How to build a secure, GDPR-compliant whistleblower and ethics hotline intake in Formaloo

An intake form where employees can report misconduct anonymously or under their own name, upload supporting evidence, and e-sign consent to be contacted for follow-up questions. Case status, priority, and investigation notes live in admin-only fields that only your compliance team can see, and reporter-identifying details auto-anonymize once a case has been closed long enough to clear your retention window, so nobody has to remember to purge sensitive records by hand.

Start from your Formaloo homepage with Magic Create so the form, its fields, and field IDs are generated for you in one pass rather than built one field at a time.

1. Open Magic Create: From your Formaloo homepage, click Magic Create.

2. Describe the form: Paste a prompt describing an ethics and misconduct reporting form: a dropdown for concern category, a dropdown letting the reporter choose anonymous or identified reporting, short text fields for name, email, and phone (shown only for identified reporters), a short text field for department or location, a long text field for who's involved, a date field for when it happened, a long text field for the incident description, a yes/no for whether evidence exists, a file upload for evidence, a yes/no for follow-up consent, and a signature field for that consent. Also describe three admin-only fields: a case status dropdown, a case priority dropdown, an assignee field for the investigator, and an admin-only long text field for internal notes.

3. Generate the form: Click Create and let Formaloo build the form.

Your form should look like this. Magic Create will have generated most of it, so verify each field and field ID matches exactly.

4. Publish the form: Once the fields look right, click Publish from the island bar at the top of the editor. Publish is different from Save, Save applies to logic rules, email templates, and PDF templates, while the form itself is always published from the island bar.

This is where the anonymous/identified choice actually does something. Reporters who choose to stay anonymous should never be asked for a name, email, or phone number, and follow-up consent only makes sense if there's a way to reach the reporter in the first place.

1. Open advanced logic: Open Advanced logic in the settings panel on the right side of the form editor, then go to the Logic tab.

2. Launch Magic Logic: Click Magic Logic in the top right corner of the Logic panel.

3. Describe the rules: Paste a plain-text prompt describing all five rules at once: show the full name, email, and phone fields only when reporting type is Identified, and hide them by default; make the email field required only when reporting type is Identified; show the follow-up consent question only when reporting type is Identified, and hide it by default; show the e-sign consent field only when follow-up consent is Yes, and hide it by default; show the evidence upload field only when "do you have supporting evidence" is Yes, and hide it by default.

4. Generate and review: Click Generate Rules and review each rule the AI proposes. Approve, redo, or cancel individually.

5. Save: Once every rule looks right, click Save in the top right corner.

The finished rule set should read like this:

Rule 1: IF "Would you like to report anonymously or share your identity?" equals "Identified" → show "What's your full name?", "What's your email address?", and "What's your phone number?". Default: hidden.

Rule 2: IF "Would you like to report anonymously or share your identity?" equals "Identified" → make "What's your email address?" required. Default: not required.

Rule 3: IF "Would you like to report anonymously or share your identity?" equals "Identified" → show "Do you consent to being contacted for follow-up questions?". Default: hidden.

Rule 4: IF "Do you consent to being contacted for follow-up questions?" equals "Yes" → show "E-sign to confirm your follow-up consent". Default: hidden.

Rule 5: IF "Do you have supporting evidence to upload?" equals "Yes" → show "Upload your evidence". Default: hidden.

Four emails carry this workflow: a confirmation to identified reporters, an internal notification to compliance on every new case, an urgent alert when a case is marked Critical, and a resolution notice once a case closes.

1. Open the email template builder: Click your profile icon, go to Apps and integrations, find Custom email templates, and click Add new template.

2. Create the reporter confirmation: Name the template "Report received confirmation." Set the subject to "Your report has been received, case #@rowid." Clear the body, add an AI block, and enter a prompt asking it to confirm the report was received, reference the case number and the concern category (@report_category), reassure the reporter the matter will be reviewed confidentially, and avoid promising a specific outcome or timeline, in 3 to 4 short, warm but neutral sentences. Save the template.

3. Create the compliance notification: Add a second template named "New report submitted." Set the subject to "New ethics report submitted, category: @report_category." Enter an AI prompt asking for a factual, neutral internal summary covering the category, department (@department_involved), incident date (@incident_date), and whether the reporter chose to stay anonymous or share their identity (@reporting_type), under 80 words, without reproducing the full incident description. Save the template.

4. Create the critical escalation: Add a third template named "Critical case escalation." Set the subject to "Urgent: critical ethics case needs immediate review, case #@rowid." Enter an AI prompt asking for a short, direct, urgent internal alert referencing the case number, category, and department, conveying urgency without alarmism, in 2 to 3 sentences. Save the template.

5. Create the resolution notice: Add a fourth template named "Case resolution notice." Set the subject to "An update on your report, case #@rowid." Enter an AI prompt asking for a warm but appropriately reserved closure email thanking the reporter for coming forward, noting that investigations are handled confidentially and specific findings can't be shared, in 3 to 4 sentences. Save the template.

For each template, use answer piping to insert the @field_id variables above, and apply the same design direction: a white background, a single centered column at a max width of 560px, an Inter or system-ui font, and a muted footer in a light gray tone noting the message is confidential.

Building the templates doesn't send them. Each one needs its own trigger, and three of the four only fire under specific conditions.

1. Trigger the reporter confirmation: Open Advanced logic and go to the On Submit tab. Click Add rule and set the condition to "When Would you like to report anonymously or share your identity? equals Identified, then send email using Report received confirmation to @reporter_email." Save the rule.

2. Trigger the compliance notification: In the same On Submit tab, add a second rule with no condition, sending "New report submitted" to your compliance team's shared address on every submission. This one fires for both anonymous and identified reports.

3. Trigger the critical escalation: Switch to the On Update tab. Add a rule: "When Case priority is updated to Critical, then send email using Critical case escalation to @assignee." Save the rule.

4. Trigger the resolution notice: In the On Update tab, add a rule: "When Case status is updated to Resolved - substantiated, Resolved - unsubstantiated, or Closed, and Would you like to report anonymously or share your identity? equals Identified, then send email using Case resolution notice to @reporter_email."

This PDF is an internal investigation record, not something handed to the reporter or anyone outside the case, so it's the one place where the admin-only fields belong on the page. It skips the raw evidence file itself and instead notes that evidence exists in the record.

1. Open the PDF template builder: Click your profile icon, go to Apps and integrations, and open Custom PDF template. Click Add new template.

2. Switch to HTML view: Switch the editor to the HTML view so you can paste custom code instead of building the layout block by block.

3. Paste the HTML: Use the file below as the starting HTML. It pipes @rowid for the case reference, @reporting_type, @reporter_name, @reporter_email, and @reporter_phone into a reporter information section (blank by design for anonymous cases), @report_category, @department_involved, @incident_date, @people_involved, @incident_description, and @has_evidence into an incident details section, @case_status, @case_priority, @assignee, and @internal_notes into an investigation status section, and @followup_consent with @followup_consent_signature into a consent section.

The full file is saved to the workspace as whistleblower-ethics-hotline-intake-pdf.html.

4. Name and save the template: Name it "Ethics case file" and click Save.

5. Attach it to the compliance notification: Open the "New report submitted" email template and attach the "Ethics case file" PDF, so every new case lands in the compliance inbox as both an email and a ready-to-file document.

Reporters and investigators need entirely different views of the same data, and internal investigators need a different access mechanism than external reporters do.

1. Start a project: From your Formaloo homepage, start a new project from Form so your intake form is already attached.

2. Activate the portal: Go to your project and click the Settings (gear) icon. Select Activate portal, then click Manage user to open the Setup Wizard.

3. Set up the reporter role: In the Setup Wizard, add a new user directory for your reporters, then click Next step to configure sign-up and login options. Once the portal is active, open the user directory, click Edit profile fields, and scroll to the User roles field to add a Reporter role for identified reporters who sign up without a Formaloo account. Anonymous reporters never sign up, so this role only ever applies to reporters who chose to share their identity.

4. Give investigators access without a portal role: Your compliance investigators are internal workspace members, not portal signups, so they don't get a portal role through the Setup Wizard. Instead, make sure each investigator is a workspace member, ideally grouped into an Ethics investigations team. Then, on each internal-facing page you build in step 6, click the page's three-dot menu, select Access, and under the internal users side of that panel choose Specific teams, then select the Ethics investigations team.

5. Build the reporter's own pages: Give the Reporter role a "Submit a report" page for the form itself and a "My reports" page. On the "My reports" page, switch to Edit mode, click Options, scroll to Manage access, select the reporter profile field, and toggle on "Allow users to view only their data."

6. Build the investigator pages: Build the Kanban, table, and chart pages listed in the page specification table below, applying the internal team access from step 4 to each one. For "My assigned cases," switch to Edit mode, click Options, scroll to Manage access, select the Assigned investigator field, and toggle on "Allow assignees to view only their data."

7. Publish the portal: Once every page and access rule is in place, publish and share the portal link.

💡 Want your portal to live at your own URL instead of a formaloo.com address? A custom domain is available on the Business plan or the Brand removal add-on, worth setting up once you're sharing this link with reporters.

The use case calls for reporter-identifying details to disappear once a case ends, but Formaloo's real anonymization mechanism runs on a day-count retention window from each record's submission date, not a custom "case closed" trigger. The way to apply it here is to set that day count comfortably longer than your typical investigation takes, and to give investigators a page that surfaces closed cases in the order they'll hit that window, so nothing gets anonymized as a surprise.

1. Open form settings: From the island toolbar at the top of the form editor, open form settings and scroll to the Privacy and compliance section.

2. Turn on automatic anonymization: Enable the anonymization toggle. If your workspace doesn't have the add-on, you'll see a prompt here and can contact sales support.

3. Set the retention window: Set "Anonymize after (days)" to a day count that comfortably outlasts how long a typical investigation runs, counted from the date the report was submitted, not from when the case is closed.

4. Choose which fields to anonymize: Under "Select fields," choose the reporter's name, email, and phone number so they clear automatically once the window passes, whether or not someone remembered to close the case first.

A single intake form that adapts to whether a reporter wants to stay anonymous, with case status, priority, and investigation notes fully invisible to anyone outside the compliance team. Four emails keep reporters and investigators informed without ever crossing that line, and a case file PDF gives investigators a clean internal record they can reference or file. Reporter details clear automatically once a case has been closed long enough to pass your retention window, so GDPR's data-minimization principle applies without anyone having to remember to go delete anything.

Don't build this from scratch, we've already put it together for you.

Patient intake & consent workflow for healthcare — A conditional intake form with a consent step and admin Kanban pipeline. The same admin-only status tracking and consent-gated field pattern carries over directly to case handling here.

Employee request workflow — Internal request routing with status tracking and team notifications. Swap in the reporting categories above and you have the backbone of the compliance-facing side of this workflow.

Job applicant tracking workflow — An assignee-based pipeline with status updates across stages, the same mechanic that drives the investigator Kanban and assigned-cases view here.