A form on the organisation's own address
Every organisation has its own subdomain and the public form lives there. The person reporting creates no account; they submit the form and receive a reference number.
How it works
What actually happens when a complaint arrives: where the record comes from, who it lands with, which states it can move through and what trace it leaves behind.
1. The record is created
Recorded by staff
A report arriving by telephone or on paper is entered by staff on someone else's behalf. The channel the record came through stays written on it.
Community and workforce on separate lines
A worker's report and a community complaint never mix in the same list. Who sees which depends on the record type, not on anyone remembering.
2. The record finds its place
Category and unit
Each record is attached to the organisation's own category tree and to the unit responsible. The public form offers only the categories the organisation left open.
Environmental or social
Every record belongs to a discipline and can be transferred between them. A transfer goes to an area rather than to a person: when that area's owner changes, the record stays where it is.
Hazard level
Workforce reports carry a hazard level; a high level is notified separately.
3. The record moves
Five states, a fixed set of moves
Received, under review, action taken, closed, rejected. Which state may follow which is fixed: a move that is not on the list cannot be made.
Rejection is an early exit
An unrelated report is rejected with a reason, without having to look as though it was reviewed. The reason is required on rejection and allowed nowhere else.
A closed record stays closed
Closed and rejected are final states; reopening is separate work needing its own permission, and it is not available today.
4. The record is discussed
Internal notes and notes shared with the reporter
Every note carries who is meant to see it. Internal assessment stays internal by default.
Attachments are scanned
Images, audio and documents can be uploaded; every file passes a security scan and disallowed types are refused.
Notifications reach the right people
A new record notifies those responsible for that discipline who are also permitted to see it. Recipients are chosen by permission rather than by role: organisations define their own roles, so binding to a role name would mean notifying someone without the right to read the record.
5. The record leaves a trace
Every write is recorded
Who, when, through which channel, the value before and after. A record's history can be read on screen.
Personal data stays masked
Revealing the reporter's contact details is a separate step, and that reveal is written into the trace as well.
No deletion, but a retention period
Records are never physically deleted. The organisation chooses the retention period; six months before it ends, several administrators are reminded.