Our whistleblower system (Integrity Line) maintains the whistleblower’s anonymity and ensures that their identity cannot be traced by technical means. Integrity Line is hosted on external ISO 27001-certified high security servers. No IP addresses, location data, device specifications or other data that could allow conclusions to be drawn as to the identity of the whistleblower are stored on these servers.

The whistleblower can decide for themselves whether they want to remain anonymous or provide any personal information. In any case, the content of the report is transmitted in a highly encrypted form using a public-private key procedure (PGP) with 2048 RSA bit. In addition, all server communications take place via a secure HTTPS connection.

Both EQS as a company and their software development for the Integrity Line is certified to Information Security Standard ISO 27001. The product development and its continuous development follows the “Security by Design” principle.

In addition, the system ensures full compliance with EU GDPR and worldwide data protection regulations, both for the whistleblower in the reporting process and for the case handler in the integrated case management.

Integrity Line meets the highest security and encryption requirements (data transmission and access) and thus ensures absolute confidentiality for submitted reports.

• ISO 27001-certified high-security computer center
• Systems security confirmed by annual external penetration test
• SSL-certified connection
• Cryptographically complex storage procedure
• Case specific encryption
• Key in the customer’s hand (neither EQS Group nor other third parties have access to content)
• Access to content via detailed authorization system
• Various IT security modules e.g. for user administration and data protection
• Complete protection of the whistleblower’s anonymity
• Regular security audits and penetration tests

Integrity Line is made for worldwide use and available in over 80 languages as standard.

Integrity Line offers various packages and configurations to meet different customer requirements. Out of the box solutions can be available within a few days with minimal effort on the customer’s side. Customized solutions with extended case management functions are usually available for operational use within 4 to 8 weeks. During implementation, our experienced project managers are at the customer’s side for optimal implementation and best practice consulting.

EQS Group offers the client various best practice templates for quick and easy whistleblower system implementation. These templates can be adopted 1:1 or adapted according to the customer’s requirements. Templates are already available in a large variety of languages and can also be transferred into any language. In addition to templates, our experienced project managers are also available at any time to provide advice and support to the customer throughout the entire implementation phase of the whistleblowing software.

EQS Group supports compliance with the European Data Protection Regulation (GDPR) and other data protection regulations worldwide through various measures at the organizational, technical and functional level:

At the organizational level, through measures taken for information security and data protection in the form of a proper and certified ISMS according to ISO 27001 standards. This is subject to regular internal and independent audits.

On the technical level, Integrity Line was developed according to the highest standards for data protection and security. This means

• no logging of personal data of visitors and whistleblowers
• encryption of data in transit and stored data
• no metadata analysis or research with our customer data
• opportunities for data protection notifications (disclaimers) and other information during the reporting process
• activating various security functions in relation to access and processing of data

At the functional level, Integrity Line supports the case handler in the frequent tasks and activities related to internal data protection processes. This includes

• dynamic reminders and notifications when certain data protection criteria occur, including indication of necessary actions
• support with anonymization of case details (e.g. personal data) and optionally also file attachments
• automation of internal approval procedures and dual control principle for sensitive case handling actions
• granular authorization management and role concept for fine-tuning access to sensitive case contents

In the US, whistleblowing systems are essential for companies as they play a vital role in detecting irregularities, with about two-thirds of such issues being uncovered by whistleblowers. These systems are more effective than management oversight or audits alone. Implementing a robust whistleblower system helps companies identify and address problems early, reducing the risk of significant financial losses and reputational damage. Relevant laws include the Sarbanes-Oxley Act, which mandates that publicly traded companies have mechanisms for anonymous reporting of misconduct, and the Dodd-Frank Act, which incentivizes reporting securities violations with rewards and protections.

Several high-profile cases highlight the importance of whistleblowing systems:

Enron Scandal (2001): Sherron Watkins exposed accounting fraud, leading to Enron’s collapse and the implementation of the Sarbanes-Oxley Act to prevent similar corporate fraud.

Wells Fargo Scandal (2016): Whistleblowers revealed the creation of millions of fake accounts, resulting in significant fines and highlighting the need for robust internal reporting mechanisms.

Bernard L. Madoff Investment Securities LLC (2008): Harry Markopolos repeatedly warned the SEC about Madoff’s Ponzi scheme, which was eventually exposed, emphasizing the importance of taking whistleblower reports seriously.

Implementing whistleblower systems demonstrates a company’s commitment to transparency and ethical practices, enhancing trust among employees, customers, and stakeholders.