Compliance

OpenWhistle gives an organisation the internal reporting channel the law asks for. This page says what the software covers and what stays with you. It is not legal advice.

One core, one profile per law

ISO 37002 is the international guideline for whistleblowing management systems. Its process has four steps: receive a report, assess it, address it, and conclude the case. OpenWhistle's core follows that process; a law adds its own deadlines and duties on top.

What OpenWhistle covers

Duty How Shown in
A secure written channel A web form on your own server. Whistleblower guide
Anonymous and confidential reports The reporter chooses; no IP address is stored. Anonymity layers
The 7-day and 3-month deadlines On the dashboard, the case and the reporter's status page. Deadline tracking
Records of every report Every report and message is stored, encrypted; PDF export. Managing reports
Records of every admin action An immutable audit log. Audit log
Deletion Closed reports are deleted after three years by default. Data retention
Who sees a case A case manager sees only the cases assigned to them. Roles

What stays with you

  • Legal advice. Have counsel check what your organisation owes.
  • The external channel. Reporters may go to the authorities directly, without reporting internally first. You publish clear, easy-to-find information on how.
  • The people. You appoint impartial, competent people to handle reports.
  • Your process. You take the follow-up action and protect the reporter from retaliation.

By jurisdiction