Customers of Business Keeper AG may ask for a specific customisation in respect of anonymous / pseudonymous reporting or reporting by name. They are advised in the privacy leaflet to consult with the competent data protection authority if they want to deviate from the advise mentioned in the previous paragraph.

The reports that are stored in the BKMS® System database are encrypted using asymmetric encryption. The same holds true for the content of the communications between whistleblowers and examiners (in the post box scenario).

Examiners can access the BKMS® System via an https interface at https://www.business-keeper.com/for-clients.html.

Customers of Business Keeper AG qualify as controller of the processing of personal data that results from the use of the BKMS® System. The Business Keeper AG qualifies as processor on behalf of its customers. It is noteworthy that Business Keeper AG cannot access clear text, but only encrypted data.

Target of Evaulation (ToE) is the Business Keeper Monitoring System (BKMS® System) v.2.3.7, functionality as provided in May 2013. The ToE is available in three different configurations:

• BKMS-Z: Collection, first verification and coordination of incoming reports by a central department;
• BKMS-D: Reports are forwarded to the competent examiners by the system automatically;
• BKMS-O: External experts (e.g., ombudsmen) deal with the collection and first verification of reports.

The ToE comprises a production system with a load balancer, two application servers and a database server as well as a development and test system.