Your internal reporting channel — secure, compliant, ready in minutes.

An internal reporting channel is set up inside an organization so employees can report violations. An external reporting channel is operated by a competent authority (for example a government agency). Under the EU Directive, organizations must provide internal channels, and member states must provide external ones. Ashio serves as your internal reporting channel.

Yes. The EU Whistleblowing Directive explicitly allows the operation of the internal channel to be outsourced to an independent third party. Outsourcing to Ashio is the most common pattern for SMEs and mid-market companies: a fully managed, ISO 27001-hosted channel that satisfies every legal requirement without building internal infrastructure.

You can file a report at any time. The EU Whistleblowing Directive requires organizations to follow up on reports within 3 months of acknowledgment; there is no statute of limitations for whistleblower reports under the Directive itself. National law may set retention obligations (e.g. the German HinSchG requires deletion of personal data after 3 years unless needed for further processing).

The EU Directive mandates confidential reporting and encourages accepting anonymous reports — but does not strictly require it. The German HinSchG, however, explicitly requires companies to process anonymous reports. Ashio supports both confidential and fully anonymous reporting — you're covered in every jurisdiction.

In Germany, the Betriebsrat (works council) has comprehensive information and co-determination rights under §80 BetrVG and §90 BetrVG. The employer must inform the Betriebsrat in good time about the introduction and use of a new reporting channel, including the categories of reports, the responsible recipient and the data processing involved. Ashio's enterprise tier includes a dedicated Betriebsrat dashboard with read-only access to anonymized report statistics.

An internal reporting channel is a confidential mechanism — digital, physical or both — that lets employees, contractors and other stakeholders report breaches of EU law to their employer. The Directive requires companies with 50+ employees to operate one, with a 7-day acknowledgment deadline, 3-month follow-up deadline and anti-retaliation protection. Ashio is a self-service internal reporting channel purpose-built for these obligations.

A whistleblowing policy is the written commitment that states who may report, what can be reported, how reports are handled and that retaliation is prohibited. Compliance or legal owns the text, but HR and the works council usually co-sign it. The policy should name the reporting channel it points to and the deadline for acknowledging a report (7 days under the EU Directive).

Describe four steps: intake (who receives the report and within what deadline), assessment (relevance and plausibility), investigation (who runs it and what is documented) and feedback to the whistleblower (within 3 months). Keep policy and procedure separate: the policy states principles, the procedure tells a case worker what to do on day one.

An email inbox or a phone hotline can satisfy the law, but neither gives you structured case handling, a tamper-proof audit trail or two-way anonymous dialogue. A platform adds those, plus multi-language intake — which is why most groups move away from inbox-based reporting once they operate in more than one country.

Ashio is 23–29 € per month, flat, with a 14-day free trial and no implementation project. Enterprise vendors in this category typically price per employee or per case and require a quote plus onboarding; if you only need a compliant internal channel, a self-service product is faster and cheaper.