A confidential reporting channel, every clock tracked
Staff report wrongdoing through your own page, with or without giving their name, and no account for the reporter to create. A case key lets a reporter check back and reply, the acknowledgement and feedback clocks start the moment a report arrives, and every action stays on an audit trail you can hand to an inspector.
What the Directive requires
Directive (EU) 2019/1937 requires covered organisations — private companies with 50 or more employees, most municipalities, and other public bodies — to operate a confidential internal channel where staff can report breaches of EU law. All 27 member states have transposed it into national law; Poland's own law took effect in September 2024.
The channel must accept reports with or without the reporter's name where national law provides for anonymous reporting, protect the reporter's identity under Art. 16, and keep a record of every report under Art. 18. A designated, impartial person or department has to be the one who handles each case.
Two deadlines run from the moment a report arrives: acknowledge it, and give the reporter feedback on what's being done. Missing either is a compliance failure in its own right, whatever happens to the report itself.
The deadlines
Directive (EU) 2019/1937 sets the acknowledgement clock from the moment a report arrives. Art. 9(1)(f) sets the feedback clock from the acknowledgement itself, or from the end of the 7-day window if none was sent; Klaruna counts feedback from the moment the report arrives instead, which is earlier and stricter, so it's never late.
- at most 7 daysAcknowledge the report
Counted from the calendar day the report is submitted, in the organisation's own time zone — weekends and holidays count.
- at most 3 monthsGive feedback
Measured in calendar months from the same submission, never reset by anything that happens to the case in between.
These are the Directive's own ceilings, not a national guarantee — a country's own transposition can require sooner, and Klaruna applies the stricter national clock wherever a country pack for that law exists.
How it works
- A report arrives
An employee opens the organisation's own reporting page, picks a category, describes what happened and optionally attaches files — with or without giving their name. No account is needed to submit, and none is created.
- A case key is issued
The confirmation page shows a one-time case key: a long random code only the reporter holds. It's stored only as a one-way hash, never the key itself, so losing it means losing access to the case — that's the design, not a bug.
- The handler is notified and acknowledges
The organisation's designated handler is told only that a new case exists, never what it contains, and can send a one-click acknowledgement built from the country's own wording and the case's real deadline dates.
- Dialogue continues, case by case
The reporter returns with their case key to read replies and respond, attaching further files if they need to. The handler works the case with internal notes and status changes, and can reveal a reporter's identity, if one was given, through a separate action that's itself recorded.
- Closure and the record
Closing a case requires a recorded outcome and a closure note. Every step — acknowledgement, replies, notes, closure — stays on an append-only audit trail you can export as a register (CSV) or as a case file for one case at a time.
What's included
Your own reporting page
A public page for your organisation, branded with your own logo and colours, in the languages you've enabled, with a QR code and a printable staff poster.
Anonymous by construction
Reporters choose whether to give their name. Either way, they come back with a case key, not an account, to read replies and respond for as long as the case stays open.
Files, handled carefully
Reporters can attach images, PDFs, Office documents, text files and audio recordings, both when they submit and whenever they reply.
A queue that shows what's due
Every open case with its acknowledgement and feedback countdowns, coloured as they approach the deadline, filterable by status and category, with an unread flag for reporter replies.
One-click acknowledgement
A ready-made acknowledgement letter in the country's own wording, referencing the case's actual deadline dates, editable before you send it.
Register and case file exports
A CSV register of every case, including ones already erased under retention, and a case file export for a single case at a time.
Retention you control
Closed cases are erased after the period you choose. The register entry stays, so the record that you handled the case survives.
Built for advisors
A consultancy handling cases for several client organisations sees every client's queue and deadline health from one dashboard, with one login.
Data and security
Everything runs in EU data centres: the application, the database, file storage, backups and email delivery.
Report content is encrypted at rest with a key unique to each case, and the case key itself is never stored — only a one-way hash, so it can't be recovered, by Klaruna or anyone else, if a reporter loses it.
Location and author metadata is stripped from image, PDF and Office-document attachments before they're stored. Audio attachments — voice notes — are stored as submitted, without that scrubbing step.
Every action on a case — acknowledgement, replies, notes, status changes, identity reveals — is written to an append-only, hash-linked audit trail, and a handler who may be a case's own subject can be excluded from opening it at all.
The acknowledgement letter comes from your country's own legal pack, not a sign-off on your specific situation: where that pack has had no independent legal input yet — true for Poland today — every letter generated from it carries a visible notice saying so.
Where it applies
The workflow and deadline tracking work in every EU country. Legal templates are available for Poland, with more countries to follow.