Confidential intake
Reports must arrive through a channel that protects the whistleblower's identity. Ashio supports both confidential and fully anonymous reporting.
Internal Reporting Channel
Your internal reporting channel — secure, compliant, ready in minutes.
The EU Whistleblowing Directive and national laws such as the German HinSchG require companies to establish internal reporting channels. Ashio provides a fully compliant solution — anonymous reporting, automated acknowledgments, and audit-proof case management — all on one platform.
Overview
What is an internal reporting channel?
An internal reporting channel is a secure, confidential channel through which employees, contractors, and other stakeholders can report violations of laws or company policies. Under the EU Whistleblowing Directive (EU) 2019/1937, companies with 50 or more employees are legally required to establish such channels. The channel must protect the whistleblower's identity, acknowledge reports within 7 days, and provide feedback within 3 months.
Must-have criteria
What a legally compliant internal reporting channel must deliver
Not every form is a legally compliant reporting channel. Here are the legal requirements — and what Ashio delivers by default.
Acknowledgment within 7 days
Every report must be acknowledged within 7 days. Ashio helps you send confirmations on time — you never miss a deadline.
Feedback within 3 months
Whistleblowers must be informed of follow-up actions within 3 months. Ashio's status workflow keeps reporters updated at every stage.
Audit-proof documentation
Every status change, comment, and team activity is recorded in an immutable timeline — ready for audits and regulatory reviews.
Team collaboration
Invite compliance officers, legal, and HR into your workspace. Everyone sees the same dashboard and case history.
Privacy by design
GDPR-compliant from the ground up. No cookies, no analytics, no fingerprinting on reporting pages. Swiss hosting, ISO 27001 certified.
Scope
Who needs an internal reporting channel?
Under the EU Whistleblowing Directive (EU) 2019/1937, the following organizations must establish an internal reporting channel:
- All private-sector organizations with 50 or more employees in the EU
- All public bodies and municipalities (with exceptions for small communities)
- Companies in financial services, insurance, aviation, and maritime — regardless of employee count
- Companies subject to national laws such as the German HinSchG, Austrian HSchG, or French Sapin II
Legal requirements
What the law requires from your internal reporting channel
Secure and confidential intake
The channel must protect the whistleblower's identity throughout the entire process. Personal data must be processed in compliance with GDPR. Ashio's reporting forms use no tracking, no cookies, and no fingerprinting.
Acknowledgment within 7 days
Companies must confirm receipt of a report within 7 days. Ashio automates this — the reporter immediately receives a confirmation with a private tracking link.
Feedback within 3 months
Whistleblowers must be informed of follow-up actions within 3 months of acknowledgment. Ashio's status page keeps reporters updated throughout the entire process.
Protection against retaliation
Whistleblowers are legally protected from dismissal, demotion, and other forms of retaliation. Ashio's anonymity features ensure the reporter's identity cannot be exposed — reducing the risk of retaliation to zero.
Your solution
How Ashio serves as your internal reporting channel
Ashio is designed to function as a fully compliant internal reporting channel under the EU Whistleblowing Directive and national implementations such as the German HinSchG.
Anonymous and confidential reporting
Reporters choose an incident type, describe what happened, and submit their report — fully anonymous. No personal data, no tracking, no trace.
Compliance workflows
Clear deadline tracking for 7-day and 3-month obligations, built-in reminders, and an immutable audit trail help you stay on top of every legal deadline.
Team-ready dashboard
Invite your compliance team, track cases from intake to resolution, and maintain a complete activity log — all in one place.
FAQ
Common questions about internal reporting channels
What's the difference between internal and external reporting channels?
An internal reporting channel is set up within an organization for employees to report violations. An external reporting channel is operated by a competent authority (e.g., the Federal Office of Justice). Under the EU Directive, companies must provide internal channels; Member States must establish external ones. Ashio serves as your internal reporting channel.
Can I outsource my internal reporting channel?
Yes. Both the EU Directive and national laws such as the German HinSchG explicitly allow outsourcing the internal reporting channel to an external third party. Ashio is designed for exactly this — an independent, neutral platform that meets all legal requirements.
How quickly can I set up a reporting channel?
With Ashio, you can go live with a fully functional internal reporting channel in under 10 minutes. Sign up, name your organization, customize your form, and share the link with your employees.
Must an internal reporting channel also accept anonymous reports?
The EU Directive mandates confidential reporting and encourages accepting anonymous reports — but does not strictly require it. The German HinSchG, however, explicitly requires companies to process anonymous reports. Ashio supports both confidential and fully anonymous reporting — you're covered in every jurisdiction.
Ready for your internal reporting channel?
Go live with a fully compliant internal reporting channel in minutes. Anonymous reporting, built-in deadline tracking, and audit-proof documentation — all included.