Code of Conduct

This is the SafeReport Code of Conduct, the company behind the SpeakSafely, a Brazilian whistleblowing and corporate ethics-hotline platform. It sets the ethical standard expected of everyone acting for SafeReport — internally and in the market.

This English version is a convenience translation. For Brazilian legal and compliance purposes, the Portuguese text is the reference version.

SafeReport exists so people can speak safely. This Code is not window dressing: it is a commitment to practice, inside our own company, what SpeakSafely helps other organizations build.

1. Purpose

This Code guides day-to-day decisions, reduces ambiguity in sensitive situations, and protects people, customers, and the trust placed in SafeReport. It complements Brazilian law, the Privacy Policy and the Terms of Use of SpeakSafely. If there is a conflict, the law prevails.

2. Who it applies to

This Code applies to:

• Partners, officers, and leadership of SafeReport
• Employees with or without a CLT contract, interns, and apprentices
• Service providers, consultants, and representatives acting for the company
• Commercial partners when they represent SafeReport or SpeakSafely

No one is above this Code. Title, seniority, or commercial results do not justify an ethical breach.

3. SafeReport and SpeakSafely

A SafeReport is the company (CNPJ 52.784.630/0001-06), based in Porto Alegre, Rio Grande do Sul. SpeakSafely is SafeReport’s whistleblowing and corporate ethics-hotline product. This Code covers development, operations, support, sales, and marketing of SpeakSafely, and any other product or service of the company.

4. Principles

• Integrity: we do the right thing even when no one is watching. We do not distort facts, metrics, or commercial promises.
• Respect for people: we treat colleagues, customers, reporters, and competitors with dignity, without harassment, discrimination, or retaliation.
• Confidentiality: we protect reports, personal data, and customer information as a fiduciary duty, not a favor.
• Responsibility: we own mistakes, correct them quickly, and do not shift undue risk onto reporters or customers.
• Transparency: we communicate clearly what SpeakSafely does and does not do. We do not sell anonymity the technology cannot provide.

5. Workplace

SafeReport does not tolerate moral harassment, sexual harassment, violence, discrimination, or any conduct that creates a hostile environment. This includes, without limitation, conduct based on race, color, ethnicity, sex, gender identity, sexual orientation, age, religion, disability, origin, social condition, or opinion.

We expect leaders to prevent, listen, and act. Internal reports about harassment, psychosocial risks, or misconduct are treated with the same seriousness we expect from SpeakSafely customers, in line with Lei 14.457/2022 and NR-01.

6. Business integrity

It is prohibited to offer, promise, request, or accept an improper advantage, directly or indirectly, in dealings with public or private agents. SafeReport complies with Brazil’s Anti-Corruption Law (Law 12.846/2013) and related rules.

Gifts and hospitality are acceptable only when modest, occasional, without expectation of return, and recorded when internal policy requires it. Cash, cash equivalents, or gifts intended to influence a buying decision are prohibited.

Conflicts of interest must be declared to leadership before any decision. Examples: a close relationship with a customer or supplier under your management; a stake in a competitor; using inside information of SafeReport or customers for personal benefit.

7. Confidentiality and duty over reports

Anyone who operates a reporting channel carries an extra duty. At SafeReport:

• We do not access customer report content, reporter data, or investigation trails without a legitimate operational need, authorization, and a record.
• We do not try to identify anonymous reporters, nor help third parties do so, except for an express legal obligation.
• We do not use report, case, or customer data for marketing, prospecting, public training, or demos without a legal basis and, when applicable, effective anonymization.
• We do not discuss customer cases in informal settings, on social media, or with people who do not need to know.
• We treat personal data in line with the LGPD (Law 13.709/2018), with minimization, a determined purpose, and retention periods.

A breach of report confidentiality is a serious offense.

8. Information security

Each person is responsible for protecting access, credentials, devices, and development environments. It is prohibited to share passwords, disable security controls without authorization, install unapproved software on systems that handle customer data, or expose information in repositories, tickets, or public conversations. Incidents, suspected leaks, or improper access must be reported immediately to leadership and the security function.

9. Customers, market, and competition

We sell honestly. Comparisons, customer stories, and metrics published on the site must be verifiable and have an explicit methodology. We do not disparage competitors with false information. We do not fix prices, allocate markets, or exchange commercially sensitive information unlawfully.

SpeakSafely is a technology platform. SafeReport does not replace the customer’s duty to investigate, decide, and protect its reporters. We do not promise a legal outcome, automatic certification, or “guaranteed” compliance merely by contracting the software.

10. Resources, brand, and intellectual property

Company resources (systems, data, the SpeakSafely and SafeReport brands, code, content, and equipment) are for legitimate work. It is prohibited to copy, license, or disclose intellectual property of the company or third parties without authorization. Occasional personal use of tools must be residual, lawful, and without risk to customer data.

11. Protection for people who report — non-retaliation

SafeReport prohibits retaliation against anyone who, in good faith, reports a concern, refuses to take part in improper conduct, or participates in an investigation. Retaliation includes unjustified dismissal, demotion, isolation, threats, biased performance reviews, or any harm for having spoken up. Bad-faith, slanderous, or deliberately false reports also violate this Code and may lead to disciplinary and legal measures.

12. How to report a concern

Violations of this Code, the law, or internal policies may be reported, identified or anonymously, through:

• Direct leadership or, if the concern involves that leader, the level above
• SafeReport’s own SpeakSafely channel, with the same anonymity protection we offer customers
• Email hello@speaksafely.com
• WhatsApp +55 51 2481-0031

Reports are handled with confidentiality, need-to-know, and a record. SafeReport does not require the person to prove the issue in advance; it expects good faith and enough information to investigate.

13. Investigation and consequences

The company investigates reports impartially, proportionately, and on the record. If a violation is confirmed, measures may include guidance, training, a warning, contract termination, ending a partnership, and notice to authorities when the law requires it. Leaders who know of a serious violation and fail to act also breach this Code.

14. Governance and updates

SafeReport leadership is responsible for keeping this Code alive: training newcomers, reviewing it periodically, and fixing process gaps. The current version is always at speaksafely.com/en/code-of-conduct. Material changes will be communicated internally. If you are unsure how to interpret a rule, ask leadership before acting — not after.