Anonymous reporting · Autessa Ethics Hotline
Case code and passphrase
Every report on Autessa Ethics Hotline gets a case code, like ETH-7K3P-Q9, and a passphrase that only the reporter holds. The suggested passphrase is five random words drawn in the reporter’s own browser; it never appears in a web address, browser storage or a log, and the hotline keeps it only as a hash, so not even the committee can read it.
Why it matters
Anonymous follow-up needs a key only the reporter has
Without an account there must be another way back to a report, and it has to be something nobody else can guess, look up or reset. Short numeric PINs are guessable and reset links need an email address. A case code plus a strong passphrase, made on the reporter’s side and never stored in readable form, is the anonymous equivalent of a login.
What you get
- Case codes look like ETH-7K3P-Q9: six characters from an alphabet without look-alikes (no 0, 1, I, L, O or U).
- Code entry is forgiving: any case, with or without spaces, dashes or the ETH prefix.
- A suggested passphrase of five words from a 256-word list, drawn with the browser’s secure random generator.
- Copy, or ask for a new suggestion, and confirm “I’ve written down or saved this passphrase” before continuing.
- Or choose your own: 10 to 200 characters, typed twice; spacing is tidied the same way every time.
- The confirmation page shows both once, with Copy code, Copy passphrase, Copy both and Download as a text file.
- The code and passphrase pass between pages only in memory: a reload shows “Nothing to show here”, not the secret.
- Repeated wrong guesses are rate limited (“Wait 15 minutes and try again”).
How it works
How does case code and passphrase work?
A passphrase is suggested on step three
Five words, such as maple-river-cobalt-lantern-quiet, made in the reporter’s browser. They can copy it, ask for another, or choose their own.
The reporter confirms they saved it
A checkbox must be ticked before continuing, because neither the code nor the passphrase can be recovered.
The report is sent and a code is issued
The hotline returns the case code. The passphrase is stored only as a hash.
Both are shown once
With copy buttons and a downloadable text file that includes the date sent and where to check the report.
The reporter comes back any time
Case code plus passphrase opens the report on the Check a report page.
Every option
Case code and passphrase rules
| Option | What it does |
|---|---|
| Case code format | ETH-XXXX-XX from 23456789ABCDEFGHJKMNPQRSTVWXYZ. |
| Suggested passphrase | Five words from a 256-word list (40 bits), chosen with rejection sampling so every word is equally likely. |
| Own passphrase | 10 to 200 characters after trimming and collapsing spaces; case-sensitive; entered twice. |
| Storage | Never in a URL, browser storage or a log; held by the hotline only as a hash. |
| Download file | A plain text file named after the case code, with a reminder to keep it somewhere private. |
| Lost passphrase | Cannot be recovered. The reporter can make a new report and mention the earlier one. |
Permissions
Who can do what?
The hotline’s access rules are enforced on the server for every request, not just hidden in the interface.
| Who | What they can do |
|---|---|
| Reporter (anyone with the hotline link; no account, no sign-in) | Hold the only copy of the passphrase, and use it with the case code to open the report. |
| Ethics committee member | See the case code on the case. They can never see or reset the passphrase. |
| Anyone else | Nothing without both values; guessing is rate limited. |
Connected
How it connects to the rest of the hotline
FAQ
Questions about case code and passphrase
What if a reporter loses their passphrase?
It can’t be recovered, by design, because the hotline keeps only a hash of it. The reporter can make a new report and mention the case code of the earlier one, and the committee can connect the two.
Can the ethics committee see a reporter’s passphrase?
No. The committee sees the case code but never the passphrase. It is stored only as a hash and is never in a URL, browser storage or a log.
How strong is the suggested passphrase?
It is five words chosen at random from a 256-word list, roughly 40 bits of entropy, and wrong guesses are rate limited. Reporters can also choose their own of up to 200 characters.
Does the case code reveal anything about the reporter?
No. It is random and contains no date, name or sequence number.
100% customizable, code and all
Make Autessa Ethics Hotline fully your own.
Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.
Start free and make it yours