Feature
Two doors for reporting something serious, and one encrypted register
Tuesday, 23:40. A resident opens on her phone the link to the confidential channel that the colegio mayor (a Spanish hall of residence with a formative programme) has on its noticeboard, chooses "Acoso" (harassment), writes what happened and leaves the "Anónima" (anonymous) option ticked. On sending, the account is stored encrypted. Management receives on WhatsApp a notice that there is a new report, without the account, and the centre's account an email that only says where to look. Had she told it on WhatsApp to the hall's number, it would have ended up in the same register.
What the person reporting does, and what happens to each thing
| What the person reporting does | What Bedel does |
|---|---|
| Opens the centre's link and chooses a category | Offers seven: hazing, harassment, sexual harassment, mental health, coexistence, discrimination and other. Through the form, hazing, sexual harassment and mental health always go in as urgent |
| Leaves "Anónima" ticked and writes the account | Stores it encrypted with AES-256-GCM. If the person prefers to identify themselves, name, phone and email are optional and are encrypted just like the account |
| Presses "Send" | Management receives on WhatsApp that there is a new report and that the content is not sent that way; the centre's account, an email with no data at all. The screen tells the person reporting whether management has already been notified or will see it in their dashboard |
| Tells it on WhatsApp to the hall's number | If it is hazing, harassment or discrimination, it opens the case in the same register, encrypted, and replies that neither their name nor what they told has been sent to anyone over WhatsApp |
| Sends several messages in a row about the same thing | Groups them: within the same thread and within 24 hours it is a single case, not five |
| Submits the form many times in a row | After five submissions in ten minutes from the same connection, it stops them and reminds them of 112 and 016 in case it is urgent |
| Management opens the report in the dashboard | Decrypts it at that moment and leaves a trace: who opened it, when, from which IP address and with which browser |
Two doors, one register
Some people look for a form and some tell it in the chat they already have open. Bedel collects both in the same place and with the same treatment: each report stays in the centre's register with the door it came through, its category, its priority and the post responsible for the channel, which by default is management.
- The form's link belongs to the centre and is created the first time management opens the channel in the dashboard; the centre decides where to publish it.
- The form page reminds people of 112 and 024 before anything else, in case the situation is an emergency.
- On WhatsApp, Bedel recognises when what is being told is hazing, harassment or discrimination, and opens the case without anyone needing to go to the form.
- Consecutive messages in the same thread are grouped into a single case for 24 hours.
Encryption, and anonymity where it is possible
The account and the identity of the person reporting are stored encrypted with AES-256-GCM, with the key outside the database. If the key were missing in production, nothing is stored in clear: the form is not shown, the help numbers are given and what comes in on WhatsApp does not open a case. Anonymity belongs to the form; WhatsApp cannot offer it.
- On the form, the "Anónima" option comes ticked: the report is stored with no name, phone or email.
- Whoever wants to identify themselves leaves their details, and they are encrypted with the same key as the account.
- On WhatsApp it is not anonymous: Bedel knows the number of whoever writes, and the message also stays in that conversation of the centre.
- To report without leaving a number, use the form. What Spanish Act 2/2023 asks and of whom, in the glossary and in the guide.
The notice is a doorbell, not the content
Management has to find out at once, but the notice cannot carry what was told. That is why the email only says there is a new communication and where to open it, and the WhatsApp message goes only to the channel's post, with emergency-level delivery: retries and a template if the window is closed. Neither the email nor the WhatsApp message carries the account or the name.
- Email to the centre's account: "Canal de denuncia: hay una comunicación nueva" (reporting channel: there is a new communication), with no data at all.
- WhatsApp only to the channel's post, with the category and without the account, with no copy to Reception or Security and no "on my way" buttons.
- If nobody in that post has a mobile set up, the report stays stored and Bedel receives a notice, without the account, so it can alert the centre.
- If a WhatsApp message also speaks of a risk to life, the emergency protocol takes over, and that one does notify every crisis post.
Reading and handling, with a trace
Reports are read only in the reports section of the dashboard and only with that permission. The list shows category, priority, status and dates, but not who reported: the identity and the account come out only when each one is opened, which is when they are decrypted and when it is logged who did it.
- Every reading, change or deletion leaves a row with the person, the action, the IP address and the browser.
- Statuses: open, under review, escalated, resolved and dismissed, with resolution notes.
- The report can be reassigned to another post in the team.
- If it came in on WhatsApp, management can reply in that same thread, and opening it costs the same as opening the identity: permission and a trace.
Retention and deletion
Each report is born with its deletion date, worked out from the retention period the centre sets, from one to ten years; if it is not changed, five. When it is reached, a daily process deletes the account and the identity and keeps only what identifies nobody, for the centre's figures.
- What is kept after the period: category, priority and dates.
- Thirty days later the whole row is deleted, in case a mistake by the team has to be corrected.
- Along with the row, the trail of who opened it is deleted too.
What it does not do
- It gives no follow-up code to someone who reports anonymously: to get an answer they have to leave an email address, and the form tells them so at the end.
- Reception and Security do not receive the notice: only the channel's post, which by default is management.
- On WhatsApp it is not anonymous: the number of whoever writes is known.
- It does not investigate, assess the facts or decide on measures: that belongs to the centre's protocol and committee (see the harassment protocol guide).
Frequently asked questions
Is it really anonymous?
On the form, yes: the "Anónima" option comes ticked and the report is stored with no name, phone or email. Whoever wants to identify themselves can, and those details are encrypted just like the account. On WhatsApp it cannot be, because Bedel knows the number of whoever writes: the case is stored encrypted, but the message also stays in that conversation of the centre.
Who can read it?
Only whoever has the reporting channel permission in the dashboard, and only from that section. The notice email and WhatsApp message carry neither the account nor the name, and the dashboard list does not show who reported either. Every time someone opens a report, it is decrypted at that moment and it is logged who it was, when, from which IP address and with which browser.
Can the person who reported be answered?
If they identified themselves, yes: management has their details on opening the report, and if it came in on WhatsApp it can reply in the same thread. If they chose anonymity on the form, there is no way to answer them, because Bedel gives no follow-up code. At the end, the form tells them that, if they want follow-up, they can send it again leaving an email address created for the purpose.
What happens if management has no mobile set up?
The report is not lost: it stays stored in the register and the centre's account receives the notice email. Since it has reached no mobile, Bedel also receives a notice, without the account, so it can alert the centre by hand. And the person reporting is not promised what has not happened: the screen tells them management will see it in their dashboard.
How long are reports kept?
The retention period is set by the centre, from one to ten years, and if it is not changed it is five. Each report is born with its deletion date. When it is reached, the account and the identity are deleted and the category, priority and dates are kept for the centre's figures; thirty days later the whole row is deleted, along with the trail of who opened it.
Does this mean we comply with Spanish Act 2/2023 or Act 3/2022?
Bedel provides the channel and the register, but it cannot decide whether a law binds you or replace your procedure. Whom each law reaches, and by which route, is explained article by article in the reporting channel guide, together with what is required for anonymous communications. It is worth reading alongside what this channel does not do.
Related features
- Escalation to peopleAnything about money, health, exceptions or conflicts goes to one specific phone by org chart and shift, and emergencies go to the crisis posts.
- Dashboard and metricsConversation history and search, metrics that come from counting rows, team roles and shifts, and data protection rights carried out from the dashboard.
For each type of centre
- Colegios mayoresFor colegios mayores: the dining hall with its cancellations, packed lunches and allergens; activities with their call and their survey; families and applicants; and what belongs to management, to management.
- University residencesFor residences owned by or affiliated with a university: support in each resident's language, repairs and cleaning with outside contractors, the arrivals of each semester and enquiries about places.
- Student residencesFor student residences and PBSA operators: WhatsApp support in the resident's language, repairs with an owner and a deadline, arrivals, presence and parcels.
- ColivingFor coliving and flex living: support in each resident's language, repairs with an owner and a deadline, common-room bookings, parcels and announcements without groups.
- Researcher residencesFor researcher, graduate and visiting-faculty residences: arrivals any week of the year, replies in each person's language, contracted maintenance and cleaning, and the end of every stay.
- Hostels and alberguesFor hostels, albergues and pilgrim hostels: house questions answered in each guest's language, repairs with an owner and a deadline, and the night covered with nobody at the desk.
- Holiday apartmentsFor holiday apartments, aparthotels and mid-stay lets: replies in the guest's language, repairs with a technician and a deadline, housekeeping requests between stays and house rules.
- Build to rentFor build-to-rent and flex living buildings: repairs with an owner and a deadline even when maintenance is outsourced, parcels with a notice, shared-space bookings, building notices and house rules answered.