Whistleblowing White-label
A channel that protects whoever reports, and withstands scrutiny from a supervisory authority.
Legislative Decree 24/2023 requires public bodies and companies to run an internal channel that keeps the identity of whoever reports confidential, encryption tools included. We design, deploy, brand and maintain that channel: under your own name, on your own domain, on our infrastructure or on yours. Reports are read solely by the handler you appoint.
Who the obligation applies to
The fifty-employee threshold is not the only test — the decree reaches well beyond large companies.
Public sector entities
Administrations, public economic bodies, publicly controlled companies and concessionaires of public services: here the obligation does not depend on size at all.
Companies with more than fifty employees
Anyone who employed, over the last year, an average of more than fifty salaried workers on fixed-term or open-ended contracts. It is an average across the year, not a headcount taken today.
Entities in regulated sectors
Financial services, anti-money-laundering, transport safety and environmental protection: for entities covered by the EU acts listed in the annex to the decree, the obligation applies whatever the headcount.
Anyone with a 231 model
Companies that have adopted an organisational and management model under Legislative Decree 231/2001 must run the internal channel even if they stay below fifty employees. This is the case most often overlooked.
The provisions have applied since 15 July 2023; for private entities that employed an average of up to 249 workers over the last year, the internal channel became mandatory on 17 December 2023. ANAC imposes administrative fines of €10,000 to €50,000 where — among other things — no channel has been set up, the procedures adopted do not comply with the decree, reports received are never examined, or there has been retaliation or a breach of confidentiality.
From the text of the decree to the configuration of the channel
Every technical requirement in the decree maps to a function we can show you in a demo and document in an audit.
Requirements of the decree
- Confidentiality of the identity of the reporter, of the person concerned and of anyone mentioned, as well as of the content of the report and the documents attached — encryption tools included
- Reports in writing, including by electronic means, and orally
- At the reporter's request, a face-to-face meeting within a reasonable time
- Acknowledgement of receipt within seven days
- Diligent follow-up and feedback within three months
- Access to reports restricted to authorised staff
- Retention for as long as necessary and in any case no longer than five years from communicating the final outcome
- A data protection impact assessment covering the handling of reports
Platform response
- Reports and attachments encrypted in transit and at rest, readable only by the designated handlers
- A web form in your own language with the fields you need; for oral reports the handler minutes them and attaches the transcript, which the reporter can verify and sign
- A request for a meeting stays on the case file, with the date and outcome recorded
- The platform computes the seven-day and three-month deadlines and flags them as they approach
- Separated roles: whoever administers the system has no access to the content of reports
- Every action on a case lands in a tamper-evident log
- Retention policies set to the period you have defined, with secure deletion when it expires
- Technical documentation of the measures in place, ready to attach to your impact assessment
No supplier makes you compliant on its own: the decree also asks for a procedure that has been adopted and published, a designated and trained handler, and — for anyone with a 231 model — alignment with that model. The platform covers the technical part, and covers it in a way you can demonstrate.
Process from reporting to archiving
Six steps, each one leaving a documented trace and a deadline to meet.
Receiving the report
From your own domain, in Italian or in English, from the reporter's browser. Anyone who wants to stay anonymous reaches the channel over Tor, through an .onion address: no IP address is recorded at all.
Issuing the receipt with a unique code
Once the report is sent, the platform issues a unique code. It is the proof of filing and the only key back into the case: it points to no identity, and we keep no copy of it.
Acknowledgement within seven days
The designated handler is notified and confirms receipt within the statutory deadline. The platform computes the due date and gives notice before it is reached.
Investigation and dialogue with the reporter
The handler asks for clarifications and documents through the channel itself. The reporter comes back in with their code and answers without revealing who they are: the exchange continues throughout the investigation.
Feedback within three months
The outcome is communicated to the reporter within three months of the acknowledgement. The reasoning, the documents and the messages stay attached to the case, in the order they happened.
Closure and time-limited retention
Communicating the outcome starts the retention period you have defined, and in any case no longer than five years. When it expires the data is securely deleted, and the deletion itself is logged.
Protecting the reporter's identity
Anyone who fears retaliation assesses the channel within seconds. If they do not trust it the report never arrives, and the problem stays inside the organisation.
Technical anonymity
The channel is also reachable as a Tor service: the traffic does not expose the reporter's IP address, and there is nothing in the logs to disclose. Anonymity is an option, not a requirement — anyone who would rather identify themselves is still covered by confidentiality.
Pseudonymisation
A case lives under an identifier, not under a name. Where there is an identity, it stays separate from the content of the report and visible only to those authorised to know it.
Encryption and authentication
Reports and attachments are encrypted in transit and at rest. Handlers connect over TLS with multi-factor authentication: a stolen password on its own opens no case.
Separation of access
Only the handlers you designate see reports, and only the ones that fall to them. Technical administration of the platform is a separate role, and reading the content is not part of it.
Deletion at the end of the retention period
The decree sets a limit on retention, not a permanent archive. When the period you defined expires, the data is securely deleted and the deletion is evidenced.
Continuity of the channel
Updates and cyclical remediation of known vulnerabilities, anomalous-traffic mitigation and load balancing against attempts to saturate the service, verified backups. The availability target is defined per service tier in the contract.
Under your brand, on your domain
People trust a channel they recognise. At that moment, an address pointing to a third-party supplier undermines that trust.
Full customisation
Your logo, your colours, your domain — reports.yourdomain.com, for instance. Wording in Italian and English, and the information page to publish on your site as the decree requires.
Deployment options
On our infrastructure, spread across two data centres, or installed on your own premises if your policies call for it. Either way the maintenance stays with us.
Corporate groups
Each company in the group has its own channel, its own handlers and its own retention policy, on a single installation. One company's reports are not visible to the others.
Professional firms and consultants
If you advise companies on 231 and compliance, the channel can carry your own brand and become part of what you sell: we stay the technical supplier, and the client relationship stays yours.
How responsibilities are divided
The decree allows the channel to be entrusted to an external party, provided it is autonomous and its staff are trained. We handle the technical part: assessing the substance rests with whoever you appoint.
Your responsibilities
- Designating the person who handles reports: an individual, a dedicated autonomous office, or the supervisory body
- Adopting the internal procedure and publishing it in a dedicated section of your site
- Assessing reports on the merits, running the investigation and deciding the outcomes
- Informing and training staff, and aligning the channel with your 231 model if you have one
- The data protection impact assessment, which is yours to make as controller
Our responsibilities
- Designing, deploying and customising the channel, with your brand and your wording
- Hardening the configuration, updates and cyclical remediation of known vulnerabilities
- Backups, restore tests and monitoring that the channel is up
- The technical side of deadlines, reminders and the operations log
- Supporting your handlers on using the platform and on retention policies
- Acting as data processor under art. 28 GDPR, on your appointment, with technical documentation of the measures in place
Who it is for
The channel is the same one; what changes is the handlers, the form fields and the retention periods.
Healthcare providers
Here a report can touch on patient safety, not just an administrative irregularity. The channel has to be built so that staff use it with confidence, otherwise it remains a formality.
Public bodies and state-owned companies
Obliged with no threshold and used to being held to account: the channel sits alongside the anti-corruption and transparency officer, and produces evidence ready for inspection.
Banks, insurers and AML-regulated entities
Sectors where the internal channel operates alongside reporting duties and controls that supervisory regulation already imposes. Separation of roles and traceability of actions are exactly where an inspection concentrates.
Companies with a 231 model
The channel has to be referenced in the model and coordinated with the supervisory body, which is often the natural handler for reports. Here no size threshold can be invoked to postpone the obligation.
Limits of the service
Four points we would rather put in writing while you are still evaluating.
We do not read your reports
The platform is configured so that content is accessible only to the handlers you designate: administering the system is a role kept separate from reading cases. If you need an external handler, that is a role to identify together with your adviser or your supervisory body.
Technical anonymity does not cover the content
We protect the metadata: IP address, session, timestamps. If the text of a report contains details that make its author recognisable, no technology can hide them. The form warns the reporter of this before submission.
It is not legal advice
We do not draft your procedure, appoint your handler or judge whether a report is well founded. We work alongside your adviser or your supervisory body, whose decisions those are.
It does not replace the external channel or a formal complaint
In the cases the decree sets out, a reporter may go to ANAC or, under certain conditions, disclose publicly. An internal channel that works makes that route less likely, but it does not close it — and it does not displace any duty to report to the authorities.
Next steps
The channel is usually live in about three weeks: configuration, branding, testing with your handlers and handover of the credentials. After that it is an annual fee that includes maintenance. If you would like to see it before deciding, we will set up a test channel with your own wording.