The reporting channel your employees actually trust.
Anonymous, end-to-end encrypted and live in 15 minutes. No IT project, no server, no legal exposure.
No credit card · Cancel anytime · Hosted in Germany
- Statutory compliance
- AES-256-GCM
- Anonymous follow-up
HBX-7F3A-9K2D
- Received
- 12 Mar 2026
- Category
- Corruption
A supplier paid for two trips for one of our buyers. I have attached the receipts.
Thank you. We are reviewing this. In what period did those trips take place?
No identity, no IP address stored
Legal framework
up to€20,000
for companies that fail to establish and operate an internal reporting office.
- Whistleblower Act § 12
- An internal reporting channel is mandatory from 50 employees
- EU 2019/1937
- The EU whistleblowing directive fully covered
- GDPR Art. 32
- Encryption and access control documented
Two screens. A reporting channel needs no more than that.
On the left is what your employees see — no login, no app, no name required. On the right your case team works: deadlines, status, anonymous return channel.
From legal obligation to a working channel — in a single morning.
No project, no vendor, no round of approvals. Three steps one person completes alone — after that the channel runs.
- 1
Create the channel
Enter your company name, confirm categories and deadlines. No server, no IT involvement.
15 minutes - 2
Distribute link and QR code
Publish your branded reporting link on a notice board, the intranet or by email.
Notice board · intranet - 3
Handle reports
Prioritise cases in the dashboard, ask questions anonymously, meet every deadline on record.
Deadlines: 7 / 90 days
What the statute requires — and where Hinweisbox covers it.
From the reporting channel to the deletion deadline: Hinweisbox technically covers all 10 requirements in this overview.
- Internal reporting office§ 12 Abs. 1
- Reports in writing§ 16 Abs. 3
- Oral reports§ 16 Abs. 3
- Anonymous reports§ 16
- Confidentiality§ 8
- Acknowledgement in 7 days§ 17 Abs. 1
- Feedback in 3 months§ 17 Abs. 2
- Documentation§ 11 Abs. 5
- Oral report protocol§ 11 Abs. 2 bis 4
- Retaliation ban§ 36
How Hinweisbox implements each duty
- § 12 Abs. 1Establish and operate an internal reporting office — mandatory from 50 employees
- A branded reporting channel, set up in about 15 minutes. No server, no IT project.
- § 16 Abs. 3Allow reports in written form
- An encrypted form reachable by link and QR code — no login, no app.
- § 16 Abs. 3Enable oral reports
- Voice message inside the reporting channel, up to six minutes, only with explicit consent — with a distorted voice on request.
- § 16Anonymous reports received should be processed
- Anonymity is the default. The access code still keeps a two-way dialogue open.
- § 8Protect the confidentiality of identities — including people named in a report
- The system never collects an identity. Access only for named case handlers, every access logged.
- § 17 Abs. 1Acknowledge receipt within seven days
- Automatic acknowledgement to the access code, plus a reminder to the case team before the deadline.
- § 17 Abs. 2Give feedback within three months
- A deadline clock per case, a reminder before it expires, documented feedback to the whistleblower.
- § 11 Abs. 5Document the case; delete three years after it closes
- Complete case documentation with timestamps. Retention period configurable per account.
- § 11 Abs. 2 bis 4Document the oral report and have it confirmed
- The case team writes a transcript or summary; the whistleblower checks and confirms it via the access code. Only then can the recording be deleted.
- § 36Retaliation ban — in a dispute the employer carries the burden of proof
- Timestamps and the access log show who knew what, when, and when it was acted on.
As of August 2026. Source: the German Whistleblower Protection Act, official text on gesetze-im-internet.de. This overview is not legal advice.
Everything the law requires — and nothing that costs you trust.
What employees see
- Ready to post
Reporting link and QR code
One branded link per company, as a QR code for notice boards and onboarding packs.
- No identity data
Real anonymity
The system never asks for a name and never stores an IP address. Anonymity is the default, not an option.
- Two-way communication
Anonymous follow-up
The access code keeps the conversation open — even though nobody knows who reported.
What the case team gets
- 7 / 90 days by statute
Deadlines on autopilot
Acknowledgement within 7 days, feedback within 3 months — the system reminds you and keeps the record.
- Access log
Roles and confidentiality
Only named case handlers can see reports. Every access is logged.
- Retention period configurable
Evidence on demand
Case file and deadline history as an export — for an audit, an auditor or a regulator.
Anonymity is not a promise. It is an architecture.
A reporting channel is worth exactly as much fear as it removes. That is why Hinweisbox cannot disclose a whistleblower’s identity — not under order, and not by accident. The data simply does not exist.
What we do store- The encrypted report text and its attachments
- encrypted
- Timestamps for the statutory deadlines
- timestamp
- The access code as a hash — not even we can reverse it
- hash
AES-256-GCM encryption, hosted in Germany, processed under GDPR Art. 32.
Disclosure request
| Requested | Held by Hinweisbox |
|---|---|
| Whistleblower's name | not held |
| Email address | not held |
| IP address | not held |
| Device identifier | not held |
| Location, browser fingerprint | not held |
| Report text and attachments | encrypted (AES-256-GCM), unreadable without the case key |
| Timestamps | 12.03.2026, 09:14 · § 17 deadlines |
| Access code | one-way hash only: 5e88…a1c7 |
One price per company. Not per report, not per user.
Starter
For companies from 50 employees
39€/ month
up to 249 employees · plus VAT
yearly 390 € — 2 months free
- One branded reporting channel
- Anonymous reports and follow-up questions
- Statutory deadline tracking
- Reporting link and QR code
Professional
For growing compliance teams
89€/ month
up to 999 employees · plus VAT
yearly 890 € — 2 months free
- Everything in Starter, plus
- Roles, permissions and access log
- Case-file export for audits
Enterprise
For groups and external ombudspersons
Custom
from 1,000 employees · on request
- Everything in Professional, plus
- SSO and multi-entity management
- Individual data-processing agreement
- Named contact person and SLA
All plans: 14 days free, no credit card, cancel anytime. Hosted in Germany.
What compliance leads ask us most often.
Are we legally required to run a reporting channel?
Yes, if your company has 50 or more employees. The German Whistleblower Protection Act has required an internal reporting office since 2 July 2023; for companies with 50 to 249 employees the transition period ended on 17 December 2023. Without one, § 40 provides for a fine of up to €20,000.
Is a report through Hinweisbox genuinely anonymous?
Yes. The form never asks for a name, and the system stores neither IP address nor device identifier. The whistleblower receives only an access code. Without that code there is no link between person and report — not even for us.
How long does setup take?
About 15 minutes. You define your company name, categories and case handlers, and immediately receive your reporting link and QR code. No software installation and no involvement from your IT team.
Which deadlines does the law impose?
Receipt of a report must be acknowledged within seven days, and feedback on follow-up action given within three months. Hinweisbox starts both clocks automatically, reminds the case team and documents compliance.
Where is the data stored?
Exclusively in German data centres. Reports and attachments are stored AES-256-GCM encrypted and processed under GDPR Art. 32. A data processing agreement is provided.
What does Hinweisbox cost?
The price is per company per month and depends on your headcount — not on how many reports arrive. The current tiers are on the pricing page. Setting up and testing is free and requires no credit card; you pay only when you make the channel available to your employees.
Can we run the channel for clients as a law firm or ombudsperson?
Yes. The Enterprise plan lets you manage several clients under separate reporting channels with their own links, categories and case handlers. Cases stay strictly separated.
What happens after the 14-day trial?
During the trial your reporting channel runs in test mode: you configure categories, deadlines and case handlers and walk through the whole process — the reporting link simply is not reachable for your employees yet. Payment starts when you go live. If you never go live, the account stays readable and nothing is charged.
Compliant in 15 minutes. Then never think about it again.
Set up your reporting channel now and try it free for 14 days — with real reports, no commitment.
No credit card · Cancel anytime · Hosted in Germany
Setup complete
- Create account2 min
- Configure reporting channel10 min
- Inform employees3 min