Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law (commonly referred to as the “Whistleblower Protection Directive”), is an EU regulation that became effective on 16 December 2019. EU Member States have until 17 December 2021 to implement its principles into their national legal order.
The purpose of introducing the directive is to improve the enforcement of European Union law and policy on the protection of whistleblowers in organisations which may be in breach of the law, constitute unethical conduct or cause harm to employees, the employer, or the public interest. The regulation applies to people working in the private or public sector who become aware of violations in a work-related context.

You can read the text of the directive here:
https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32019L1937&from=EN

EU Member States had until 17 December 2021 to implement the principles of the Whistleblower Protection Directive into national law.

By that date, the requirements of the Directive were to be met by:

•  private entities with more than 250 people,
•  all entities operating in the financial sector,
•  all public entities. Communes/municipalities with fewer than 10,000 inhabitants may be exempted from this obligation by the national legislator.

Despite the lack of a Polish law, the directive applies to entities subject to state sovereignty or control, while private companies will be obliged to implement a system of reporting violations of the law and whistleblower protection in accordance with the provisions of the expected law.

Private entities with between 50 and 249 people have until 17 December 2023 to comply with the Directive.

The most important obligations include:

•  the requirement to establish internal procedures and confidential and secure channels for receiving submissions from whistleblowers,
•  taking action to investigate and provide feedback to whistleblowers, both on the receipt of the submission and on actions taken or intended to be taken with respect to it,
•  providing employees and business partners with information about internal and external options for reporting violations.

A whistleblower is a person who, acting in good faith and in the interest of their workplace or the public interest, reports information on suspected illegal or unethical activities. The phrase „whistle blower” originated in the 19th century, when law enforcement officials used a whistle to alert the public or fellow police. Sports referees, who use a whistle to indicate an illegal or foul play, also were called whistle blowers.

whiblo is a service that makes it possible to confidentially report written information about suspected illegal or unethical activities within an organisation.
whiblo provides a channel for an anonymous, encrypted dialogue between the whistleblower and the organisation after the submission has been sent, so that the identity of the whistleblower cannot be revealed at any stage of the correspondence.
whiblo also supports the management of reports by providing the possibility to assign them to particular coordinators, set the status of submissions, store documentation, keep a register or generate reports.

whiblo protects anonymity by using an encrypted communication channel, as well as by removing all metadata from any attachments sent and by not recording the IP address of the whistleblower. Unless the whistleblower himself/herself discloses his/her personal data (e.g. by providing his/her data in the content of the report), whiblo is not in a position to identify him/her in any way.

No, the whiblo app does not allow deletion of a submission once it has been sent.

Yes, this functionality is available from 1st January 2022.

Yes, whiblo does offer such an option.

whiblo enables organisations to comply with the requirements imposed on them by the Whistleblower Directive. In addition, our service enables you to respond to reports of potential violations, thus minimising the risk of financial and reputational damage to your organisation.

The whiblo service is available from 38 euro net per month. All details, purchase packages are available under OUR OFFER. For an individual quote, please contact us or leave your details in the contact form.

With the basic package the setup cost is 115 euro net. If you require a custom configuration, please contact us or leave your details in the contact form.

whiblo can be launched within seven days of signing the contract.

The process is simple and quick. After configuration according to the customer’s wishes, the customer receives a link to the database on the server. They can share the link according to their needs, e.g. on the company’s website.

Yes, there is such a possibility. Contact us or leave your details in the contact form.

12 months.

Yes, braf.tech will store client data for 3 months after the termination of the contract. After that time, the data will be automatically deleted.

In terms of data storage, the application uses the infrastructure provider’s ISO 27001 certification. Regarding the security of the information stored and access to it, security and penetration tests have been performed by an independent auditor. The whiblo test report is available in Polish language on our BLOG. The system has been designed in accordance with the OWASP standard.

The content of the submission as well as any attachments added to the submission are encrypted using the AES 256 algorithm while passwords are hashed using Argon2.

Data transmission is secured by SSL protocol (TLS 1.2) and a relevant confirming authentication certificate issued for it.

All keys are stored in the Azure Key Vault service intended for secure storing and accessing confidential records.

Document metadata (e.g. in MS Office) containing information e.g. about the author of the document or the person who modified it are removed by the application algorithms at the stage of file transfer to the server. The file that is delivered to the coordinator in the company does not contain this information. The solutions used in the application are a trade secret.

The application does not save whistleblowers’ IP addresses so that even people who can access the application are not able to obtain information about which network the submission was sent from, which makes the whistleblower anonymous.

In terms of bot protection, whiblo uses the rate limiting mechanism recommended by the external auditing company that performed the security tests. The whiblo application does not use captcha mechanisms as these rely on tracking files which would create a conflict in terms of maintaining the whistleblower’s anonymity.

The system does not allow tampering with the content of the submission; it is not possible even for the coordinator on the part of the company.

No, braf.tech does not have access to any customer’s data.

The service is based on the proven and secure Microsoft Azure cloud infrastructure (What is the Azure platform – Microsoft’s cloud services | Microsoft Azure) using the Application Gateway service, including the use of a Web Application Firewall (WAF). Security and privacy are fundamental to the Azure platform. The Microsoft company is committed to providing the highest levels of trust, transparency, standards compliance and regulatory compliance (Compliance list: Compliance offerings for Microsoft 365, Azure, and other Microsoft services. | Microsoft Docs).

Yes. Backups are made on servers in European locations of EU member states (Ireland and the Netherlands). The regions are paired with each other, i.e. the Irish backup is stored in the Netherlands and the Dutch backup is stored in Ireland. Additionally, there is database replication so even if a server in one region stops working for whatever reason, there is exactly the same data in the other region that the system will continue to run on.

Yes. During the design and development of the application, we have placed particular emphasis on the protection of personal data of the persons making a submission and any third parties mentioned in the submission in order to meet all security standards under the provisions of the General Data Protection Regulation (GDPR).

The whiblo app only uses 2 essential cookies:

•  COOKIE_CONSENT – Storing information so as not to display the cookie message again,
•  __Host-SESSION – A session cookie required to enter the submission. Upon exit, the cookie is deleted from the user’s browser.

Yes, the main and the backup servers are located in European locations of EU member states (Ireland and the Netherlands) with disaster recovery procedures available.

Yes. In case the whistleblower includes some personal data, there is space provided in the application for an information notice from the Data Controller and a check box which the whistleblower has to actively check in order to confirm that he/she has read and accepted the provisions of the notice. The solution has been implemented in the place where the customer is likely to receive such data.

The application does not require providing any personal data unless the whistleblower provides such data voluntarily. It is a browser-based application that does not require the whistleblower to create a user account while at the same time it does not limit their options to contact the person receiving the submissions on the part of the company and exchange information with them.

After a submission is closed, it is moved in the system to the Archive tab. The submission, the correspondence between the whistleblower and the coordinator in the organisation as well as all attachments are stored in the Archive according to the individual retention period specified at the stage of configuring the application by the customer as the Data Controller. After the end of this period the documents are automatically deleted.

The whiblo application uses technological solutions to mitigate the potential risks associated with a personal data breach:

• Protection against unauthorised access to the whistleblower’s inbox and outbox. After making the submission, the whistleblower is given a unique identifier and creates his own password that meets the OWASP standard. The identifier is created randomly and cannot be assigned to any content entered in the disclosure.
•  Protection against unauthorised access to the coordinator’s account through two-factor authentication (2FA) of persons operating the system in the organisation. Only persons designated in the company can deal with the submissions. After creating accounts in the system for them, they have to log in by providing a login and password as well as a code which they receive to their mobile phone numbers provided when creating the account. This functionality significantly reduces the risk of the submission being accessed by unauthorised persons.