Security and compliance
Confidentiality is the product
A whistleblowing tool that leaks is worse than none. This is how ClearVoice protects reporters, evidence and your organisation's data.
Principles
Six ideas behind every control
Encrypt what matters
Report content, messages, notes, contact details and evidence are encrypted individually.
Least privilege
Every action is checked against permissions on the server. Administrators configure but cannot read cases.
Protect the reporter first
No IP or device logging, a separate identity vault and four-eyes disclosure.
Prove nothing changed
A tamper-evident audit log with a built-in verification check.
Keep every customer apart
Each organisation's data is kept separate from every other organisation's.
Private by design
Reporting pages load no tracking scripts, and emails carry no case details.
Data protection
Encrypted individually, kept apart completely
Sensitive information is protected where it lives, and each organisation's data is kept separate from every other's.
Encryption
- Report narratives, people involved, answers, messages, notes and contact details are encrypted individually
- Evidence files are encrypted at rest
- Reporters are guided to keep names out of case titles
Keys
- Encryption keys are kept apart from the data
- Keys can be rotated
Separation between organisations
- Your organisation's data is visible only to your organisation
- Access is always checked against your organisation
Access control
Permissions the server enforces on every request
Nothing relies on hiding a button. If you lack a permission, the server says no.
Role-based access
- Five system roles and custom roles
- Changes apply immediately
Separation of duties
- Administrators configure, but cannot read cases
- No default role can reveal identity
- Closure and identity approvals can need a second person
Conflict enforcement
- Implicated person and reporting line excluded
- Whole implicated department excluded
- Restricted cases need an extra permission
Safe administration
- You cannot grant what you do not hold
- Access ends the moment a user is deactivated
Sign-in
Protected sign-in
Sign-in is protected against guessing, and staff can add a second step.
Passwords
- Strong password rules
- Repeated failed attempts are slowed and locked out
- Failures reveal nothing about which accounts exist
Two-step sign-in
- Authenticator-app codes
- Single-use recovery codes
- Available to every member of staff
Sessions
- Short-lived sessions
- Protected cookies that page scripts cannot read
- Access can be revoked immediately
Reporter anonymity
Designed so that nothing identifies a reporter by accident
Anonymity fails through small leaks. We closed them one by one.
At the reporting page
- No IP address or device identifier stored with reports
- No tracking scripts, and the referrer is suppressed
- Anonymous reports contain no contact details
- The access code is shown once and never stored in readable form
Inside your organisation
- Identity kept in a separate encrypted vault
- Viewing needs a permission, a written reason and no conflict
- Optional four-eyes approval
- The audit log records who and why, never the identity
Audit and evidence
A record you can prove, files you can trust
When someone challenges what happened, you need evidence of your own process.
Tamper-evident audit log
- Entries are linked, so a change or deletion is detectable
- The log can only be added to
- One-click integrity check pinpoints the first broken entry
- Entries never contain allegation text or identity
Evidence safeguards
- Files are checked before they are accepted
- Executable and risky file types are refused
- Encrypted at rest, with version history
- Chain of custody, and integrity re-checked on every download
Compliance
Designed to support your programme
ClearVoice is built around these frameworks. It is not certified against them, and no tool makes an organisation compliant by itself. Have legal counsel confirm your use in each jurisdiction.
| Framework | What it expects | How ClearVoice helps | Your part |
|---|---|---|---|
| EU Whistleblower Directive 2019/1937 | Confidential channels, acknowledgement within 7 days, feedback within 3 months, protection from retaliation | Anonymous channel and mailbox, configurable acknowledgement and feedback deadlines with pauses and warnings, retaliation concerns | Set your deadlines, appoint impartial handlers, keep your policy current |
| ISO 37002 | Impartiality, confidentiality, protection, assessment, investigation, closure | Conflict-aware routing, role separation, identity vault, retaliation module, case lifecycle with approvals | Policies, protection assessments, management review |
| GDPR and Nigeria Data Protection Act 2023 | Lawful processing, minimisation, security, retention, data-subject rights | No IP or device storage, encryption, separation between organisations, audit trail, small-group suppression | Lawful basis, privacy notices, retention periods, rights requests |
| Sector rules (for example CBN and SEC) | Configurable workflows, retention, audit | Configurable categories, rules and deadlines, and a verifiable audit trail | Map your regulator's requirements to your configuration |
| Your own policies | Custom categories, approvals, deadlines | Categories, routing rules, closure approvals, custom roles and departments | Write and maintain the policies the system enforces |
FAQ
Security questions we hear most
Can ClearVoice staff read our reports?
Sensitive report content is encrypted, and access inside your organisation is controlled by permissions and audited. If you need specific assurances about who can access what, contact SLEM Technologies and we will go through them with you.
Where is our data hosted?
Hosting depends on your deployment. Contact SLEM Technologies to discuss region, hosting model and data-residency requirements.
How do we know the audit log is intact?
Open the audit log and choose Verify integrity. ClearVoice checks the whole log and tells you if any entry was altered or removed, and where.
What happens if an employee leaves?
Deactivate them. Their access ends immediately, their sessions are revoked and any cases assigned to them are released for reassignment.
Can we see your security documentation?
Yes. We can share a security overview and our compliance mapping for your review. Contact SLEM Technologies.
Do you support penetration testing by customers?
Talk to us before testing so we can agree scope and a safe time.
Need our security documentation?
We can share a security overview and our compliance mapping for your review.