Who is responsible
Coalfire Systems, Inc. operates Speak Up so that workers, contractors, clients and others can raise concerns about conduct. Reports are handled by designated investigators in the Legal and People teams. TODO Legal Data protection contact details for each region.
What we collect, and what we don't
- We collect only what you choose to enter: the details of your concern, any files you attach, messages you send, and your name and contact details if you choose to share them. All of this is encrypted on your device and can be read only by the investigators you allow and a sealed recovery key held by Legal.
- We store unencrypted only what is needed to run the process: the category and region you select, the date (not time) of submission and of later activity, case status, and which investigators can read the case.
- We do not collect your IP address, device, browser details or location. The service keeps no access logs for reports, sets no cookies, and uses no analytics or third-party services.
Why we process it
To receive, assess and investigate concerns, protect people from retaliation, and meet our legal obligations, including the EU Whistleblowing Directive as implemented in Ireland, the UK Public Interest Disclosure Act and U.S. federal contracting requirements. TODO Legal Confirm lawful bases per jurisdiction.
People named in a report
If you are named in a report you have rights under data protection law, including being told about the processing. We may delay telling you where doing so would put the investigation or the reporter at risk. The identity of a reporter is never disclosed to the person reported without the reporter's consent, except where the law requires it.
How long we keep it
Cases are permanently deleted after a retention period that depends on the outcome, for example 60 days for reports that need no action and up to 7 years for substantiated cases. TODO Legal Confirm the retention schedule.
Where it is stored
Encrypted data is stored in Amazon Web Services in TODO region. Because content is encrypted on your device, AWS and Coalfire administrators cannot read it.
Your rights
You can ask to access, correct or delete personal data about you. For anonymous reports we cannot link a request to a report unless you provide your receipt key. You can also complain to your data protection authority.