01

ANONYMOUSNESS OF THE SIGNALIST'S CONTACT WITH THE SIGNANET SERVICE:

The whistleblower's contact with the SYGNANET server must be anonymous. From the very beginning of the server's design this was and is our greatest concern. The whistleblower has to remain unknown, in particular to the recipient of the notification as well as any other person, but also to the server and its staff as well as the Internet itself.

Of course, if requested, one may leave the contact details in the notification submitted.

Experts say that it is impossible to hide connection data on the Internet by 100%. If not, they can be made so difficult that it is not profitable to identify them.

The problem is like data encryption. Nobody claims that modern ciphers cannot be broken, but everyone knows that it takes a lot of time, huge resources, and processing power to do so. And that is why they are considered secure.

02

SECURE CONTENT OF SIGNALLER'S SUBMISSION:

Encryption of the transmitted notification content (on the whistleblower's computer) with the public key of an established notification recipient.

Encryption of the content of the transmitted message The user of Specfile.pl encryption system established in your company is a user of our system, and as such, has encryption keys generated for him (a pair of keys: public and private). In this way, every message intended only for him, can be encrypted with his public key, and decrypted only by him (with his private key) with the public key of the established recipient of notifications.
This is how we handle the content of your request. This process is not visible to you, but here you can find out that the moment your message is sent to the server, a public key is taken from the recipient of the message, your whole message is encrypted with this key, and in this encrypted form it is sent to the SYGNANET server. In addition, the encryption process is performed on your computer (not on the server's computer!), so no one can read your message except for the designated recipient.

03

SECURE CONTENT OF SIGNALLER'S SUBMISSION:

The SYGNANET service provides a way for the recipient of any request to get back to you, even though you are anonymous to the recipient. The solution is that if the recipient of the request wants to send you a message back, he puts it on the server (in plain text), and the server makes it available to you if you enter the number and password given to your request during its sending.

It is therefore desirable that you periodically check the whistleblower response page on the SYGNANET server. If even the recipient does not give you feedback, the server in the reply shows confirmation that your request was sent and decrypted by the recipient. In this way you can be sure that your report has been forwarded to the recipient.

04

EMPLOYER SECURITY:

By definition, the whistleblowers should be employees of a given company and not members of the public from outside the company. Currently, such an access filter is assigning a given company a dedicated website on SYGNANET server. The company will receive a unique website address, to be used only by the company's employees. The address of this web page must be communicated to all employees of a given company (e.g., by posting it on a publicly available board or sending an e-mail). Only persons who know this address will then forward notifications through the SYGNANET server to the designated recipient in the company.
If we find this solution insufficient, we will additionally introduce the requirement of a fixed password.

The process of registering a company and a designated person to handle whistleblower is also possible remotely but has a few identification safeguards. Registration on the server can be done by a person appointed to handle whistleblowers and his/her e-mail address is checked, but this address must be confirmed by a transfer made from the account of a given company with a subscription fee, i.e., it must be confirmed by a decision-maker from a given company. In addition, this person must register with the encryption service specfile.pl and obtain the encryption keys there.

The recipient's panel is also a record-keeping safeguard for the reports, showing a list of reports from the signalers (of course with the encrypted text of their messages) and the contact history (data about the report being sent to the recipient, decryption of the report by the recipient, reply back).