Glossary
Whistleblowing and compliance terms, in plain language.
The vocabulary you meet in the EU Whistleblowing Directive, in procurement questionnaires and in your own DPA conversations. Short definitions, no jargon.
Why this list
One word, one meaning.
Whistleblowing vocabulary drifts between the directive, national law, auditors and vendors. These are the definitions we use, and the ones we hold ourselves to in our own product and documentation.
Terms
Definitions.
- Whistleblower
- A person who reports a breach of law or serious wrongdoing they learned about in a work-related context. Under Directive (EU) 2019/1937 that covers employees, contractors, suppliers, shareholders and volunteers.
- Whistleblowing
- Reporting that breach through an internal channel, an external channel, or both.
- Internal reporting channel
- The confidential route inside an organization for receiving reports. Mandatory in the EU for organizations with 50 or more employees.
- External reporting channel
- A route outside the organization, such as a supervisory authority or an ombudsman. Reporters may use it instead of, or after, the internal channel.
- Directive (EU) 2019/1937
- The EU Whistleblowing Directive. It requires member states to protect reporters and to oblige organizations to run internal channels. Transposition deadline: 17 December 2021.
- Acknowledgment
- Written confirmation to the reporter that their report was received. Due within 7 days under the Directive.
- Feedback
- The information given to the reporter about the follow-up to their report. Due within 3 months of the acknowledgment.
- Follow-up
- Every step taken after a report arrives: assessment, investigation, decision and the response to the reporter.
- Retaliation
- Any detriment suffered because someone reported, such as dismissal, demotion or harassment. Prohibited by the Directive.
- Anonymous reporting
- A report submitted without identifying details. Ashio's reporting pages set no cookies and record no IP addresses.
- Confidential reporting
- A report where the organization knows who reported, but their identity is protected from wider disclosure.
- End-to-end encryption
- Encryption performed in the reporter's browser, so the server only ever stores ciphertext and cannot read the report.
- Zero-access architecture
- A design in which the operator cannot decrypt customer content at all, even with direct database access.
- Audit trail
- The immutable, timestamped record of every event on a case: created, assigned, acknowledged, answered, closed.
- Pseudonymization
- Replacing identifying data with a reference, so it can no longer be attributed to a person without additional information.
- Retention period
- How long personal data is kept before it is deleted. Set by your organization, within the limits of the law.
- ISO 37002
- The international standard for whistleblowing management systems. It describes how a channel should be governed, operated and reviewed.
- ISO 27001
- The information security standard. The servers Ashio runs on are ISO 27001 certified, in Switzerland.
- ESRS G1-1
- The CSRD disclosure requirement on business conduct policies and corporate culture, which covers how concerns about business conduct can be reported inside a company.
- CSRD
- Corporate Sustainability Reporting Directive: EU rules requiring large companies to report on sustainability, including who may use the reporting channel and how those people are protected (ESRS G1-1).
- Anonymization
- Removing identifying data for good, so a report can no longer be traced to a person. Pseudonymization replaces identifiers with a key that the holder can reverse. Ashio's intake form itself logs no IP address, no cookies and no fingerprinting.
See the definitions in a running channel.
The 7-day and 3-month deadlines, the audit trail and end-to-end encryption are all in the product. 14-day free trial, no card.