Whistleblower reporting channel (France's Waserman law): automating it with n8n instead of a shared inbox

Since September 1, 2022, every company with at least 50 employees in France must have an internal reporting channel for whistleblowers — an obligation from law n° 2022-401 of March 21, 2022, known as the "Waserman law," which strengthened the earlier Sapin 2 law to transpose EU directive 2019/1937. In practice, many SMBs settle for a generic email address like alert@company.com, read by the same person who handles the rest of a shared inbox — which guarantees neither the confidentiality of the reporter's identity nor compliance with the deadlines set by the implementing decree. A multi-country study by Latan, Chiappetta Jabbour and Vo-Thanh, published in 2023 in the Journal of Business Ethics, found that the perception of a genuinely secure, followed-up channel is one of the strongest determinants of the intention to report wrongdoing — a channel perceived as a poorly maintained formality discourages reports, including the most serious ones (study on Google Scholar). This guide shows how to build, with n8n and Supabase, a reporting channel that meets the legal deadlines without depending on a proprietary whistleblowing platform billed by the year.

What the decree actually requires

Decree n° 2022-1284 of October 3, 2022 sets out three obligations the channel must meet, regardless of how it's built:

• Acknowledgment of receipt within 7 business days of the report being received.
• Feedback within 3 months, counted from the acknowledgment (or, if none was sent, from the expiry of the 7-business-day window): the reporter must be informed in writing of the action taken or planned — this doesn't mean the case must be closed within that window.
• Strict confidentiality of identity for the reporter, the person(s) implicated, and any third parties named — access restricted to authorized personnel only, with traceability of who accessed what.

A form with no automated follow-up reliably misses the first deadline the moment the person handling it is out for a week; that's exactly the kind of repetitive, calendar-sensitive task an n8n workflow handles better than a reminder in someone's agenda.

The architecture: three building blocks, not a dedicated platform

This setup reuses a pattern already covered elsewhere on this blog for other compliance processes — guided intake, timestamped access-restricted storage, automated reminders, a synthesis step — applied here to the most sensitive case: a report can directly name a line manager, so the channel must sit outside the normal management chain.

1. A dedicated n8n form (a Form Trigger node), hosted on a subdomain or a non-indexed URL, separate from your other forms — a whistleblower report must never travel through the same address as customer support. The form offers two entry points: an identified report or an anonymous one, with clear wording on what anonymity means in practice (no personalized feedback is possible without a reply channel).
2. An access-restricted Supabase table, modeled on our guide to building a GDPR audit trail with n8n and Supabase: append-only writes, but with one major difference from a standard audit log — identity fields are encrypted on the n8n side before insertion (crypto.createCipheriv in a Code node, with the key stored as an n8n environment variable, never in the database), and Postgres Row Level Security restricts reads to a dedicated report_referent role, distinct from the role used by your other automations.
3. Two scheduled follow-up workflows (Schedule Trigger): one for the 7-business-day acknowledgment, one for the 3-month feedback — detailed below.

Step 1 — The form and initial logging

The Form Trigger node collects the facts (nature of the wrongdoing, people or departments involved, any evidence attached) without ever forcing identification. A downstream Code node generates a random tracking_token (UUID) given to the reporter at the end of the form: it's this token, not their identity, that lets them check the status of their case on a dedicated page — the mechanism that makes an anonymous report still trackable, as recommended by the CNIL. The Supabase write follows the same logging sub-workflow described in our audit trail guide, with event_type: 'report.received', entity_id: tracking_token, and an encrypted payload.

Step 2 — Automatic acknowledgment at day 7

A daily Schedule Trigger queries the reports table where acknowledgment_sent = false and date_received <= now() - 7 business days (business-day math is handled with a simple Code node excluding weekends and French public holidays). For each match: send an email (if a contact was provided) confirming receipt and reminding the reporter of the 3-month feedback deadline, then flip the flag so it's never sent twice. It's the same conditional-reminder pattern as the automated follow-up for incomplete cases workflow from the Compliance & Audit Pack (€149), applied here to a legal deadline instead of a client case.

Step 3 — Feedback at 3 months, without disclosing case detail

This is the trickiest part: feedback must exist, but it must never reveal details that would indirectly identify the reporter or compromise an ongoing investigation involving unauthorized parties. The workflow does not generate free-text summaries with AI from the full case file — a human referent writes the summary that gets sent, in a feedback_text field on the record. n8n's role is limited to watching the deadline and nudging the referent if that field is still empty at day 80 (a safety margin before the 3-month mark), then automatically sending the validated text to the reporter through their tracking channel (email or the token-based page). This is a deliberate departure from the AI-generated synthesis reports used elsewhere on this blog: here, automation handles the calendar and the delivery, never the substance of the judgment on the facts.

What n8n should never do on its own here

• Never auto-notify the manager of the person named in a report — routing must always go through the authorized referent, never a Switch rule based on the department involved.
• Don't store the form's IP address or connection metadata by default: most n8n form builders capture it, and it needs to be explicitly disabled so as not to reintroduce an indirect identifier into a channel meant to allow anonymity.
• Restrict the Supabase credentials: the role used by the report-logging sub-workflow must be distinct from the one used by your other n8n automations — a secret exposed on an unrelated workflow must never grant access to this table.
• Document this processing activity in your GDPR record, following our guide on keeping a GDPR record of processing activities up to date with n8n: a whistleblowing channel handles potentially sensitive data (GDPR Article 9) and deserves its own entry, with legal obligation rather than legitimate interest as its legal basis.

What still has to be done by hand

n8n handles the calendar, technical confidentiality, and traceability — not the investigation of the report itself, which remains a human decision governed by employment law and, where relevant, criminal law. The authorized referent (often the DPO or a trained employee representative) stays solely responsible for the analysis, the decision to escalate to an external authority if needed, and the wording of the feedback. Automation simply keeps this sensitive case from getting lost in a shared inbox or from blowing past a legal deadline because no one had a reminder set.

If your company already handles other compliance obligations through workflows — audit questionnaires, a GDPR record, ISO 27001 or SOC 2 evidence — the Compliance & Audit Pack (€149) provides the base building blocks (guided questionnaire bot, timestamped Supabase logging, automated reminders, AI-generated summary report) directly adaptable to a reporting channel: all four workflows ship as importable JSON with the table SQL and the setup guide, ready to customize per the reinforced confidentiality principles described here.