preeco | whistleblower

A publicly accessible reporting form for confidential and optionally anonymous reporting. The integrated step-by-step wizard guides whistleblowers safely and clearly through the entire reporting process – no technical expertise required.

The form is highly customizable: introductory texts, areas of application, and required fields can be individually configured. Available in up to 26 languages with automatic acknowledgment of receipt within 7 days in compliance with the HinSchG. Attachments such as documents, images, or screenshots can be submitted directly with the report. The reporting form appears step by step, as expandable sections or on a single page, as you choose. On request, the portal removes metadata such as author or GPS position from uploaded files and voice messages and warns before submission about files that cannot be cleaned. Voice messages can be added as a configurable form element – also as a mandatory field: whistleblowers record their oral report in accordance with section 16 (3) HinSchG directly in the browser – they can listen back to it before submitting, with no phone line and no voice service provider involved, even for fully anonymous reports. Reports received outside the form also converge in one place: reports taken by phone, in writing, or in a personal meeting are documented by the reporting office as a manually created report in the system – the reporting office's phone number is published and maintained in the form for each organization; conversation records or voice recordings can be stored encrypted as a file attachment on the respective case.

Systematic prioritization of each report using a 4x4 risk matrix based on probability of occurrence and severity of impact – an objective basis for escalation and resource planning. Documentation of circumstances, causes, and consequences. Recording of measures including implementation status for transparent case processing. Recurring risks and measures can be stored centrally as team-wide templates and applied to each report.

Export reports as PDF, DOCX, or ZIP with all attachments. Filterable overview tables as XLSX for statistical analyses – ready for further use in Excel and common analysis tools. Complete documentation for compliance obligations and audit readiness.

SSL/TLS encryption for all data transmissions. AES encryption of essential data in the database. Two-factor authentication (TOTP) – optional for individual accounts and enforceable team-wide, complemented by brute-force protection with graduated lockout periods. Hosting of Cloud and Private Cloud exclusively in ISO 27001 certified data centers in Germany. To protect whistleblowers, no access data that could identify them is logged – preeco | whistleblower deliberately goes as far as not writing system log files.

Professional automatic translation of report contents and correspondence in up to 26 languages via the DeepL API – an optional add-on, so you only pay for the translations you actually use. This lets you process reports from multilingual workforces in your working language.

Optional support for case processing with a language model: summary of the report, risk analysis, suggested measures and message drafts. OpenAI, Langdock and any OpenAI-compatible endpoint are supported – including one you operate yourself. Access keys and the contract with the provider are supplied by the customer. Selectable generation mode – automatic, deterministic, or reasoning in four levels. A default instruction stored per team is prepended to every request – up to 5,000 characters, freely editable, supplied with a default template. The whistleblower's name and e-mail address are never transmitted; request and response contents are automatically deleted after seven days, and every call is recorded in a dedicated AI activity log. If you use an endpoint you operate yourself, the contents never leave your company's infrastructure. Disabled as delivered; activated per team by administrators, with an additional approval per person. Suggestions are never adopted automatically. New: for each area of application you set the legal frameworks that apply (HinSchG, EU AI Act, GDPR or the German Supply Chain Act, LkSG); the “Validation check” tab shows the deadlines of every framework for a report, and you complete the check yourself or let the AI draft it.

Automatic monitoring of legal deadlines (7-day acknowledgment of receipt, 3-month feedback) – configurable per organization, also for internal service levels or international subsidiaries with differing requirements. Follow-up function for timely processing. Dashboard alerts for due deadlines and unassigned reports. Closed reports are flagged for GDPR-compliant deletion on a configurable date after case closure.

The reporting portal follows WCAG 2.1 AA and includes an accessibility statement with a contact point; fields, error messages and dialogs are announced clearly by screen readers. Keyboard operability, semantically structured HTML, sufficient contrast, scalable font sizes, clear and understandable language and alternative texts for graphics. The low-threshold access lowers the barrier to reporting and strengthens acceptance and usage of the reporting channel. Accessibility is continuously reviewed and improved. Read our accessibility statement

Our support team is available Monday to Friday, 9:00 am to 5:00 pm in German and English (excluding public holidays in Germany). Extended 24/7 standby is optionally available.

Clearly defined response times by priority: in the Private Cloud from 2 business hours for critical incidents to 3 working days for general inquiries, in the Cloud from 4 business hours to 5 working days. If response times are not met, a multi-level escalation process applies, up to executive management. For on-premises installations, service levels and response times are agreed individually in the contract.

Reach us by email and ticket system as well as – subject to availability – via online chat, so you get help quickly and easily.

Optionally available at an additional cost: personal phone support and assistance via online video conference for particularly demanding requirements.

We support your rollout with a dedicated contact person as well as online training for administrators and ombudspersons – this onboarding service is included free of charge. Custom training on demand is additionally available. Documentation and help texts are available directly within the application.

The software is generally available 24/7. Updates are rolled out automatically about once a month without downtime; security updates are applied at short notice when needed. After each update, a pop-up in the application transparently shows the changes made. Longer maintenance work is announced in advance.

preeco | whistleblower has its own REST API: reports with status, deadlines and case handling, messages, risks and measures, exports and master data can be connected to your case management, your reporting or your GRC system. The interface is disabled by default and is enabled per team on request and per user by an administrator. Access works through personal API tokens; each token sees exactly what the person it belongs to sees in the application. Whistleblowers never receive a token, and the interface does not expose their pseudonymous account. Interactive API documentation with an OpenAPI file. For Private Cloud and On-Premises, customer-specific endpoints are also possible.