Complete case lifecycle
From report intake to closure, Ashio documents every step with the responsible person, timestamp and reasoning. During an audit you can reconstruct the entire incident lifecycle in seconds.
Security
Ashio is built with privacy and security at its core — end-to-end encrypted in the browser, hosted in ISO 27001-certified data centers in Austria, and GDPR-compliant by design.
Last reviewed: November 3, 2026
GDPR compliance
Data protection by design and by default. All data is processed under strict EU data protection laws.
End-to-end encryption
Reports and messages are encrypted in the reporter's browser with a per-report AES-256-GCM key that's wrapped for each recipient using P-256 ECDH. The server only stores ciphertext — it cannot decrypt your reports.
EU hosting
Your data is hosted in Austria, inside the European Union, so no international transfer is involved. The data centers are ISO 27001-certified and run on green energy.
Zero-access architecture
Built on a true zero-access architecture — even Ashio cannot read report bodies or messages. Keys live in the reporter's URL and on each handler's device, protected by an Argon2id-derived password key.
No tracking on report pages
Reporting pages set no cookies, run no analytics, and use no fingerprinting.
Audit-ready logging
Every action and status change is recorded in an immutable, timestamped activity log — ready for audits and compliance reviews.
For auditors
Audit-ready documentation for compliance audits.
Ashio gives you complete, tamper-proof documentation from day one — ready for ISO 37002 audits, GDPR reviews, regulatory inspections and internal compliance reviews. Every action is automatically timestamped — no manual work, no spreadsheets, no missing evidence.
Automatic 7-day and 3-month tracking
The EU Directive and national whistleblower laws require acknowledgment within 7 days and feedback within 3 months of the acknowledgment. Ashio documents both deadlines automatically — if your auditor asks whether the deadlines were met, the evidence is already there.
Standard format exports
All reports, activities and audit trails can be exported as PDF — ideal for external auditors, regulators or internal compliance teams. No vendor lock-in, no proprietary formats.
Procurement review
The answers a security questionnaire asks for
If you are running vendor due diligence, this is the short version. Write to sales@ashio.eu for the full questionnaire and the scope of our ISO 27001 certification.
Processing agreement
An Art. 28 GDPR agreement is included in every subscription and accepted with the Terms. A counter-signed copy is available if your procurement requires one.
Where the data sits
Austria, in ISO 27001-certified data centers. Data collected before 8 November 2026 moves there on 8 December 2026. Inside the EEA, so no transfer is involved.
Who can read a report
Only the case team you invite. Report bodies stay encrypted end to end; the server holds ciphertext.
Retention
Retention periods are configurable per organization.
Export and audit trail
Cases export as PDF at any time, and every event is timestamped.
Contract term
No minimum term beyond the billing period. Cancel from the dashboard at any time.
Processing agreement · Sub-processors · DPIA template · Ask for the security questionnaire
Questions
Security questions, answered.
Where are Ashio's servers, and who can access report data?+
On ISO 27001-certified servers in Austria, inside the EU, so report data is never transferred to a third country. Report content is end-to-end encrypted, so the provider cannot read it, and a case is visible only to the people the organization invited into it.
Does Ashio log reporters' IP addresses or use cookies?+
No. The reporting form sets no IP logging, no cookies and no fingerprinting, and no third-party trackers are loaded. Anonymity is a property of the form, not a promise: there is nothing stored that could trace a report back.
Is ISO 27001 certification relevant for whistleblowing software?+
For the infrastructure, yes: ISO 27001 certifies information-security management, and Ashio runs on ISO 27001-certified servers and data centers in Austria. The product itself is not certified, because the standard applies to an organization's security management rather than to an application. For the reporting system itself, the guidance standard is ISO 37002.
EU directives covered
Related compliance guides.
Explore Ashio's coverage of each EU regulation.