Compliance
Review process, evidence handling and technical safeguards.
Entries are published only after evidence and wording have been reviewed. The party concerned can respond to every incident.
- 1Access
- 2Change
- 3Review
- 4Viewing
Safeguards
Built into the process
Manual operator verification
No account is activated automatically. Each brand is verified individually before it can query or document, and lookups are enabled after a first contribution.
Evidence requirement
Every incident is tied to a documented business relationship and requires at least one supporting document. Evidence files receive a checksum, and capture metadata such as location and device is removed from images.
Structured review
Evidence and wording are reviewed before an incident is published. High amounts and compliance topics require a second reviewer. The review establishes whether documentation exists, not who is right.
Statement of the party concerned
A party concerned can submit a statement without an account, optionally with acknowledged and disputed amounts. It appears next to the incident. Only its wording is reviewed, never the truthfulness of its content.
Protocol and monitoring
Lookups with their purpose, access to evidence and changes are recorded in a protocol that cannot be changed afterwards. A hash chain makes tampering visible, and a lookup monitor detects systematic probing.
Access control and data protection
Access rules are enforced in the database itself, a second factor can be required per operator, and teams work with roles. Data is hosted in Frankfurt. Records of processing, a balancing of interests, an impact assessment, retention periods and a log of security incidents with the 72-hour deadline are maintained in the product.
Request operator access
Verification of each brand is the first step. Access is enabled manually after review.
Request access