Challenge: confidentiality and contact without revealing identity
A shared email inbox or a conversation with a manager can discourage people from reporting misconduct. An anonymous message without a return channel, in turn, makes it difficult to ask questions and collect additional evidence.
Sensitive descriptions and attachments were at risk of being scattered across inboxes and drives. Corporate groups needed separate channels for individual companies, but one consistent handling standard.
Solution: a confidential portal with no account required
Astrafox built a platform for anonymous and identified reports, two-way communication, and integration with an investigation management system.
The solution includes:
- a form that guides the user through the incident description,
- a choice between anonymous and identified reporting,
- field validation before submission,
- attachments checked for file type, size, and malware,
- a case number and a password set by the reporting person,
- confidential correspondence without revealing the person’s identity,
- status tracking from receipt through closure,
- Polish and English language versions,
- separate configuration for every organization or company,
- editable form content, consent language, and message templates.
Outcome: a complete report and secure dialogue
The reporting person returns to the case, submits another file, and answers questions. The investigation team receives structured data without manual retyping. For each additional company, we configure a separate channel and isolate its data.
The platform is developed and maintained as a reusable solution.
Technical details
Data and attachments are encrypted before storage, while data exchange with the investigation management system uses a key assigned to the organization. The password is stored as a cryptographic hash. The platform applies temporary lockouts after failed login attempts, protects the form against automated submissions, and scans files. The API uses separate authorization for each organization.
Frequently asked questions
Does the reporting person have to provide personal data?
No. The organization provides an anonymous reporting option, while two-way communication continues in the case panel.
Does the platform support multiple companies?
Yes. Each company has its own address, content, configuration, and isolated data.