Caravel Canal
Sales open soonAn encrypted whistleblowing channel (Lei n.º 93/2021) and a record of your compliance programme under the RGPC (Decreto-Lei n.º 109-E/2021), for public and private entities in Portugal with 50 or more workers. Reports are encrypted in the reporter's browser: Caravel has no access to what they say.
What Caravel Canal does
- A channel page for your entity, where workers and others submit written reports, anonymously or with their name
- End-to-end encryption: the text and attachments are encrypted in the reporter's browser before they leave the computer, and only your entity's report handlers can read them
- A follow-up code, so the reporter can come back, read replies and talk to your entity without revealing who they are
- Report handlers sign in with mandatory two-factor authentication (2FA)
- Conflicts of interest: the reporter can stop a given handler from seeing the report, if your entity allows it
- Legal deadlines worked out for every report, with reminders on the dashboard and by email to handlers (the email never includes the content)
- Reports kept for at least 5 years, and deletion blocked while related proceedings are pending
- An append-only, chained access log (each line linked to the previous one by a hash), with a chain check and CSV export
- A record of the actions in your RGPC compliance programme, with dates, owners and evidence
- Exports: RGPC record as CSV, JSON or printable HTML; access log as CSV; reports exported in the browser after decryption
- Each entity has its own database, fully separate from every other entity
- No third-party resources on the channel pages: no CDN, external fonts or analytics
How it works for the person reporting
- They open your entity's channel page. No account is needed.
- They write the report and can attach files. They choose whether to give their name or stay anonymous.
- The browser encrypts everything before sending it. The server only stores the encrypted data, dates and statuses.
- They get a follow-up code, shown only once, and keep it.
- With the code they come back to read the acknowledgement, the replies and the outcome, and to answer — without identifying themselves.
Lei n.º 93/2021 deadlines the Canal keeps track of
- Acknowledgement of receipt to the reporter within 7 days, with information on external reporting (Lei n.º 93/2021, art. 11(1)).
- The measures planned or taken, and the reasons for them, within 3 months of receipt at the latest (art. 11(3)).
- If the reporter asks for it, the outcome of the analysis within 15 days of its conclusion (art. 11(4)).
- A record of reports, kept for at least 5 years and for as long as related court or administrative proceedings are pending (art. 20(1)).
The law does not say whether these are calendar days or working days. By default the Canal counts calendar days (the shorter count) and always shows the due date of each deadline.
Compliance programme records (RGPC)
The RGPC requires a compliance programme with at least a corruption-risk prevention plan (PPR), a code of conduct, a training programme and a whistleblowing channel (art. 5(1)). The Canal records what your entity has done on each point — date, owner, description and evidence — and reminds you when a date is coming up:
- Compliance officer, appointed from senior management or equivalent (art. 5(2))
- PPR, reviewed every three years or whenever the entity's structure changes (art. 6(1) and 6(5))
- Interim assessment report in October on high or maximum risks (art. 6(4)(a))
- Annual assessment report in April of the following year (art. 6(4)(b))
- Code of conduct, reviewed every three years (art. 7(1) and 7(4))
- Training for managers and staff (art. 9)
Each item shows “not recorded” or “recorded on” a date — never “compliant”. The Canal does not draft the PPR, the code of conduct or legal opinions. The articles cited are from the regime annexed to Decreto-Lei n.º 109-E/2021.
Security, and what Caravel can see
- The content of reports, their category and the reporter's identity stay inside the encryption. Caravel only sees dates, statuses, deadlines, sizes and the log of who opened what — never the content.
- Each handler has their own key. The password, and the key derived from it, never leave the browser.
- The reporter's actions are logged without an IP address.
- Strict cookies, protection against forged requests and limits on sign-in attempts.
An honest limit: as with any web-based channel, encryption in the browser cannot protect against someone changing the code sent to the browser. To make that detectable, handlers can see their keys' fingerprints.
Who has to have a channel
- Legal persons with 50 or more workers, including the State and other public-law legal persons, must have internal reporting channels (Lei n.º 93/2021, art. 8(1)).
- The RGPC applies to legal persons based in Portugal and to branches in Portugal with 50 or more workers, and to public administration bodies and the state business sector with 50 or more workers (RGPC, art. 2(1) and 2(2)).
- Some entities must have a channel even with fewer than 50 workers, because they work in areas covered by Directive (EU) 2019/1937, such as financial services (Lei n.º 93/2021, art. 8(1)).
The Canal does not decide whether your entity is covered: check with whoever advises you.
Official texts: Lei n.º 93/2021 (Diário da República, PDF) · RGPC, republished by Decreto-Lei n.º 70/2025 (Diário da República, PDF)
What Caravel Canal is not
- Caravel Canal is a tool. It does not give legal advice.
- It does not certify your entity and does not say that it complies with Lei n.º 93/2021 or the RGPC.
- The legal content — PPR, code of conduct, notices, legal opinions — belongs to your entity and to whoever advises it.
- Reports are handled by the people your entity appoints. Caravel does not read or handle reports.
Pricing
50–149 workers
€79 / monthexcl. VATBilled yearly: €948- Encrypted whistleblowing channel
- RGPC compliance programme records
- Handlers with 2FA and a chained access log
- Exports
150–499 workers
€129 / monthexcl. VATBilled yearly: €1,548- Encrypted whistleblowing channel
- RGPC compliance programme records
- Handlers with 2FA and a chained access log
- Exports
500 or more workers
€199 / monthexcl. VATBilled yearly: €2,388- Encrypted whistleblowing channel
- RGPC compliance programme records
- Handlers with 2FA and a chained access log
- Exports
Sales open soon: write to us and we will reply with the next steps. Prices exclude VAT and are billed yearly; there is no free period.
Public entities
For public entities there is no free demo and no free trial (Código dos Contratos Públicos, art. 113). You can ask for a quote and see a demo with fictitious data.
Frequently asked questions
Does my entity have to have a whistleblowing channel?
In general, yes, if it has 50 or more workers, public or private (Lei n.º 93/2021, art. 8(1)). There are exceptions and special cases, such as municipalities with fewer than 10,000 inhabitants (art. 8(6)) and entities in certain areas that are covered with fewer workers. The Canal does not decide this for you.
Can someone report anonymously?
Yes. The reporter chooses whether to report anonymously or with their name; the law provides for both (Lei n.º 93/2021, art. 10(1)). With the follow-up code, an anonymous reporter can talk to your entity without revealing who they are.
What can Caravel see?
Only dates, statuses, deadlines, sizes and the access log. The text, attachments, category and the reporter's identity are encrypted in the browser, and Caravel does not have the keys to read them.
What about reports made by phone or in person?
The report handler can record them in the Canal. To record a verbal report (recording or transcript) the law requires the reporter's consent and, where there is no recording, an accurate record of the conversation (Lei n.º 93/2021, art. 20(3) and 20(4)).
Can we export our data?
Yes. The RGPC record as CSV, JSON or printable HTML, and the access log as CSV with a chain check. Reports are exported in the handler's browser after decryption (JSON or printable HTML).
What happens if handlers lose their passwords?
When the channel is activated, your entity gets a recovery code to print, shown only once. It restores access to the reports. If the passwords of every handler and the recovery code are all lost, the reports cannot be read — by Caravel either.
Is there a free period?
No. There is no free period and no free trial. You can ask for a quote and see a demo with fictitious data.
Does Caravel Canal guarantee that we comply with the law?
No. It is a tool: it does not give legal advice, does not certify and never says that an entity complies. The legal content belongs to your entity and to whoever advises it.