Everything compliance requires, in one tool
From an anonymous report, through statutory deadline tracking, to a full audit trail and export for inspections. Built around whistleblower privacy and the obligations of organisations.
Confidentiality and identity protection
-
Identity reveal only with a second person's approval
Revealing a reporter's identity is a request that a second authorised person must approve. No one lifts anonymity single-handedly.
-
Four-eyes principle
Weakening the protection (turning the rule off) requires a second person's confirmation. Critical decisions are never made by one person.
-
End-to-end encryption (E2E)
Want report content readable by no one outside your team, including us? You switch on encryption with a key that stays with you: neither the operator nor a partner can read a report even with full database access. Turning the mode off or rotating keys has a 48-hour window you can cancel from an e-mail; if the organisation loses all its keys, nobody can recover the content, including us.
How E2E mode is written into the data processing agreement (section 3) -
Reporter anonymity
The reporter files without an account or login and replies through a case number and PIN. The reporting page stores no IP address and has no analytics or external resources. The team sees the content, never the reporter’s activity; the reporter sees “Case handling team”, never names.
-
Immutable audit log
Every access to a report and every action recorded in a log that cannot be altered. Hard evidence for inspections.
-
Metadata stripped from attachments
Files automatically lose metadata (EXIF, author) that could expose the reporter.
-
Chat and meeting at the reporter’s request
The reporter sees that the team is typing, but the team never sees the reporter’s activity. The reporter sets their own inactivity limit (5, 15 or 30 minutes) and can log out of the thread. When they ask for a meeting, you propose a date and form (in person, online, phone) within the statutory 14 days, and they accept or decline.
Case handling and workflow
-
Case lifecycle
Statuses, priorities, categories, notes and history visible only to the handling team. A closed or rejected case is final: nothing changes quietly, and reopening is an explicit status change kept in the history.
-
Auto-assignment
New reports reach the right people by rules, without manual routing.
-
Statutory deadlines, automatically
Acknowledgement within 7 days, feedback within 3 months and a meeting at the reporter’s request within 14 days: the system counts them from the date of receipt and reminds you before they pass. You can set your own feedback deadline shorter, up to 90 days. A case cannot be closed without feedback to the reporter.
-
Notification engine
You learn about a new report or an approaching deadline at once: in the panel, by e-mail or SMS, according to rules for each role. You see a preview before sending, so you know exactly what goes out to the reporter.
-
Reply templates
Acknowledging receipt within 7 days is a duty that is easy to forget in a busy week. Switch on the automatic acknowledgement sent the moment a report arrives and use ready-made messages so everyone on the team replies consistently.
-
Register for inspections and statistics
An inspector asks for the register of reports with deadlines? You export it to XLSX or CSV, optionally in a password-protected ZIP, with columns for acknowledgement, feedback deadline and closing. Every export is logged, a single case downloads as a password-protected PDF, and the Statistics page shows the whole picture.
-
Case teams and handover
Cases are assigned to people or teams (HR, compliance, audit). A handover between teams is logged, and someone outside the team cannot even see that the case exists.
-
Identity disclosure requests
A separate register of requests to reveal a reporter’s identity: who asked, for what purpose, who approved and when. This is the document an auditor or a court asks for.
Compliance, permissions and data
-
Authorisations repository
Issue data processing authorisations with confirmation of receipt by the employee. GDPR accountability.
-
Granular permissions (RBAC)
Roles and permissions per form and per case. Access for authorised people only.
-
Retention: 3 years under control
Cases are kept for 3 years from the end of the year in which they were closed, then the system deletes them itself. Open cases are never deleted. When proceedings are ongoing, you hold deletion in the panel for 30 days, with an entry in the immutable log.
-
Consents and terms, versioned
You accept the terms and the data processing agreement at registration, and the system records which version. A new version is announced 14 days ahead, including a banner in the panel. Every declaration is versioned in the immutable log.
-
Data export and migration
Full tenant export (JSON/CSV + attachments) for migration or audit, with identity masking and password protection.
-
EU data only
Hosting, encryption and backups in the European Union. No transfer outside the European Economic Area.
-
Register of persons covered by the procedure
A list of people the reporting procedure applies to, with confirmation that they have read it. Evidence of the statutory information duty, without a binder.
-
Procedural documents on the reporting page
Reporting rules, the GDPR information notice and the internal procedure published on the reporter page under your domain, in versions. The reporter reads them before sending, and you have proof of which version they saw.
-
Account security
Every role signs in with 2FA and has recovery codes. You see active sessions and login history, log out an unknown device, and a login from a new device sends an e-mail alert. After 30 minutes of inactivity the system signs you out.
Onboarding, channels and integrations
-
Onboarding wizard
Logo, colours, domain, people and form in a few steps, without an IT team. The panel works in Polish and English, you choose PLN or EUR before the first subscription, and the help centre is right there in the panel.
-
No-code form builder
Custom fields, sections and form variants, with duplication. A form tailored to your organisation.
-
White-label and your own domain
The channel under your brand and address. It looks like part of your company, not a foreign tool.
-
Channels: online, e-mail, phone, letter
Not every reporter will use a form. A report from a conversation, phone call, letter or e-mail is entered by a staff member with the date of receipt, and the 7 days for acknowledgement count from that date just as for online reports.
-
WCAG 2.2 AA accessibility
Contrast, keyboard operation, ARIA, touch targets, text resizing, no time limits on filling in a report. A channel usable by everyone, including screen-reader users.
-
Google and Microsoft 365 sign-in
Convenient SSO for the handling team, alongside mandatory 2FA, brute-force protection and a password policy.
-
Integrations: webhooks and API
Notifications to Slack, Teams, Power BI and your own systems. Metadata only, never report content, with HMAC signing.
-
Reporter page editor
Layout, welcome texts, section order and language of the reporting page are changed in an editor with a live preview. No implementation partner and no waiting for the vendor.
-
Billing and invoices in the panel
Subscription, plan changes and VAT invoices available in the client panel. An MSP partner bills its clients from one place.
-
Voice recordings without metadata
A report from a conversation or a recording goes into the system like any other. The recording is converted to MP3 or MP4 with metadata removed, so the file does not reveal when and on which device it was made.
Corporate groups, law firms and DPOs
-
One login, many companies
Looking after several companies and signing in to each separately? In sygnadesk you have one password and one 2FA app, and you switch between organisations from the panel bar. Each company remains a separate, isolated account with its own register, forms, domain and team.
-
Every deadline on one screen
A case in a subsidiary is stuck and head office does not know? The “My organisations” screen shows, for each company, open cases, cases past 7 days without acknowledgement, missed feedback deadlines, cases assigned to you and unread messages.
-
Control stays with the company
Worried a law firm or partner will get too much? The company’s own administrator invites, sets the role and detaches with one click, and access ends at once. An outside person gets at most the director role, never administrator, and is shown on the team list as an external person.
-
A trail of every outside access
An inspector asks who from outside the company had access and on what basis? The invitation, its acceptance, every switch and every detachment go into the immutable log on both sides. The authorisation repository keeps the written authorisation of each person in each company.
-
Safe switching between companies
One account for many companies must not be a weak point. Thirty minutes after the last 2FA code, switching asks for a new code, a login from a new device sends an e-mail alert, and an invitation expires after 14 days. You change the password once, in the main account, and it applies to every organisation.
This is what working in sygnadesk looks like
A few snippets from the case-handling panel: a clear dashboard, a case list with metadata (no report content) and a no-code form builder.
For the whole compliance team
One tool that answers the needs of different roles across the organisation.
-
Data Protection Officer (DPO)
GDPR compliance: data minimisation, a data processing agreement (DPA), 3-year retention, EU data. Accountability in an immutable log.
-
Compliance director and manager
The whole legal obligation in one place. The 7-day and 3-month deadlines tracked automatically, full register and audit.
-
Board and CEO
Lower legal and reputational risk without involving IT. Set up in an hour, predictable cost, a register and audit log ready for an inspection.
-
HR director
A safe channel for employee, harassment and ethics cases. Anonymity, reply templates, per-case permissions.
-
Legal counsel and legal team
Compliance with the act and the directive, ready procedures, control over identity disclosure (four-eyes principle).
-
Internal audit and risk
An immutable log, statistics and export for proceedings. Hard proof the system works.
For every regulated industry
- Healthcare and hospitals
- Industry and manufacturing
- Public sector and local government
- Finance, banking and insurance
- Education and universities
- Retail and store chains
- Transport and logistics
- Energy and utilities
- IT and professional services
Data protection at every stage
From the form, through transmission, to storage and deletion of reporters’ data.
-
Legal basis
The Act of 14 June 2024 and EU Directive 2019/1937. Categories cover breaches of law and ethical standards.
-
Reporter privacy
No IP or location stored, no external resources, strict CSP, self-hosted fonts. Anonymity and confidentiality of identity.
-
Data protection
Data exclusively in the EU, encryption in transit and at rest, three-year retention from the end of the year the case was closed with automatic deletion and the option to hold it, a data processing agreement (DPA) and a list of sub-processors.
Several companies or clients? See the deployment models Security End-to-end encryption
Try the system on a trial account
A 14-day trial with full access. No technical knowledge needed.