How Matter Heard handles reports

Anonymous reporting and your access code

The anonymous form does not require an account, name or email address. After submitting, you receive a private access code to return to the report and its conversation. Anonymous reporters receive no notification emails.

Keep the full code private: anyone holding it can open that report. A lost code cannot be recovered. The report text, attachment contents or filenames can reveal identity. The software does not prevent identification from what a reporter chooses to share, or from an organisation’s separate network or device information.

If you choose to identify yourself

You can provide a name and email address. Reply-email notifications are optional. An email address used for notification delivery is also stored separately for that purpose. Notification emails do not include report details, attachment names or access codes.

Encryption and administrator access

Reports, conversations, internal notes and attachments are encrypted. Matter Heard uses platform-managed encryption keys, so the service can technically decrypt report contents. This is not end-to-end encryption that excludes the platform.

The organisation’s authorised administrators review reports in their own workspace. Internal notes are separate from the conversation with the reporter. Each administrator uses an individual verified account.

Matter Heard’s platform operator console shows customer accounts, operational counts, billing and support enquiries. It does not display report contents or attachments. That interface limit is separate from the platform’s technical decryption capability.

Primary project location and service providers

The primary Supabase project for database, authentication and storage is in Ireland. Production application functions are configured in Vercel’s Dublin region. These configurations do not mean that every provider, hosting, CDN or operational process runs only in the EU.

• Supabase supports the database, account authentication and storage.
• Vercel hosts the application.
• Stripe handles subscription billing.
• Hostinger delivers service and account emails.

Provider processing can include other locations. For detailed processing and contractual questions, contact info@matterheard.com. The organisation’s reporting policy and privacy information are separate from this service explanation and can be linked on its reporting page.

Deletion and recovery copies

Authorised administrators can delete closed cases and their attachments after confirmation. The application does not automatically purge reports on a retention schedule. Organisations should define how long they need to keep their reports and give deletion instructions accordingly.

Encrypted recovery copies are stored separately from the application. They include data and the settings needed to restore the service. They are copied to an operator-managed folder configured for Microsoft OneDrive synchronisation. A validated local copy does not itself confirm that the cloud copy has synchronised.

The current recurring recovery process depends on the operator’s desktop computer and connected accounts; it is not an always-on recovery service or a guaranteed recovery time. There is no automatic pruning schedule for these recovery copies. Deleting a live case does not itself remove it from earlier recovery copies. Contact info@matterheard.com about retention, account closure or deletion of recovery data.

Your organisation’s reporting procedure

The organisation decides how its channel is used, supplies its reporting and privacy information, and handles cases and deadlines. Matter Heard provides the software; using it does not by itself establish that every applicable reporting requirement is met.

This page explains the current service. It is not a data-processing agreement or a certification. See the registered supplier and billing policy or contact us with privacy and processing questions.