Whistleblowing FAQ

Reporters are people who are not indifferent to the organization, its employees, or the region, who have information that can benefit the organization or help to avoid harm, to its employees or the region, and, acting with the best intentions, want to help and are willing to share important information.

Ethicontrol enables informants to report information anonymously, confidentially to the company, or identify themselves to the response team.

Anonymity means that the informant's identity is unknown to anyone - neither to the representatives of Ethicontrol who received the message, nor to the response team, nor to other representatives of the company.

Confidentiality for the company provides for the disclosure of its name to the company Ethicontrol but excludes the transfer of this information to others without the informant's consent. In such a situation, Ethicontrol acts as an intermediary between the informant and the company, protecting the anonymity of the informant.

Identification means that the informant discloses his name during the registration of the message and is ready to openly and independently, without the mediation of Ethicontrol, cooperate with the organization.

However, identification does not mean that everyone should know who left the message. All information on the report and on informants is confidential and Ethicontrol provides access to it only to authorized members of the company's response teams, who are obliged to observe the appropriate confidentiality regime.

By default, Ethicontrol's whistleblowing hotline is intended for any interested and not indifferent parties to the company: shareholders, employees, customers and suppliers, business partners, former employees, relatives of employees, residents of the surrounding territories, and others.

The target audience may vary on the request of the company.

We aim to provide services at less cost than the cost of developing and maintaining such a tool on your own.
On the page Prices, you can check how it works.

The service cost depends primarily on the number of employees in your company since this is the main factor in the load of our contact center and web systems. Additional charges apply when working in multiple jurisdictions or when you want to improve our process or system significantly.

Each case is unique, and we are ready to take into consideration the wishes and budgets of our clients as much as possible.

No. We do not provide advice on the content of the message and possible follow-up actions for the informant.

Moreover, we do not have to understand the complexities of each organization and its processes to avoid misleading you.

The only exception is that we are always ready to advise you on anonymity options. Also, we clearly explain what details of the incident should be provided to make it easier for the compliance team to complete their work quickly.

In short, Ethicontrol knows about the company only what it is allowed to know about itself.

Once again, Ethicontrol has no right to spread ANY information about the company, including the very fact of using the service without the written permission of the company.

More broadly, we should start with the very definition of "know" - let's understand this as an opportunity to register information, save and accumulate it, as well as the ability to duplicate it later, apply, use or distribute.

Accordingly, when we talk about registration or obtaining information - Ethicontrol receives general information about the company when registering and signing a service agreement. Such information includes name, organizational form, tax and bank details, contact persons, means of communication, address, location and name of organizational units, names and grounds for actions of the authorized management, as well as names and email addresses of users of the web system on behalf of companies.

Further, Ethicontrol's contact center receives information about the incidents that caused the concern of the reporters. It contains the type of incident, what happened and when, who is to blame, who is the witness, who is the victim, and so on. This information passes through us, but we do not "remember" it.
It is due to the fact that any information which passed through the website or contact center goes directly to the database that belongs to your company.
"Directly" means that it is not registered or saved anywhere else. We only keep general information about the time and duration of the contact, the type and number of the incident, as well as the unique code of the whistleblower.
Also, for information security reasons, we are implementing several measures to exclude the possibility of storing even a bit of confidential information. See the FAQ section for details.

We do not have permanent access to the database, and if maintenance is required, such access occurs after agreement with the company and under the supervision of its technical specialists. At the same time, the system records any requests for data access, and it is easy to check us.
The storage of your data in the company's database is organized under the requirements of the legislation of the relevant jurisdiction.

Thus, we do not have information about the company or events indicated in the reports of whistleblowers, and we only know what we are allowed to know.

Among the security guarantees or protection from retaliation for using the whistleblowing hotline, you can often see a written commitment from management, shareholders protection, or protection through courts and civil or criminal law mechanisms.

However, we cannot call such methods a GUARANTEE.

At Ethicontrol, we believe that the only guarantee of the reporter's safety is his total ANONYMITY.

We recommend you acquaint yourself with the corresponding section on the Question-Answer page.

Any system can be hacked - anonymous hackers prove it on the example of numerous American banks or US government agencies.

We designed the security system in such a way as to make hacking the system economically sensible - expensive and time-consuming.

For example, to decrypt an SSL-encrypted message sent from your browser through the Ethicontrol service, you need to spend the total capacity of a huge data center, which should work for at least two months on just one case. The cost of such a case is estimated at millions of dollars.

At the same time, after two months, according to our typical process, the message should have already been processed, verified, investigated and closed, significantly reducing the cost of disclosed confidential information.

Any information which passes through the website or contact center goes directly to the database that belongs to your company.
"Directly" means that it is not registered or stored anywhere else. We only have general data about the time and duration of the contact, the type, and number of the incident, as well as the unique code of the informant.

Also, for information security reasons, we clear the temporary memory (cache) of the web system servers and contact center terminals regularly to exclude the possibility of storing even a bit of confidential information.

We do not have permanent access to the database. When there is a need for maintenance, such access occurs with the company's permission and under the supervision of technical specialists. At the same time, the system logs any data access requests.

Data storage in the company's database is organized under the requirements of the legislation of the relevant jurisdiction.

The only exception is that we are always ready to advise you on anonymity options. Also, we clearly explain what details of the incident should be provided to make it easier for the compliance team to complete their work quickly.

All information on the case in the database belongs to the company.

Companies independently approve data storage policies.

By default, any information on the case is kept for two months after the closure of the case. After that, the case undergoes a cleaning procedure: only a skeleton of important information is saved, and the system deletes all names and personal data.

Yes, there is.

However, we made sure to minimize it and provide for additional regular backups of encrypted data carriers.

Additionally, we use servers with geographical distribution in different locations. We use only the services of certified suppliers whose level of reliability is confirmed with the availability of their own backup procedures and smooth management.