Speak Up
Anonymous and confidential whistleblowing channel with a designated adviser panel, statutory acknowledgement and feedback clocks, and an auditor-ready register.
MangoApps
Overview
Speak Up is a protected-disclosure channel built for the EU Whistleblowing Directive (2019/1937) and its national transpositions: anonymous or confidential intake open to employees and — through a public portal on your tenant's own domain — to ex-employees, contractors, suppliers, and applicants.
Reports go to a designated adviser panel you choose. Business admins configure the channel and no administrator screen opens a case — the plausible subject of a disclosure is an admin, so the usual admin-sees-everything rule is deliberately inverted. Case access comes from panel membership or an audited per-case grant, and every grant and every read of a case body is recorded. An anonymous reporter keeps a one-time reference code that opens a two-way thread: the panel asks follow-up questions, the reporter answers, and no identity is ever stored.
Statutory clocks run automatically — acknowledgement within 7 days, feedback within 3 months (both configurable) — with panel alerts on breach. Closing a case starts the retention clock; past it, content is purged while the minimal register row an auditor needs is kept. Psychosocial cases can be referred into Safety Hub as incidents with nothing identifying carried across.
Highlights
Capabilities
Intake & Anonymity
-
Anonymous, confidential, or open reporting modes (tenant-configurable)
-
Anonymous mode stores no reporter identity — ever
-
Public portal intake for ex-employees, contractors, suppliers, and applicants (Directive Art. 4)
-
One-time reference code (12-character, unambiguous alphabet) as the reporter's only credential
-
Mobile reporting surface — submit and follow up from a phone
-
The public portal runs on your own tenant web address and carries your branding
-
Evidence attached to a case by the panel, on open cases only
-
Attachments stripped of location, capture time and device before storage
-
The EXIF strip is not a tenant setting and cannot be switched off
Adviser Panel & Access Segregation
-
Designated adviser panel — case access comes from panel membership, not from any platform role
-
No administrator screen opens a case — the admin role configures the channel and grants no case access
-
Per-case grants to bring an investigator into one case (with expiry + audit trail)
-
Grants are revocable at any time and every change is audited
-
Every read of a case body is recorded in an append-only audit trail
Statutory Clocks & Dialogue
-
Acknowledgement clock (default 7 days, Art. 9(1)(b)) with panel breach alerts
-
Feedback clock (default 3 months, Art. 9(1)(f)) with panel breach alerts
-
Two-way anonymous dialogue — panel asks follow-ups, reporter answers via the reference code
-
Retaliation flagging (Art. 19) with a 30-day follow-up cadence until the case closes
Case Handling
-
Nine report categories, from harassment and discrimination to fraud, data protection and environmental
-
A case moves new, acknowledged, investigating, then closed or referred
-
Closing requires a reason — substantiated, unsubstantiated, insufficient information, withdrawn, referred externally or duplicate
-
Named reporters follow their own reports in-app without going through the code lookup
-
A reporter holding a reference code keeps thread access even if the tenant later clears its panel
-
Breach alerts fire once per breach, and only record as sent when one actually went out
Register, Retention & Integration
-
Auditor-ready register (Art. 18) with step-up-verified CSV export
-
Retention purge — content cleared after the configured period, register row kept
-
Refer a case into Safety Hub as an anonymous incident with nothing identifying carried across
-
Referred cases feed the same corrective & preventive action (CAPA) register as physical incidents
-
Notifications carry category + reference only — never the report body
-
Step-up verification on register export is on by default and can be required by policy
-
Creating a Safety Hub incident on referral is a tenant setting, on by default
Limits & Specs
-
Reference code format: 12 characters, unambiguous alphabet (no 0/O/1/I/L)
-
Acknowledgement window: 7 days — Directive 2019/1937 Art. 9(1)(b) ceiling, enforced; configurable lower
-
Feedback window: 90 days — Directive 2019/1937 Art. 9(1)(f) ceiling, enforced; configurable lower
-
Retention after closure: 60 months default, configurable 1–240
-
Reporting modes: Anonymous, confidential, open (tenant-configurable)
-
Public intake rate limit: 15 submissions per hour per IP
-
Pricing: $22 per operational seat / month — included in the Safety & Compliance Pack, or licensed standalone
Use cases
FAQ
Not through any administrator screen. Only members of the designated adviser panel — and people they explicitly grant into a specific case — can open a case; business admins configure the channel and case content is never visible to them, and every read of a case body is logged. The honest caveat: designating the adviser panel is itself an administrator setting, so an administrator who puts themselves on the panel becomes an adviser. That choice is recorded in the audit log with the person who made it, and the panel is the smallest group your organisation designates — the control is accountability, not impossibility.
Yes. In anonymous mode no user reference is stored on the case, replies carry no identity, and the reporter's only credential is a one-time reference code shown once at submission. The code travels in form posts, never URLs, and looking up a wrong code is indistinguishable from looking up a right one.
Speak Up implements the Directive's operative mechanics — acknowledgement within 7 days, feedback within 3 months, intake beyond current employees, a retained register, and retaliation flagging. National transpositions differ; confirm your configuration (especially retention) with counsel.
Surveys' anonymous feedback is a pulse channel — workload, communication, culture — read by HR with no legal clock. Speak Up is for protected disclosures: wrongdoing, harassment, retaliation. It has a designated panel, statutory deadlines, a register, and retention rules. If it could end up in front of a regulator, it belongs in Speak Up.
An automatic purge clears the report body, the message thread and any evidence, while keeping the minimal register row — reference, category, dates, status, outcome. Deleting the row would destroy the Article 18 register; keeping the content would breach retention. Sixty months is the default; confirm the right value for your jurisdictions with counsel.
Yes, through a per-case grant — an investigator or specialist gets access to that single case, never the case list. Grants carry an expiry, are revocable at any moment, and every grant, revocation and case-body read lands in an append-only audit trail.
If they filed confidentially or openly while signed in, yes — their reports appear in-app under My Reports. Anonymous reporters and anyone reporting through the public portal use the twelve-character reference code instead, which is the only credential that exists for those disclosures.
Panel members. Step-up verification is ON by default — opening the register or exporting it re-authenticates the panel member at that moment rather than trusting an old session — and a tenant can switch it off by policy. Both the screen and the export are treated as sensitive actions, because each page of the register lists reference codes and the register is the one artefact that outlives the case content.
