Whistleblowing Policy

Who can report

Anyone can use this channel: our employees and contractors, partners, customers, suppliers and members of the public. Vigilbase LLC operates it.

What you can report

Report anything you believe in good faith is wrong or unlawful in how Vigilbase or its people work, for example:

• Fraud, bribery, corruption or theft.
• Breaches of laws or regulations, including sanctions and competition law.
• Security or privacy incidents that are being hidden, and misuse of customer data.
• Breaches of our information security, privacy and other policies.
• Risks to health and safety.
• Discrimination, harassment or bullying.
• Retaliation against someone who raised a concern.
• Attempts to cover up any of the above.

You don't need proof, only reasonable grounds for your concern. For product support, contact us. To report a security vulnerability in our systems, follow our Vulnerability Disclosure Policy.

How to report

The reporting form is the safest way to stay anonymous. You can also write to us by name at legal@vigilbase.com or by post, marked for the attention of Whistleblowing:

Email

legal@vigilbase.com

Phone

+1 (855) 458-4445

Address

Vigilbase LLC
Whistleblowing
1908 Thomes Ave #12112
Cheyenne, WY 82001
United States

What we collect

We keep: the answers you type and the date of each message. On this channel they are stored encrypted. Each report and message is also emailed to the people who handle reports, and kept with their case records. Your name and contact details are optional.

We don't keep: your IP address, browser or device details, language, cookies or any analytics identity, or the time of day you wrote. These pages load no analytics, advertising, chat or session recording.

• Cloudflare Turnstile checks the form to stop automated abuse. Cloudflare processes signals from your browser to do this; we don't receive or store them.
• To limit abuse, we count submissions from each network for up to 24 hours. The count is kept under a code made from the network address with a secret key, never under the address itself, and is deleted when the period ends.
• Our hosting provider, Cloudflare, handles your connection to deliver these pages, as for any website. We don't link that to reports.

To stay anonymous, leave out details that identify you, and consider using a personal device and network rather than a work device.

Following up anonymously

When you submit a report, you get a case code and a secret. Save both: we can't recover them for you. Use them on the case page to read our replies and add information. Anyone who has both can read the case, so keep them private.

How we handle reports

• Reports go only to the small group responsible for legal and compliance matters. Nobody named in a report handles it.
• We aim to acknowledge a report on its case page within 7 days.
• We assess every report, investigate where it is warranted and act on what we find.
• We aim to tell you what we have done, or plan to do, within 3 months, as far as we can without harming the investigation or anyone's rights.

Confidentiality

We keep reports confidential and share them only with the people who need them to investigate, or where the law requires. If you tell us who you are, we won't disclose your identity without your consent unless the law requires it.

No retaliation

Vigilbase does not tolerate retaliation against anyone who reports a concern in good faith or helps with an investigation, even if the concern turns out to be mistaken. Retaliation includes dismissal, demotion, harassment, exclusion and loss of work or business. Anyone who retaliates faces disciplinary action. Reports that are knowingly false are not protected.

Retention

A case on this channel, with everything in it, is deleted 12 months after its last message. The emailed copies, and any records an investigation or a legal obligation needs, are kept in our case files for as long as that requires.

Reporting to authorities

Where the law gives you the right to report to a regulator or other authority, you can do so as well as or instead of reporting to us. Nothing in this policy limits that right.