Prototypes Nordlys ApS Speak UpP7 · Whistleblower channel
Speak upAnonymous and encrypted

Report a concern

Tell us what happened. You do not give a name or an email, and the report is encrypted in this browser before it is sent. You get a receipt code, and with it you can read our answer and write back.

As much as you know. Leave out your own name if you want to stay anonymous.

Roles are enough, for example the purchasing manager.

Encrypted for Nordlys ApS

What we can see

  • The report, after we open it with the organization’s private key.
  • When it was sent, and when you wrote back.

This server stores no address, no browser details and no account. Cloudflare’s network sees the connection, as the network of every host does.

Coming back

Keep the receipt code. On the page for your report, the code opens the conversation with the case handler in this browser.

How Nordlys ApS Speak Up is built
  1. The page makes a receipt code of 80 random bits. PBKDF2 turns the code into two values: the case number and the case key.
  2. The report is encrypted with the case key. The case key is also wrapped for the organization’s public key, so the case handler can open it.
  3. The server stores the case number, the wrapped key and ciphertext. It never sees the code, so it cannot find a case from a person or a person from a case.
  4. Coming back, the code gives the same case number and the same key, and the conversation opens in this browser. Data on the server is deleted after 7 days.