Software by DesignNextcloud Apps
WhistleCheck · Anonymous whistleblowing channel

WhistleCheck

A HinSchG / EU-2019/1937-ready internal reporting channel that runs entirely on your own Nextcloud — anonymous, end-to-end encrypted, statutory deadlines built in, no plaintext ever on the server.

We improve this app with real-world use. Bug reports, rough edges, and ideas help — open a GitHub Issue or write to info@software-by-design.de.

Get WhistleCheck on GitHub Contact us

What you get

  • Free AGPL web app — runs entirely on your Nextcloud
  • Anonymous report submission — no account, cookie or session; strict CSP, no third-party requests
  • End-to-end encryption via libsodium: per-case content keys, wrapped to case officers and the reporter’s one-time case code
  • Reporter follow-up via case code only — constant-time checks, no existence oracles
  • Statutory workflow built in: automatic receipt confirmation (§ 17 (1) HinSchG), 3-month feedback clock with reminders
  • Case management: inbox, statuses, assignment, encrypted internal notes, legal hold, optional two-person close rule
  • Verifiable retention: crypto-shredding after the configurable period (§ 11 (5) HinSchG)
  • Append-only, hash-chained audit log — proves the procedure, never leaks content
  • Configurable channel texts, categories, attachment policy, retention and access — English and German included

Requirements

  • Your organisation’s Nextcloud (HTTPS in production)
  • Client-side encryption needs JavaScript in the reporter’s browser — an honest server-side fallback exists when it is off

Questions? info@software-by-design.de

Pricing & licensing

Web app

Free

AGPL-3.0-or-later — the full reporting channel, case management and audit log. No licence key, no seat fees, no paid tier.

Install from GitHub

Optional

Sponsored features

Need a workflow variation shipped sooner or tailored to your sector? We take sponsored feature work — tell us what you need.

Frequently asked questions

Is WhistleCheck really free?

Yes — AGPL-3.0-or-later, no paid tier and no licence key. There is deliberately no paid companion app; the responsive web UI covers reporters and case officers, and fewer binaries means fewer trust surfaces for a reporting channel.

Does it cover HinSchG / the EU Whistleblowing Directive?

It implements the statutory workflow on infrastructure you control: automatic receipt confirmation (§ 17 (1) HinSchG), the 3-month feedback clock, and verifiable retention with crypto-shredding (§ 11 (5) HinSchG). The legal conformity assessment for your organisation remains with your counsel — we provide the tooling.

Why run it on our own Nextcloud instead of a SaaS channel?

Case content never leaves your infrastructure — reports are end-to-end encrypted, the server holds no plaintext, and there are no third-party requests. A breach of an external provider cannot expose your cases.

Support this app

These apps are maintained in public. If WhistleCheck helps your organisation, you can fund ongoing work through GitHub Sponsors. Want a feature shipped sooner or tailored to your setup? Contact us — we are happy to discuss sponsored feature development. Product feedback — bugs, rough edges, missing pieces — is always welcome via GitHub Issues or info@software-by-design.de; it directly shapes what we build next.

Companion licences fund the maintenance, updates, and support behind the free web apps — open source is free to use, not free to build.

Sponsor on GitHub Discuss sponsoring a feature