Where is whistleblowing data stored? Encryption, location and retention
This page is not legal advice.
Reports can contain some of the most sensitive information an organisation ever holds. This guide explains what a channel stores and what to ask before choosing one. It is general information, not legal advice.
What a channel stores
The report text, attachments and the conversation with the reporter; case data such as status, category and deadlines; and technical records such as logs. Good channels keep the last group small: no IP addresses or browser fingerprints for anonymous reporters, and no hidden metadata in attachments, such as a photo’s location.
Two kinds of encryption
- Provider-held: data is encrypted on the provider’s servers, but the provider holds the keys and can technically read it.
- Customer-held (end-to-end): the report is encrypted in the reporter’s browser and only the organisation’s staff hold the keys. The provider and its subcontractors store ciphertext they cannot read.
Location still matters for law and contracts, but with customer-held encryption a copy of the data is useless without the organisation’s keys.
Questions to ask a vendor
- Who can read report contents: only our handlers, or also your staff?
- Which subcontractors process data, where, and with what safeguards for transfers outside the EU/EEA?
- What do you store about anonymous reporters: IP addresses, browser data, attachment metadata?
- How are reports erased after the retention period, including backups?
- Who can access the system, and is every action logged?
The five-year rule
Section 29 of Act 1171/2022: report data is erased five years after receipt unless further retention is necessary for statutory rights or obligations or legal claims. Clearly irrelevant personal data is erased without undue delay.
In Ilmoo, organisations can turn on customer-held encryption, anonymous reports store no IP address, attachment metadata is removed in the browser, and automatic deletion after the retention period is an opt-in setting. Every service provider is listed on our service-provider page.
Service providers and data transfers