A long queue of people waiting outside a barred service window

Community feedback & misconduct reporting — one system

Nothing changes if nothing is answered.

Every feedback mechanism makes a promise to the people it serves. Most keep it in a spreadsheet nobody can audit. FCRM is one system for community feedback and misconduct reporting, where a sensitive report is sealed at the moment it arrives, routed to a named person, closed with a response — and every case carries a trace that cannot be rewritten.

See pricing Read the evidence ↓

§ 01 — The problem

The feedback graveyard

Ask a community for feedback and you raise an expectation. Fail to answer and you spend trust you cannot earn back — and the people with the most at risk stop telling you anything at all.

A child holding up a soiled palm towards the camera — Tearfund, reported by the Humanitarian Practice Network

Research, not opinion

Low use, limited response

A 2025 qualitative systematic review of downward accountability by humanitarian NGOs found “low utilization of complaint response mechanisms and limited response to feedback concerns” across the studies it pooled.

Systematic review, LMICs · PMC12118924

The silence problem

Zero reports is not safety

The PSEA handbook is blunt: “zero complaints/reports does not mean an absence of cases.” Silence is evidence of an enabling environment — or of a mechanism nobody trusts to keep a secret.

CHS Alliance / InterAction · PSEAH Handbook

The standard

“Closing the loop” is now a requirement

CHS Commitment 5 demands safe, responsive, documented complaints handling. The IASC Standards for Collective Feedback Mechanisms make closing the loop a standard to be met — and increasingly evidenced — not a nice-to-have.

CHS Alliance 2023 · IASC 2025

Donors, HQAI assessors and boards no longer accept a policy PDF that says “confidential.” They ask what happened to the case: who saw it, when, what changed, who answered. If your answer is a folder of spreadsheets, you do not have evidence. You have exposure.

Children looking out through a red metal grille

What the mechanism is for

If a report is collected and never answered, the community learns not to report. The next silence is the result.

The reason this product exists

§ 02 — Implementation today

What “we have a feedback mechanism” usually means

Five arrangements we see across country programmes. Every one of them is documented practice — some of it in the sector's own guidance. None of them can answer the only question that matters: what happened to this case?

Two spreadsheets, one copied from the other, with a redacted row

The spreadsheet register

Paper forms are collected, re-keyed into Excel by volunteers, consolidated into a central workbook by an information-management officer, and coded by hand. The sector's own toolkits describe this workflow step by step. Each handoff is a copy; each copy is a file on a laptop.

What it costs you
No access control at row level. No history. A SEA allegation sits in the same workbook as complaints about lateness. When someone asks who read it, the file cannot say. When a laptop leaves the country office, the cases leave with it.

An envelope with three pairs of eyes reading it

The shared inbox

Reports arrive as email and WhatsApp threads and get forwarded to “the focal point.” Everyone with the mailbox can read everything. The person who reported has no reference, no status and no reply unless someone remembers.

What it costs you
Confidentiality depends on individual restraint, not on the system. Forwarded attachments persist in mailboxes for years, outside any retention policy you can describe to a donor.

A desk phone with a price tag hanging from it

The corporate hotline

Ethics-line and whistleblowing products are built for boardroom compliance — phone-first, per-employee pricing, EU Whistleblowing Directive checklists. They know nothing about Kobo, CommCare, community meetings, or IASC case categories.

What it costs you
You pay enterprise prices for channels your communities don't use, then bolt the field intake on manually — which drops you right back into the spreadsheet of 01.

The consultant CRM

A general-purpose CRM configured for case management: custom objects, an implementation partner, a two-quarter rollout. Powerful, and built with the assumption that IT capacity exists to keep it running.

What it costs you
Six figures before the first case, recurring licence and partner hours after. Sensitivity is a field, not a boundary: access is granted by role membership, and a curious admin can open anything.

The dashboard that can't answer a person

Aggregate charts for the donor report: volumes, categories, response-time averages. Beautiful slides. The person who reported in March still has no idea whether anyone read their case, and the chart can't tell you either.

What it costs you
Measurement without traceability. You can count closure in a chart and still be unable to show, case by case, that a response was delivered.

A mechanism that cannot show what happened to a case is not an accountability mechanism. It is a collection. And a collection is exactly what it looks like the day someone asks for proof.

§ 03 — The bill

What the market charges for this

Accountability software is sold at corporate prices — per employee, per year, quote-based, with the real number arriving after the demo. Here is what is published today.

Published list prices · collected November 2026 · sources in § 08
Segment	Published price	Who they built it for	Source
Case management platforms	$20–150 /user/mo	General case work, tiered feature gates; compliance features at the top tiers	Case Management Hub, 2026
Humanitarian M&E / case tools	€545–3,700 /user/yr	Reporting and information management; Solo vs Programme tiers	ActivityInfo, 2026
Ethics & whistleblowing hotlines	$1k–50k /yr	Corporate ethics lines. $1k–5k small-to-mid; $10k–50k enterprise programmes	Veremark, 2026
Enterprise case management	“Custom”	Quote-based annual pricing, plus implementation partner hours	Case Management Hub, 2026
FCRM published tariff · no quote required	$0–10 /user/mo	Accountability, MEAL and safeguarding teams in field programmes. Free tier for small teams; community submitters are never counted, never billed	§ 04 · this product

The price is rarely the price.

Setup and onboarding fees, then “premium support” tiers
Language packs: 10 included, more bought per pack
The phone channel as an add-on — the one channel some communities need
Administrator licences billed separately from the people doing the work
Training days, configuration days, consultant hours per change request
Annual uplifts after the first-year discount runs out

FCRM's model: bill the staff accounts that work cases — case handlers, managers, sensitive-case recipients, admins. The people you serve are never a line item. The full tariff — free tier, per-user tiers and connector add-ons — is published in § 04. No quote required, no per-language packs, no admin licence surcharge.

Why a trace

Most systems can show that reports arrived. Almost none can show what happened to one.

Evidence, not a folder of spreadsheets

§ 04 — The terms

Published numbers. No quote required.

The market sells accountability software by the demo and the negotiation. Here is the whole tariff: three tiers, two connectors, one line that never moves — the people you serve are free, on every tier, always.

Free

forever · no card required

Users5
Forms1
Storage1 GB
Submittersfree · unlimited

A real mechanism, not a trial: sealing, the accountability trace and the audit log included. For a single team running one channel.

Basic

per staff user / month

10 staff = $50 / month

Usersup to 100
Storage10 GB
Submittersfree · unlimited

For a country programme: the whole accountability and MEAL team, safeguarding focal points, project managers — one shared taxonomy, one trace.

Advanced

$10

per staff user / month

25 staff = $250 / month

Usersup to 1,000
Storage100 GB
Submittersfree · unlimited

For organisations running accountability across countries: partner users, senior sensitive-case roles, per-project structure and the full reporting suite.

Kobo connector

Route KoboToolbox submissions into the canonical case model — mapped per XLSForm version, with sensitivity classification before anything is stored.

$200per month

CommCare connector

Data forwarding and API pull from CommCare, mapped per app and form version — the same sealed intake path as the public form.

$200per month

A community gathered outdoors under trees

The line that never moves

Community submitters are free and unlimited on every tier. The people you serve are never a line item.

§ 05 — The system

One intake. Two tracks. One trace.

FCRM is a single system for community feedback and misconduct reporting. Every intake — from any channel — becomes one canonical case. Sensitivity decides which of two tracks it follows, and the decision is enforced by the system, not by a policy document.

Trust model · 01

Classified before it exists

Sensitivity is decided before the submission is persisted. A sensitive intake is sealed at the moment of arrival: content is encrypted to the named recipient's key, and no tracking reference is returned to the shared device it was submitted from. There is no window in which a sensitive case sits readable in a queue.

Trust model · 02

Sealing is server-side and immediate

When a case is sealed — at intake or later, during review — access is revoked on the server before anything else runs. Open sessions are pushed a notice; an edit in flight is refused and logged. The submitter sees only that a restricted case exists. Sealed content, the raw payload and attachments all move under the recipient's key; watchers are purged.

Trust model · 03

Named people, not just roles

Sensitive cases route to a named recipient and a designated backup, so cases never sit unread when the recipient is absent — or implicated. Admins can reassign the role but cannot read content themselves; every reassignment is logged and notified. If a case names the recipient, routing escalates to the next level automatically.

Trust model · 04

Nothing rewrites the record

Every case carries a complete, ordered accountability trace — received, classified, assigned, viewed, edited with before-and-after values, referred, responded, closed. It is append-only and hash-chained, verified nightly and anchored. No role can edit it or delete it.

Intake

Form builder with skip/display logic, validation and sensitivity triggers — a field value can seal a report before submit
Multilingual labels and options with a language switcher on the public form (two languages per form in v0); right-to-left support is specified
Public link & QR code delivery; embeddable widget, kiosk mode and offline drafts are specified for the pilot programme
Low-bandwidth design target: under 100 KB first load — built for field connections
No login, minimal cookies, clear screen after submit
Versioned forms: each publish is immutable; cases keep the version they came from

Channels

Live: public web forms, in-person logging by staff, outbound webhooks per form — HMAC signatures, retries, dead-letter queue, delivery log
Add-ons: KoboToolbox and CommCare connectors, $200/month each — see § 04. SMS aggregators, voice/IVR and inbound email follow as adapters
Every connector carries a heartbeat, last-success time and a test-message function; silent failure alerts the project owner
Backup provider per channel, manual or automatic failover
Sensitive cases send metadata only through webhooks — never content

Casework

One canonical case model from every channel: category, dimensions, status, assignee, response to community
Standard track and sensitive track with explicit, enforced rules
Taxonomy aligned with IASC and CHS categories, extendable per organisation
SLA timers and escalation for overdue acknowledgement or response
Referral to services from the project directory, with consent captured; duplicate and related-case detection is specified next
Partner organisations work only the cases referred to them

Workflow & automation

Workflow rules fire on events: received, assigned, status changed, sealed, deadline breached, manual run
Live actions: assignment, status changes, watcher management. Notification and templated-response actions are specified next
Rules never see case answers; macros cannot see sealed content and cannot downgrade a case from sensitive
Every run logged with inputs, actions and errors; failed runs retry, then alert the owner

Reporting & privacy

Live: project dashboard, summary and CSV export with small-cell suppression (k=5) so counts cannot identify individuals in small sites
Specified: org and programme roll-ups, donor report templates, scheduled exports (CSV, XLSX, PDF)
Data residency by region (EU today), retention with automatic deletion and a deletion certificate
Redaction for exports and referrals; anonymised donor exports — specified with the reporting suite
Hash-chained audit log covering logins, views, exports and permission changes — exportable for donor or internal audit

Operating commitments

Cloud-hosted, multi-tenant, jurisdiction-pinned storage (EU today)
Intake availability target 99.5%; receive-to-case latency target under 2 seconds
No accepted intake lost: the raw payload is stored encrypted before any processing begins
Rate limits and optional bot challenge on the public intake, standard track only
Public forms built to WCAG 2.1 AA; staff sign-in with password, MFA and forced password change on first login
570 automated tests green across the tenant and control planes, plus schema checks on every run

What the person who reported gets

“Every case must be closed with a response to the community.”

Submitters return with a tracking code and PIN — no account required. They can view and edit their own submission and follow its accountability trace as it is worked. If their case is classified as sensitive, they are told a restricted case exists, with no details, and their access ends there — which is the only honest thing a system can do for them.

Closing the loop is not a report someone generates at quarter end. It is the last required step of every case.

§ 06 — The trace

What happened to this case?

The question every auditor, donor and — eventually — every complainant asks. FCRM answers it with a record that no role can edit and no role can delete: append-only, hash-chained, verified nightly and anchored.

A single line of footprints crossing empty sand — FCRM product specification — core trust model

Stamp: hash chain verified nightly, append only

Accountability trace · sample

CASE 2026-0148 · sensitive track · structural events only

2026-03-11 09:14:02 systemintake case.received — channel: public form, project: field site #8f3a…c21b
2026-03-11 09:14:03 systemclassify classified sensitive — form trigger: category. Sealed before persist #2c91…04e7
2026-03-11 09:14:03 systemseal submitter access revoked · no tracking reference returned · content encrypted to named recipient key #4d0e…9aa3
2026-03-11 09:14:04 systemroute delivered to named recipient + designated backup · acknowledgement deadline: 24h #71ba…5f10
2026-03-12 08:02:19 personrecipient case.viewed — logged. Every read of a sensitive case is an event #e93c…77d2
2026-03-12 08:47:51 personrecipient triage: investigation opened · status → in progress #6b88…1c46
2026-03-13 15:20:07 personrecipient referral created — service: legal aid · consent recorded #9a71…b0e8
2026-03-19 11:05:44 personrecipient response delivered through the original channel #f0d4…2a69
2026-03-19 11:06:02 personrecipient case.closed — outcome code only · content retained under sensitive retention policy #b27c…8d31

Each event is chained to the one before it; field-level edits record before-and-after values. Nightly verification recomputes every hash and anchors the chain head — a rollback against the newest anchor is detected, not debated. Actors are attributed as person, workflow or system. Nothing here can be edited or deleted — by any role.

Stamp: audited against CHS 5, IASC PSEA, CFM, GDPR

§ 07 — Standards

Built against the standards you are audited on

Not “inspired by.” The case taxonomy, the complaints process and the reporting are shaped around the instruments that assessors, donors and HQ actually use.

CHS Commitment 5

Safe, inclusive, responsive complaints handling — documented from receipt to closure, with the safety of the complainant prioritised at every stage.

IASC PSEA principles

Sensitive reporting routed to designated focal points, zero-tolerance confidentiality, and the operating rule that zero reports is never proof of zero cases.

IASC CFM standards

Collective feedback mechanisms with closing the loop as a measurable standard — loop-closure rates are first-class data, not a quarterly afterthought.

GDPR-aligned, from day one

Data residency by region, retention with automatic deletion and deletion certificates, redaction for exports and referrals. ISO 27001 is a declared later goal.

Meant for

Accountability & MEAL teams One mechanism across country programmes: shared taxonomy, per-project structure, dashboards that measure closure instead of volume.
Safeguarding & PSEA focal points Sensitive cases arrive sealed, addressed to them and a designated backup, with acknowledgement deadlines and an investigation-ready trace.
Senior country roles Exclusive access to sensitive categories — and for everyone else, including admins, the system answers “a restricted case exists” and nothing more.
Implementing partners Scoped strictly to the cases referred to their organisation, inside the same trace as everyone else.
Affected people & staff Submit by web form or in person today — with Kobo and CommCare available as connectors, and SMS and voice following as adapters. Return with a tracking code and PIN to follow the case and receive the response.

A young woman laughing and clapping among the women of her community

Closing the loop

A case is closed when the community has the answer — not when the file is marked done.

CHS Commitment 5 · IASC feedback standards

The offer

Start free. Pilot where the risk is.

Start on the free tier today — five users, one form, one gigabyte, and the same sealing, trace and audit log the paid tiers run on. When the programme grows, the numbers above are the whole price. For a country-wide rollout, the pilot programme scopes the trial against your channels and your risk — not a feature list.

Start on the free tier Request a pilot

Tell us the country programme, the channels your communities use, and which cases keep you awake. We scope the pilot against that.

Free tier: 5 users · 1 form · 1 GB. Forever, no card required.
Paid tiers: Basic $5 / user / month (up to 100 users, 10 GB). Advanced $10 / user / month (up to 1,000 users, 100 GB).
Connectors: Kobo $200 / month. CommCare $200 / month. Added to any tier.
Residency: EU jurisdiction today; region chosen per organisation.
Exit: Retention windows, purge with deletion certificate, exports in open formats.