Reporting platform for misconduct, harassment & IT security TUM SafeSignal

Process & anonymity

What happens after you submit, who reads your report and how your identity is protected.

  1. Submit your report

    You choose an area and fill in a short form – without an account and, if you wish, without your name. You then receive an access code. Write it down: if you stay anonymous, it is your only way back to your report.

  2. Acknowledgement within 7 days

    The responsible office acknowledges receipt of your report within 7 days at the latest. You can check the status at any time via “Track a report” with your access code.

  3. Confidential review

    Your report is visible only to the people responsible for the area and a few technical administrators of the platform. The responsible office reviews the matter and may ask you questions through the platform – you reply with your access code, anonymously if you wish.

  4. Feedback within 90 days

    Within 90 days at the latest you receive feedback on which measures have been taken or are planned – as far as this is possible without infringing the rights of others involved.

  5. Closure & deletion

    After the case is closed, the report including messages and attachments is deleted automatically once the statutory retention period has expired.

Who handles my report?

Each area on the start page has a fixed responsible office. Your report can only be read by the people named there and a few technical administrators of the platform – not your supervisor, not your lecturers and not the person you are reporting.

  • Misconduct, harassment, violence, discrimination, academic misconduct, corruption: the TUM Compliance Office. It reviews reports independently, i.e. free from instructions by university management.
  • IT security: TUM IT Security.

How does the platform protect my anonymity?

  • No account required. You do not need to log in or give your name.
  • Access code instead of a name. After submitting you receive a code. You use it to read replies and write back. The code is shown only once and stored only as an irreversible hash – the case handlers cannot see it either.
  • No IP addresses stored with your report. The platform stores neither your IP address nor a browser fingerprint with your report.
  • Image metadata is removed. For uploaded photos we automatically strip e.g. GPS location and device data. This is not possible for PDF, Office or audio files – please check them beforehand (e.g. the author name in the file properties).
  • Email only if you want. If you enter an email address, we only use it to notify you of new messages. Without an email you stay fully anonymous; just check back via “Track a report” with your code.

Tip: If you want to stay anonymous, leave out details only you could know (e.g. a one-on-one conversation), and avoid writing from a work computer in the affected unit.

What does the reported person learn?

Your identity is treated confidentially under the German Whistleblower Protection Act (§ 8 HinSchG). It may only be disclosed in exceptional cases defined by law, e.g. at the request of a law-enforcement authority (§ 9 HinSchG). In that case you will be informed beforehand unless this would jeopardise the investigation.

The reported person has the right to respond and to present a counter-statement before any measures are taken. They learn what they are accused of – not who made the report. Details that could point to you are left out wherever possible.

Retaliation is prohibited

Anyone who reports in good faith should not suffer any disadvantage for doing so. For employees this is protected by law: retaliation is prohibited (§ 36 HinSchG).

Do I have to use SafeSignal?

No. SafeSignal is one channel among several. You can also contact a support or reporting office in person, by phone or by email – or simply get advice first without reporting anything. See Support & other ways to report.