Challenge
An internal whistleblowing program has to protect reporter anonymity while reliably preserving the records of intake, investigation, and response. With operations centered on spreadsheets and email, it's hard to track who viewed which report, and the risk of information leakage remains. What was needed was a dedicated foundation built on the premise of privilege separation and access logging.
Approach
- 01 Designed the reporting form so it can be submitted anonymously, with contact details as optional input only when needed
- 02 Stored report data with identifying information separated from the body, and controlled viewing privileges by role
- 03 Managed the intake, investigation, response, and completion statuses and recorded the response history in chronological order
- 04 Kept every action, including viewing and downloading, in the access log so it can be traced
- 05 Set up an operational structure with Sentry error monitoring to prevent reports from slipping through
Key success factors
- Balancing anonymity and traceability
- By separating reporter information from the body of the report, we protect anonymity while reliably preserving the response history.
- Privilege separation
- Role-based permission management narrows each handler's viewable scope to the minimum.
Solution
We built the reporting intake form, the handlers' admin panel, and the storage of response records as a single system. Reporter-identifying information and the body of the report are held separately, and every viewing and response action is recorded in the access log. Role-based permission management narrows each handler's viewable scope to the minimum.
Facing a similar challenge?
Whatever your industry or scale, let's start with a conversation.
Contact form
