external handler, a contract sets its tasks and powers, and the handler may process data as a processor under art. 28 GDPR (guidelines No. 1/2025, § 3.4). - **Written and oral.** Reports can be made in writing, including electronically, or orally, by telephone lines or voice messaging. On request, an in-person meeting is set within a reasonable time (art. 4(3)). ANAC states that the entity **must offer both forms** and that the reporter must be able to choose (guidelines No. 1/2025, § 2.2). - **Tools.** ANAC prefers IT platforms. It considers email, ordinary or certified (PEC), not adequate on its own to protect the reporter's identity unless specific countermeasures are in place (guidelines No. 1/2025, § 2.2). - **Anonymous reports.** The decree does not require them to be accepted. Protection also applies to an anonymous reporter who is later identified and suffers retaliation (art. 16(4)). The entity may handle anonymous reports as ordinary reports if its rules provide for this, but it must record them and keep the file (ANAC guidelines No. 311/2023, § 2.2, and No. 1/2025, § 3.5). See also [anonymous and confidential reporting](https://ethicsportal.eu/blog/anonymous-vs-confidential-reporting/). - **Report sent to the wrong person.** It is passed to the handler within seven days, and the reporter is told (art. 4(6)). - **Information for staff.** Clear information on the internal channel, its procedures and conditions, and on the external channel. It is displayed in the workplace, made available to people who do not work on site, and published in a dedicated section of the website, if the entity has one (art. 5(1)(e)). - **Data protection.** The entity defines how it receives and handles reports on the basis of a **data protection impact assessment**, and it governs external providers with a contract under art. 28 GDPR (art. 13(6)). It gives privacy notices to the reporter and the people concerned (art. 13(4)). Data that is clearly not useful is not collected, or is deleted at once (art. 13(2)). See [GDPR and whistleblower reporting](https://ethicsportal.eu/blog/gdpr-and-whistleblower-reporting/). ## Deadlines and what happens after a report | Step | Deadline | | --- | --- | | Acknowledge receipt to the reporter | within **7 days** of receipt (art. 5(1)(a)) | | Feedback on the follow-up taken or planned | within **3 months** of the acknowledgement; without one, within 3 months of the end of the 7 days after the report was made (art. 5(1)(d)) | | Pass on a report received by the wrong person | within **7 days**, telling the reporter (art. 4(6)) | For ANAC, the acknowledgement only confirms receipt and involves no assessment of the content. The handler then checks that the reporter is entitled to protection and that the facts fall within the scope of the decree (guidelines No. 1/2025, § 3.5). In the meantime, the handler stays in contact with the reporter, may ask for more information, and follows up the report diligently (art. 5(1)(b) and (c)). The person concerned may be heard, and must be heard if they ask (art. 12(9)). The decree provides no extension of the feedback deadline for the internal channel. For the external channel, ANAC may take up to six months where there are justified reasons (art. 8(1)(f)). For ANAC, the internal deadline is not peremptory, because some checks take longer, but the outcome must still be communicated (guidelines No. 1/2025, § 3.5). ## Confidentiality and records **Confidentiality (art. 12).** Reports are not used beyond what is needed to follow them up. The reporter's identity, and any information from which it can be inferred, is not disclosed without their express consent to anyone other than the competent, authorised staff. Special rules apply: - in criminal proceedings, the identity is covered by secrecy within the limits of art. 329 of the Code of Criminal Procedure; - before the Court of Auditors, it is not disclosed until the investigation phase is closed; - in disciplinary proceedings, if the charge is based on the report and the identity is essential for the defence, the report can be used only with the reporter's express consent. The reporter is told the reasons in writing. The identity of people concerned or named is protected until the proceedings are closed. Reports are exempt from public access to documents and from freedom-of-information requests. **Records (art. 14).** Reports and their documents are kept for as long as needed to handle them, and **no longer than five years** after the final outcome of the procedure is communicated. Oral reports are recorded as follows: - recorded telephone line or voice messaging: with the reporter's consent, a recording or a full transcript; - unrecorded line: a detailed written account of the call; - in-person meeting: with the reporter's consent, a recording or minutes. The reporter may check, correct and confirm the transcript, account or minutes by signing them. ## Shared channels and groups of companies **Shared channel.** Private entities with an average of up to 249 employees may share the internal reporting channel and its management. The same applies to municipalities that are not provincial capitals (art. 4(4)). Entities that share resources set out their data protection responsibilities in an internal agreement (art. 13(5)). For ANAC, sharing does not remove each entity's duty to keep reports confidential, assess the facts and give feedback. Each entity appoints its own handler and sees only its own reports (guidelines No. 1/2025, § 3.4.3). **Groups of companies.** The decree does not regulate groups. According to ANAC (guidelines No. 1/2025, in-depth note 2): - the 249-employee threshold is calculated for **each company**, not for the group; - companies with up to 249 employees may share the channel, for example through a single platform split into separate sub-channels, one per company. Dialogue with the reporter stays with each company; - companies with more than 249 employees **may not share** the channel. Each one may, however, entrust its management to a third party, including another group company or the parent, under a contract that sets its tasks, powers and responsibilities. ## Penalties and enforcement ANAC imposes the administrative fines of **art. 21(1)** of Legislative Decree 24/2023: | Conduct (art. 21(1)) | Fine | | --- | --- | | Retaliation; obstructing a report or attempting to; breach of the confidentiality obligation under art. 12 (lit. a) | **€10,000–50,000** | | **No whistleblowing channel**; no procedures for making and managing reports, or procedures that do not comply with arts. 4 and 5; **no verification and analysis** of the reports received (lit. b) | **€10,000–50,000** | | A reporting person whose civil liability for defamation or malicious accusation is established for intent or gross negligence (art. 16(3)), unless they have been convicted of those offences, even at first instance (lit. c) | **€500–2,500** | The fines are applied **to the person responsible**. For letter (b), ANAC identifies the person responsible as follows. For a missing channel and for missing or non-compliant procedures, it is the entity's **governing body**, in both the public and the private sector. For failure to verify and analyse the reports received, it is the **report handler** (guidelines, resolution No. 311/2023 as updated by resolution No. 479/2025, Part Three, § 1). The governing body is jointly liable with its members, with a right of recourse against those who committed the breach (guidelines No. 1/2025, § 2.3). The fining procedure is set by ANAC resolution No. 301 of 12 July 2023. Private entities with a Model 231 (art. 2(1)(q)(3)) must also provide for sanctions against those responsible in the disciplinary system adopted under art. 6(2)(e) of Legislative Decree 231/2001 (art. 21(2)). **An honest assessment of enforcement.** Letter (b) does not only penalise the absence of a channel: non-compliant procedures and failure to verify and analyse the reports received sit in the same band. Operating a channel nobody investigates therefore carries the same fine as having none, although ANAC holds the report handler, not the governing body, responsible for it. For ANAC, a procedure adopted without hearing the unions also does not comply and can be fined (guidelines No. 1/2025, § 2.1). The fine for a reporter is narrow by design: it requires an established finding of liability for defamation or malicious accusation, not merely a report that turned out to be unfounded. ## External reporting authority The external authority is [ANAC](https://ethicsportal.eu/authorities/italy-anac/). In Italy, external reporting is not a free alternative to the internal channel. It is allowed only if one of these conditions applies (art. 6(1)): - the internal channel is not mandatory, not active, or does not comply with art. 4; - an internal report was made and was not followed up; - the reporter has reasonable grounds to believe that an internal report would not be followed up effectively or would expose them to retaliation; - the reporter has reasonable grounds to believe that the breach may be an imminent or clear danger to the public interest. Public disclosure is also protected only under specific conditions (art. 15). The ANAC page describes the external channel, its deadlines and the fining procedure. ## Data protection authority For GDPR complaints relating to the handling of whistleblower data, the relevant authority is the [Garante per la protezione dei dati personali](https://www.garanteprivacy.it/). ## Setting up in seven steps 1. **Check the duty:** average employees in the last year, Model 231, sectors of Parts I.B and II of the annex. 2. **Choose the handler:** an autonomous, trained internal person or office, an external party, or, up to 249 employees, a shared channel. 3. **Hear the unions:** send the notice before the organisational act or the Model 231 is approved. 4. **Set up the channels:** written and oral, an in-person meeting on request. Decide how to handle anonymous reports. 5. **Protect the data:** impact assessment, privacy notices, art. 28 GDPR contracts with providers. 6. **Inform people:** display the information in the workplace and publish it on the website. 7. **Set the procedure:** acknowledgement within 7 days, feedback within 3 months, records kept no longer than 5 years after the final outcome, training for the handler. ## Official sources - [Legislative Decree No. 24 of 10 March 2023 — current text (Normattiva)](https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2023-03-10;24) - [Legislative Decree No. 24 of 10 March 2023 — Official Journal No. 63 of 15 March 2023](https://www.gazzettaufficiale.it/eli/id/2023/03/15/23G00032/sg) - [ANAC — whistleblowing](https://www.anticorruzione.it/en/-/whistleblowing) - [ANAC — guidelines, resolution No. 311/2023 as updated by resolution No. 479/2025](https://www.anticorruzione.it/-/del.311.2023.linee.guida.whistleblowing) - [ANAC — guidelines No. 1/2025 on internal channels, resolution No. 478/2025](https://www.anticorruzione.it/-/del.n.478-26.11.2025.llgg.wb) - [Garante privacy](https://www.garanteprivacy.it/) ## Frequently asked questions ### What is D.Lgs. 24/2023? It is Legislative Decree No. 24 of 10 March 2023, which transposes Directive (EU) 2019/1937 on whistleblowing into Italian law. It protects people who report breaches learned at work and requires public and private entities to set up a whistleblowing channel. It applies from 15 July 2023. ### From how many employees is a whistleblowing channel required? From an average of 50 employees, on permanent or fixed-term contracts, in the last year. Below that threshold, the duty still applies to entities with a Model 231 and to entities in the sectors of Parts I.B and II of the annex, such as financial services and anti-money laundering (art. 2(1)(q)). Public-sector bodies must have a channel at any size. ### Must the channel accept anonymous reports? No, the decree does not require it. An anonymous reporter who is later identified and suffers retaliation is still protected (art. 16(4)). According to ANAC, the entity must record the anonymous reports it receives and keep the file, and it may handle them as ordinary reports. ### Is a written channel enough? No. The decree provides for written and oral reports (art. 4(3)), and ANAC states that the entity must offer both and let the reporter choose. On request, an in-person meeting must also be set. A non-compliant channel can be fined in the same band as a missing one (art. 21(1)(b)). ### What deadlines apply after a report? Acknowledgement within 7 days of receipt. Feedback within 3 months of the acknowledgement or, without one, within 3 months of the end of the 7 days (art. 5(1)). ### How long may reports be kept? As long as needed to handle them, and no longer than five years after the final outcome of the procedure is communicated (art. 14(1)). ### What fines does D.Lgs. 24/2023 set? ANAC imposes fines of €10,000 to €50,000 for retaliation, obstructing reports and breaches of confidentiality, and for having no channel, non-compliant procedures or failing to verify reports. A reporter found liable for defamation or malicious accusation through intent or gross negligence faces a fine of €500 to €2,500 (art. 21). ### Can a reporter go straight to ANAC? Only if one of the conditions in art. 6 applies: no internal channel or a non-compliant one, an internal report with no follow-up, reasonable fear that an internal report would fail or lead to retaliation, or reasonable grounds to believe that the breach may be an imminent or clear danger to the public interest. ### May an external provider manage the channel? Yes. The decree allows management by an external party that is autonomous and has specifically trained staff (art. 4(2)). In groups, according to ANAC, this party may also be the parent or another group company, under a contract with each company. ### Must trade unions be involved? Yes. The channel is set up after hearing the union representatives or organisations (art. 4(1)). Their opinion is not binding, but according to ANAC a procedure adopted without this step does not comply and can be fined. --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Latvia — Trauksmes celšanas likums > Latvia's Whistleblowing Law: the 50-worker rule, KNAB's contact-point role, and the official Latvian sources. Canonical: https://ethicsportal.eu/whistleblower-laws/latvia/ Last updated: 2026-04-24 Latvia implemented Directive (EU) 2019/1937 through the **Trauksmes celšanas likums** (Whistleblowing Law), effective from **4 February 2022**. The Latvian framework combines the familiar **50-worker** trigger with a visible anti-corruption and public-guidance role for KNAB. ## Applicable law - [Trauksmes celšanas likums — official text](https://likumi.lv/ta/id/329680-trauksmes-celsanas-likums) - [KNAB whistleblowing overview](https://www.knab.gov.lv/en/whistleblowing) ## Who must establish an internal channel Private legal entities with **at least 50 employees** are the main business group required to establish an internal reporting channel. Public-sector entities are also covered by the law. Entities in the financial-services and anti-money-laundering, transport-safety, and environmental sectors are in scope **regardless of headcount**. ## External reporting authority Latvia's official whistleblowing landscape is coordinated through [KNAB](https://www.knab.gov.lv/en/whistleblowing). Official Latvian materials also describe KNAB as the **contact point** for whistleblowers and a training / guidance body for the system. ## Data protection authority For complaints about the processing of whistleblower data, the relevant authority is the [State Data Inspectorate (DVI)](https://www.dvi.gov.lv/en/services/complaint-concerning-processing-personal-data). ## Key compliance points - Latvian official materials emphasise the public-interest nature of whistleblowing and the need to submit reports in the work-related context. - KNAB and DVI both publish whistleblowing-related guidance, so Latvian implementation often has a visibly anti-corruption as well as privacy angle. - Internal policies should explain when a report belongs in the statutory whistleblowing process and when it should go through another grievance route. ## Official sources - [Trauksmes celšanas likums — official text](https://likumi.lv/ta/id/329680-trauksmes-celsanas-likums) - [KNAB — whistleblowing](https://www.knab.gov.lv/en/whistleblowing) - [DVI — whistleblowing](https://www.dvi.gov.lv/en/whistleblowing) - [DVI — complaint concerning processing of personal data](https://www.dvi.gov.lv/en/services/complaint-concerning-processing-personal-data) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Lithuania: requirements > Lithuania's whistleblower law: the 50-worker rule, the central role of the Public Prosecutor's Office, and the official Lithuanian sources. Canonical: https://ethicsportal.eu/whistleblower-laws/lithuania/ Last updated: 2026-10-06 Lithuania adopted whistleblower legislation before many other EU states and later aligned it with Directive (EU) 2019/1937 through the revised **Pranešėjų apsaugos įstatymas**, in force since **15 February 2022**. The framework gives the **Public Prosecutor's Office of the Republic of Lithuania** a central role. ## Applicable law - [Law on the Protection of Whistleblowers — official text](https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/3832a712149511eab9d9cd0c85e0b745) - [2021 revision and commencement date — Lithuanian Seimas](https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/241ff042626311ecb2fe9975f8a9e52e) - [Official English translation of the law](https://www.prokuraturos.lt/data/public/uploads/2020/02/1.9-225-praneseju-apsaugos-istatymas-eng.pdf) ## Who must establish an internal channel Private organisations with **at least 50 workers** are the main business group expected to maintain an internal reporting channel. Public-sector bodies are also part of the statutory framework. Entities in the financial-services and anti-money-laundering, transport-safety, and environmental sectors are in scope **regardless of headcount**. ## External reporting authority Lithuania's whistleblower system gives a central role to the **Public Prosecutor's Office of the Republic of Lithuania**, as reflected in the official English translation of the law. ## Data protection authority For GDPR complaints about the handling of report data, the relevant authority is the [State Data Protection Inspectorate (VDAI)](https://vdai.lrv.lt/en/services/). ## Key compliance points - Lithuania's legal framework is older and more institutionally embedded than the late-transposition countries, which makes legal terminology and scope especially important. - The official English translation of the law remains one of the clearest primary sources for understanding Lithuania's whistleblower framework. - Organisations operating in Lithuania should not blur statutory whistleblowing with wider ethics intake unless the policy clearly separates them. - The **[Bank of Lithuania](https://www.lb.lt/en/)** is the country's single financial-market supervisor and authorises electronic money and payment institutions. Financial-sector entities must operate an internal reporting channel regardless of headcount, so a licensed firm is covered from authorisation onward however few staff it has. ## Official sources - [Pranešėjų apsaugos įstatymas — official law text](https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/3832a712149511eab9d9cd0c85e0b745) - [2021 revision and commencement date — Lithuanian Seimas](https://e-seimas.lrs.lt/portal/legalAct/lt/TAD/241ff042626311ecb2fe9975f8a9e52e) - [Official English translation of the law](https://www.prokuraturos.lt/data/public/uploads/2020/02/1.9-225-praneseju-apsaugos-istatymas-eng.pdf) - [State Data Protection Inspectorate — services](https://vdai.lrv.lt/en/services/) - [Bank of Lithuania — financial-market supervisor](https://www.lb.lt/en/) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Luxembourg — Loi du 16 mai 2023 > Luxembourg's whistleblower law: the 50-worker rule, the 22-authority structure, and the official CNPD and reporting-office sources. Canonical: https://ethicsportal.eu/whistleblower-laws/luxembourg/ Last updated: 2026-06-10 Luxembourg implemented Directive (EU) 2019/1937 through the **Loi du 16 mai 2023 relative aux lanceurs d'alerte**. The Luxembourg system is notable because it uses **22 competent authorities** plus a central **Reporting Office** that helps identify the correct authority. ## Applicable law - [Loi du 16 mai 2023 — official text on Legilux](https://legilux.public.lu/eli/etat/leg/loi/2023/05/16/a232/jo) ## Who must establish an internal channel - **Private-sector entities with 50 or more workers** and **public-sector entities** must establish an internal reporting channel. - Luxembourg **extended the material scope to the entire national law** — one of the broadest transpositions in the EU, not limited to EU-law breaches. - **Financial / AML, transport-safety, and environmental entities** — regardless of headcount. Phased: entities with 250+ employees had an immediate obligation on entry into force (**21 May 2023**); 50-249 entities had until **17 December 2023**. Municipalities under 10,000 residents are excluded. ## Penalties and enforcement Luxembourg fixes a **large explicit fine for not having a channel** — the second-highest in the EU after Spain. | Conduct | Penalty | | --- | --- | | **Failing to establish internal channels** (also: obstruction, withholding/false information, breach of confidentiality, refusing to remedy) | administrative fine **€1,500–250,000**, doubled to **€500,000** for a repeat offence within 5 years | | Retaliation (*représailles*) or abusive proceedings against a whistleblower | fine **€1,250–25,000** | | Knowingly reporting/disclosing false information | **criminal**: 8 days–3 months imprisonment + **€1,500–50,000** + civil liability | The no-channel band is confirmed verbatim on the official ITM page: *"de 1.500 à 250.000 euros notamment si elles entravent un signalement, refusent de remédier à une violation ou n'ont pas mis en place les canaux de signalement interne requis (l'amende peut être doublée en cas de récidive)."* **An honest assessment of enforcement.** The on-paper exposure is serious (up to €500,000), but enforcement is **remediation-first**: the ITM examines a matter and only transmits it to the **Office des signalements (OSIG)** — operational since 1 September 2023, under the Minister of Justice — which can fine if the entity fails to regularise. No company has been documented as fined to date. Enforcement is split across ~22 competent authorities (the **CSSF** for financial-sector breaches, the **CNPD** for data-protection-scope reports). The high ceiling makes this especially relevant for the regulated fund-administration and financial sector. ## External reporting authority Luxembourg does not rely on one universal authority. The [CNPD guidance](https://cnpd.public.lu/en/support/lanceurs-alerte.html) explains that there are **22 competent authorities** and that anyone can contact the **Reporting Office** of the Ministry of Justice to identify the correct authority for a given type of report. ## Data protection authority For data-protection matters, the relevant authority is the [CNPD](https://cnpd.public.lu/en.html). ## Key compliance points - Luxembourg is one of the clearest examples of why country-law pages matter: there is no single obvious external authority unless the organisation explains the competent-authority model. - The CNPD itself is one of the competent whistleblowing authorities for data-protection matters, which makes the privacy angle unusually visible. - Internal policies should make it easy for reporters to identify the correct external authority or the ministry reporting office. ## Official sources - [Loi du 16 mai 2023 — official law text (Legilux, a232)](https://legilux.public.lu/eli/etat/leg/loi/2023/05/16/a232/jo) - [ITM — administrative fines for whistleblower-law breaches](https://itm.public.lu/fr/support/lanceurs-alerte/signalement-externe/amendes.html) - [ITM — Office des signalements (OSIG)](https://itm.public.lu/fr/support/lanceurs-alerte/office-signalement.html) - [CSSF — whistleblower protection (financial sector)](https://www.cssf.lu/en/whistleblower-protection/) - [CNPD — whistleblowers](https://cnpd.public.lu/en/support/lanceurs-alerte.html) - [CNPD — home page](https://cnpd.public.lu/en.html) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Malta — Cap. 527 > Malta's Protection of the Whistleblower Act: the 50-worker rule, Malta's reporting-officer model, and the official sources. Canonical: https://ethicsportal.eu/whistleblower-laws/malta/ Last updated: 2026-06-01 Malta implemented Directive (EU) 2019/1937 by amending the **Protection of the Whistleblower Act (Cap. 527)**. Malta's framework combines the usual **50-worker** private-sector trigger with a visible public-service reporting-officer model. ## Applicable law - [Protection of the Whistleblower Act (Cap. 527) — official text](https://legislation.mt/eli/cap/527/eng/pdf) - [Government whistleblowing site](https://whistleblower.gov.mt/) ## Who must establish an internal channel - **All public-sector entities** — each Government ministry, with a whistleblowing reporting officer at Assistant Director level or above. - **Private organisations with 50 or more workers** (entities with exactly 50 are in scope). - **Voluntary organisations** raising more than €500,000 a year from public collections and donations. - Private entities with fewer than 50 workers can be brought into scope by a risk assessment (nature of activities; risk to environment and public health). - **Financial / AML, transport-safety, and environmental entities** — regardless of headcount. The 2021 amendments (in force 24 December 2021) lowered the private-sector trigger from the old ~250-employee test to **50 workers**; the 50-249 band had until **17 December 2023** to establish channels. ## Penalties and enforcement Malta's penalty structure is **criminal, not administrative**, and narrowly drawn. The one specific monetary figure the law fixes is under **Article 19**: a person who uses violence, threats, or besetting to compel another to abstain from a protected disclosure faces imprisonment up to one year or a fine (*multa*) of **€500–5,000** — rising to **€1,500–10,000** (plus increased imprisonment) where they succeed. **An honest assessment of enforcement.** Two things matter here. First, the research found **no specific fine dedicated to "failing to establish a reporting channel"** — the obligation is mandatory, but the sourced penalty attaches to actively coercing a whistleblower, not to the administrative gap of lacking a channel. Second, **no company has been publicly recorded as fined or sanctioned** for whistleblowing non-compliance to date, and the enforcement mechanics across the sector bodies are not well documented. External disclosures are only protected if an internal report was first made or attempted (subject to exceptions such as the head of the organisation being implicated, urgency, or risk of evidence being destroyed) — which is itself a practical reason to operate a credible internal channel. ## External reporting authority Malta uses **competent authorities** and reporting officers rather than one single universal external authority. The First Schedule to Cap. 527 designates external-disclosure authorities including the [MFSA](https://www.mfsa.mt/firms/enforcement/whistleblowing/) (financial services), the FIAU (anti-money-laundering), the Commissioner for Revenue, the Commissioner for Voluntary Organisations, the Permanent Commission Against Corruption, and the Ombudsman. The official [whistleblower.gov.mt](https://whistleblower.gov.mt/) site explains the Maltese reporting-officer model for the public service. ## Data protection authority For complaints about the handling of whistleblower data, the relevant authority is the [Information and Data Protection Commissioner (IDPC)](https://idpc.org.mt/file-a-complaint/). ## Key compliance points - Malta's public-service model is operationally visible: each ministry has a whistleblowing reporting officer and public-facing procedures. - The public guidance stresses that identified reporting is important to obtain formal whistleblower status and protection, even though anonymous submissions may still surface concerns. - Organisations operating in Malta should explain clearly whether they are describing the statutory whistleblowing process or a broader grievance / speak-up workflow. ## Official sources - [Protection of the Whistleblower Act (Cap. 527) — official text](https://legislation.mt/eli/cap/527/eng/pdf) - [Government whistleblowing site](https://whistleblower.gov.mt/) - [Government whistleblower guidance](https://whistleblower.gov.mt/about-us/) - [Government whistleblower questions and answers](https://whistleblower.gov.mt/questions-and-answers/) - [MFSA — whistleblowing (designated external authority)](https://www.mfsa.mt/firms/enforcement/whistleblowing/) - [MFSA — external disclosure procedure (PDF)](https://www.mfsa.mt/wp-content/uploads/2023/11/Protection-of-the-Whistleblower-Reporting-of-External-Disclosure-Procedure.pdf) - [IDPC — file a complaint](https://idpc.org.mt/file-a-complaint/) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Moldova — Legea 165/2023 > Moldova's Legea 165/2023 on integrity whistleblowers: who needs an internal channel, the CNA and Ombudsman roles, and the law's partial alignment with Directive (EU) 2019/1937. Canonical: https://ethicsportal.eu/whistleblower-laws/moldova/ Last updated: 2026-06-10 Moldova regulates whistleblowing through **Legea nr. 165/2023 privind avertizorii de integritate** (Law 165/2023 on integrity whistleblowers), in force since **26 October 2023**. Moldova is not an EU member state — it is an accession candidate, and Law 165/2023 is **partially aligned** with Directive (EU) 2019/1937 rather than a transposition of it. ## Applicable law - [Legea nr. 165/2023 — official text (Ministry of Justice)](https://www.justice.gov.md/ro/file/181625) - [Avocatul Poporului — integrity whistleblowers guidance](https://ombudsman.md/avertizorii-de-integritate/) ## EU accession alignment As a non-member, Moldova has no obligation to transpose Directive (EU) 2019/1937. Law 165/2023 was adopted as a partial alignment with the Directive ahead of accession, and a [draft law for full alignment is under legislative consultation](https://particip.gov.md/ro/document/stages/proiectul-de-lege-pentru-modificarea-unor-acte-normative-consolidarea-mecanismului-de-protectie-in-domeniul-avertizarilor-de-integritate/14025), consolidating the protection mechanism for integrity disclosures. Organizations operating in Moldova should expect the framework to converge on the Directive's standards as the accession process advances. ## Who must establish an internal channel - **All public entities** — regardless of employee count. - **Private entities with at least 50 employees.** - Private entities with fewer than 50 employees are not required to operate an internal channel; their employees use the **external reporting channel**. Disclosures are recorded in a register of disclosures (Registrul dezvăluirilor privind încălcările legii), and records must be retained for **5 years**. ## Penalties and liability Law 165/2023 establishes liability categories rather than a published fine schedule: - Failing to operate a required whistleblowing channel — contraventional liability. - Breaching whistleblower confidentiality — disciplinary or contraventional liability. - Retaliation against a whistleblower — disciplinary, contraventional, or criminal liability depending on the facts. - Knowingly false reports — contraventional or criminal liability. **An honest assessment.** The current law does not attach specific fine amounts to these categories, so any Moldova compliance pitch built on penalty figures is not grounded in the statute as it stands. The 2025 full-alignment consultation materials propose more detailed contravention fines; until those are adopted, the operational exposure is a disclosure reaching the external authorities with no internal channel in place. ## External reporting authority The competent external authority is the [Centrul Național Anticorupție (CNA)](https://cna.md/en/node/1681) — the National Anticorruption Center, which receives external disclosures. ## Whistleblower protection authority Whistleblower protection is handled through the [Avocatul Poporului (Ombudsman)](https://ombudsman.md/avertizorii-de-integritate/), which examines protection requests from integrity whistleblowers facing retaliation. ## Data protection authority For complaints about the handling of personal data in reporting systems, the competent authority is the [Centrul Național pentru Protecția Datelor cu Caracter Personal (CNPDCP)](https://datepersonale.md/). ## Key compliance points - The law's own terminology is "avertizor de integritate" (integrity whistleblower) and "dezvăluire de încălcare a legii" (disclosure of a breach of the law) — distinct from the Romanian Legea 361/2022 vocabulary, even though both laws are in Romanian. - Private entities below 50 employees route reports through the external channel rather than an internal one. - The disclosure register carries a 5-year retention obligation. - Full Directive alignment is in legislative consultation — an internal channel built to Directive (EU) 2019/1937 standards today is positioned for the converged framework. ## Official sources **Primary law and authorities** - [Legea nr. 165/2023 — official text (Ministry of Justice)](https://www.justice.gov.md/ro/file/181625) - [Avocatul Poporului — integrity whistleblowers](https://ombudsman.md/avertizorii-de-integritate/) - [Centrul Național Anticorupție (CNA)](https://cna.md/en/node/1681) - [CNPDCP — data protection authority](https://datepersonale.md/) **Alignment work** - [Particip.gov.md — full alignment amendments consultation](https://particip.gov.md/ro/document/stages/proiectul-de-lege-pentru-modificarea-unor-acte-normative-consolidarea-mecanismului-de-protectie-in-domeniul-avertizarilor-de-integritate/14025) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in the Netherlands — Wbk > The Dutch Whistleblower Protection Act: the 50-worker rule, the Dutch Whistleblowers Authority, and the official Dutch sources. Canonical: https://ethicsportal.eu/whistleblower-laws/netherlands/ Last updated: 2026-04-24 The Netherlands implemented Directive (EU) 2019/1937 through the **Wet bescherming klokkenluiders (Wbk)**, in force since **18 February 2023**. The Dutch regime is institutionally visible because it sits alongside the **Dutch Whistleblowers Authority** and a dedicated government information site for employers. ## Applicable law - [Wet bescherming klokkenluiders — official text](https://wetten.overheid.nl/BWBR0033585) ## Who must establish an internal channel Employers with **at least 50 workers** must establish an internal reporting channel. This applies across the Dutch public and private sectors, subject to the statutory framework. Entities in the financial-services and anti-money-laundering, transport-safety, and environmental sectors are in scope **regardless of headcount**. ## External reporting authority The key official body is the [Dutch Whistleblowers Authority](https://www.huisvoorklokkenluiders.nl/english). The government employer-facing site also points organisations to the authority as the core institutional reference point. ## Data protection authority For GDPR complaints relating to whistleblower data handling, the relevant authority is the [Autoriteit Persoonsgegevens (AP)](https://autoriteitpersoonsgegevens.nl/en/submitting-a-tip-off-or-a-complaint-to-the-dutch-dpa). ## Key compliance points - The Dutch government maintains a dedicated site explaining the act to employers, which makes the market relatively transparent on basic legal positioning. - Internal procedures should clearly explain when workers can use the Dutch Whistleblowers Authority and when another competent authority is more appropriate. - The AP expects complainants to first raise the matter with the organisation where possible before escalating a data-protection complaint. ## Official sources - [Wet bescherming klokkenluiders — official text](https://wetten.overheid.nl/BWBR0033585) - [Government site — contact / service page](https://www.wetbeschermingklokkenluiders.nl/service/contact) - [Dutch Whistleblowers Authority](https://www.huisvoorklokkenluiders.nl/english) - [Autoriteit Persoonsgegevens — submitting a complaint](https://autoriteitpersoonsgegevens.nl/en/submitting-a-tip-off-or-a-complaint-to-the-dutch-dpa) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Norway — Working Environment Act chapter 2 A > Norway is outside the Directive, and its internal-routines duty starts at five employees rather than fifty. Chapter 2 A of the Working Environment Act, the retaliation rules, and how the duty is enforced. Canonical: https://ethicsportal.eu/whistleblower-laws/norway/ Last updated: 2026-09-21 Norway regulates whistleblowing through **chapter 2 A of the Working Environment Act** (*arbeidsmiljøloven*, Act of 17 June 2005 No. 62). It is not a transposition of Directive (EU) 2019/1937. It is also, on the point that matters most operationally, stricter: the duty to have internal whistleblowing procedures starts at **five employees**, not fifty. A group that reads "outside the EU, therefore nothing applies" has Norway exactly backwards. ## Applicable law - [Working Environment Act, chapter 2 A — official English text (Lovdata)](https://lovdata.no/dokument/NLE/lov/2005-06-17-62/KAPITTEL_3) - [Arbeidstilsynet — varsling guidance](https://www.arbeidstilsynet.no/tema/varsling/) Chapter 2 A was added by the Act of 16 June 2017 No. 42, in force 1 July 2017, and amended by the Act of 21 June 2019 No. 24, in force 1 January 2020. Both changes predate the Directive's transposition deadline and were not written to it. ## Does Directive (EU) 2019/1937 apply? No. Norway is an EEA state, and the Directive has not been incorporated into the EEA Agreement. The [EFTA Secretariat's factsheet](https://www.efta.int/eea-lex/32019l1937) records it as an "EU legal act marked as EEA relevant by the EU and under scrutiny for incorporation into the EEA Agreement by Iceland, Liechtenstein and Norway", with no Joint Committee Decision adopted. Norwegian obligations therefore stand entirely on their own. A Norwegian group with EU subsidiaries also carries the Directive's obligations through those subsidiaries — the 50-worker threshold applies per legal entity, not per corporate group. See our [reading of the threshold](https://ethicsportal.eu/directive-interpretations/) and the [country-by-country obligations](https://ethicsportal.eu/whistleblower-laws/). ## Who must establish an internal channel Section 2 A-6(1): "Undertakings that regularly employ **at least five employees** are obliged to have routines for internal whistleblowing. Undertakings with fewer employees shall also have such routines if the conditions at the undertaking so indicate." The Act applies to any undertaking that engages employees (s. 1-2), so the duty covers public and private employers alike. There is no sectoral carve-out and no larger-employer exemption. The procedures themselves are prescribed, not left to the employer: - **Written**, and at minimum containing an encouragement to report, the procedure for notification, and the procedure for the employer's receipt, processing and follow-up of reports (s. 2 A-6(4)). - **Prepared as part of the undertaking's systematic health, environment and safety work** under s. 3-1, in cooperation with the employees and their elected representatives (s. 2 A-6(2)). - **Easily accessible to all employees** at the undertaking (s. 2 A-6(5)). - They **may not limit** the employee's statutory right to report (s. 2 A-6(3)). The participation requirement is the one most often missed: a channel procured and switched on without involving employee representatives does not meet s. 2 A-6(2), however good the channel is. ## What counts as a reportable concern Section 2 A-1(2) defines *kritikkverdige forhold* as breaches of legislation, of the undertaking's written ethical guidelines, **or of ethical norms on which there is broad agreement in society** — for example danger to life or health, danger to climate and the environment, corruption or other economic crime, abuse of authority, an unsatisfactory working environment, or breach of personal data security. That is materially wider than the Directive, which is confined to breaches of listed areas of Union law. Section 2 A-1(3) draws the boundary the other way: matters relating only to the employee's own work situation are not whistleblowing unless they also involve a reportable concern. ## Reporting routes Section 2 A-2 sets out three tiers, and the second is unconditional: 1. **Internally** — to the employer or a representative, under the undertaking's routines, under a duty to report, or via a safety representative, union representative or lawyer. 2. **Externally to a public supervisory authority or other public authority** — always permitted. There is no requirement to report internally first. 3. **To the media or the public at large** — only where the employee is in non-negligent good faith, the concern is of public interest, and the employee has first reported internally or has reason to believe internal reporting would not be appropriate. Section 2 A-2(4) places the burden on the employer to show that a whistleblower did not follow proper procedure. ## Employer duties on receiving a report Section 2 A-3 requires the employer to ensure the matter is "adequately investigated within a reasonable time", and specifically to ensure the whistleblower has a fully satisfactory working environment, taking measures to prevent retaliation where necessary. Norwegian law sets no fixed acknowledgment or feedback deadlines. A group applying the Directive's seven-day and three-month rules across its Norwegian entities is above the Norwegian standard, not below it. ## Retaliation and remedies - **Prohibition (s. 2 A-4).** Retaliation is any unfavourable act, practice or omission in response to a report, and the section names examples: threats, harassment, arbitrary discrimination, social exclusion; warnings, change of duties, relocation, demotion; suspension, dismissal, summary discharge, disciplinary action. It also protects an employee who merely signals that they will report. - **Reversed burden of proof (s. 2 A-4(4)).** Where the employee produces information giving reason to believe retaliation has occurred, the employer must substantiate that it has not. - **Redress and compensation (s. 2 A-5).** Available **without regard to fault**. Redress is set by reference to the circumstances and the gravity of the retaliation; compensation covers financial loss. - **Confidentiality at the authority (s. 2 A-7).** Anyone working for a body that receives an external report must prevent others from learning the employee's name or other identifying information — including from the parties to the case. ## External reporting and enforcement Norway designates no single national whistleblowing authority; an employee reports to whichever public supervisory authority covers the subject matter. The internal-routines duty is supervised and enforceable. Section 18-6 lists **s. 2 A-6** among the provisions for which the [Norwegian Labour Inspection Authority](https://www.arbeidstilsynet.no/tema/varsling/) issues orders. Failure to comply with an order can attract a coercive fine (s. 18-7), and s. 18-10 allows an administrative fine of up to 50 times the National Insurance basic amount or four per cent of the undertaking's annual turnover, whichever is higher. Retaliation disputes go elsewhere: under s. 2 A-8 they may be brought before the [Equality and Anti-Discrimination Tribunal](https://www.diskrimineringsnemnda.no/en/), except cases concerning dismissal with or without notice, which remain with the courts. ## Data protection authority For complaints about the handling of personal data in a reporting process, the competent authority is the [Norwegian Data Protection Authority (Datatilsynet)](https://www.datatilsynet.no/en/). ## Key compliance points - The five-employee threshold is the single most consequential difference from the Directive. A group channel scoped to entities of 50 or more workers will leave small Norwegian entities out of compliance. - The definition of a reportable concern reaches the undertaking's own written ethical guidelines, so a code of conduct is not decorative in Norway — breaching it is a statutory reporting ground. - Employees may go to a public authority without trying internally first. Internal handling competes for the report on its merits; it is not protected by a legal cascade as it is in some jurisdictions. - The routines must be produced through the health, environment and safety process with employee participation, and must be written and accessible. All four are checkable by an inspector. ## Official sources - [Working Environment Act, chapter 2 A — official English text](https://lovdata.no/dokument/NLE/lov/2005-06-17-62/KAPITTEL_3) - [Arbeidstilsynet — varsling](https://www.arbeidstilsynet.no/tema/varsling/) - [EFTA — EEA-Lex factsheet for Directive (EU) 2019/1937](https://www.efta.int/eea-lex/32019l1937) - [Equality and Anti-Discrimination Tribunal](https://www.diskrimineringsnemnda.no/en/) - [Datatilsynet — Norwegian Data Protection Authority](https://www.datatilsynet.no/en/) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Poland: requirements > Poland's 2024 whistleblower act: the 50-person threshold, what the internal procedure must contain, the 7-day and 3-month deadlines, the register, and penalties. Canonical: https://ethicsportal.eu/whistleblower-laws/poland/ Last updated: 2026-11-04 Poland implemented Directive (EU) 2019/1937 through the **Act of 14 June 2024 on the Protection of Whistleblowers** (Journal of Laws 2024, item 928). Internal reporting duties have applied since **25 September 2024**. A procedure is required when **at least 50 persons** perform gainful work for an entity, not only 50 standard employees. ## The act at a glance | Question | Answer | | --- | --- | | In force since? | Internal procedures from 25 September 2024; external reports to the Ombudsman from 25 December 2024 (art. 64). | | Who needs a procedure? | A legal entity for which at least 50 persons perform gainful work, counted on 1 January or 1 July (art. 23(1)). Some sectors at any size (art. 23(3)). | | How is it adopted? | After 5–10 days of consultation with trade unions or worker representatives (art. 24(3)–(4)). | | Which channels? | At least oral or written reports; on request, a meeting within 14 days (art. 26). | | Deadlines? | Acknowledgement within 7 days, feedback within 3 months (art. 25(1)). | | Anonymous reports? | The entity may accept them; the procedure must say how they are handled (art. 7(1), art. 25(1) point 4). | | How long to keep data? | 3 years after the end of the calendar year in which follow-up, or the proceedings it started, ended (art. 29(5)). | | Penalty for no procedure? | A fine for the person responsible for setting it up, imposed by a court (arts. 58–59). | ## Applicable law - [Act of 14 June 2024 on the Protection of Whistleblowers — official text PDF](https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU20240000928/O/D20240928.pdf) - [Ombudsman information for external reports](https://bip.brpo.gov.pl/pl/sygnalisci) ## Who must establish an internal channel Internal reporting procedures are mandatory for legal entities for which gainful work is performed by **at least 50 persons**. The count is taken on **1 January or 1 July** of each year (art. 23(1)). The count includes employees **as full-time equivalents**, plus people paid for work on another basis, such as civil-law contracts, if they do not employ others for that work (art. 23(2)). Entities in the financial-services and anti-money-laundering, transport-safety, and environmental sectors are in scope **regardless of headcount** (art. 23(3)). The chapter does not apply to municipal and county units with fewer than 10,000 inhabitants (art. 23(5)). Smaller entities may adopt a procedure voluntarily (art. 24(2)). ## What can be reported A breach of law is an act or omission that is unlawful, or aims to get around the law, in one of 17 areas listed in [art. 3(1)](https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU20240000928/O/D20240928.pdf), among them: - corruption and public procurement; - financial services, products and markets, and anti-money laundering; - product, transport, food and feed safety; - environmental protection, public health, consumer protection; - privacy and personal data, and the security of networks and IT systems; - the financial interests of the State Treasury, local government and the EU, and the EU internal market; - constitutional freedoms and rights in dealings with public authorities. An entity may also allow reports about breaches of its **internal rules or ethical standards** (art. 3(2)). For such reports, the rules on external reporting and public disclosure (chapters 4 and 5) do not apply. **Exclusions (art. 5).** The act does not apply to, among others, classified information, the professional secrecy of medical and legal professions, the secrecy of judicial deliberations, and the secrecy of pre-trial criminal proceedings. ## Who is protected A whistleblower is a **natural person** who reports or publicly discloses information about a breach of law obtained in a work-related context (art. 4). The act lists, among others, employees, temporary workers, civil-law contractors, entrepreneurs, commercial proxies, shareholders and partners, board members, interns, volunteers, and people working for contractors and suppliers. Protection also covers job applicants and people whose work relationship has ended (art. 4(2)). A whistleblower is protected from the moment of the report if they had **reasonable grounds to believe** that the information was true and concerned a breach of law (art. 6). | Protection | Provision | | --- | --- | | Retaliation is prohibited, including attempts and threats | art. 11 | | **Burden of proof on the employer**: the employer must show that its action was not retaliation | art. 12(3) | | Compensation of **at least the average monthly wage** in the national economy in the previous year, or damages for harm suffered | art. 14 | | No liability, including disciplinary, for a report if the whistleblower had reasonable grounds to believe it was necessary to reveal the breach; no liability for obtaining the information unless that was itself an offence | art. 16 | | Protection for people who assist the whistleblower or are connected to them | art. 21 | ## What the internal procedure must contain The procedure is adopted **after consultation** with the workplace trade union or, if there is none, with representatives of the people who work for the entity. Consultation lasts **5 to 10 days** from presentation of the draft (art. 24(3)–(4)). The procedure takes effect **7 days** after it is announced to the workforce (art. 24(5)). Job applicants receive information about it when recruitment starts (art. 24(6)). Under art. 25(1), the procedure specifies: - who receives reports: an internal unit, a person, or an **external provider**; - how reports can be made, and the contact address; - an **impartial** unit or person who takes follow-up action and communicates with the whistleblower; - how anonymous reports are handled; - the duty to acknowledge receipt and the deadline for feedback; - information on external reporting to the Ombudsman and public authorities. **Channels (art. 26).** The procedure must allow at least oral or written reports. Oral reports may be made by telephone or by electronic means. At the whistleblower's request, an oral report is taken at an **in-person meeting within 14 days**. A recording or transcript requires the whistleblower's consent, and the whistleblower can check and sign the record. **Confidentiality and access (art. 27).** The procedure must protect the identity of the whistleblower, the person concerned and third parties. Only people with **written authorisation** may handle reports, and they must keep them confidential even after their work ends. **External provider (art. 28).** Handling reports may be outsourced by contract. Responsibility for confidentiality, feedback and follow-up stays with the legal entity (art. 28(4)). ## Deadlines | Step | Deadline | | --- | --- | | Consultation on the draft procedure | 5 to 10 days (art. 24(4)) | | Procedure takes effect | 7 days after it is announced (art. 24(5)) | | Acknowledge receipt of a report | within **7 days** of receipt (art. 25(1) point 5) | | Meeting at the whistleblower's request | within **14 days** of the request (art. 26(6)) | | Feedback | within **3 months** of the acknowledgement; without one, 3 months from the end of 7 days after the report (art. 25(1) point 7) | The duty to acknowledge and give feedback does not apply if the whistleblower gave no contact address. ## Anonymous reports Legal entities, the Ombudsman and public authorities **may** accept anonymous reports (art. 7(1)). This is a choice, not a duty, but the internal procedure must state how such reports are handled (art. 25(1) point 4). If an anonymous whistleblower is later identified and suffers retaliation, they are protected, provided the conditions of art. 6 are met (art. 7(2)). See also [anonymous and confidential reporting](https://ethicsportal.eu/blog/anonymous-vs-confidential-reporting/). ## Register and retention The legal entity keeps a **register of internal reports** and is the controller of the data in it (art. 29). The register records the report number, the subject of the breach, the personal data of the whistleblower and the person concerned, the contact address, the date of the report, the follow-up taken, and the date the case closed. Data is kept for **3 years after the end of the calendar year** in which follow-up, or the proceedings it started, ended (art. 29(5)). ## Shared procedure Private entities with **50 to 249** people working for them may agree by contract on shared rules for receiving and checking reports and for investigations (art. 28(3)). Each stays a separate data controller with no access to the other's data (art. 28(6)). Local governments may adopt a joint procedure within a shared-services arrangement (art. 28(5)). ## Penalties and enforcement Poland does not use administrative fines. Chapter 6 of the Act creates **criminal offences**, and the penalties listed for each are alternatives: a court imposes one of them, not all of them. | Conduct | Penalty | | --- | --- | | Preventing or substantially hindering a report (art. 54(1)) | fine, restriction of liberty, or **up to 1 year's imprisonment** | | — using violence, unlawful threat or deception (art. 54(2)) | **up to 3 years' imprisonment** | | Retaliation against a whistleblower, a person assisting, or a related person (art. 55(1)) | fine, restriction of liberty, or **up to 2 years**; if persistent, **up to 3 years** | | Disclosing the identity of a whistleblower, assisting or related person (art. 56) | fine, restriction of liberty, or **up to 1 year** | | Reporting or publicly disclosing while knowing no breach occurred (art. 57) | fine, restriction of liberty, or **up to 2 years** | | **No internal reporting procedure**, or one established in significant breach of the Act's requirements (art. 58) | **a fine**, imposed under the Code of Procedure in Petty Offence Cases (art. 59) | Having no internal procedure is therefore a **petty offence tried by a court**, not an administrative breach penalised by a supervisory body. The fine targets the **person responsible for setting up the procedure**, not the entity itself. The Act names no amount, so the general rule of the [Petty Offences Code](https://api.sejm.gov.pl/eli/acts/DU/2026/1372/text.pdf) applies: a fine of **PLN 20 to PLN 5,000** (art. 24 § 1). The Rzecznik Praw Obywatelskich receives external reports but imposes none of these penalties. **An honest assessment of enforcement.** Because every penalty runs through the courts and no supervisory authority imposes them, there is no central tally of fines for a missing procedure. The weightier exposure is criminal and personal: obstruction, retaliation and disclosure of a reporter's identity can lead to imprisonment for the people responsible, and the Ombudsman's first annual report (below) documented cases in which a confidential reporter's identity was disclosed. ## External reporting authority The [Rzecznik Praw Obywatelskich (Ombudsman)](https://ethicsportal.eu/authorities/poland-rpo/) receives external reports, checks them, and forwards them to the competent public authority within **14 days** at the latest (art. 32(2)). A whistleblower may report to the Ombudsman without reporting internally first (art. 30(1)). External reporting started on **25 December 2024**. ## Data protection authority For GDPR complaints about how whistleblowing data is processed, the relevant authority is the [Urząd Ochrony Danych Osobowych (UODO)](https://uodo.gov.pl/pl/501/3485). ## Setting up in seven steps 1. **Check the duty:** at least 50 persons performing gainful work on 1 January or 1 July; some sectors at any size. 2. **Appoint people or a provider:** who receives reports, and who takes impartial follow-up action. Issue written authorisations. 3. **Draft the procedure** with every element of art. 25, including the decision on anonymous reports. 4. **Consult** the trade union or worker representatives (5–10 days). 5. **Announce the procedure** in the usual way; it takes effect after 7 days. Inform job applicants about it. 6. **Open the channels:** oral or written, a meeting on request within 14 days, access only for authorised people. 7. **Keep the register** and meet the deadlines: acknowledgement within 7 days, feedback within 3 months, retention for 3 years. ## The first year in practice In its first annual report — published on 10 February 2026 by the Ombudsman's Whistleblowers Team — the Rzecznik Praw Obywatelskich set out how the external channel was used between 27 December 2024 and 31 December 2025: - **690 submissions** were received, of which **223** were accepted as qualifying external reports. - **175 submissions were anonymous**; of these, **72** were accepted and **54** were forwarded to the competent authority. - The Ombudsman documented cases in which a confidential reporter's identity was disclosed to the people they had reported, underlining how much depends on disciplined handling of [confidentiality](https://ethicsportal.eu/blog/anonymous-vs-confidential-reporting/) once a report is received. ## Official sources - [Act of 14 June 2024 on the Protection of Whistleblowers — official text PDF](https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU20240000928/O/D20240928.pdf) - [Petty Offences Code — consolidated text (Journal of Laws 2026, item 1372)](https://api.sejm.gov.pl/eli/acts/DU/2026/1372/text.pdf) - [Ombudsman — whistleblowers page](https://bip.brpo.gov.pl/pl/sygnalisci) - [Ombudsman — act enters into force notice](https://bip.brpo.gov.pl/pl/content/ustawa-o-ochronie-sygnalistow-wchodzi-w-zycie) - [UODO — whistleblowing and data protection](https://uodo.gov.pl/pl/501/3485) ## Frequently asked questions ### Who must comply with Poland's whistleblower act? A legal entity for which at least 50 persons perform gainful work, counted on 1 January or 1 July, must adopt an internal reporting procedure. Entities in financial services, anti-money laundering, transport safety and environmental protection must do so regardless of headcount. ### When did the Polish whistleblower act take effect? On 25 September 2024, when internal reporting procedures became mandatory. External reports to the Ombudsman have been accepted since 25 December 2024. ### How is the 50-person threshold counted? Employees are counted as full-time equivalents. People paid for work on another basis, such as a civil-law contract, are added if they do not employ others for that work. The count is taken on 1 January or 1 July (art. 23). ### Must the procedure be consulted with trade unions? Yes. The procedure is adopted after consultation with the workplace trade union or, if there is none, with worker representatives. Consultation lasts 5 to 10 days (art. 24). ### Must anonymous reports be accepted? No. An entity may accept anonymous reports but does not have to. Its procedure must, however, state how such reports are handled (art. 7(1), art. 25(1) point 4). ### What deadlines apply after a report? Acknowledgement within 7 days and feedback within 3 months of the acknowledgement. At the whistleblower's request, a meeting takes place within 14 days. ### What is the penalty for having no internal procedure? A fine for the person responsible for setting up the procedure, imposed by a court under petty-offence rules (arts. 58–59). The Act names no amount, so the general range of the Petty Offences Code applies: PLN 20 to PLN 5,000. ### How long must report data be kept? For 3 years after the end of the calendar year in which follow-up, or the proceedings it started, ended (art. 29(5)). --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblowing in Portugal: Lei 93/2021 requirements > Portugal's Lei 93/2021: who needs a whistleblowing channel, anonymous reports, the 7-day and 3-month deadlines, 5-year records and fines up to €250,000. Canonical: https://ethicsportal.eu/whistleblower-laws/portugal/ Last updated: 2026-11-04 Portugal transposed Directive (EU) 2019/1937 through **Lei n.º 93/2021, de 20 de dezembro**, the general regime for the protection of whistleblowers. The law has applied since **18 June 2022**. It requires legal persons with **50 or more workers** to operate a whistleblowing channel (an "internal reporting channel" under Article 8 of the Directive), and it protects people who report breaches from retaliation. **Does your organisation need a whistleblowing channel?** - **Fewer than 50 workers:** As a rule, no. Exception: entities covered by the EU acts in Parts I.B and II of the Directive's Annex must have a channel regardless of headcount (Art. 8(1)). According to MENAC, this means financial services, products and markets and the prevention of money laundering, transport safety and environmental protection. - **50 to 249:** Yes, since 18 June 2022. Entities of this size that are not public-law bodies may share resources for receiving and following up reports (Art. 8(2)). Having no channel is a serious offence: a fine of €1,000 to €125,000 for legal persons (Art. 27). - **250 or more:** Yes, since 18 June 2022. No channel: a fine of €1,000 to €125,000. Retaliation, obstructing a report or breaching confidentiality: €10,000 to €250,000 for legal persons (Art. 27). ## Lei 93/2021 at a glance | Question | Answer | | --- | --- | | In force since? | 18 June 2022, 180 days after publication (Art. 31). | | Who needs a channel? | Legal persons with 50 or more workers, including the State and public-law bodies; certain regulated entities at any size (Art. 8(1)). | | Written or oral? | Written, oral or both; one is enough. If oral reports are accepted, also an in-person meeting on request (Art. 10). | | Anonymous reports? | Yes. The channel must allow anonymous and identified reports (Art. 10(1)). | | Deadlines? | Acknowledge receipt within 7 days; communicate follow-up measures within 3 months of receipt (Art. 11). | | How long to keep reports? | At least 5 years, and in any case while court or administrative proceedings about the report are pending (Art. 20(1)). | | Fine for having no channel? | €1,000 to €125,000 for legal persons; €500 to €12,500 for natural persons (Art. 27(3) and (4)). | | Who enforces? | The National Anti-Corruption Mechanism (MENAC), except under sector regimes (Art. 29). | ## Applicable law - [Lei n.º 93/2021 — official text in the Diário da República](https://files.diariodarepublica.pt/gratuitos/1s/2021/12/24400.pdf) (1st series, no. 244, 20 December 2021) - [Lei n.º 93/2021 — consolidated text (PGDLisboa)](https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=3544&tabela=leis) ## Who must establish a whistleblowing channel [Article 8](https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=3544&tabela=leis) defines the **obliged entities**: - **Legal persons with 50 or more workers**, including the State and other public-law legal persons (para. 1). - **Regardless of headcount**, entities covered by the EU acts listed in Parts I.B and II of the Directive's Annex (para. 1). According to the [MENAC FAQ](https://www.menac.pt/faq/regime-geral-de-protecao-de-denunciantes-de-infracoes/), this means financial services, products and markets and the prevention of money laundering, transport safety and environmental protection. Check the sector legislation that applies to your entity. - **Branches in Portugal** of legal persons based abroad, with the necessary adaptations (para. 3). In the public sector, the State has at least one channel in each body listed in para. 4, such as the Presidency, the Parliament and each ministry. The autonomous regions have a channel in the regional legislative assembly and in each regional department (para. 5). Local authorities with fewer than 10,000 inhabitants do not need a channel, even with 50 or more workers (para. 6). See also [whistleblowing in the public sector](https://ethicsportal.eu/industries/public-sector/). ## What can be reported [Article 2](https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=3544&tabela=leis) defines a **breach**: - acts or omissions against the EU rules listed in the Directive's Annex, and the national rules that implement or transpose them, in **public procurement**, **financial services and markets and anti-money laundering**, **product and transport safety**, **environmental protection**, radiation protection and nuclear safety, **food safety**, animal health and welfare, **public health**, **consumer protection**, and **privacy and personal data protection** and the security of network and information systems; - acts or omissions that harm the EU's financial interests (Art. 325 TFEU); - acts or omissions against internal market rules, including **competition**, **State aid** and **corporate tax** rules; - **violent, especially violent and highly organised crime**, and the crimes listed in Art. 1(1) of Lei n.º 5/2002 on organised and economic-financial crime, among them **corruption**, influence peddling, embezzlement and **money laundering**; - acts or omissions that defeat the purpose of the rules in the first three points. A report may cover breaches that have been committed, are being committed or can reasonably be expected, and attempts to conceal them (Art. 4). **Exclusions.** In defence and national security, only breaches of the procurement rules in Part I.A of the Directive's Annex count (Art. 2(2)). The law does not affect the protection of classified information, religious secrecy, the professional secrecy of doctors, lawyers and journalists, or the secrecy of judicial proceedings (Art. 3(3)). ## Who is protected and how A **whistleblower** is a natural person who reports or publicly discloses a breach based on information obtained in their professional activity (Art. 5(1)). This includes workers in the private, social or public sector, service providers, suppliers and subcontractors, shareholders and members of company bodies, volunteers and trainees (para. 2). It also includes people who obtained the information in a professional relationship that has ended or during recruitment (para. 3). Protection requires **good faith** and **serious grounds** to believe that the information was true at the time of the report (Art. 6(1)). An anonymous reporter who is later identified is also protected (para. 2). Protection extends to people who help the reporter, including trade union or worker representatives, to colleagues and relatives, and to legal persons linked to the reporter (para. 4). | Protection | Legal basis | | --- | --- | | Retaliation is prohibited, including threats and attempts | Art. 21(1) and (3) | | **Presumption**: certain acts within **two years** of the report are presumed to be caused by it, until proven otherwise. For example: dismissal, changes to duties, working hours or pay, a negative assessment, not renewing a fixed-term contract. | Art. 21(6) | | A disciplinary sanction within two years of the report is presumed abusive | Art. 21(7) | | Whoever retaliates compensates the reporter; the reporter may ask the court for measures to prevent the damage | Art. 21(4) and (5) | | A report made under the law creates no disciplinary, civil, administrative-offence or criminal liability | Art. 24 | | The rights cannot be waived; contract clauses that prevent reports are void | Art. 26 | **Order of channels.** In Portugal, the reporter as a rule uses the internal channel first. They may use an external channel only when there is no internal channel, the internal channel accepts reports only from workers and the reporter is not one, they have reasonable grounds to believe that the breach cannot be effectively known or resolved internally or that there is a risk of retaliation, they made an internal report and were not told of the follow-up measures within the Article 11 deadlines, or the breach is a crime or an administrative offence with a fine above €50,000 (Art. 7(2)). A reporter who did not know these rules, through no fault of their own, keeps the protection (Art. 6(3)). ## Requirements for the internal channel - **Who runs it:** people or departments of the entity designated for this purpose, for receiving and following up reports (Art. 9(2)). The channel may be operated externally **for receiving** reports (para. 3). MENAC's reading is that only the technical solution of the channel may be operated externally ([MENAC FAQ, question 18](https://www.menac.pt/faq/regime-geral-de-protecao-de-denunciantes-de-infracoes/)). - **Independence:** the people who receive and handle reports act with independence, impartiality, confidentiality, data protection, secrecy and no conflicts of interest (Art. 9(4)). - **Security:** the channel ensures the completeness, integrity and retention of the report, the confidentiality of the reporter's identity or their anonymity, and the confidentiality of third parties named in it, and it prevents access by unauthorised people (Art. 9(1)). - **Who can report:** at least all workers (Art. 10(1); Art. 27(3)(d)). The entity may open the channel to other people, such as suppliers (Art. 7(2)(b)). - **Written or oral:** the channel allows reports in writing **and/or** orally (Art. 10(1)). One of the two is enough. If oral reports are accepted, they must be possible by telephone or another voice messaging system and, at the reporter's request, in an **in-person meeting** (para. 2). - **Anonymous reports:** the channel allows **anonymous or identified** reports (Art. 10(1)). A channel that does not accept anonymous reports is a serious offence (Art. 27(3)(d)). See [anonymous and confidential reporting](https://ethicsportal.eu/blog/anonymous-vs-confidential-reporting/). - **Information on external reporting:** with the acknowledgement, the entity tells the reporter, clearly and accessibly, about the competent authorities and the rules for external reporting (Art. 11(1)). ## Deadlines and follow-up | Step | Deadline | | --- | --- | | Acknowledge receipt to the reporter and inform them about external reporting | **7 days** (Art. 11(1)) | | Communicate the planned or adopted follow-up measures and the reasons for them | at most **3 months from the date of receipt** (Art. 11(3)) | | Communicate the result of the analysis, if the reporter asks | **15 days** after the analysis is completed (Art. 11(4)) | The reporter may make the Art. 11(4) request at any time. In the follow-up, the entity takes the internal steps needed to check the allegations and, where appropriate, to stop the breach. For example, it opens an internal inquiry or informs the competent authority (Art. 11(2)). Failing to acknowledge within 7 days and failing to answer an Art. 11(4) request are serious offences (Art. 27(3)(f) to (h)). Missing the 3-month deadline is not in the list in Article 27, but it lets the reporter use an external channel (Art. 7(2)(d)). ## Confidentiality and record retention **Confidentiality (Art. 18).** The reporter's identity, and information from which it can be deduced, is confidential. Only the people responsible for receiving or following up reports have access to it. The duty extends to anyone who receives information about a report without being responsible for handling it. The identity is disclosed only under a legal obligation or a court decision, and the reporter is told first, in writing and with the reasons, unless this would harm the investigation. The same rules protect the identity of the people concerned (Art. 25(2)). **Records (Art. 20).** - Entities keep a **register** of the reports they receive and keep the reports for **at least five years** and, regardless of that period, while court or administrative proceedings about the report are pending (para. 1). - Reports by recorded telephone line or voice message: with the reporter's consent, a recording in a durable form or a complete and accurate transcript (para. 3). If the oral channel cannot record, the entity draws up accurate minutes (para. 4). - In-person meetings: with consent, a recording or accurate minutes (para. 5). - The reporter may check, correct and approve the transcript or minutes by signing them (para. 6). - Personal data that is clearly not relevant to the report is not kept and is deleted immediately (Art. 19(2)). ## Shared channels and groups of companies **Shared resources.** Obliged entities that are not public-law bodies and employ **50 to 249 workers** may share resources for receiving and following up reports (Art. 8(2)). Local authorities may share channels (para. 7). **Groups of companies.** The law has no specific rules for groups. According to [MENAC (question 15)](https://www.menac.pt/faq/regime-geral-de-protecao-de-denunciantes-de-infracoes/), the company based in Portugal, or the Portuguese branch of a foreign company, must ensure full compliance with the law, whatever channels the parent company has. ## Worker representatives and data protection Lei 93/2021 does not require consulting worker representatives before setting up the channel. It keeps workers' right to consult their representatives or trade unions (Art. 3(5)(a)). Check whether other rules apply to your entity. The processing of personal data follows the GDPR and Lei n.º 58/2019 (Art. 19(1)). See [GDPR and whistleblower reporting](https://ethicsportal.eu/blog/gdpr-and-whistleblower-reporting/). ## Penalties and enforcement Breaches of the law are **administrative offences** (*contraordenações*) punished with fines under [Article 27](https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=3544&tabela=leis). Not having a whistleblowing channel is a serious offence (Art. 27(3)(a)). | Offence | Legal persons | Natural persons | | --- | --- | --- | | **Very serious** (*muito grave*, para. 1): obstructing a report or its follow-up; retaliation; breaching confidentiality; communicating or publicly disclosing false information | **€10,000 to €250,000** | €1,000 to €25,000 | | **Serious** (*grave*, para. 3): **no internal channel**; a channel without security, confidentiality or anonymity safeguards; lack of independence or impartiality; a channel that does not admit all workers, anonymous and identified reports, or any written or oral form; refusing an in-person meeting; not acknowledging within 7 days or not informing about external reporting; not giving a requested result within 15 days; not registering or keeping a report for 5 years; recording without consent; not letting the reporter check and approve the minutes | **€1,000 to €125,000** | €500 to €12,500 | Attempts and negligence are punishable, with the maximum fines halved (Art. 27(5) and (6)). If the same act is also a crime, it is punished as a crime (Art. 28). **Enforcement authority.** MENAC handles the proceedings and imposes the fines (Art. 29(1)). For entities subject to EU sector regimes (Art. 3(1)), the sector authorities are competent (Art. 29(2)). The statutory fine ranges do not show how many fines have been imposed. Compare other countries: [penalties by country](https://ethicsportal.eu/penalties/). ## External reporting and MENAC Portugal has no single external reporting authority. External reports go to the authority competent for the subject, for example the Public Prosecutor's Office, the criminal police, the Banco de Portugal, the independent administrative authorities, public institutes, the general inspectorates, local authorities and public associations (Art. 12(1)). [MENAC](https://www.menac.pt/) receives reports when there is no competent authority or when the report concerns a competent authority. If the report concerns MENAC, it goes to the Public Prosecutor's Office (Art. 12(3)). A report sent to the wrong authority is forwarded to the competent one (para. 2). External channels accept written and oral reports, anonymous or identified (Art. 14(1)). The authority acknowledges receipt within 7 days and communicates follow-up within 3 months, or 6 months in complex cases (Art. 15). The [Ministry of Justice](https://justica.gov.pt/Regime-Geral-de-Protecao-de-Denunciantes-de-Infracoes) explains where to file an external report. ## Data protection authority For GDPR complaints, the competent authority is the [Comissão Nacional de Proteção de Dados (CNPD)](https://www.cnpd.pt/cidadaos/participacoes/). ## Setting up in six steps 1. **Check the duty:** 50 or more workers, or an entity in a regulated sector covered at any size. 2. **Designate the people in charge:** internal people or departments, independent and free of conflicts of interest. Entities with 50 to 249 workers that are not public-law bodies may share resources. 3. **Set up the channel:** written, oral or both; anonymous and identified reports; an in-person meeting on request if oral reports are accepted; access only for the people in charge. 4. **Open the channel to all workers**, and decide whether to open it to suppliers and other people. 5. **Set the procedure:** acknowledgement within 7 days with information on external reporting, follow-up measures within 3 months, the result within 15 days on request. 6. **Organise the records:** keep reports for at least 5 years, record or transcribe only with consent, delete irrelevant data immediately. ## Official sources - [Lei n.º 93/2021 — Diário da República, 1st series, no. 244 (PDF)](https://files.diariodarepublica.pt/gratuitos/1s/2021/12/24400.pdf) - [Lei n.º 93/2021 — consolidated text (PGDLisboa)](https://www.pgdlisboa.pt/leis/lei_mostra_articulado.php?nid=3544&tabela=leis) - [MENAC — FAQ on the general whistleblower protection regime](https://www.menac.pt/faq/regime-geral-de-protecao-de-denunciantes-de-infracoes/) - [Ministry of Justice — general regime for whistleblower protection](https://justica.gov.pt/Regime-Geral-de-Protecao-de-Denunciantes-de-Infracoes) - [CNPD — complaints](https://www.cnpd.pt/cidadaos/participacoes/) ## Frequently asked questions ### What is Lei 93/2021? It is the law that sets Portugal's general regime for the protection of whistleblowers. It transposes Directive (EU) 2019/1937. It requires entities with 50 or more workers to operate a whistleblowing channel and protects whistleblowers from retaliation. ### When did Lei 93/2021 start to apply? On 18 June 2022. The law entered into force 180 days after its publication on 20 December 2021 (Art. 31). ### Who must have a whistleblowing channel in Portugal? Legal persons with 50 or more workers, including the State and public-law bodies, and, on the same terms, Portuguese branches of foreign companies. Entities covered by the EU acts in Parts I.B and II of the Directive's Annex must have one at any size (Art. 8). ### Must companies accept anonymous reports? Yes. The internal channel must allow anonymous reports and reports with the reporter's identity (Art. 10(1)). Not allowing them is a serious offence (Art. 27(3)(d)). ### Must the channel accept both written and oral reports? No, one is enough: the law says "in writing and/or orally" (Art. 10(1)). If the channel accepts oral reports, it must allow telephone or another voice messaging system and, on request, an in-person meeting (Art. 10(2)). ### What deadlines apply after a report? The entity acknowledges receipt within 7 days and communicates the planned or adopted follow-up measures within 3 months of receipt. If the reporter asks, it communicates the result of the analysis within 15 days of its completion (Art. 11). ### How long must reports be kept? For at least five years and, in any case, while court or administrative proceedings about the report are pending (Art. 20(1)). Personal data that is clearly irrelevant is deleted immediately (Art. 19(2)). ### What is the fine for having no whistleblowing channel? It is a serious offence: €1,000 to €125,000 for legal persons and €500 to €12,500 for natural persons (Art. 27(3) and (4)). Retaliation, obstructing reports and breaching confidentiality are very serious offences: up to €250,000 for legal persons. ### May an external provider run the whistleblowing channel? Only in part. The channel may be operated externally for receiving reports, but follow-up stays with designated people or departments of the entity (Art. 9(2) and (3)). MENAC's reading is that only the technical solution may be external. ### Can a whistleblower go directly to MENAC or another authority? Only in certain cases. As a rule, they use the internal channel first. They may use an external channel, for example, if there is no internal channel, if there is a risk of retaliation, if they were not told of the follow-up measures within the Article 11 deadlines, or if the breach is a crime or an administrative offence with a fine above €50,000 (Art. 7(2)). --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Romania — Legea 361/2022 > Romania's Legea 361/2022: who needs an internal channel, ANI's role as the external authority, and the official Romanian compliance sources. Canonical: https://ethicsportal.eu/whistleblower-laws/romania/ Last updated: 2026-10-17 Romania implemented Directive (EU) 2019/1937 through **Legea nr. 361/2022 privind protecția avertizorilor în interes public**. The Romanian framework pairs the standard **50-employee** private-sector trigger with a visible role for ANI as both external authority and practical guidance body. ## Applicable law - [Legea nr. 361/2022 — official text PDF](https://legislatie.just.ro/public/DetaliiDocument/262872) - [ANI FAQ for whistleblowers](https://avertizori.integritate.eu/intrebari-frecvente/) ## Who must establish an internal channel - **All public-sector entities** — authorities, public institutions, and other public-law legal entities — regardless of headcount. - **Private-law entities with at least 50 employees.** - **Certain Annex 3 sector entities** (financial services, anti-money-laundering, insurance) — regardless of headcount. Private entities with between 50 and 249 employees may pool or share resources for their internal channel (Art. 9(4)). Deadlines were phased: the law entered into force on 22 December 2022 for the public sector and entities with 250+ employees, while the 50–249 employee tier had until **17 December 2023** to comply (Art. 36). ## Penalties and enforcement Failing to establish an internal reporting channel is an **administrative contravention** under Article 28(2)(c), not a criminal offense. The headline figures (EUR approximate at ~5 RON = €1): | Conduct | Fine (RON) | ≈ EUR | | --- | --- | --- | | Preventing a report by any means, by the person designated to receive and register reports (Art. 28(2)(a)) | 2,000–20,000 | ~€400–4,000 | | Refusing to respond to the Agency's requests | 3,000–30,000 | ~€600–6,000 | | **Failing to establish internal channels** (Art. 28(2)(c)) | **3,000–30,000** | **~€600–6,000** | | Non-compliance with Art. 10(1)(a) obligations | 4,000–40,000 | ~€800–8,000 | | Breaching whistleblower confidentiality | 4,000–40,000 | ~€800–8,000 | | Knowingly false report (Art. 29) | 2,500–30,000 | ~€500–6,000 | Verbatim, Art. 28(2)(c): *"nerespectarea de către persoanele juridice prevăzute la art. 1 alin. (1) a obligației de a institui canalele interne de raportare prevăzute la art. 9 alin. (1), cu amendă de la 3.000 lei la 30.000 lei"* ([legislatie.just.ro](https://legislatie.just.ro/public/DetaliiDocument/262872)). **An honest assessment of enforcement.** The fines above are what the statute provides. In practice, no public record of a company being fined specifically for a missing internal channel has surfaced, and enforcement to date appears reactive — driven by reports reaching ANI rather than proactive audits. ANI [registered 329 external reports in 2025](https://agerpres.ro/justitie/2026/05/18/ani-anul-trecut-au-crescut-semnificativ-raportarile-avertizorilor-de-integritate-privind-incalcari-a--1557362), 188 of them in domains regulated by Legea 361/2022; those are reports received by the authority, not sanctions issued against employers. Independent analysis ([CEELI Institute, 2023](https://ceeliinstitute.org/resource/beyond-paper-rights-implementing-whistleblower-protections-in-central-and-eastern-europe)) documents a gap between the law on paper and its implementation. The practical conclusion: the obligation is real and the operational exposure is a report arriving at ANI with no internal channel in place — not a large fine. A compliant internal channel is best treated as low-cost infrastructure that removes that exposure, not as insurance against a penalty that has rarely, if ever, been levied. ## External reporting authority The official external channel is the [Agenția Națională de Integritate (ANI)](https://ethicsportal.eu/authorities/romania-ani/). ANI receives reports, can redirect them to the competent authority where needed, and publishes practical guidance for both reporters and employers. ## Data protection authority For GDPR complaints about the handling of report data, the relevant authority is the [ANSPDCP](https://www.dataprotection.ro/?lang=ro&page=Transmiterea_plangerilor_catre_ANSPDCP). ## Key compliance points - If a private entity has fewer than 50 workers and no internal channel, the practical route is often the external channel. - Anonymous reports may be examined if they contain sufficient indications of a breach, but identified reporters have fuller procedural rights. - ANI explicitly positions itself as both an intake authority and a guidance body for implementation questions. ## Official sources **Primary law and authority** - [Legea nr. 361/2022 — official consolidated text (legislatie.just.ro)](https://legislatie.just.ro/public/DetaliiDocument/262872) - [Legea nr. 361/2022 — ANI Romanian PDF](https://integritate.eu/wp-content/uploads/2024/03/Legea-361-2022.pdf) - [Law 361/2022 — ANI English PDF](https://integritate.eu/wp-content/uploads/2024/03/Law-361-2022.pdf) - [ANI — whistleblower competence page](https://integritate.eu/competente/avertizori-in-interes-public/) - [ANI — frequently asked questions](https://avertizori.integritate.eu/intrebari-frecvente/) - [ANSPDCP — complaints submission (data protection)](https://www.dataprotection.ro/?lang=ro&page=Transmiterea_plangerilor_catre_ANSPDCP) **Enforcement and independent analysis** - [ANI — 2025 whistleblower reporting statistics (via Agerpres, May 2026)](https://agerpres.ro/justitie/2026/05/18/ani-anul-trecut-au-crescut-semnificativ-raportarile-avertizorilor-de-integritate-privind-incalcari-a--1557362) - [CEELI Institute — "Beyond Paper Rights: Implementing Whistleblower Protections in Central and Eastern Europe" (2023)](https://ceeliinstitute.org/resource/beyond-paper-rights-implementing-whistleblower-protections-in-central-and-eastern-europe) - [EU Whistleblowing Monitor — Romania](https://whistleblowingmonitor.eu/?country=romania) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Slovakia — Act No. 54/2019 > Slovakia's whistleblower law: the 50-worker rule, the Whistleblower Protection Office, and the official Slovak sources. Canonical: https://ethicsportal.eu/whistleblower-laws/slovakia/ Last updated: 2026-10-06 Slovakia implemented Directive (EU) 2019/1937 through **Act No. 189/2023 Coll.**, amending **Act No. 54/2019 Coll. on the Protection of Whistleblowers of Anti-Social Activities**. The amendment took effect on **1 July 2023**, with several provisions following on **1 September 2023**. Slovakia stands out because it has a visible and specialised **Whistleblower Protection Office** rather than a low-profile distributed model. ## Applicable law - [Act No. 54/2019 Coll. — official text on Slov-Lex](https://www.slov-lex.sk/pravne-predpisy/SK/ZZ/2019/54/) - [Act No. 189/2023 Coll. — transposing amendment and commencement dates](https://static.slov-lex.sk/static/SK/ZZ/2023/189/vyhlasene_znenie.print.html) - [Whistleblower Protection Office](https://www.oznamovatelia.sk/en/) ## Who must establish an internal channel Employers with **at least 50 workers** must establish an internal reporting channel under the Slovak whistleblower framework. Entities in the financial-services and anti-money-laundering, transport-safety, and environmental sectors are in scope **regardless of headcount**. ## External reporting authority The specialised external authority is the [Whistleblower Protection Office](https://www.oznamovatelia.sk/en/), which protects whistleblowers, supervises the law's application and provides guidance to both workers and employers. ## Data protection authority For GDPR complaints relating to report handling, the relevant authority is the [Office for Personal Data Protection of the Slovak Republic](https://www.dataprotection.gov.sk/en/rights-data-subjects/proceedings-on-protection-personal-data/). ## Key compliance points - Slovakia has one of the more visible dedicated whistleblowing institutions in CEE, which means buyers often expect a more formal legal framing. - The Whistleblower Protection Office can intervene in retaliation-related employment measures, which gives the Slovak regime a strong protection profile. - Slovak official materials distinguish between the employer's internal process and the office's own protection and reporting functions, so product copy should do the same. ## Official sources - [Act No. 54/2019 Coll. — official text](https://www.slov-lex.sk/pravne-predpisy/SK/ZZ/2019/54/) - [Act No. 189/2023 Coll. — transposing amendment and commencement dates](https://static.slov-lex.sk/static/SK/ZZ/2023/189/vyhlasene_znenie.print.html) - [Whistleblower Protection Office](https://www.oznamovatelia.sk/en/) - [Whistleblower Protection Office — protection activity](https://www.oznamovatelia.sk/en/nase-cinnosti/ochrana-oznamovatelov/) - [Whistleblower Protection Office — compulsory information](https://www.oznamovatelia.sk/en/povinne-zverejnovane-informacie/) - [Office for Personal Data Protection — proceedings](https://www.dataprotection.gov.sk/en/rights-data-subjects/proceedings-on-protection-personal-data/) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Slovenia — ZZPri > Slovenia's Reporting Persons Protection Act (ZZPri): the 50-worker rule, the 10-worker sectoral rule, the zaupnik, the 1 March return to the KPK, the fine bands, and the official Slovenian sources. Canonical: https://ethicsportal.eu/whistleblower-laws/slovenia/ Last updated: 2026-09-22 Slovenia implemented Directive (EU) 2019/1937 through the **Zakon o zaščiti prijaviteljev (ZZPri)**, Uradni list RS no. 16/23, in force since **22 February 2023**. Slovenia gives a visible role to the **Commission for the Prevention of Corruption (KPK)** for protection and reporting oversight. Two features make Slovenia unusual. The person who receives internal reports — the *zaupnik* — must be appointed from among the employer's own employees. And every obliged employer files an annual return to the KPK by 1 March. ## Applicable law - [ZZPri — official text in Uradni list RS no. 16/23](https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2023-01-0301/zakon-o-zasciti-prijaviteljev-zzpri) - [KPK — protection of reporting persons](https://www.kpk-rs.si/en/commissions-activities/protection-of-reporting-persons) ## Who must establish an internal channel Article 9(2) ZZPri: public and private sector entities with **50 or more employees**. Article 9(3) lowers the threshold to **10 employees** for entities whose principal registered activity is healthcare, or the collection, treatment and distribution of water, sewerage, or waste collection and management. This is a lower threshold, not an exemption from headcount — the Directive's own Article 8(4) carve-out for regulated financial and AML entities applies separately and does remove the headcount test for those entities. Article 9(4) covers listed public sector bodies regardless of size. ## The zaupnik The employer appoints a *zaupnik* (confidential officer) **from among its employees**. The role cannot be outsourced, which is the first structural question for any organization procuring a whistleblowing channel here: the software is the system of record and the audit trail, but the statutory recipient is an internal person. The zaupnik runs a **7-day preliminary admissibility test** on each report — whether the reporter qualifies, whether the matter is a breach within scope, whether it is manifestly unfounded, and whether the breach is ongoing or ended less than two years ago. Substantive feedback follows within **three months**. ## Annual return to the KPK Article 9(16): by **1 March** each year, for the preceding year, every obliged employer reports to the KPK via an electronic form — the number of reports received, how many were anonymous, how many were well-founded, the number of retaliation cases handled, and the identity of the zaupnik. This is a recurring dated obligation most EU transpositions do not impose, and it is the practical reason a mailbox is not enough: the figures have to be countable at year end. ## Retention Article 7(4): unless another act provides otherwise, data in the register of reports is retained for **five years after the end of the procedure**. ## Penalties Fine bands turn on the size of the offender as well as the offence. | Offence | Medium/large companies | Other legal entities | Sole traders | Responsible person | |---|---|---|---|---| | No internal channel; channel not described in the internal act; missed 1 March return | €3,000–6,000 | €2,000–4,000 | €1,000–2,000 | €300–2,000 | | Trying to establish the reporter's identity; threatening or attempting retaliation | €3,000–6,000 | €2,000–4,000 | €1,000–2,000 | €300–2,000 | | Carrying out a retaliatory measure | €10,000–60,000 | €5,000–20,000 | €3,000–15,000 | €500–2,500 | Disclosing the identity of a reporter, facilitator or connected person is fined **€300–2,500**. A reporter who deliberately reports or publicly discloses information they know to be untrue is fined **€400–1,200**; that offence is prosecuted by the external reporting authority that handled the report, not the KPK. ## External reporting authority ZZPri designates around two dozen sectoral external reporting authorities. The [Commission for the Prevention of Corruption (KPK)](https://www.kpk-rs.si/en/commissions-activities/protection-of-reporting-persons) is the catch-all where no specialised regulator has jurisdiction, and it is the body that issues the certificate of eligibility for protection. ## Data protection authority For GDPR complaints about whistleblower data handling, the relevant authority is the [Information Commissioner of the Republic of Slovenia](https://www.ip-rs.si/en/) and its [complaint filing page](https://www.ip-rs.si/varstvo-osebnih-podatkov/pravice-posameznika/vlo%C5%BEitev-prijave). ## Support measures beyond the Directive - **Free legal aid** in court proceedings, granted regardless of the applicant's means, once the reporter shows they filed a report before the retaliatory measure or holds a KPK certificate of eligibility. - **Unemployment benefit** where the employer terminated the contract and the reporter is pursuing judicial protection. - **State-funded psychological support**, which the KPK can arrange through the public mental-health network. - **Reversed burden of proof** and exemption from court fees in retaliation proceedings. ## Official sources - [ZZPri — official law text, Uradni list RS no. 16/23](https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2023-01-0301/zakon-o-zasciti-prijaviteljev-zzpri) - [KPK — official guidance on ZZPri, including the fine bands (PDF)](https://www.kpk-rs.si/storage/uploads/cd75a022-7e97-4497-85e0-fff75c493673/ZZPri.pdf) - [KPK — protection of reporting persons](https://www.kpk-rs.si/en/commissions-activities/protection-of-reporting-persons) - [KPK — reporting on whistleblowing](https://www.kpk-rs.si/en/kpk-applications/reporting-on-whistleblowing) - [Information Commissioner of the Republic of Slovenia](https://www.ip-rs.si/en/) - [Information Commissioner — complaint filing](https://www.ip-rs.si/varstvo-osebnih-podatkov/pravice-posameznika/vlo%C5%BEitev-prijave) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Spain — Ley 2/2023 > Spain's Ley 2/2023: the private-sector threshold, public-sector scope, regional authority nuance, and the official Spanish reporting authorities. Canonical: https://ethicsportal.eu/whistleblower-laws/spain/ Last updated: 2026-06-10 Spain implemented Directive (EU) 2019/1937 through **Ley 2/2023, de 20 de febrero**. The Spanish framework combines the standard **50-worker** private-sector trigger with a broad public-sector obligation and a meaningful regional-authority layer. ## Applicable law - [Ley 2/2023 — official BOE text](https://www.boe.es/buscar/act.php?id=BOE-A-2023-4513) - [AIPI — external information channel](https://www.proteccioninformante.gob.es/nuestro-trabajo/investigacion) ## Who must establish an internal channel - **Private-sector entities with 50 or more workers** must maintain an internal information system (*Sistema interno de información*). - **All public-sector entities.** - **Financial / AML, environmental, and transport-safety entities** — regardless of headcount. Phased deadlines: **13 June 2023** for 250+ employees, **1 December 2023** for 50-249. Municipalities below 10,000 inhabitants may share means; 50-249 entities may share resources. ## Which breaches are covered The Act protects people who report (art. 2): - breaches of **EU law** within the annex to Directive (EU) 2019/1937, affecting the EU's financial interests (art. 325 TFEU) or concerning the internal market (art. 26(2) TFEU), including competition, State aid and corporate-tax avoidance practices; - acts or omissions that may constitute a **criminal offence or a serious or very serious administrative infringement**. The second limb goes beyond the Directive's minimum: in Spain the system covers any criminal offence or serious/very serious administrative infringement, not only the annex subject matters. ## Who is protected Article 3 covers anyone who obtains the information in a work or professional context: public employees and employees, **the self-employed**, **shareholders and partners**, members of the administrative, management or supervisory body — including **non-executives** — and anyone working for contractors, subcontractors and suppliers. It extends to **relationships that have already ended**, volunteers, trainees, people in training whether paid or not, and people who **have not yet started work**, where the information was obtained during recruitment or pre-contractual negotiation. ## What the internal reporting system must do Responsibility for implementing it sits with the **administrative or governing body**, after consulting the workers' legal representatives (art. 5(1)). The system must (art. 5(2)): - let everyone covered by art. 3 report; - be designed, established and managed **securely**, guaranteeing the confidentiality of the reporting person's identity and of any third party mentioned, and preventing access by unauthorised staff; - allow reports **in writing, orally, or both**; - **integrate** any separate internal channels the entity operates; - ensure reports can be handled effectively inside the entity, so that the organisation itself is the first to learn of the possible irregularity. **Anonymous reports.** Article 7(3) is explicit: internal channels *shall permit the submission and subsequent processing of anonymous reports*. It is not a recommendation. Germany, by contrast, imposes no equivalent duty. **Channel and formats** (art. 7(2)). In writing — by post or electronic means — or orally, by telephone or voice messaging. At the reporting person's request, an **in-person meeting within a maximum of seven days**. Oral reports are documented, with consent, either by a recording in a secure and durable format or by a complete transcript, and the reporting person is offered the chance to check, correct and sign it. **Third-party management** (art. 6). The system may be run in-house or by an external third party, "management" meaning the receipt of reports. The third party must offer adequate guarantees of independence, confidentiality, data protection and secrecy of communications. **System Officer** (art. 8). The administrative body appoints the natural person responsible for running the system. Where a collegiate body is chosen, it must delegate to one of its members. A point frequently missed: **both the appointment and the removal must be notified to the AIPI**, or to the competent regional authority (art. 8(3)). **Procedural deadlines** (art. 9(2)). Acknowledgment within **seven calendar days**, unless that would endanger confidentiality. A response within a maximum of **three months** from receipt — or from the expiry of the seven days where no acknowledgment was sent — **extendable by up to three further months** in especially complex cases. **Register** (art. 26). Every obliged entity must keep a register of the reports received and the internal investigations they led to. It is not public: access is only possible on a reasoned request from the competent judicial authority, by court order and within judicial proceedings. The data may not be kept for more than **ten years**. ## Penalties and enforcement Spain has the **harshest no-channel penalty in the EU**. Failing to have an internal information system is a *muy grave* (very serious) infraction under **Art. 63.1.g** — verbatim, *"Incumplimiento de la obligación de disponer de un Sistema interno de información en los términos exigidos en esta ley."* | Infraction tier (Art. 65) | Legal persons | Natural persons | | --- | --- | --- | | Leve | up to €100,000 | €1,001–10,000 | | Grave | €100,001–600,000 | €10,001–30,000 | | **Muy grave** (incl. **no internal system**, retaliation, breach of confidentiality, obstruction) | **€600,001–1,000,000** | €30,001–300,000 | For *muy grave* infractions the authority may add (Art. 65.2): **public reprimand**, a ban on subsidies / tax benefits for up to 4 years, and a ban on public-sector contracting for up to 3 years. **An honest assessment of enforcement.** Two things make Spain different from the rest of the region. First, the headline is real: **up to €1,000,000** for simply not having a compliant system. Second, **enforcement is actually switching on**: the national authority (**AIPI**) only began operating on **1 September 2025** and activated channel supervision around February 2026, and in December 2025 it made its first public move — referring a channel-mismanagement matter (the PSOE/Salazar case) to its Monitoring & Sanctions Department. That is a *referral*, not yet a completed fine — no company has been fined to date — but Spain is the clearest "enforcement is arriving" signal of any market we track. ## External reporting authority The national external channel is run by the [Autoridad Independiente de Protección del Informante (AIPI)](https://ethicsportal.eu/authorities/spain-aipi/) — its competence, the statutory deadlines and how a report is filed. Autonomous community authorities may handle regional and local matters within their territory unless a convention assigns them to the national authority. ## Data protection authority For GDPR complaints and privacy guidance, the competent authority is the [Agencia Española de Protección de Datos (AEPD)](https://www.aepd.es/). ## Key compliance points - Spain's public-sector obligation is broader than the simple private-sector 50-worker rule. - The national external system expressly supports written and verbal submissions. - The regional-authority layer matters in practice, especially for local or single-region cases. ## Official sources - [Ley 2/2023 — official BOE text](https://www.boe.es/buscar/act.php?id=BOE-A-2023-4513) - [AIPI — external information channel](https://www.proteccioninformante.gob.es/nuestro-trabajo/investigacion) - [AIPI — who we are](https://www.proteccioninformante.gob.es/AIPI/que-es) - [AIPI — sanctioning procedure](https://www.proteccioninformante.gob.es/nuestro-trabajo/potestad-sancionadora/procedimiento) - [Oficina Antifrau de Catalunya — whistleblower authority](https://www.antifrau.cat/en/who-is-independent-whistleblower-protection-authority-catalonia) - [AEPD](https://www.aepd.es/) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Sweden — SFS 2021:890 > Sweden's whistleblower act: the 50-worker rule, Sweden's sectoral external-authority model, and the official Swedish sources. Canonical: https://ethicsportal.eu/whistleblower-laws/sweden/ Last updated: 2026-04-24 Sweden implemented Directive (EU) 2019/1937 through **Lag (2021:890) om skydd för personer som rapporterar om missförhållanden**, in force since **17 December 2021**. Sweden combines the standard **50-worker** trigger with a **sectoral external-authority model** and supervision of internal-channel obligations by the Swedish Work Environment Authority. ## Applicable law - [Lag (2021:890) om skydd för personer som rapporterar om missförhållanden — official Riksdag text](https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2021890-om-skydd-for-personer-som_sfs-2021-890/) - [Government English translation of the Act](https://www.government.se/government-policy/labour-law-and-work-environment/2021890-act-on-the-protection-of-persons-reporting-irregularities-2021890/) ## Who must establish an internal channel Public and private organisations with **at least 50 workers** must establish internal reporting channels under the Swedish act. Entities in the financial-services and anti-money-laundering, transport-safety, and environmental sectors are in scope **regardless of headcount**. ## External reporting authority Sweden does not rely on one universal whistleblowing authority. The [Ordinance (2021:949)](https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/forordning-2021949-om-skydd-for-personer-som_sfs-2021-949/) designates multiple competent external authorities depending on the sector. The [Swedish Work Environment Authority](https://www.av.se/en/about-us/contact-us/) also receives reports that an employer has failed to maintain internal channels and procedures. ## Data protection authority For GDPR complaints relating to whistleblower data handling, the relevant authority is the [Swedish Authority for Privacy Protection (IMY)](https://www.imy.se/en/individuals/forms-and-e-services/file-a-gdpr-complaint/). ## Key compliance points - Swedish law is structurally clear but operationally decentralised, so country-specific legal content matters more than generic "EU-compliant" messaging. - Employers should tell users which external authority is relevant for the kind of breach being reported, not just that an "external authority" exists. - The Work Environment Authority is the clearest official supervisory body if the issue is the employer's failure to operate a compliant internal channel. ## Official sources - [Lag (2021:890) — official Riksdag text](https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2021890-om-skydd-for-personer-som_sfs-2021-890/) - [Government — English translation of the Act](https://www.government.se/government-policy/labour-law-and-work-environment/2021890-act-on-the-protection-of-persons-reporting-irregularities-2021890/) - [Ordinance (2021:949) — designated competent authorities](https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/forordning-2021949-om-skydd-for-personer-som_sfs-2021-949/) - [Swedish Work Environment Authority — contact and internal-channel supervision](https://www.av.se/en/about-us/contact-us/) - [IMY — file a GDPR complaint](https://www.imy.se/en/individuals/forms-and-e-services/file-a-gdpr-complaint/) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in Switzerland — no general statute > Switzerland has no general whistleblower protection law: the Code of Obligations reform failed in 2020 and a 2024 motion to revive it was rejected. What actually governs, which companies must still run a reporting procedure, and why EU subsidiaries put a Swiss group in scope anyway. Canonical: https://ethicsportal.eu/whistleblower-laws/switzerland/ Last updated: 2026-10-12 Switzerland has **no general whistleblower protection law**. The Federal Council's partial revision of the Code of Obligations, *Protection in the event of reporting irregularities in the workplace*, was rejected by the National Council on **5 March 2020** by 147 votes to 42, after an earlier version had already been sent back to the Federal Council for redrafting. The business was closed the same day. A motion to tighten Switzerland's implementation of the OECD Anti-Bribery Convention, including a legal framework to protect private-sector whistleblowers ([23.3844](https://www.parlament.ch/de/services/news/Seiten/2024/20240227115317950194158159038_bsd089.aspx)) was rejected by the National Council on 27 February 2024, with the Federal Council opposed. The OECD Working Group on Bribery has recorded "the lack of concrete proposals to pursue the necessary legislative reforms" and expects a Swiss implementation report in [December 2026](https://www.oecd.org/content/dam/oecd/en/topics/policy-sub-issues/fighting-foreign-bribery/wgb-plenary-public-summary-record-december-2025.pdf). What governs instead is ordinary employment and criminal law, a separate statutory regime for federal public employees, and sectoral supervision. ## Applicable law - [Code of Obligations (SR 220) — Art. 321a, 336, 336a](https://www.fedlex.admin.ch/eli/cc/27/317_321_377/en) - [Swiss Criminal Code (SR 311.0) — Art. 102, 162, 273](https://www.fedlex.admin.ch/eli/cc/54/757_781_799/en) - [Federal Personnel Act (SR 172.220.1) — Art. 22a](https://www.fedlex.admin.ch/eli/cc/2001/123/de) - [Ordinance on Due Diligence and Transparency in relation to Minerals and Metals from Conflict-Affected Areas and Child Labour (SR 221.433) — Art. 14](https://www.fedlex.admin.ch/eli/cc/2021/847/de) - [Curia Vista 13.094 — the failed Code of Obligations revision](https://www.parlament.ch/en/ratsbetrieb/suche-curia-vista/geschaeft?AffairId=20130094) ## Does Directive (EU) 2019/1937 apply? No. Switzerland is neither an EU nor an EEA member, and the Directive does not extend to it through the bilateral agreements. The exposure runs through subsidiaries in both directions, and the two directions are not symmetrical: - A **Swiss group with EU subsidiaries** is in scope through those subsidiaries. The 50-worker threshold applies per legal entity, not per corporate group, so each EU subsidiary answers to its own national transposing law regardless of where the parent sits. See our [reading of the threshold](https://ethicsportal.eu/directive-interpretations/) and the [country-by-country obligations](https://ethicsportal.eu/whistleblower-laws/). - An **EU group with a Swiss entity** gets no Directive obligation for that entity. A group channel that stops at the Swiss border still satisfies the Directive; the Swiss entity is simply governed by the rules below. ## Who must establish an internal channel No general Swiss law requires one. One ordinance does, for a narrow group of companies, and two further provisions make the absence of a channel expensive for everyone else. **Supply-chain due diligence (Art. 964j–964k CO and Art. 14 of the ordinance, SR 221.433).** Companies with their seat, head office or principal place of business in Switzerland that place in free circulation or process tin, tantalum, tungsten or gold above the ordinance's annual import volumes, or that offer products or services with a reasonable suspicion of child labour, must provide "as an early-warning mechanism for risk detection, a reporting procedure that enables all interested persons to raise justified concerns" about adverse impacts in those areas. "The reports must be documented." The procedure is limited to minerals, metals and child labour, and the child-labour limb exempts small and medium-sized companies (Art. 6) and companies with low child-labour risk (Art. 7). It is open to anyone, not only to staff. **Corporate criminal liability (Art. 102 para. 2 SCC).** For bribery, money laundering, terrorism financing and criminal-organisation offences, the undertaking is penalised **irrespective of the criminal liability of any natural person**, provided it "failed to take all the reasonable organisational measures that are required in order to prevent such an offence". Article 102 para. 1 caps the corporate fine at CHF 5 million. Swiss law does not enumerate those measures, so an organisation that has no way of learning about the conduct in the first place is arguing from a weak position. **The reporting cascade.** Swiss case law permits a report to an authority only after an internal attempt has failed or would plainly be futile. [FINMA states this in its own guidance](https://www.finma.ch/en/finma-public/reporting-information/): "According to case law for permitted whistleblowing you are fundamentally required first of all to attempt to report the suspected irregularity within the institution concerned. Only if this is not successful or appears futile is an external report to FINMA as the supervisory authority justified (so-called cascade system of permitted whistleblowing)." The regulator goes on to warn reporters that they "otherwise run the risk by submitting your report to FINMA of being liable to prosecution due to a potential breach of your duty of confidentiality." An employer with no internal route does not thereby keep reports in-house. It pushes workers straight to the step that carries the most legal risk for them, and the least control for the employer. **Soft law.** Recommendation 12 of the 2023 [Swiss Code of Best Practice for Corporate Governance](https://backend-api.economiesuisse.ch/sites/default/files/2025-09/swisscode_e_web_0.pdf) states that the board "should ensure that employees can report the suspected irregularities they have identified in the company to an independent internal or external body without expecting disadvantages. The reports should be investigated." It binds no one, but it is the benchmark auditors and boards of listed companies are measured against. ## What protection a private-sector whistleblower has Very little, and it is worth being plain about that rather than implying otherwise. - **Art. 321a CO** binds the employee to "loyally safeguard the employer's legitimate interests" and, in para. 4, not to reveal confidential information. This is the duty a report is measured against. - **Art. 336 CO** makes some terminations unlawful, and the courts have treated dismissal for a lawful report as falling within it. The provision does not name whistleblowing. - **Art. 336a para. 2 CO** caps the remedy: compensation "must not exceed an amount equivalent to six months' salary". The dismissal itself stands. There is no reinstatement. - **Art. 162 SCC** punishes betrayal of a manufacturing or trade secret that the person is under a statutory or contractual duty not to reveal. - **Art. 273 SCC** punishes making a manufacturing or trade secret available to a foreign official agency, a foreign organisation or a private enterprise, or their agents. Article 273 is the provision multinational groups underestimate. Where a report crosses the Swiss border — into a group intake abroad, or to a foreign authority — the routing decision is a question of Swiss criminal law, not of system architecture. Storage by a contracted processor abroad is the open question, and we know of no court decision on it. The Federal Supreme Court holds that a secret is made available as soon as the recipient has the possibility of learning it and that the information must have a connection to Switzerland, and records that prevailing doctrine favours applying Article 273 with restraint ([BGE 141 IV 155](https://www.bger.ch/ext/eurospider/live/de/php/clir/http/index.php?highlight_docid=atf%3A%2F%2F141-IV-155%3Ade&lang=de&type=show_document), E. 4.2.2–4.2.4). Swiss commentary on cloud services takes a risk-based approach: what matters is whether access by a foreign authority must still reasonably be expected ([Rosenthal, Jusletter IT, 15 February 2024](https://www.rosenthal.ch/downloads/Rosenthal_Cloud-Gutachten-Replik.pdf), in German). ## The federal public sector Federal employees are covered by a real statutory regime. **Art. 22a of the Federal Personnel Act** obliges them to report felonies and misdemeanours prosecuted *ex officio* that they observe in the course of their duties, to the prosecution authorities, their superiors or the **Swiss Federal Audit Office (SFAO)**. Paragraph 4 gives them the right to report other irregularities to the SFAO, which then establishes the facts and takes the necessary measures. Paragraph 5 provides that anyone who reports in good faith or testifies as a witness may not be disadvantaged in their professional position as a result. The SFAO operates [an external reporting platform at whistleblowing.admin.ch](https://www.efk.admin.ch/en/whistleblowing/), open to federal employees and to the public, covering the federal administration, affiliated organisations and subsidy recipients. A revision of 20 June 2025 rewrites Article 22a with effect from **1 January 2027**. The reporting duty then attaches to a reasonable suspicion connected with a federal task, and a new paragraph gives the reporter's privacy precedence over freedom-of-information requests. Article 22a covers employers under the Federal Personnel Act. Cantonal and communal employees fall under cantonal personnel law instead, which varies by canton. ## External reporting authority There is no general external whistleblowing authority for the Swiss private sector. Reporting runs through whichever supervisory body has jurisdiction over the subject matter: - [FINMA](https://www.finma.ch/en/finma-public/reporting-information/) for breaches of financial market law, through a secured external platform with voluntary disclosure of identity. - [The Swiss Federal Audit Office](https://www.efk.admin.ch/en/whistleblowing/) for the federal administration and bodies connected to it. - The prosecution authorities for criminal conduct. ## Data protection authority The competent authority is the [Federal Data Protection and Information Commissioner (FDPIC)](https://www.edoeb.admin.ch/en), under the [Federal Act on Data Protection of 25 September 2020](https://www.fedlex.admin.ch/eli/cc/2022/491/en), in force since 1 September 2023. ## Key compliance points - "No general Swiss obligation" is not the same as "no Swiss exposure". Article 102 para. 2 SCC attaches corporate liability to the absence of reasonable organisational measures, and a Swiss group's EU subsidiaries carry the Directive's obligations on their own account. - Who receives reports about the Swiss entity, and where, is a question under Art. 273 SCC. Handing them to an intake team or an authority abroad is the clearest risk; whether storage by a contracted processor abroad is caught has not been decided. Where reports are stored is also a disclosure duty: under Art. 19(4) FADP the privacy notice must name the state to which personal data is disclosed. The Federal Council recognises all EU and EEA states as providing adequate protection (Annex 1 to the Data Protection Ordinance), so EU hosting needs no further transfer safeguards, but it still has to be named. - A company in scope of the supply-chain ordinance needs a documented reporting procedure open to outside parties. A whistleblowing channel that accepts reports from suppliers and other third parties can serve as that procedure. - Nothing in Swiss law corresponds to the Directive's seven-day acknowledgment or three-month feedback deadlines. A group that applies those deadlines uniformly is above the Swiss floor, not below it. - A Swiss employee weighing whether to report is deciding between a duty of loyalty with criminal edges and a remedy capped at six months' salary if the employer dismisses them. Internal handling that visibly works is what changes that calculation. ## Official sources **Primary law** - [Code of Obligations (SR 220)](https://www.fedlex.admin.ch/eli/cc/27/317_321_377/en) - [Swiss Criminal Code (SR 311.0)](https://www.fedlex.admin.ch/eli/cc/54/757_781_799/en) - [Federal Personnel Act (SR 172.220.1)](https://www.fedlex.admin.ch/eli/cc/2001/123/de) - [Federal Act on Data Protection (SR 235.1)](https://www.fedlex.admin.ch/eli/cc/2022/491/en) - [Data Protection Ordinance (SR 235.11), Annex 1](https://www.fedlex.admin.ch/eli/cc/2022/568/en) - [Ordinance on Due Diligence and Transparency (SR 221.433)](https://www.fedlex.admin.ch/eli/cc/2021/847/de) **Parliament and authorities** - [Curia Vista 13.094 — Code of Obligations revision, closed 5 March 2020](https://www.parlament.ch/en/ratsbetrieb/suche-curia-vista/geschaeft?AffairId=20130094) - [Motion 23.3844 rejected by the National Council, 27 February 2024](https://www.parlament.ch/de/services/news/Seiten/2024/20240227115317950194158159038_bsd089.aspx) - [FINMA — making a report](https://www.finma.ch/en/finma-public/reporting-information/) - [Swiss Federal Audit Office — whistleblowing](https://www.efk.admin.ch/en/whistleblowing/) - [Federal Data Protection and Information Commissioner](https://www.edoeb.admin.ch/en) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/) --- # Whistleblower law in the United Kingdom — PIDA 1998 > The UK protected disclosure regime under Part IVA of the Employment Rights Act 1996: no general duty to operate an internal channel, the prescribed-persons route, and why Directive (EU) 2019/1937 does not apply. Canonical: https://ethicsportal.eu/whistleblower-laws/united-kingdom/ Last updated: 2026-09-21 The United Kingdom protects whistleblowers through **Part IVA of the Employment Rights Act 1996**, inserted by the **Public Interest Disclosure Act 1998 (PIDA)**. It is not a transposition of Directive (EU) 2019/1937 and predates it by two decades. The structural difference matters more than any point of detail: the Directive obliges the employer to operate a whistleblowing channel, while UK law imposes no such duty and instead gives the worker a remedy after the fact. ## Applicable law - [Employment Rights Act 1996, Part IVA — official text](https://www.legislation.gov.uk/ukpga/1996/18/part/IVA) - [Public Interest Disclosure Act 1998](https://www.legislation.gov.uk/ukpga/1998/23/contents) - [Economic Crime and Corporate Transparency Act 2023, s. 199](https://www.legislation.gov.uk/ukpga/2023/56/section/199) ## Does Directive (EU) 2019/1937 apply? No. The Directive binds member states, and the UK ceased to be one on 31 January 2020 — before the 17 December 2021 transposition deadline. No UK entity is in scope by virtue of being British. A UK group is still exposed through its subsidiaries. The Directive's 50-worker threshold applies **per legal entity**, not per corporate group, so a subsidiary established in a member state falls under that state's transposing law whatever the parent's nationality. See our [reading of the threshold](https://ethicsportal.eu/directive-interpretations/) and the [country-by-country obligations](https://ethicsportal.eu/whistleblower-laws/). ## Who must establish an internal channel **There is no general statutory duty to operate one.** A disclosure to the employer is one protected route among several (s. 43C ERA 1996), not an obligation the employer owes. Two regimes narrow that in practice. **Financial services.** [SYSC 18.3.1R](https://www.handbook.fca.org.uk/handbook/SYSC/18/3.html) of the FCA Handbook requires a firm to "establish, implement and maintain appropriate and effective arrangements for the disclosure of reportable concerns by whistleblowers". "Firm" is narrow here: UK SMCR banking firms other than small deposit takers, and Solvency II insurers. Those firms must also appoint a **whistleblowers' champion** (SYSC 18.4) and ensure settlement agreements state that workers may make protected disclosures (SYSC 18.5). SYSC 18.6 carries separate procedure obligations for UK MiFID investment firms other than collective portfolio management firms, and for third-country investment firms. **Large organisations, through fraud.** Since **1 September 2025**, [s. 199 of the Economic Crime and Corporate Transparency Act 2023](https://www.legislation.gov.uk/ukpga/2023/56/section/199) makes a large organisation criminally liable where an associated person commits a listed fraud offence intending to benefit it. A body is "large" if it met two of three conditions in the preceding financial year: turnover over £36 million, balance sheet total over £18 million, more than 250 employees ([s. 201](https://www.legislation.gov.uk/ukpga/2023/56/section/201)). The only defence is having had reasonable fraud prevention procedures in place, and the [statutory guidance](https://www.gov.uk/government/publications/offence-of-failure-to-prevent-fraud-introduced-by-eccta) states: "To help prevent fraud, organisations should have appropriate whistleblowing arrangements." That is the honest UK position. The obligation is not to have a channel; it is to be able to show reasonable procedures if an associate defrauds someone on the organisation's behalf — and a channel is how the government's own guidance says that is evidenced. ## What counts as a protected disclosure Under s. 43B a qualifying disclosure is a disclosure of information which, in the worker's reasonable belief, is made **in the public interest** and tends to show a criminal offence, a failure to comply with a legal obligation, a miscarriage of justice, danger to health or safety, **sexual harassment**, damage to the environment, or deliberate concealment of any of these. The public-interest test was added by the Enterprise and Regulatory Reform Act 2013; sexual harassment was added on 6 April 2026 by the Employment Rights Act 2025. Section 43B(2) is easy to miss and useful for multinationals: it is immaterial whether the wrongdoing occurred in the UK or elsewhere, and whether the applicable law is British or foreign. A UK worker's disclosure about conduct in an overseas group company can be protected. ## External reporting: prescribed persons The UK has no single whistleblowing authority. Under **s. 43F** a worker may disclose to a **prescribed person** — a body named in an order made by the Secretary of State — provided the worker reasonably believes the matter falls within the description for which that person is prescribed and that the information is substantially true. The [list of prescribed people and bodies](https://www.gov.uk/government/publications/blowing-the-whistle-list-of-prescribed-people-and-bodies) records which kind of wrongdoing each body covers. Section 43FA lets the Secretary of State require prescribed persons to report annually on the disclosures they receive. Nothing requires a worker to raise the matter internally first. Wider disclosure — to the press or the public — is a different matter: under s. 43G it is protected only where the worker reasonably believes the information is substantially true, does not act for personal gain, meets one of the statutory gateways, and where disclosure is reasonable in all the circumstances. Section 43H relaxes the gateways for failures of an exceptionally serious nature. Section 43G(3)(f) gives employers a concrete reason to run a channel: in judging whether a wider disclosure was reasonable, a tribunal has regard to whether the worker used a procedure authorised by the employer. Where no such procedure exists, that factor cannot count in the employer's favour. ## Protection and remedies - **Detriment (s. 47B).** A worker has the right not to be subjected to detriment for making a protected disclosure. Since 2013 this covers detriment by co-workers and agents, with the employer treated as also having done it and an "all reasonable steps" defence available. - **Dismissal (s. 103A).** Dismissal is automatically unfair where the reason, or principal reason, is that the employee made a protected disclosure. The two-year qualifying period does not apply (s. 108(3)(ff)). - **Uncapped compensation (s. 124(1A)).** The statutory cap on the compensatory award does not apply to s. 103A dismissals. - **Confidentiality clauses (s. 43J).** Any agreement is void so far as it purports to preclude a protected disclosure. Section 202A, inserted by the Employment Rights Act 2025 and commenced for specified purposes on 6 January 2026, extends that voiding to clauses covering allegations of harassment and discrimination. ## Data protection authority For complaints about the handling of personal data in a reporting process, the competent authority is the [Information Commissioner's Office](https://ico.org.uk/make-a-complaint/), under the UK GDPR and the Data Protection Act 2018. ## Key compliance points - Northern Ireland runs a parallel regime under the [Employment Rights (Northern Ireland) Order 1996](https://www.legislation.gov.uk/nisi/1996/1919/contents). The FCA Handbook reads its own references to the Employment Rights Act 1996 as including the corresponding Northern Ireland provisions (SYSC 18.1.1B). - A UK-shaped policy does not satisfy the Directive anywhere in the EU. It has no acknowledgment or feedback deadlines, no designated channel duty, and no equivalent of the Directive's designated external authority. - The two-year qualifying period and the compensation cap both fall away in whistleblowing dismissals, which makes a badly handled report unusually expensive compared with an ordinary unfair-dismissal claim. - Internal procedures should say which prescribed person covers which subject, rather than pointing at "the regulator" in general — the s. 43F protection depends on the worker picking the right one. ## Official sources **Primary law** - [Employment Rights Act 1996, Part IVA](https://www.legislation.gov.uk/ukpga/1996/18/part/IVA) - [Public Interest Disclosure Act 1998](https://www.legislation.gov.uk/ukpga/1998/23/contents) - [Employment Rights (Northern Ireland) Order 1996](https://www.legislation.gov.uk/nisi/1996/1919/contents) - [Economic Crime and Corporate Transparency Act 2023, ss. 199 and 201](https://www.legislation.gov.uk/ukpga/2023/56/section/199) **Government and regulator guidance** - [Whistleblowing: list of prescribed people and bodies](https://www.gov.uk/government/publications/blowing-the-whistle-list-of-prescribed-people-and-bodies) - [Whistleblowing: guidance and code of practice for employers](https://www.gov.uk/government/publications/whistleblowing-guidance-and-code-of-practice-for-employers) - [Statutory guidance on the failure to prevent fraud offence](https://www.gov.uk/government/publications/offence-of-failure-to-prevent-fraud-introduced-by-eccta) - [FCA Handbook, SYSC 18 — whistleblowing](https://www.handbook.fca.org.uk/handbook/SYSC/18/) - [Information Commissioner's Office — make a complaint](https://ico.org.uk/make-a-complaint/) --- [Deploy your whistleblowing channel →](https://ethicsportal.eu/pricing/)