How to Set Up an Anonymous Reporting Channel (and Why a Hotline Isn't Anonymous)

A telephone hotline feels anonymous because the caller doesn't give their name. But two things leak identity. First, the caller's voice is itself identifying; in a small team, a department head recognises who called. Second, and more importantly, the moment the investigator needs to go back to the reporter ("which branch was this?", "do you have the date?"), they need a way to reach them. The usual answer is a callback number, and a callback number is identity. So the hotline is either genuinely anonymous and a dead end (you can never ask a follow-up question), or it's followable-up and not anonymous. It cannot be both. That is a structural limit of the medium, not a vendor shortcoming.

An email address is an identity. Even a freshly created "whistleblower@gmail" is tied to a device, an IP, a recovery number, and it sits in your mail system where anyone with access can read it. Routing reports to an inbox also quietly turns whistleblowing into just another thing in someone's email, with no triage, no deadline clock, and no separation between the report and the investigation. If your "anonymous channel" is an email address, you have neither anonymity nor process.

The only way to be anonymous and able to keep talking is to key the conversation to a report code instead of a person. The reporter submits with no account, no email, no phone number, and receives a code. They use that code to come back and see responses, answer questions, and read the outcome. The organisation holds a live, two-way thread, and never holds an identity. This is exactly the gap a hotline and an inbox cannot fill, and it is the model Xono is built on: a public reporting link and QR code that need no account (so a contractor at a site gate can use it), and anonymous two-way messaging keyed to the report code.

If you take one design decision from this article, it is this: decide up front that follow-up must not depend on knowing who the reporter is. Everything else follows.

1. Choose a code-keyed channel, not a phone line or inbox. Confirm it lets you reply to an anonymous reporter via a reference code.
2. Make it reachable without an account. A public link and a QR code people can use from their own phone: at the gate, on the noticeboard, in the induction pack.
3. Separate intake from investigation. The report lands in a case with its own record; the investigation file stands alone (never written so that it reveals the reporter).
4. Put a clock on it. Acknowledge quickly and give the reporter feedback on a defined timeline, even when they stay anonymous.
5. Extend access beyond employees. Make sure suppliers and contractors can reach it too (see below).
6. Write the short policy that describes it (scope, anonymity, no-retaliation, how follow-up works) and publish where people will find it.

Trying to work out who it was. If a report is specific enough to point at one person, resist reverse-engineering the reporter. Investigate the allegation, not the source. Our guide on handling an anonymous complaint covers this in depth.

Letting intake be an inbox. Without triage, a clock, and a record, reports get lost, and a lost report is worse than no channel, because the person took the risk and nothing happened.

Employee-only reach. The people who often see the most (contractors, suppliers, agency staff) can't use a channel that requires a staff login.

No way to close the loop. If you can't tell the reporter what happened, they (and everyone they talk to) conclude the channel is for show.

Good governance guidance increasingly expects a channel to be reachable not just by employees but by suppliers and other business partners: the people on site who often witness the most and are tied in the least. In South Africa, King V's guidance on an ethical culture points in this direction for the organisations that apply it, and the same expectation sits behind the IFC Performance Standards that development-finance-backed companies work to. An employee-only hotline simply cannot meet it. A no-account public link and QR code can. That is the practical reason to choose one.

In South Africa the Protected Disclosures Act protects a worker who makes a protected disclosure from "occupational detriment". It is a protection framework, and it does not, today, require every company to operate a reporting channel. For JSE-listed and larger organisations, King V treats a speak-up channel as a governance expectation, not a statutory duty. Separately, a draft Protected Disclosures Amendment Bill has been published that would strengthen the regime, but it is draft, not law, and nothing here should be read as a current legal requirement to have a channel. The reason to set one up now is simpler than compliance: it is the only way to hear about a problem while you can still fix it.