Speak Up
Anonymous and confidential whistleblowing channel with a designated adviser panel, statutory acknowledgement and feedback clocks, and an auditor-ready register.
MangoApps
Overview
Speak Up is a protected-disclosure channel built for the EU Whistleblowing Directive (2019/1937) and its national transpositions: anonymous or confidential intake open to employees and — through a public portal on your tenant's own domain — to ex-employees, contractors, suppliers, and applicants.
Reports go only to a designated adviser panel you choose. Business admins configure the channel but can never read cases — the plausible subject of a disclosure is an admin, so the usual admin-sees-everything rule is deliberately inverted. An anonymous reporter keeps a one-time reference code that opens a two-way thread: the panel asks follow-up questions, the reporter answers, and no identity is ever stored.
Statutory clocks run automatically — acknowledgement within 7 days, feedback within 3 months (both configurable) — with panel alerts on breach. Closing a case starts the retention clock; past it, content is purged while the minimal register row an auditor needs is kept. Psychosocial cases can be referred into Safety Hub as incidents with nothing identifying carried across.
Highlights
Capabilities
Intake & Anonymity
-
Anonymous, confidential, or open reporting modes (tenant-configurable)
-
Anonymous mode stores no reporter identity — ever
-
Public portal intake for ex-employees, contractors, suppliers, and applicants (Directive Art. 4)
-
One-time reference code (12-character, unambiguous alphabet) as the reporter's only credential
-
Mobile reporting surface — submit and follow up from a phone
Adviser Panel & Access Segregation
-
Designated adviser panel — the only people who can read cases
-
Business admins configure the channel but can never read cases
-
Per-case grants to bring an investigator into one case (with expiry + audit trail)
-
Grants are revocable at any time and every change is audited
-
Every read of a case body is recorded in an append-only audit trail
Statutory Clocks & Dialogue
-
Acknowledgement clock (default 7 days, Art. 9(1)(b)) with panel breach alerts
-
Feedback clock (default 3 months, Art. 9(1)(f)) with panel breach alerts
-
Two-way anonymous dialogue — panel asks follow-ups, reporter answers via the reference code
-
Retaliation flagging (Art. 19) with a 30-day follow-up cadence until the case closes
Register, Retention & Integration
-
Auditor-ready register (Art. 18) with step-up-verified CSV export
-
Retention purge — content cleared after the configured period, register row kept
-
Refer a case into Safety Hub as an anonymous incident with nothing identifying carried across
-
Referred cases feed the same corrective & preventive action (CAPA) register as physical incidents
-
Notifications carry category + reference only — never the report body
Limits & Specs
-
Reference code format: 12 characters, unambiguous alphabet (no 0/O/1/I/L)
-
Acknowledgement window: 7 days default, configurable 1–30
-
Feedback window: 90 days default, configurable 7–180
-
Retention after closure: 60 months default, configurable 1–240
-
Reporting modes: Anonymous, confidential, open (tenant-configurable)
-
Public intake rate limit: 5 submissions per hour per IP
-
Pricing: License required (opt-in per tenant); included in the Safety & Compliance Pack, also sold standalone per operational seat
Use cases
FAQ
No. Only members of the designated adviser panel (and people they explicitly grant into a specific case) can open a case. Business admins configure the channel — the panel, the clocks, retention — but case content is never visible to them. Every read of a case body is itself logged.
Yes. In anonymous mode no user reference is stored on the case, replies carry no identity, and the reporter's only credential is a one-time reference code shown once at submission. The code travels in form posts, never URLs, and looking up a wrong code is indistinguishable from looking up a right one.
Speak Up implements the Directive's operative mechanics — acknowledgement within 7 days, feedback within 3 months, intake beyond current employees, a retained register, and retaliation flagging. National transpositions differ; confirm your configuration (especially retention) with counsel.
Surveys' anonymous feedback is a pulse channel — workload, communication, culture — read by HR with no legal clock. Speak Up is for protected disclosures: wrongdoing, harassment, retaliation. It has a designated panel, statutory deadlines, a register, and retention rules. If it could end up in front of a regulator, it belongs in Speak Up.
