Whistleblowing channel
Spanish Law 2/2023 · EU Directive 2019/1937
The channel that hides nothing from you.
Spanish Law 2/2023 does not ask for a mailbox. It asks for a procedure: acknowledgement of receipt within seven days, a resolution within three months, reinforced confidentiality for the reporting person, a designated System Officer to run it, a traceable record of everything done, and a route out to the competent authority.
Almost the whole market sells the mailbox. Integryty Lab builds the procedure.
Tracking code
7K2M · 4XQP · 9DR3
Acknowledgement · art. 9.2 Sent · day 2 of 7
Resolution · art. 9.2 Day 34 of 90
Identity of the reporting person
Encrypted with a key of its own for this case. Visible only to the assigned investigator.
SHA-256 chain of custody · 14 chained actions
7 days
Acknowledgement, counted for you
It warns before the deadline, not after
3 months
Resolution, with its regulated extension
One only, and with written grounds
11
Competent authorities, already in
The national one and the ten regional
0
Third parties in the public form
No typefaces, no analytics, no CDN
The procedure
Six stages, from the form to the authority
The whole route of a report, closed end to end. Each stage leaves its chained trace, and none of them depends on somebody remembering to take the next step.
Still not sure whether the law applies to you? We explain it article by article, in Spanish, in our guide on which companies are required to have a whistleblowing channel.
01 · Report
Public form, anonymous or identified. A tracking code is generated that is the only key to the case file, and only the reporting person holds it.
02 · Triage
Whoever runs the channel weighs seriousness, urgency and risk of retaliation under ISO 37002, and assigns an investigator. They see metadata; they do not see identities.
03 · Investigation
The investigator looks into it, puts questions to the reporting person through a secure channel without breaking anonymity, and attaches the evidence as it is gathered.
04 · Resolution
It closes with a conclusion — substantiated, unsubstantiated or referred — an internal reason and a text addressed to the reporting person. The case file is then sealed.
05 · Case report
A PDF with the verifiable chain of custody, built to leave the organisation without taking with it what must not go out.
06 · Referral
Sent on to the AIPI, the national whistleblower protection authority, or to the competent regional one, with the destination recorded and checkable.
Double-blind
There is no ladder here where the boss sees everything.
The reinforced confidentiality the law requires does not hold up on an internal policy: it holds up on a division of access that makes the question impossible. Each role sees exactly what it needs, and nothing else.
Whoever runs the channel
Every case in the organisation
No identity at all, not even in the cases they assign
Whoever investigates
The identity in their own case
And in no other. Every access is logged
Whoever administers the platform
Users and configuration
And sees no cases whatsoever
Asking for an identity through the role system does not return a «no». It returns an error, because it is a question that mechanism cannot answer.
And when there is a legitimate reason to lift the veil, it takes dual control: a second person from the organisation, a single-use approval and three audit events in order.
The guarantees
Anonymity that holds up under technical scrutiny
Promising confidentiality on the front page is not enough. These are the three pieces that hold it up when somebody really looks.
No third parties
The public form works without JavaScript and without a single request to a third party: no typefaces, no analytics, no CDN. Nothing is left behind to correlate who came in to report.
Encrypted case by case
Each case file is encrypted with a key of its own derived inside AWS KMS. No key is stored, and every access to an identity leaves a trace in the AWS log, not only in ours.
Clean metadata
Documents supplied have author, software and coordinates stripped out, and are then checked to confirm they really did come out clean. If a format cannot be cleaned, we say so.
The deadlines run on their own
The system counts the seven days for the acknowledgement and the three months for the resolution, and applies whichever counting rule fits, depending on whether receipt was acknowledged or not.
The extension, by the book
It allows the extension the law permits: one only, and with written grounds. It stays in the case file like any other action.
It warns before, not after
And a case with no investigator assigned yet warns all the same: that is precisely the one that needs it most.
AI, off by default
Unconfigured it analyses nothing, and even configured it only acts in the organisations that switch it on. A client who does not want AI over their whistleblowers' evidence does not have it.
And in Europe
Processing is restricted by code to European destinations, and there is a test that fails if anybody changes that.
And it can be refused
The reporting person is told their documents will be analysed automatically, before they supply them, and they can refuse. If they refuse, the documents are not analysed.
Contradictions are flagged
If two pieces of evidence in the same case file put the same fact on different dates, or give different amounts, the system flags it and says in which documents. Resolving the contradiction is the investigation itself, and that is done by a person who answers for it.
The report leaves the organisation clean
It is produced by whoever investigates, but it is read by an auditor or an authority, and that decides what goes in it: what happened, when, who did it, how it ended and how to check it. Without the identity, and without the retaliation-risk breakdown, which in a small workforce would let you work out who it is.
Fitting into Spain
It knows which authority to refer to, and which one is actually operating.
Several European competitors handle anonymity and encryption well. What none of them handles is the relationship with the Spanish authorities, and that is where a channel stops being a generic tool and starts being of real use.
Integryty Lab ships the full catalogue — the national AIPI, the independent whistleblower protection authority, and the ten regional ones — transcribed from the official source, with the instrument that created each one.
11
competent authorities in the system: the national one and the ten regional, each with the instrument that created it.
And it tells you which one is not operating yet
Some regional authorities have been created but do not yet exercise their powers. The system says so before you refer, not after.
The chain of custody, closed with a seal
Every action is chained with SHA-256. On closing, the case file gets a seal that sums up what it held at that moment: if an event later goes missing, is added or is altered, the seal does not add up and the system refuses to issue the report. A sealed document is taken as good by whoever receives it; so if the chain is broken, what does not happen is handing it over.
The limits
Where the machine ends and you begin
These boundaries are documented decisions, not features still to come. They define the product almost as much as everything above, which is why they are here and not in the small print.
Evidence once supplied stays
There is no route to delete it. Evidence quietly withdrawn is exactly what a whistleblowing channel cannot allow.
A person signs the investigation
The system flags which pieces of evidence contradict each other and in which documents. Deciding which one is right is the investigation itself, and there is no field anywhere for the system to do it in.
The tracking code cannot be recovered
Being able to recover it would mean somebody else can obtain it. That is the honest price of anonymity that holds.
A closed case file stays closed
It is not closed twice, and nothing is written into one already resolved: that would rewrite the conclusion and the seal of a case file that has already gone out. And when something fails, the status «could not be verified» reaches whoever reads the result, instead of staying in an internal field.
Pricing
By headcount, with the price in front of you
A whistleblowing channel is a legal obligation, not an impulse purchase: you need to know what it costs before asking for a meeting. Annual fee paid in advance, no setup fee, and the full terms below.
Essential
1 – 49 employees
€290
per year · VAT not included
For entities under the obligation by a route other than headcount: the public sector, municipalities and sector-specific obliged parties.
Starter Most common
50 – 249 employees
€590
per year · VAT not included
The band where the Spanish Law 2/2023 obligation starts by number of employees.
Professional
250 – 999 employees
€1,490
per year · VAT not included
Organisations with several sites and a case volume that means spreading the investigation across more than one person.
Enterprise
1,000 employees or more
Custom
Groups and multi‑entity
It carries no list price on purpose: at this size the configuration of entities and roles is what decides the scope.
If you have fewer than 50 employees, read this before you sign
Below that threshold, the obligation to have a channel does not come from the number of employees. You may be under it by another route — the public sector, a municipality of more than 10,000 inhabitants, a sector-specific obliged party — or not be under it at all. We cannot tell from headcount and we do not guess: we tell you, and you confirm it before signing.
Terms
Why we build it this way
Asking for an identity you are not entitled to returns an error, not a «no»
Because it is a question that mechanism cannot answer, and saying so is more honest than refusing the request. The same idea governs the other two products: we build systems that know when they do not know, and say so.
The JRV Lab paradigm →Getting started
Your trial starts with the whole route
From the report to the referral, with synthetic data, so you see the entire procedure before deciding anything. The deadlines running, the triage, the double-blind access and the closing report — exactly as they would work in your organisation.