No IP collection
We never log, store, or process IP addresses from reporting pages. The submitter's network identity is invisible to us — and to your organization.
Anonymous reporting
Truly anonymous reporting platform. Not just a promise — a guarantee.
Most anonymous reporting platforms still log IPs, drop cookies, and leave traces. Ashio doesn't. No IP collection. No cookies. No fingerprinting. No tracking of any kind. Your reporters deserve real anonymity — and you deserve a platform that delivers it.
What it means
What true anonymous reporting actually means.
Anonymity isn't a checkbox. It's a technical commitment. Here's what we do — and don't do — to protect every reporter.
No cookies
Zero cookies on reporting forms. No session tracking, no analytics cookies, no third-party scripts. The page loads, the report is sent, nothing persists.
No browser fingerprinting
We don't collect browser metadata, screen resolution, installed fonts, or any other fingerprinting data. The submitter's device leaves no trace.
No email required
Submitters don't provide a name, email, or any identifying information. They get a private tracking link — no account, no login.
Independent third party
Ashio is a separate company from your organization. Even if someone subpoenaed us, we have no identifying data to hand over.
End-to-end encrypted
Reports are encrypted in your browser before they reach our servers. Only the people you choose can read them — not even Ashio.
Comparison
Anonymous vs. confidential — what's the difference?
The EU Whistleblowing Directive requires confidential reporting. Anonymous reporting goes further — and it's the difference between reporters trusting your channel or staying silent.
Confidential reporting
The organization knows who the reporter is but promises not to disclose their identity.
- Reporter identity is known internally
- Risk of accidental disclosure exists
- Minimum legal requirement under EU Directive
Anonymous reporting (Ashio)
The organization never knows who the reporter is. Identity protection is technical, not just procedural.
- Reporter identity is never collected
- Zero risk of identity disclosure — no data exists
- Exceeds legal requirements — builds real trust
How it works
How Ashio achieves true anonymity.
Four technical decisions that make anonymous reporting real — not just a policy statement.
1
Zero-data submission pages
Our reporting forms run with no analytics, no tracking scripts, and no third-party services. The only data transmitted is the report content itself — nothing else.
2
One-way tracking links
After submitting, the reporter receives a unique URL to check their report status. The link contains a random identifier — it cannot be traced back to the submitter or their device.
3
No user accounts
There are no reporter accounts, no logins, and no profiles. Every report is self-contained. Even we can't link multiple reports from the same person.
4
Swiss infrastructure, EU law
All data is processed and stored in ISO 27001-certified data centers in Switzerland, under GDPR and Swiss Federal Data Protection Act. No data ever touches US cloud providers.
Anonymes Meldesystem
Anonymes Meldesystem — die sicherste Form der Hinweisgebermeldung
Ein anonymes Meldesystem ist ein digitaler Meldekanal, bei dem die Identität der hinweisgebenden Person technisch nicht erfasst wird. Anders als bei einem vertraulichen System — wo die Identität bekannt ist, aber nicht weitergegeben wird — werden bei einem echten anonymen Meldesystem keine IP-Adressen protokolliert, keine Cookies gesetzt und keine Geräte-Fingerprints erhoben. Das ist keine Frage der Unternehmenspolitik, sondern der technischen Architektur.
Keine IP-Speicherung
Das System darf die IP-Adresse der meldenden Person zu keinem Zeitpunkt erfassen. Was nicht gespeichert wird, kann nicht eingesehen werden — weder vom Arbeitgeber noch von Strafverfolgungsbehörden.
Keine Cookies, kein Tracking
Das Meldeformular setzt keine Cookies und verwendet kein Tracking — kein Fingerprinting, keine Analytics, keine Drittanbieter-Skripte. Der Seitenaufruf bleibt vollständig spurlos.
Keine persönlichen Daten
Die meldende Person braucht keinen Namen, keine E-Mail und keine Telefonnummer. Die gesamte Kommunikation läuft über einen kryptografisch zufälligen Link — kein Account, kein Login.
Unabhängiger Drittanbieter
Das System wird nicht auf der IT-Infrastruktur des Arbeitgebers betrieben, sondern von einem unabhängigen Anbieter. Nur so ist sichergestellt, dass niemand im Unternehmen Zugriff auf Server-Logs oder Metadaten hat.
HinSchG-konform
§ 16 Abs. 1 HinSchG verlangt ausdrücklich, dass interne Meldestellen auch anonym eingehende Meldungen bearbeiten müssen. Anders als die EU-Richtlinie, die Anonymität nur empfiehlt, schreibt das deutsche Gesetz sie verbindlich vor.
Schweizer Hosting, ISO 27001
Alle Daten werden in ISO-27001-zertifizierten Rechenzentren in der Schweiz gehostet — einem der strengsten Datenschutzstandorte weltweit. Keine Daten verlassen jemals den europäischen Rechtsraum.
FAQ
Common questions about anonymous reporting.
Is anonymous reporting legal under the EU Whistleblowing Directive?
Yes. The EU Directive mandates confidential reporting and explicitly encourages Member States to accept anonymous reports. Several national laws — including the German HinSchG — go further and require companies to process anonymous reports. Ashio supports both confidential and fully anonymous reporting.
How can you prove a report is really anonymous?
Our reporting pages are publicly auditable. You can open your browser's developer tools on any Ashio report form and verify: no cookies are set, no analytics requests fire, and no identifying data is transmitted. We also publish our security practices and undergo regular penetration testing.
Reporters can use their private tracking link to send follow-up messages and receive updates from your team. The conversation stays fully anonymous — your team sees the messages but never the sender's identity.
Reporters can use their private tracking link to send follow-up messages and receive updates from your team. The conversation stays fully anonymous — your team sees the messages but never the sender's identity.
Can anonymous reporting lead to false reports?
Research consistently shows that anonymous channels do not produce more false reports than identified ones. What they do produce is earlier warnings — people report sooner when they feel safe. Ashio's structured intake form also helps filter out non-actionable submissions.
Does Ashio support confidential reporting too?
Yes. Organizations can configure their reporting page to allow reporters to optionally provide contact details. The choice is yours — anonymous by default, confidential when the reporter chooses.
How do you evaluate an anonymous reporting platform?
The four non-negotiables: (1) no IP collection on the reporting page, (2) no cookies or browser fingerprinting, (3) reports encrypted in the reporter's browser before they reach the server, (4) the organization cannot decrypt the report unless the reporter chooses to share the decryption key. Ashio checks all four — and our reporting pages are publicly auditable.
EU directives covered
Related compliance guides.
Explore Ashio's coverage of each EU regulation.
EU Whistleblowing Compliance
One platform for every EU directive — NIS2, AI Act, CSRD, CSDDD, Pay Transparency, ISO 37002.
Read moreEU Whistleblower Directive
Requirements, deadlines, and penalties under Directive 2019/1937.
Read moreISO 37002:2021
How Ashio aligns with the global whistleblowing standard.
Read moreReady to offer real anonymity to your people?
Set up your anonymous reporting channel in minutes. No tracking, no IPs, no cookies — just trust.