For compliance & ethics teams
A whistleblower form where even the platform can’t unmask the reporter
Give people a reporting channel that is anonymous by construction — the report is encrypted in the browser, only your ethics team holds the key, and any optional contact details are encrypted alongside it.
Orion Group — Ethics & Compliance
Confidential concern report
Category of concern
Fraud, safety, harassment, conflict of interest, other
What happened
encryptedDescribe the conduct in your own words
When and where it happened
encryptedPeople and departments involved
encryptedSupporting evidence
encryptedOptional upload
Do you want the ethics team to be able to reach you?
Optional — leave blank to stay fully anonymous
Contact method, if you chose to share one
encryptedFields marked are encrypted in the browser before this form is sent.
The problem this solves
A whistleblower channel only works if people believe it. Web forms that promise anonymity but run on infrastructure the vendor can read — with IP logs, plaintext storage, and email notifications — do not earn that belief.
The failure mode is not hypothetical: a reporter who is identified and retaliated against is both a compliance failure and, in many jurisdictions, a legal one.
Why the encryption matters here
The whole report is encrypted in the reporter’s browser with RSA-3072 and AES-256 before it is sent. The key is generated client-side and never reaches VerifID, so the platform stores an unreadable blob and cannot identify who filed it.
If the reporter chooses to share a contact method, that field is encrypted in the same submission — visible only to your ethics team, not to VerifID and not to anyone who breached VerifID.
Whistleblower protection: Use the free checklist to make sure the report captures what an investigation will actually need. Read more →
How it works
- 1
Publish the channel
Brand the form for your ethics office, set the concern categories, and link it from your intranet and code of conduct.
- 2
Receive reports
Submissions arrive as ciphertext. There is no reporter identity for anyone — including VerifID — to leak.
- 3
Investigate with your key
Your ethics team decrypts to review the report and follows up through the contact method only if the reporter provided one.
Frequently asked questions
How is this genuinely anonymous and not just "we promise not to look"? ▾
The encryption key is generated in the reporter’s browser and never sent to VerifID. The platform physically cannot read a report or associate it with a person, so anonymity does not depend on a policy — it is a property of the architecture.
Can a reporter still choose to be contactable? ▾
Yes. The form includes an optional contact field. If the reporter fills it in, it is encrypted in the same submission and visible only to your ethics team.
Does the form log IP addresses or device information? ▾
The submission payload your team receives contains only what the reporter entered, encrypted. Confirm your own hosting and network logging separately, but the form itself is not building a profile of the reporter.
Who on our side can open reports? ▾
Only the people who hold the decryption key. Restrict it to your ethics or compliance leads, and every decryption is logged.
Build this form for your organisation
Start on the free plan, add your branding, and publish an encrypted version in minutes.