Compliance - Digital tools and personal support

Approximately four years have now passed since the Swedish Whistleblowing Act entered into force for the country's municipalities. This means that the first generation of procured contracts and system solutions is now expiring, which has triggered an intensive wave of contract renewals and direct procurements. Looking back at the past four years, it is clear that much has changed. From being a completely new and untested legal requirement, the field has matured significantly. Here, we summarize the three clearest trends and challenges shaping municipal whistleblowing solutions right now. 1. Higher Quality and the Decline of Clusters When the legislation was first introduced, uncertainty was high. Many municipalities pooled their resources into large clusters for joint procurements, and several attempted to build their own internal solutions. Today, we see a completely different level of confidence in the market. Clearer Specifications: Municipalities have gathered valuable experience. They know exactly what they want, and the procurement specifications are of a significantly higher quality. There is a demand for system solutions with specific functionality, such as integrated login (Single Sign-on) and advanced AI support for masking sensitive information when responding to public records requests. More External Sourcing: Organizations that previously attempted to manage channels entirely internally are now increasingly choosing to seek external assistance, both with the reporting solution and with parts of the case management. Independent Sourcing Replaces Coordination: The tendency to join large clusters has decreased. Because the process has proven to be smooth and uncomplicated, most municipalities now choose to handle their procurements independently. Furthermore, contracts are being signed for significantly longer periods than before (often up to 6 or 7 years), as the cost structure has stabilized and trust in suppliers has grown. 2. Large vs. Small Municipality: Independence in Focus The need for support in the process naturally varies depending on the size of the organization, but interestingly, resources are not the primary deciding factor. The very large municipalities often have the capacity to handle a large part of the case management internally. For other municipalities, it instead comes down to two critical factors: independence and competence. In a smaller municipality, where a case officer might only handle a handful of cases per year, the learning curve is steep and the challenges are completely new each time. Additionally, it is operationally difficult to guarantee a completely independent and impartial internal process. Therefore, external parties are increasingly in demand to step in more actively in the workflow, perform initial assessments, and act as a sounding board or investigator in more complex cases. 3. The Swedish Work Environment Authority Steps Up Inspections After maintaining a relatively passive profile during the initial years, the Swedish Work Environment Authority (Arbetsmiljöverket), as the supervisory authority, has now sharply increased its audits. They conduct regular inspections to review how channels actually function—and there is a clear common thread in what they look for. Right now, the authority’s focus is primarily on the written word. They compare the literal text of the law with the organization's internal policy documents and documented routines. They simply assume that what is written in the organization's guidelines reflects their practice. Sooner or later, the authority will knock on the door of most public actors, and when that happens, the documentation must hold up to scrutiny. How are you preparing? The market has shifted from uncertainty toward standardization and stability. This is highly visible among municipally owned companies—even those with well under 50 employees that are not formally covered by the legal mandate. Many of them still proactively choose to implement external whistleblowing channels, both for the purely business value of capturing useful information and as an important part of their employer branding. Should you receive an inquiry from the Swedish Work Environment Authority, or are you about to renew your current contracts? As a Lantero client, we are always available to provide direct support. We help you prepare accurate responses for the authority and continuously update our documentation and texts based on current practice and experiences from previous supervisory cases.

Every year on June 23rd, we recognize World Whistleblowers Day. The day was established to acknowledge and honor those who blow the whistle on corruption, misconduct, and irregularities, as well as to recognize heroic efforts in defending human rights and democracy. In public debate, being a whistleblower is generally perceived as something highly honorable. In practice, however, it is often a very thankless role, rarely met with goodwill. The whole idea is that you fight for what you believe is right, but in opposition to the prevailing order where you operate. In reality, this also frequently means entering into conflict with your employer, your colleagues, and your superiors. At Lantero, we work with whistleblowers and whistleblowing cases every single day. We know that reported cases often miss the mark. Sometimes they are matters that do not belong in the channel at all, such as issues concerning interpersonal conflicts or leadership. Other times, they stem from a misinterpretation of the circumstances. Those who report are often driven by a strong sense of justice. But just as often as actual violations are brought to light, the report may be based on an overinterpretation or misconstruction of the situation. Whistleblowers tend to be of a personality type that dares to go against consensus, which in certain situations is admirable and valuable. In practice, however, the individual is often perceived as a crank or a troublemaker. We at Lantero constantly remind ourselves of this duality. It is easy to see the troublemaker and focus on cases that perhaps should be handled face-to-face between a couple of colleagues. At the same time, these are the very individuals who are prepared to stand up and sound the alarm when something is genuinely wrong. As professionals working with these issues daily, we tip our hats to this often thankless commitment. Today, let us celebrate our challenging, yet upstanding and vital whistleblowers!

Lantero maintains an active agenda for ongoing technical development. This applies to our whistleblowing service as well as support services regarding compliance, user management, and the redaction service, Redact. The following is a summary of some of the technical and security-related changes implemented over the past year. ### Cloudflare Turnstile The reporting form in the whistleblowing service now utilizes Cloudflare Turnstile, which provides a seamless way to protect against bots without disrupting the user experience. ### Infrastructure Overview Our internal monitoring has been better structured to allow us to proactively handle issues before they impact the customer. We have real-time monitoring in place, providing immediate feedback regarding any disturbances in our systems or services. Bitdefender is active on all our servers, and we apply maintenance and upgrade procedures on a daily, weekly, and monthly basis to ensure everything runs smoothly and predictably. ### Information and Operational Security Some of our initiatives during the year include: - Anonymized Application Logs: We have established anonymized logs to protect personal data. - Vulnerability Patching: Patched several known vulnerabilities (CVEs) across the npm ecosystem. - Dependency Updates: Ensured that all major code libraries have been updated, such as Express, Vite, and Qs. - JWT-based Verification: We have modernized the authentication flow by switching to JWT-based user verification. In practice, this means the server does not need to store information about logged-in users, providing a more secure and reliable method for session management. - Deletion Protection: Implemented protection against deleting a channel that still contains active cases, serving as an extra safeguard for case information. ### Infrastructure and Performance Several efforts have been made to make the platform faster, more stable, and easier to maintain. During the past year, we have, among other things, completed the following: - MongoDB Upgrade: Upgraded to version, v7. This brings several security enhancements, as well as improvements in encryption, stability, and cluster management, while securing long-term support. - React Upgrade: Upgraded to React v19.2, the latest stable version of React 19. This version represents a paradigm shift in how the framework handles interface updates. Among other benefits, it reduces the need for manual routines and offers advantages for search engine optimization (SEO). - Node.js 24 Support: Provides more efficient memory management and improved support for the latest API standards. - Email Queue: Implementation of an email queue to avoid issues caused by too many simultaneous SMTP connections. - Autosave Functionality: Improved functionality for automatic saving. - Session Renewal: Minute-by-minute session renewal to reduce the risk of being logged out while working. - Nginx Improvements: Updated to follow best practices, including log rotation and HTTP/2 configuration. Do not hesitate to contact us if you would like to learn more about our development and security efforts.