Internal investigations in companies
When a tip turns into a suspicion, you need facts. We process the data of the affected areas forensically, your investigation team reviews it in a targeted way, and every step stays documented.
- to confirm receipt of a report under the German Whistleblower Protection Act
- 7 days
- until feedback is due to the whistleblower
- 3 months
- Only data on the people, period and suspicion in scope is processed
- Targeted
- Every access within the investigation team is recorded
- Logged
Between a tip and clarity lies a lot of data.
And little time.Under the German Whistleblower Protection Act (HinSchG), companies with as a rule at least 50 employees must run an internal reporting channel. Once a report comes in, deadlines start: receipt must be confirmed within seven days at the latest, and feedback on follow-up measures is due within three months. Anyone who wants to find out in that time whether an allegation holds needs quick access to the right data.
That data is rarely tidy. A suspicion of breach of trust, corruption or the leak of trade secrets usually involves several people whose communication is spread across mailboxes, chats and drives. At the same time, data protection requires that no more is reviewed than the specific suspicion calls for.
For internal investigations we process exactly the data you define and make it searchable in Inspector. For questions that concern mailboxes only, an email review is often enough. If litigation is on the horizon, we also work directly with your law firm.
What happens in the investigation team.
Tools that fit the suspicion.- 01
Scoping first
You define people, period and data sources before processing. Only what falls within that scope is processed.
- 02
Ask in plain language
In AI mode you ask, for example, about contacts with a particular supplier. Every answer names its sources, so the finding can be checked against the original.
- 03
Altered versions
Modified versions of a document, such as an invoice or a quote, are detected. What changed between two versions is visible at a glance.
- 04
Check money flows
Where breach of trust or fake invoices are suspected, Tracer merges bank statements and shows through which accounts payments were passed on.
- 05
Separate roles
Investigation lead, reviewers and external advisers get different permissions. Anyone who only assesses sees only the tags released for that purpose.
- 06
A complete log
Every tag, every access and every export is recorded. The investigation therefore remains traceable for data protection, the works council or a court.
One question, one answer with evidence.
AI mode in the sample case CASE-JKL1.The question is whether Valentin Mayer and Mariana Peterson were in touch. AI mode searches 1,731,310 objects and answers with 14 direct emails from June 2004.
- 01
A single thread
All contact runs through “Revised Letter”, and two of the messages are about interconnect volumes.
- 02
Evidence alongside
An email, a memo and an audio recording support the answer, each with its date.
- 03
Back into the collection
Every piece of evidence opens in Inspector, and the passage in the recording starts at 14:20.
%20--%3e%3csvg%20version='1.1'%20id='Ebene_2'%20xmlns='http://www.w3.org/2000/svg'%20x='0px'%20y='0px'%20viewBox='0%200%20595.3%20841.9'%20style='enable-background:new%200%200%20595.3%20841.9;'%20xml:space='preserve'%3e%3cstyle%20type='text/css'%3e%20.st0{fill:%231A5DED;}%20.st1{fill:%23FFFFFF;}%20%3c/style%3e%3cpolygon%20class='st0'%20points='325.9,255.1%20265.9,255.1%20235.9,307%20265.9,359%20325.9,359%20355.9,307%20'/%3e%3cpolygon%20class='st1'%20points='325.9,141.1%20265.9,141.1%20235.9,193.1%20265.9,245.1%20325.9,245.1%20355.9,193.1%20'/%3e%3cpolygon%20class='st1'%20points='325.9,596.8%20265.9,596.8%20235.9,648.8%20265.9,700.8%20325.9,700.8%20355.9,648.8%20'/%3e%3cpolygon%20class='st1'%20points='325.9,482.9%20265.9,482.9%20235.9,534.9%20265.9,586.8%20325.9,586.8%20355.9,534.9%20'/%3e%3cpolygon%20class='st0'%20points='325.9,369%20265.9,369%20235.9,420.9%20265.9,472.9%20325.9,472.9%20355.9,420.9%20'/%3e%3cpolygon%20class='st1'%20points='325.9,710.8%20265.9,710.8%20235.9,762.7%20265.9,814.7%20325.9,814.7%20355.9,762.7%20'/%3e%3cpolygon%20class='st0'%20points='424.1,198.1%20364.1,198.1%20334.1,250.1%20364.1,302%20424.1,302%20454.1,250.1%20'/%3e%3cpolygon%20class='st1'%20points='424.1,84.2%20364.1,84.2%20334.1,136.1%20364.1,188.1%20424.1,188.1%20454.1,136.1%20'/%3e%3cpolygon%20class='st1'%20points='424.1,539.9%20364.1,539.9%20334.1,591.8%20364.1,643.8%20424.1,643.8%20454.1,591.8%20'/%3e%3cpolygon%20class='st1'%20points='424.1,425.9%20364.1,425.9%20334.1,477.9%20364.1,529.9%20424.1,529.9%20454.1,477.9%20'/%3e%3cpolygon%20class='st1'%20points='424.1,312%20364.1,312%20334.1,364%20364.1,415.9%20424.1,415.9%20454.1,364%20'/%3e%3cpolygon%20class='st1'%20points='424.1,653.8%20364.1,653.8%20334.1,705.8%20364.1,757.7%20424.1,757.7%20454.1,705.8%20'/%3e%3cpolygon%20class='st0'%20points='522.4,141.1%20462.4,141.1%20432.4,193.1%20462.4,245.1%20522.4,245.1%20552.4,193.1%20'/%3e%3cpolygon%20class='st1'%20points='522.4,27.2%20462.4,27.2%20432.4,79.2%20462.4,131.1%20522.4,131.1%20552.4,79.2%20'/%3e%3cpolygon%20class='st1'%20points='522.4,482.9%20462.4,482.9%20432.4,534.9%20462.4,586.8%20522.4,586.8%20552.4,534.9%20'/%3e%3cpolygon%20class='st1'%20points='522.4,369%20462.4,369%20432.4,420.9%20462.4,472.9%20522.4,472.9%20552.4,420.9%20'/%3e%3cpolygon%20class='st1'%20points='522.4,255.1%20462.4,255.1%20432.4,307%20462.4,359%20522.4,359%20552.4,307%20'/%3e%3cpolygon%20class='st1'%20points='522.4,596.8%20462.4,596.8%20432.4,648.8%20462.4,700.8%20522.4,700.8%20552.4,648.8%20'/%3e%3cpolygon%20class='st0'%20points='167.3,643.8%20227.3,643.8%20257.3,591.8%20227.3,539.9%20167.3,539.9%20137.3,591.8%20'/%3e%3cpolygon%20class='st1'%20points='167.3,757.7%20227.3,757.7%20257.3,705.8%20227.3,653.8%20167.3,653.8%20137.3,705.8%20'/%3e%3cpolygon%20class='st1'%20points='167.3,302%20227.3,302%20257.3,250.1%20227.3,198.1%20167.3,198.1%20137.3,250.1%20'/%3e%3cpolygon%20class='st1'%20points='167.3,415.9%20227.3,415.9%20257.3,364%20227.3,312%20167.3,312%20137.3,364%20'/%3e%3cpolygon%20class='st0'%20points='167.3,529.9%20227.3,529.9%20257.3,477.9%20227.3,425.9%20167.3,425.9%20137.3,477.9%20'/%3e%3cpolygon%20class='st0'%20points='68.9,700.8%20128.9,700.8%20158.9,648.8%20128.9,596.8%2068.9,596.8%2038.9,648.8%20'/%3e%3cpolygon%20class='st1'%20points='68.9,359%20128.9,359%20158.9,307%20128.9,255.1%2068.9,255.1%2038.9,307%20'/%3e%3cpolygon%20class='st1'%20points='68.9,472.9%20128.9,472.9%20158.9,420.9%20128.9,369%2068.9,369%2038.9,420.9%20'/%3e%3cpolygon%20class='st1'%20points='68.9,586.8%20128.9,586.8%20158.9,534.9%20128.9,482.9%2068.9,482.9%2038.9,534.9%20'/%3e%3c/svg%3e)
From report to result.
Four steps of an internal investigation.- 01
Define the scope
Together with your investigation lead we clarify which people, periods and sources are affected. You coordinate the involvement of data protection and the works council internally before any data moves.
- 02
Secure and hand over data
Your IT provides mailboxes, drives or device images. We take them over with a hash and work on forensic copies, so the originals stay untouched.
- 03
Targeted review
Your team searches Inspector for evidence for and against the suspicion and tags findings. Exculpatory documents are as much part of the result as incriminating ones.
- 04
Report and follow-up
You export findings as a report with source references, for example as the basis for feedback to the whistleblower or for employment law measures.
What the investigation leaves behind.
A basis for decisions.An internal investigation ends with a decision: close it, adjust course or escalate. That requires evidence whose origin nobody can question.
- Report
- Findings with sourcesEvery statement points to a specific document.
- Export
- Relevant emails as a PST archiveFor a law firm, an authority or later proceedings.
- Scope
- Documented scopingWhich people, periods and sources were included.
- Log
- Audit log of the investigationWho accessed what, when, and what was tagged.
- Integrity
- Hashes of all sourcesCaptured at the start, compared again before every export.
Why companies bring us in.
For investigations that have to hold up.- 01
Independent processing
Technical processing sits with an external provider instead of your own IT. That strengthens credibility, especially when managers are involved.
- 02
Data minimisation built in
Thanks to scoping up front and roles per case, every person only sees what they need for their task.
- 03
Ready for the next step
If the investigation turns into proceedings, the collection is already forensically processed. A law firm or authority can carry on directly.
Questions about internal investigations.
Between tip-off, data protection and evidence.Your question is not listed? Write to us.
That depends on the individual case, for example on rules about private use, the degree of suspicion and works agreements. Your legal department or law firm handles the legal assessment. We make sure the technical implementation stays within the defined scope and is documented.
The act requires reports to be examined and follow-up measures taken, with feedback to the whistleblower within three months. When a tip can only be checked against large volumes of data, eDiscovery makes that deadline realistic.
Yes. Your IT can export mailboxes and drives itself. What matters is that the exports are complete and reach us unchanged. We record the hash at intake.
The investigation is documented in that case too. The report shows which sources were examined and why the allegation could not be substantiated. That protects the employees concerned and the company alike.
Only the people you name have access, each with their own role. The data sits on a review laptop without a network or in Sinacluster in German data centres, and every access is logged.
When things move on.
Services for the next steps.Got a case on your desk?
Describe data volume, sources and deadline. Within one business day you get an assessment of process and effort.The people behind Explorer, Inspector and Tracer. Your enquiry goes straight to us in Bad Soden am Taunus.
