OpenWhistle Files

🎉 v1.0.0 — Production-Ready Release

This is the first production-stable release of OpenWhistle. All core HinSchG compliance requirements are met.

Highlights

Security & Privacy

• Envelope encryption at rest — per-report DEK wrapped with HKDF-SHA256 MEK derived from SECRET_KEY; Fernet AES-256; admin UI transparently decrypts; pre-encryption rows backward-compatible
• Data retention policy — RETENTION_ENABLED=true + RETENTION_DAYS (default 1095 = 3 years); daily job at 03:00 UTC; GDPR Art. 5(1)(e) + HinSchG §12 Abs. 3; immutable report.auto_deleted audit log entries; admin page at /admin/retention

Multi-Tenancy

• Multi-tenancy — MULTI_TENANCY_ENABLED=true; Organisation model; org_id FK on all data tables; superadmin role manages organisations at /admin/organisations; default org auto-created at setup
• Superadmin role — superadmin > admin > case_manager hierarchy; require_superadmin guards org management

Compliance Tools

• Telephone reporting channel guide — /admin/telephone-channel; HinSchG §16 checklist, §10 recording prohibition notice, legal references
• SOC 2 / ISO 27001 documentation — security policy template and DPA template in docs/security/

Database Migrations

• Migration 012: creates organisations table; adds org_id FK and encrypted_dek column to all data-bearing tables; adds superadmin to adminrole enum
• Migration 013: data migration — backfills org_id, encrypts all existing report descriptions and message bodies
• Migration 014: per-org composite unique constraints on report_categories.slug and locations.code
• Migration 015: reverts admin_users.org_id to nullable for superadmin accounts

Full Changelog: https://github.com/openwhistle/OpenWhistle/compare/v0.5.0...v1.0.0