---
title: Getting started with whistleblowing
description: Understand the reporting scheme, its permissions, the case access rule and what each profile sees.
url: "http://illizeo.com/en/centre-aide/whistleblowing-getting-started/"
updated: "2026-11-11"
category: Whistleblowing
---

# Getting started with whistleblowing

The Whistleblowing module is your organisation’s reporting scheme. Anyone — employee, former employee, supplier, partner — can use a public portal to report a concern, without an account and, if they wish, anonymously. The report goes only to the handlers of the chosen channel, who deal with it in Illizeo and exchange with the reporter through secure messaging. The screens refer to EU Directive 2019/1937 on the protection of whistleblowers, which French law transposes through the Sapin II Act. This article introduces the module, its screens, its permissions and what each profile sees; it is aimed first at the administrators who set it up.

## The module at a glance

The module opens from the **Whistleblowing** menu entry, which has three tabs, and is configured under **Settings › Whistleblowing**.

- **Dashboard**: the figures for your cases and, if you have the right, the scheme’s compliance card — described below.
- **Reports**: the case list and case handling — see [Handling a whistleblowing case](https://illizeo.com/en/centre-aide/whistleblowing-handling-a-case/).
- **Analytics**: statistics, deadline compliance and export — see [Analytics, export and data privacy](https://illizeo.com/en/centre-aide/whistleblowing-reports-and-gdpr/).
- The **public portal**, where a report is submitted and tracked — see [Submitting and tracking a report](https://illizeo.com/en/centre-aide/whistleblowing-submitting-and-tracking-a-report/).
- The **channels** and their **handlers** — see [Setting up channels and naming handlers](https://illizeo.com/en/centre-aide/whistleblowing-channels-and-handlers/).
- The other **settings**: confirmation message, legal deadlines, organisation, DPO, appearance — see [Configuring the scheme](https://illizeo.com/en/centre-aide/whistleblowing-settings/).

## Before you start

- The Whistleblowing module must be subscribed in your workspace and open to your account. Without a subscription, the public portal accepts no reports.
- The module’s rights are in the role catalogue, under **Manage Employees › Employee Roles**. By default:
  - **Whistleblowing report**, which opens the module: Administrator (**Admin** level), HR (**Execute** level), Auditor (**Access** level);
  - **Reports — View**: Administrator, HR and Auditor; **Reports — Export**: Administrator and HR at **Execute** level;
  - **Whistleblowing — Read case audit trail**: Administrator, HR and Auditor;
  - **Settings — Compliance (GDPR / EU 2019/1937)**: Administrator, and read-only for HR and Auditor;
  - the configuration rights (**Channels — List**, **Channel — Create**, **Channel — Edit**, **Channel — Configure (managers)**, **Settings — General**, **Settings — Notifications**, **Settings — Anonymization / consent**, **Tenant — Branding (logo/colors)**, **Tenant — Custom domain**, **Tenant — Configure DPO**, **Whistleblowing — Full administration**): Administrator only.
- The module does not manage permissions itself: it has no “access” screen. Everything goes through the application’s role matrix.

## The case access rule

This is the point to understand first. In this module, access to cases does not follow ordinary roles:

1. **permissions** open the module;
2. the **channel** opens the case: you only see a case if you handle the channel that received it;
3. two situations close it whatever else is true: being **implicated** in the case, or being recused from it.

That denial cannot be overridden: neither an administration role nor system-administrator status lifts it. It is the guarantee owed to the person who reported, and every denial is recorded in the case’s audit log. In practice, an administrator who handles no channel sees no case, and a director who is implicated does not see the case that concerns them.

## What each profile sees

- **The person reporting** has no account. They submit on the public portal, receive a tracking password, follow progress and exchange with the handler without identifying themselves.
- **The handler** (or manager) is an employee named on one or more channels. They see the cases of their channels, take them on, acknowledge receipt, exchange with the reporter, record the persons concerned and close the case. They are notified of new cases and replies in the module’s bell and by email.
- **The scheme administrator** sets up channels, names handlers, writes the confirmation message, sets deadlines and retention, and records the DPO. They only see the cases of channels they handle themselves.
- **The DPO or auditor** reads the analytics and, with the compliance right, the **Programme compliance** card: counts of overdue cases across all channels, without any case data.

## Reading the dashboard

Open **Whistleblowing › Dashboard**.

- The **Programme compliance** card (**DPO view**) only appears with the compliance right. It counts the cases overdue for **Acknowledgement** and **Response**, and those to purge under **Retention**, with a breakdown by late channel.
- Four counters sum up your cases: **Total reports**, **New**, **In progress** and **Resolved**.
- **Breakdown by category** and **Breakdown by channel** show where reports come in.
- **Recent reports** lists the latest cases with their status, priority, remaining time and assignee.

![Dashboard seen by a handler: Programme compliance card marked DPO view with the counters Acknowledgement · 7 d (1 overdue), Response · 90 d (0) and Retention · 36 months (0 to purge), and the Harcèlement et discrimination channel flagged with 1 overdue; four counters 3 reports, 1 new, 1 in progress, 0 resolved; breakdowns by category and by channel; Recent reports table with three cases.](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/lanceur-alerte-01.en_-scaled.png?resize=800%2C550&quality=80&ssl=1)
The dashboard counts only your cases; the compliance card counts every channel.

## Following notifications

The bell to the right of the tabs opens the module’s notifications. They announce a new report, a reporter’s reply, and deadlines that are close or overdue. Click a notification to open the **Reports** tab; **Mark all as read** clears the counter. A person implicated in a case never receives its notifications.

![Notifications panel open beside the Reports tab of the Case Management page, with the counter 7 and the Mark all as read button: notifications about an overdue legal deadline, an upcoming legal deadline, new reports and reporter replies (their titles are displayed in French on this demo workspace), each with the case reference, channel and date.](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/lanceur-alerte-08.en_-scaled.png?resize=800%2C498&quality=80&ssl=1)
Notifications announce cases, replies and deadlines.

## Understanding your access: the My access page

Open **Settings › Whistleblowing › My Access**. The page explains why you can — or cannot — see a report:

- **Your role in the scheme**: **Administrator**, **Manager**, **DPO**, **Auditor** or **Reader**. This role is not assigned in the module: it is derived from the permissions you hold, listed under **Permissions held** together with the **Roles granting them**;
- **Channels you handle**: it is the channel, not your role, that decides which cases appear in your list;
- **How access to a case is decided**: the rule described above;
- **Password, two-factor authentication and sessions**: these belong to your Illizeo account and are managed there (**Open my Illizeo account**).

![My access page of an administrator whose name and email are blurred: Your role in the scheme card with the Administrator badge derived from the permissions, a note for system administrators, Permissions held and Roles granting them lists; Channels you handle card; How access to a case is decided card with its four rules; Password, two-factor authentication and sessions card with the Open my Illizeo account button.](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/lanceur-alerte-02.en_-scaled.png?resize=800%2C676&quality=80&ssl=1)
Derived role, handled channels and access rule, in one place.

## Setting up the scheme

1. Check the role permissions under **Manage Employees › Employee Roles**: who opens the module, who sees analytics, who administers.
2. Create the channels and name at least two handlers per channel: [Setting up channels and naming handlers](https://illizeo.com/en/centre-aide/whistleblowing-channels-and-handlers/).
3. Write and enable the confirmation message, check the acknowledgement deadline and record the DPO: [Configuring the scheme](https://illizeo.com/en/centre-aide/whistleblowing-settings/).
4. Set the retention period: [Analytics, export and data privacy](https://illizeo.com/en/centre-aide/whistleblowing-reports-and-gdpr/).
5. Share the portal address with employees and the partners concerned.

## Good to know

- The module does not replace your internal reporting procedure: it is the tool for it. Its legal content (deadlines, notices) follows what the screens cite; it is not legal advice.
- The default deadlines are 7 days for the acknowledgement of receipt and 90 days for feedback to the reporter.
- Every action on a case, including simply opening it, is recorded in its audit log.
- Emails sent to handlers contain metadata only (reference, category, priority, channel), never the account of the facts.
- The module does not configure connectors to other tools: integrations are set up in the app store.

## Frequently asked questions

### I am an administrator and my report list is empty. Why?

Because you do not handle any channel that has received a case. Permissions open the module, not the cases. Your **My Access** page confirms this.

### Who should be a handler?

The module leaves the choice to you: any employee can be named on a channel. Naming at least two handlers per channel keeps cases moving during an absence, and lets one handler take over if the other is implicated.

### Does the reporter need an Illizeo account?

No. The portal is public and asks for no account: that is what allows outside people to report and everyone to remain anonymous.

### *Similaire*