Security
GDPR permits transfers outside the EU/EEA with an appropriate legal basis and transfer mechanism. EU hosting is an operational choice, not a universal legal requirement. The subprocessor list distinguishes providers and data types; billing data is handled separately.
- TLS protects data in transit. Sensitive report fields and private attachments use server-side AES-256-GCM encryption. The application decrypts for authorised users and server-side analysis; operators with access to the service and its keys can also decrypt.
- We hold no ISO 27001 certification or SOC 2 attestation. We make no blanket guarantee of NIS 2 or AI Act compliance.
- Audio add-on â coming soon. Audio recording and audio-file uploads are unavailable. Written reporting and in-person meeting requests are included. The organisation arranges its oral reporting route and requested meetings under applicable law.
Data flow, keys and responsibilities
TLS protects data in transit. Sensitive report fields and private attachments use server-side AES-256-GCM encryption. The application decrypts for authorised users and server-side analysis; operators with access to the service and its keys can also decrypt.
We hold no ISO 27001 certification or SOC 2 attestation. We make no blanket guarantee of NIS 2 or AI Act compliance.
Application and database: The server is located in Stockholm, Sweden (EU/EEA) and is operated by Manpro Invest AB.
| Browser â service | TLS protects transport. The audio add-on is coming soon; new audio recording and audio-file uploads are disabled. Optional analytics does not load on reporting pages. |
|---|---|
| Application â database | Report titles, narratives, reporter contact details, chat, audio and sensitive snapshots use application-level encryption. Organisation and account data and case status are outside this field-encryption scope. |
| Attachments | Private files are encrypted before storage and decrypted after authorisation. Public branding assets are outside this scope. |
| Keys and access | The service holds keys in Vault and injects them as runtime secrets. Derived keys separate database fields, files and backups. Rotation retains old keys until data and backups have been migrated or expired. Customer-owned keys are not currently available. |
| Backup and restore | Operations jobs handle daily backups and regular restore drills. Recovery requires both the backup and its decryption keys. Database field encryption does not replace whole-backup encryption. |
| AI processing | Text can be decrypted for server-side categorisation on our own infrastructure. Audio transcription and voice distortion are unavailable. |
We publish no claim of external penetration testing or formal certification without verifiable evidence. Ask support for current security evidence.
Verified operational evidence
Checked 16 October 2026: existing report content has been migrated to field encryption. Daily database backups are encrypted as whole files before persistent storage and copied encrypted to separate storage. Restore drills before and after the data migration succeeded, including reads of protected fields. Backups expire after seven days.
This is a dated technical check, not certification or an uptime commitment. During an incident, Manpro investigates its scope, contains the impact and notifies affected controllers under the DPA. Report suspected security problems through the contact below without sending case content by ordinary email.
Supplier security evidence
Sources checked: 20 October 2026, Mailjet 22 October 2026. Evidence applies to each providerâs stated services. It does not certify Whistlechannel or Manproâs own application and database infrastructure.
- Hetzner Online GmbH · Public ingress in Finland
SOCOTEC certificate ZN-2025-35 V 1.1 for ISO/IEC 27001:2022 covers the providerâs hosting and data centres, including Tuusula in Finland. Stated validity: 27 September 2025â26 September 2028.
- BunnyWay, informacijske storitve d.o.o. (bunny.net) · CDN and DNS
The provider reports ISO 27001 certification. Current certificate validity and scope for the services we use have not yet been verified.
- Stripe · Subscriptions and billing, no report content
The public SOC 3 report linked by Stripe at review covers payment and billing systems for 1 October 2024â30 September 2025. Newer SOC evidence and any bridge letters need to be checked in the Stripe Dashboard.
- Mailjet · Email notifications
Mailjet states storage in Germany and Belgium and ISO 27001 certification. These are public provider statements; the certificateâs current scope has not been verified. The existing account and sender domain were checked without sending mail.
Designed around