Raised Hand — setting it up
Who this is for: directors · Where: Raised Hand in the sidebar, under Users & communication.
What this is
A channel through which a pupil, a teacher or a parent can tell the school that something is wrong — including anonymously — and through which the school then acts under Moldovan law without losing track of who is protected, who is accused, and what the state has to be told.
It is called Raised Hand, not a red button, on purpose. A red button is an emergency object, and a child who is humiliated in a corridor every day does not feel entitled to press one. Raising your hand is what you already do in a classroom when you need to be heard. The urgent path has not gone anywhere: the emergency numbers sit above every step of the form.
HG 270/2014, pct. 39 subpct. 5) obliges the school to put at children's disposal means of reporting violence, neglect, exploitation and trafficking including means that ensure anonymity, appropriate to their age. This page is how you provide them.
Nothing works until you do these three things
1. Nominate a coordinator
HG 270/2014, pct. 44 says the director designates, from the administration, a coordinator of prevention, identification, reporting, referral and assistance in cases of violence against children. That is the person this channel delivers to.
Open the Setup tab, find the teacher, press Coordinator.
Not pupils, and not you. A director already sees everything, and the list is built from active teachers of this school only.
2. Nominate at least one deputy
Press Deputy on one or more other teachers.
A deputy is not a spare pair of hands. It is the answer to the question "where does a report about the coordinator go?" — and if you have not nominated one, the answer is "outside the school, immediately", because the product will not put an allegation into the inbox of the person it accuses. The page shows an amber warning until you have at least one.
3. Open the channel
Tick The channel is open.
Until you do, nobody in the school sees Raised Hand at all — the nav entry is absent for pupils, and a report submitted through a stale browser tab is refused. Trying to open it with no coordinator nominated is refused too, with "Nominate a coordinator before opening the channel": a channel a child can post into that nobody is assigned to read is worse than no channel.
Who can read what
| Role | Sees |
|---|---|
| Coordinator | Every case, unless a report names them |
| Deputies | The same, and the cases the coordinator is blocked from |
| You (director) | Everything, plus this Setup tab, the statistics and the disclosures |
| Every other teacher | Nothing. Not a report, not a case, not a count |
| Pupils, parents | Only their own reports |
That is deliberate. An empty queue says "you have no cases"; the truth is "this is not yours to read", and the difference matters when the case is about them.
Confidential reporting needs a key on the server
A pupil choosing Confidential is promised that their real name is kept encrypted and can be produced only if the police or the prosecutor ask for it officially. That promise needs an encryption key that lives on the server and not in the database — so that you, with full application access, cannot read who complained about you.
If it is missing, the Setup tab shows a red banner and confidential reporting is
switched off. Named reporting keeps working. Whoever runs your server must set
SAFEGUARDING_VAULT_KEY to 32 random bytes, base64:
node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
Every sealed identity becomes permanently unreadable without it — including by a court. Keep it wherever you keep the rest of your production secrets, and do not rotate it casually.
Emergency numbers
The Setup tab has fields for the emergency number (112 by default), your local guardianship authority and your police inspectorate. They appear at the top of the reporting page, above every step, so a child in danger never has to finish a form first.
Reporting without an account
Optional, and off by default. Turning it on produces a short poster code you can print with a QR link, so the pupil with no phone and the neighbour who saw something can still report.
It widens reach and it widens the surface for nuisance reports at the same time, which is why it is your decision and not a default.
A mistyped code, or one you have since replaced, lands on a page that says so — and that page still shows the national emergency number and the free child helpline, so nobody who reaches it is left with nowhere to turn. If you switch the channel off, the page shows your school's own numbers instead.
The board
The Cases tab is the queue. Each card shows the case number, the severity, the deadline, how many reports it holds and how many distinct people sent them.
A director sees Cases, Signals, Statistics, Disclosures and Setup — and no Report or My reports tab. You can never be the subject of a report through this channel (see Who can read what), so the one thing a reporting form exists to protect against does not apply to you, and a report you filed about yourself would have no one to route it away from.
Finding one case among many
The search box looks inside the cases, not just at their titles — the text of
the reports, the people named, the place, and the reporter's codename. It ignores
diacritics, so stefan finds Ștefan and coridor finds coridorul. Several
words narrow rather than widen: popescu coridor returns only the cases that
match both.
When a case matches on something you cannot see in the card, the card shows you the sentence it matched on, with your words highlighted, so you never have to open a case to find out why it is in the list.
More filters adds deadline state, outcome, an opened-between date range, only cases naming a member of staff, and only cases assigned to me. The list is paged; the count above it is the number of cases matching your filters, not the number on the page.
A case you are firewalled out of is not searchable by you either. It cannot be found, counted, or confirmed to exist — see Who can read what.
Deadlines are set by law, not by you
| Severity | Deadline | Where it comes from |
|---|---|---|
| Urgent | Telephone now; one hour to acknowledge | L140 art. 9(1)(b) · HG 270 pct. 34 |
| Serious | 24 hours to send the report form | L140 art. 8 a)–c) · art. 9(1)(a) |
| Internal | Your own SLA (72 hours by default) | HG 270 pct. 61(2) |
| Integrity | 3 months | Legea 122/2018 |
| Facilities | Your own SLA | — |
The Internal deadline (hours) field in Setup changes only the internal one. The 24-hour and immediate deadlines are not editable, because they are not the school's to set.
A deadline that passes is recorded, escalated to you, and then out of the school if it keeps passing. Every step is timestamped — Legea 140/2013, art. 22 alin. (2) lit. g) attaches personal liability to a missed notification deadline, so the record has to show who held it and when it moved, not merely that the case was "handled".
The two signals
The Signals tab shows two things a queue cannot:
- The same person, again — one reporter, one subject, several times. This reads two ways at once: a child being harmed repeatedly, or a child using the channel against somebody. The board shows both readings and decides neither.
- Different people, one subject — several reporters who do not know about each other. This is the strongest evidence a school can hold.
Each pattern is written out in plain words with the number that makes it a pattern, and each one ends with what to do about it. When there is nothing to show, the tab tells you what would have to happen for a line to appear there, rather than leaving you an empty box.
This tab decides nothing. It points at cases; you open them and judge.
The register and the documents
- Report form (PDF) — the fișă de sesizare for one case, generated fresh each time and never stored.
- Register (PDF) — the evidence trail HG 270/2014, pct. 35 names by hand: date and time of registration, date and time of dispatch, who sent it, who received it.
- Pack for the authority — one ZIP with the case, the reports, the whole conversation, the intervention plan and every attachment with its SHA-256 hash, so a file can be shown not to have changed.
The law requires a person to telephone the guardianship authority. The product makes that fast and records that it happened; it does not do it for you, and an automatic entry nobody made would be a false entry in a legal register.
Identity disclosure
The Disclosures tab is the only way a confidential reporter's real name can ever be produced, and it now needs three signatures, not two:
- a written official request from an authority — the body, the file number and the date, all recorded;
- a written reason of at least 40 characters;
- two people inside the school. Whoever raised the request cannot countersign it;
- the platform operator, from outside the school.
Why a third signature
The first two both come from inside the school the report is about. The people most motivated to learn who complained are sometimes that school's own leadership, and "two of us agreed" is a thin brake when both of them work in the same building. The operator holds the written authority request in front of them and has nothing at stake in the outcome.
This is a hard gate. If it is not reviewed, no identity is ever released.
The window
When the operator approves, they also choose how long the name stays readable — minutes, hours or days, up to thirty days. Inside that window the two signatories can open the vault as often as they need, and every opening is logged. When it lapses the name is unreachable again without a whole new request.
Nothing is ever stored decrypted. The window controls how long the vault may be re-opened, not how long a name sits in a database column.
The tab shows each request as three steps — requested, countersigned, reviewed — so a coordinator who has countersigned can tell "waiting on the operator" apart from "it failed".
Every request and every decision stays on the list permanently and cannot be edited or deleted, and a decision is final: an approval cannot be quietly set back to pending, and a window can be cut short but never extended. That visibility is the safeguard, because it is what stops the vault being opened quietly to find out who complained about you.
What the product deliberately does not do
- No AI decides severity. A model's unreviewed guess has no place on a legal clock.
- No public statistics. School-level counts become league tables, and a school punished for reporting honestly stops reporting honestly.
- No view for the accused. They are informed through your real procedure, by a person.
- No automatic notification of authorities. See the caution above.
The printed poster
Switching on Reporting without an account gives you a code, a QR code and a poster you can print and put on a wall. Photographing the square opens the reporting form with no account and no login.
You can change the headline and the line under it before printing.
⚠️ Switching the channel off destroys the code. Every poster already on a wall stops working, and switching it back on gives you a new one. That is deliberate — a code that survived being revoked would not be a revocation. The New code button does the same thing on purpose, for when a poster walks.
How long this is kept
Retention is three years, and it is enforced rather than merely recorded. Once a night, cases closed for longer than that are deleted — the reports, the messages and the evidence files themselves.
You are warned first, and nothing goes unannounced
Thirty days before a case falls due you get an email, in your school's own language, saying how many cases are affected, exactly what will be deleted, and the date. A case that has not been warned about is never deleted, and the deletion does not run until at least 14 days after the warning — so a warning sent this morning can never be followed by a deletion this afternoon.
If the email cannot be sent at all, deletion stops rather than proceeding silently. Material kept a little too long can be deleted later; material deleted without warning cannot be brought back.
From the Statistics tab you can export every case in a date range as one archive — see Exporting a period. That is the fastest way to get a term or a year off the platform before retention takes it.
Three things are never touched: a case under legal hold, the disclosure register (a record that an authority was given somebody's name outlives the file it came from), and the access log.
An open case is never deleted however old it is.
Exporting a period
The Statistics tab has a date range and an export button. It produces one ZIP containing a full dossier for every case in that range — as PDF, as Word, or both.
Use it when the inspectorate asks for a term, when you are audited for a year, or before retention takes a batch. Doing that one case at a time is how a school ends up with eleven downloads and no idea whether it has them all.
- The archive carries a README listing exactly which cases are inside, which could not be generated, and how many were withheld from you.
- A case you are firewalled out of is simply absent, and the README says how many — never which, because naming them would be the disclosure the firewall exists to prevent.
- No document ever contains a confidential reporter's name. They appear under their codename, exactly as everywhere else.
- Nothing is stored. It is generated fresh each time, so it always matches the register on the day you downloaded it.
- One archive holds at most 200 cases. A wider range is refused with the count rather than quietly truncated — an archive missing 140 cases would be filed as if it were complete.
Nominating the coordinator
The staff list is searchable, and the people currently nominated stay pinned at the top while you search — so you can find a replacement without losing sight of who holds the role now.
The panel states the three requirements plainly and shows which are met: a coordinator is mandatory before the channel opens, and at least one deputy is what makes a report about the coordinator readable by somebody who is not its subject.