A key for every company
Report content, messages and files are encrypted with a separate key per company. Data stays in India.
Trust centre
Private by design. Here is the proof.
Three facts, the rules we map to, and where to reach us.
To open a sealed name
Revealing who reported needs a second person, and the reporter is told. SpeakUpSafe staff see counts only.
Controls with tests
Mapped to ISO/IEC 27001 and SOC 2, each with the tests behind it, and an evidence pack for auditors.
Mapped toControls mappedISO/IEC 27001:2022Controls mappedSOC 2Built inDPDP Act 2023Built inEU Directive 2019/1937Built inPOSH Act 2013
SpeakUpSafe has not been through an ISO/IEC 27001 or SOC 2 audit yet. We build to those standards, and the register below shows each control and how it is tested.
Controls register (24)
| Control | ISO/IEC 27001 | SOC 2 | How it works |
|---|---|---|---|
| Access by role and need to know | A.5.15, A.8.3 | CC6.1, CC6.3 | Permissions per role, case scope by category and location, people named in a report blocked from it, hidden details per role |
| Strong sign-in | A.5.17, A.8.5 | CC6.1 | Email one-time codes with limits, two-step sign-in for staff and SpeakUpSafe staff, single sign-on with OpenID Connect (PKCE, nonce, token checks) |
| Session security | A.8.5 | CC6.1 | httpOnly cookies, idle time-outs (15 minutes for staff), absolute expiry, sign out of other devices |
| Encryption of report content | A.8.24 | CC6.1, CC6.7 | AES-256-GCM with a key per company; reporter identities in a separate sealed vault; keyed hashes for tokens and phone numbers |
| Tamper-evident audit log | A.8.15, A.8.17 | CC7.2, CC4.1 | Append-only activity log with a hash chain, checked on screen and in exports; staff sign-ins with IP |
| Monitoring and status | A.8.16 | CC7.2, CC7.3 | Scheduled job runs recorded; public status page for the database, scheduler and email delivery |
| Retention and deletion | A.5.34, A.8.10 | P4.2, P4.3 | Retention per company and category, 30-day warning, legal holds with two-person release, anonymisation or deletion |
| Data subject rights | A.5.34 | P5.1, P5.2 | Export and erasure for employees; rights requests log for people named in reports with exemptions recorded |
| Data leak prevention | A.8.12 | C1.1 | Content-free emails and webhooks, counts-only dashboards with small numbers hidden, metadata-only reporting API |
| Outbound connection safety | A.8.23, A.8.20 | CC6.6 | Webhooks and identity provider addresses must be public https; DNS checked against private ranges |
| Secure development | A.8.26, A.8.28 | CC8.1 | Typed code, lint rules that stop company code reading the reporter vault or private diary, security headers and nonce-based CSP |
| Testing in development and acceptance | A.8.29 | CC8.1, CC7.1 | Unit, integration and security tests against a real Postgres; end-to-end and WCAG tests in a browser; all on every push |
| Change management | A.8.32 | CC8.1 | Every change in Git with review history; database changes only through versioned migrations; settings changes logged with before and after |
| Cloud and supplier security | A.5.23 | CC9.2 | Hosting and database in India (Mumbai); sub-processors listed; AI provider off unless the company opts in, counted in the AI register |
| Incident handling | A.5.24, A.5.26 | CC7.4, CC7.5 | Security contact and disclosure policy, CERT-In 6-hour and Data Protection Board 72-hour referral deadlines on cases |
| Legal and regulatory requirements | A.5.31, A.5.36 | CC2.3, P1.1 | Compliance profiles start legal clocks (Companies Act, SEBI, POSH, EU Directive); compliance register kept up to date |
| Reporting of events | A.6.8 | CC2.2 | The portal itself: anonymous, confidential or open reports, guest and kiosk reports, protection from retaliation |
| Segregation of duties | A.5.3 | CC5.1 | Maker-checker for closing cases and other actions, two-step approvals, legal hold release by a second person, no reviewing your own declaration |
| Access rights reviews | A.5.18 | CC6.2, CC6.3 | Evidence pack lists every staff account with roles, two-step status and last activity; outside advisers expire on a set date; SCIM removes leavers |
| Privileged access | A.8.2 | CC6.1 | SpeakUpSafe staff see counts only through a restricted database role; support sessions need the company's consent, are time-limited and logged |
| Backups | A.8.13 | A1.2 | Daily database backups and point-in-time recovery by the database host; encryption keys backed up separately by SpeakUpSafe |
| Shared and personal devices | A.7.7, A.8.1 | CC6.4 | Quick exit, no offline copies, kiosk screens that clear themselves and store nothing |
| Acceptable use and privacy notices | A.5.10 | C1.2 | Notice before first use, policies and FAQ with versions, AI help labelled where it appears |
| Documented procedures | A.5.37 | CC2.1 | Architecture, compliance register, DPIA, security and deployment guides kept with the code and updated each phase |
Who processes data for us
| Company | What for | Where | When |
|---|---|---|---|
| Amazon Web Services (EC2, S3) | Runs the app and holds the database, the encrypted files and their backups | India (Mumbai) | Always |
| Cloudflare | Carries traffic to the server: encryption in transit, firewall, protection from attacks | Global network | Always |
| Resend | Sends notification emails (an address and a short sentence, never report content) | Global delivery | Always |
| Anthropic | AI help on the website (the reporting assistant, Ask, translation). Case AI never goes here: it runs on our own model or the company's | As set by the provider; nothing kept | Off. Only if SpeakUpSafe turns it on and the company opts in |