When someone raises a safeguarding concern, they may be sharing deeply personal, sensitive or distressing information. They need confidence that their concern will reach the right person, be handled securely and remain accessible to the organisation even if staff or volunteers change.
Using a personal email address such as joe.bloggs@hotmail.com for safeguarding correspondence makes achieving this much harder. However trustworthy or experienced the individual may be, safeguarding information should be controlled by the organisation - not held within somebody’s personal email account.
Safeguarding belongs to the organisation
Safeguarding is an organisational responsibility. Although a designated safeguarding lead may manage concerns on a day-to-day basis, the records and communications relating to those concerns belong to the church, charity, school or organisation.
When safeguarding emails are sent to a personal account, the organisation loses an important degree of control. It may not know:
-
Where the messages and attachments are stored
-
Who else can access the account or device
-
Whether appropriate security measures are in place
-
Whether information has been forwarded or downloaded
-
How long messages will be retained
-
Whether records can be retrieved when needed
-
What will happen if the individual leaves the organisation
A personal account may also contain thousands of unrelated messages. Important safeguarding information can become mixed with household bills, online shopping confirmations, family correspondence and marketing emails. That is not an appropriate environment for managing sensitive concerns.
Personal accounts create security risks
Free personal email services are not necessarily insecure in themselves, but the organisation has little or no control over how the account is configured or used.
The account holder may reuse passwords, access their inbox through an unsecured device or share a computer with family members. Emails may appear in notifications on a personal phone, while attachments could be automatically downloaded or backed up to other personal services.
If the account is compromised, the organisation may have no ability to reset the password, review login activity or remove access. It may not even know that a security breach has occurred.
By contrast, an email address using the organisation’s domain—such as safeguarding@yourdomain.com - can be managed centrally. The organisation can apply security requirements, change access permissions, retain appropriate records and ensure that responsibility passes safely to a new safeguarding lead when necessary.
Continuity matters when people change roles
Safeguarding roles are often carried out by committed volunteers, employees or trustees, but the people fulfilling those roles will inevitably change.
If concerns have been sent to an individual’s personal email address, important information may leave with them. The organisation could find itself dependent on a former volunteer to locate historic correspondence or forward records. In the worst cases, nobody may know what information remains in the account.
A role-based address such as safeguarding@ provides continuity. The address remains the same even when the person responsible for monitoring it changes. It is easier to promote consistently on websites, posters, policies and safeguarding notices, while access can be transferred without changing the organisation’s published contact details.
It also creates a clearer boundary for the safeguarding lead. Sensitive correspondence is kept separate from their personal messages, helping them manage information more consistently and reducing the risk of accidentally replying from the wrong account.
A domain-based address builds confidence
People may already feel anxious about raising a safeguarding concern. A generic personal address can create uncertainty: Is this the correct person? Is the address still current? Will the information be treated officially? Who owns the inbox?
An address connected to the organisation’s domain looks accountable and professional. It reassures the person reporting the concern that they are contacting an official safeguarding channel rather than simply emailing an individual.
However, creating a safeguarding@ address is only part of the solution. The organisation must still decide who can access it, apply strong security controls, enable multi-factor authentication where possible and establish procedures for monitoring, recording and responding to concerns.
Safeguarding information should not be accessible to everyone with general access to the organisation’s email. Permissions should be limited to those who genuinely need the information.
Why a secure contact form can be even better
Even a dedicated safeguarding email address has limitations. Email conversations can be fragmented, attachments may be downloaded onto different devices and important details can be omitted from the original message.
A properly configured safeguarding contact form provides a more structured way for someone to raise a concern. It can guide the person through the information that may be helpful, while making it clear that they do not need to know safeguarding terminology or have all the details before contacting the organisation.
A form can also reduce the need to display an email address publicly. This helps limit spam and phishing attempts and ensures that concerns are directed into the organisation’s agreed safeguarding process.
Crucially, the form should not simply forward sensitive information into several ordinary inboxes. It should connect to a secure safeguarding system with controlled access, clear accountability and an appropriate record of what was submitted and when.
Raise concerns securely with iKnow Safeguarding
iKnow Safeguarding includes a Raise a Concern Form that can be added to an organisation’s website. This gives people a clear and accessible route for submitting a safeguarding concern without relying on somebody’s personal email address.
The form can also be linked to using a QR code. The QR code can be displayed on safeguarding posters, noticeboards, information cards, newsletters, event materials or inside buildings. Someone can scan the code with their phone and go directly to the concern form.
This makes the reporting process easier to find and use. Rather than expecting somebody to copy an email address, identify the correct safeguarding lead or wait until the office is open, the organisation can provide a consistent route for raising a concern.
The submitted information can then be managed within iKnow Safeguarding, helping authorised safeguarding personnel maintain appropriate records and oversee the concern through the organisation’s safeguarding process.
The form should sit alongside clear guidance explaining what to do if somebody is in immediate danger or urgent assistance is required. In those circumstances, people should contact the emergency services or the relevant statutory safeguarding authority rather than wait for an online response.
A simple but important improvement
Replacing personal safeguarding email addresses is a relatively small administrative change, but it can make a significant difference to security, continuity and public confidence.
Every organisation should review the safeguarding contact details published on its website, policies and noticeboards. If the address belongs personally to a member of staff or volunteer, it should be replaced with an address controlled through the organisation’s own domain.
Better still, organisations can provide a dedicated online route for raising concerns. The iKnow Safeguarding Raise a Concern Form helps make safeguarding reporting more accessible while directing sensitive information into a system created for managing safeguarding responsibilities.
Safeguarding concerns are too important to be left inside somebody’s personal inbox. They should be received through a channel that is secure, accountable and owned by the organisation.