EN
Create account
About Log in
Example scenarios

How sygnadesk works in practice

Thirteen typical situations in which organisations reach for a whistleblowing system. They are illustrations, not accounts of specific deployments. A reporting channel is not about informing on colleagues; it is early warning that lets the organisation fix things internally before they grow into costs, inspections or resignations.

The situation

A purchasing officer notices one supplier keeps winning tenders despite worse bids. She has the documents, but the person involved sits two desks away. Going to her manager is not an option.

How it works

She files the report anonymously with the files attached. The system strips the metadata that could identify her, and she continues the conversation with the case handler through a case number and PIN. The board gets the signal before the matter reaches a prosecutor or the press.

The situation

In one store the manager has been humiliating staff for months. Everyone knows, nobody reports it, because the only route runs through that same manager. Head office finds out from the resignations.

How it works

Each branch has its own report form, and access to a case is granted only to someone outside the local hierarchy, such as HR at head office. A report never passes through the hands of the person it concerns.

The situation

A nurse sees a ward procedure being bypassed and none of the doctors reacting. Raising it directly would mean a conflict with the consultant who sets her rota.

How it works

The report goes to the people named in the procedure, bypassing the ward. The system tracks the statutory seven-day acknowledgement, so the case cannot sit in a drawer. The response comes before an event that cannot be undone.

The situation

A doctoral student notices grant costs being booked against equipment nobody on the team has seen. The project lead is also the supervisor of his thesis. The field is small and everyone knows who works with whom.

How it works

Anonymity here is not a convenience but the precondition for reporting at all. Revealing an identity requires the consent of two authorised people, so nobody can look it up alone, even out of curiosity. The reporter follows the case without an account or a login.

The situation

A local government body must run an internal channel by law. The previous email inbox met the requirement on paper, but during an inspection nobody could show when a report had arrived or who had read it.

How it works

Every report carries a timestamp and every access to it leaves an entry in a log that cannot be altered. The system counts the seven-day and three-month deadlines itself and escalates as they approach. An inspection is shown a register, not an assurance.

The situation

The company has crossed the headcount threshold and the owner learned of the obligation from the accountant. There is no IT department and no compliance function, and rolling out a system sounds like a quarter of work and an invoice from a law firm.

How it works

A wizard walks through the setup: logo, responsible people, the form, and procedural documents ready to adapt. The channel is live under the company's own domain the same day. The owner does not need to understand the act in detail, because the system handles the deadlines and the register.

The situation

A bank's compliance team judges vendors by one test: what happens if the vendor is breached, or receives a demand from a foreign authority. Whistleblower reports are the most sensitive data in the organisation.

How it works

Once end-to-end mode is switched on, content and identity are encrypted with a key that stays with the client, so the operator cannot read them even with full database access. A personal emergency code covers a forgotten password, and if the organisation loses all its keys, nobody can recover the content. Data does not leave the European Union, and every operation leaves a trace in the log.

The situation

The organisation takes signals from people outside its own structure: former employees of companies, residents, officials. For them, exposure means losing a job or worse. An email inbox records the sender's address, and that is already too much.

How it works

The reporting page stores no IP address, loads nothing from third parties and uses no tracking tools. The reporter returns to the case with a number and a PIN, with no account and no email. Attachments lose their metadata before anyone opens them.

The situation

Someone with documents from inside an institution approaches a newsroom. They want to hand them over but will not identify themselves, because doing so could cost them their job, or worse. Email and messaging apps leave traces that can be recovered on demand.

How it works

The source hands over files and talks to the journalist through a case number and PIN, without an account, an address or an IP record. Content and identity are encrypted with a key held by the newsroom, so the operator has no key and nothing to hand over on demand. Source protection stops depending on the vendor’s goodwill.

The situation

Drivers and warehouse staff have no company laptop and no email address, and the only computer at the depot is in the dispatcher's office. A channel that works only on the intranet does not exist for them.

How it works

A report can be filed from a private phone through the page at the company’s address or by phone, and the team enters it into the register with the date of receipt. The case status is checked from a mobile, with a code and PIN. The channel is genuinely available to everyone, not only the office.

The situation

An operator notices someone on the night shift has bridged the guard sensor on a press because it is faster that way. Reporting it openly means naming colleagues, so everyone stays quiet and hopes nothing happens.

How it works

They report the hazard anonymously from a phone, describing the machine and the shift, not the people. Health and safety locks the machine for inspection the same day and fixes the procedure. There is no accident, and the operator keeps working in the same crew without being labelled an informer.

Outcome The organisation gets the hazard signal before it becomes an accident: no post-accident investigation, labour inspection, downtime or compensation claims. One report like this can pay for the system for years. And employees see the channel protects people, not hunts for culprits, so next time they will speak up again.

The situation

A front-line worker sees batches shipped without the inspection step whenever deadlines are tight. Complaints have been rising for three months, but nobody upstairs connects the two, and he does not want to be the one who slows production down.

How it works

The signal goes through the channel straight to the person responsible for quality, bypassing the shift manager who tolerates the practice. The case gets a number and a deadline, the process is restored, and the company fixes the problem internally before a key client notices.

Outcome The company fixes the process before complaints turn into contractual penalties and before a key client notices. The channel works as an early-warning system for management: first-line knowledge reaches the top without being filtered by middle layers. It is often the only process in the company that shortens that path, and the reporter risks nothing in the team.

The situation

Within six months three people leave the same department, and every exit survey mentions new challenges. There is no mobbing in the legal sense, just an atmosphere discussed over coffee but never with HR.

How it works

An anonymous signal describes what the surveys do not show: who withholds information and how tasks are really divided. HR starts corrective conversations with facts instead of guesses and prevents a fourth resignation before recruitment starts costing more than repairing the team.

Outcome Stopped attrition is the easiest return to count: keeping one person costs less than recruiting and onboarding a replacement. HR gets a picture exit surveys never show, and the team gets proof that raising problems is safe and changes things. It is not informing on a colleague; it is information that saves the team.

Looking for a deployment model?

A corporate group, an MSP partner and a law firm with an external DPO are not reporting stories but ways to lay out accounts, permissions and billing. We describe them separately, together with the model for a single organisation with many branches.

See the three deployment models

Questions about whistleblowing systems

Who must have a whistleblowing system?

The Polish Act on the protection of whistleblowers of 14 June 2024 requires an internal reporting channel in entities with at least 50 employees. In some sectors, including finance, the threshold is lower and the duty does not depend on headcount. It applies to companies as well as public bodies and local government.

What are the penalties for not having a reporting channel?

The act provides for criminal liability for the absence of an internal reporting procedure and for retaliation against a whistleblower. The scale and procedure are set out in the act itself. Beyond the sanction, something else matters more: without a channel, an organisation learns of wrongdoing from the press or a regulator rather than from its own employee.

How does a whistleblowing system differ from an email inbox?

An inbox records the sender's address and tracks no deadlines. The system stores no IP address, runs the conversation through a case number and PIN, counts the statutory acknowledgement and feedback deadlines, and logs every access to a report in a record that cannot be altered. An inspection is shown a register, not an assurance.

Can the vendor read a report?

With end-to-end encryption enabled, report content and the reporter’s identity are encrypted with a key that stays with the client. The operator cannot read them even with full database access and holds no key or recovery mechanism; if the organisation loses all its keys, nobody can recover the content.

Can one system serve many branches or group companies?

Yes. Each branch can have its own report form, and permissions are granted per form and per case, so a report from a branch reaches the designated people and bypasses the local hierarchy. Law firms and IT providers serving many entities use the partner model: separate client accounts in a single panel.

Why we do not publish client names

The discretion we promise whistleblowers extends to the organisations that trust us. The examples above illustrate typical use and do not describe specific deployments. If an organisation chooses to talk about its channel publicly, it will do so with its own consent and under its own name.

Recognise your situation?

Let us talk about how a reporting channel would work in your organisation. No obligations.

Book a call about your scenario See all features