Designed to survive discovery
Tenant isolation
Every table is protected by row-level security keyed to your organization. A staff account can only ever read cases belonging to the tenant it is granted a role in.
Zero-knowledge reporting
Anonymous reports store no name, no email, no IP address and no device signature. Only a salted SHA-256 hash of the reporter's passphrase is persisted — the passphrase itself is shown once and never stored.
Metadata scrubbing
Evidence is re-encoded from raw bytes under a sanitised filename before it enters the vault, so camera GPS coordinates, device serials and document authorship do not travel with the file.
Append-only ledger
Each audit entry embeds a SHA-256 hash of its own contents plus the previous entry's hash. Database triggers reject UPDATE and DELETE outright, so any tampering breaks the chain visibly.
Least-privilege roles
Super Admin, Client Admin, Investigator and Reporter are separate roles stored in a dedicated table and evaluated by security-definer functions — never inferred from a profile field.
Retaliation controls
Conflict-of-interest detection removes named recipients from a case at intake, and the ledger evidences exactly who could see what, and when.
Framework mapping
- ISO 37002:2021Case stages, feedback obligations and impartial handling.
- EU Directive 2019/19377-day acknowledgement and 3-month feedback clocks tracked and escalated per report.
- Sarbanes-Oxley §301Confidential, anonymous submission channel for accounting concerns.
- GDPR / data minimisationNo reporter identifiers collected unless the reporter opts in.
- WCAG 2.1 AAKeyboard-navigable, screen-reader-labelled intake on mobile and desktop.