We keep all reports confidential to the extent possible. Investigating concerns often involves interviewing relevant individuals, and we therefore can’t promise complete confidentiality. However, please know that we exercise appropriate caution, sharing only the need-to-know information with the smallest possible audience required to conduct a credible investigation. We require all witnesses to keep our discussions in confidence and to respect our fact-finding process and the individuals involved. We handle all material investigative information in accordance with our Global Employee Privacy Notice and U.S. and Canada Employee Privacy Notice.

Yes, we allow people to make reports anonymously and promise those who wish to remain anonymous that we won’t take any proactive steps to identify them, where legally permissible. Vault doesn’t generate or maintain any internal connection logs with IP addresses and has no information linking your reporting device. When submitting an anonymous report, please provide contact information or log into the Helpline periodically using the code provided to you by Vault. You can also create an anonymous email account and use it to communicate with us via ethics@paloaltonetworks.com. However, please remember to check that account for correspondence.

Please note that in some cases, knowing your identity can help us protect your anonymity. For example, if the information you’re sharing was only available to a small group of people, knowing your identity may help us design the investigation in a manner that doesn’t reveal your identity. However, whether you wish to remain anonymous or not is solely up to you. We’ll address all good-faith reports containing sufficient information, irrespective of whether or not the reporter is anonymous.

You’re always welcome to escalate your concern to your manager or another trusted manager. They’ll ensure your concern is properly routed to the appropriate Company investigator. However, there’s absolutely no need to tell your manager or another manager if you’re uncomfortable.

Sometimes a person feels comfortable going to a manager initially but later decides they no longer want to discuss the issue with the manager. If that happens and a manager asks you about the status, simply tell them that you’ve been instructed by GET or ER to not discuss the issue with anyone. Refer them to us for additional information.

Remember, raising your concern with the Helpline or directly to us at ethics@paloaltonetworks.com ensures your report is routed to trained investigators who will help address your concern.

PANW strictly prohibits retaliation against good-faith reporters. Our commitment to the protection of those who report is outlined in our Global Code of Business Conduct and Ethics, found here, as well as in other Company policies. Anyone who engages in retaliation is subject to discipline, up to and including termination of employment. If you believe you’ve been a victim of retaliation for raising a good-faith concern, please report this to us immediately.

PANW takes all good-faith reports seriously and investigates them thoroughly. An experienced investigator assesses each report and, where appropriate, initiates an investigation. We may ask to speak with you or request that you provide additional details to ensure we properly understand your concern and can address it expeditiously. In some instances, we may need additional information to enable a thorough and impartial investigation.

If you report a concern and don’t hear back from us, please contact us again. It’s possible that we were unable to contact you for additional information. This can happen when, for example, someone submits a report by phone without providing any contact information or forgets to check the Helpline using the code provided by Vault.

Please make sure you keep the report key provided by Vault and remember your password. To ensure security and confidentiality, Vault won’t provide anyone with previously issued keys or passwords. However, you can simply refile your report. Simply note that it’s related to a prior submission, but that you lost your key or forgot your password.

Each investigation is different, but in most cases, our investigators will review documents, interview witnesses and take other appropriate steps to reach a determination. Once we reach a conclusion, we’ll debrief relevant staff and, where we determine a violation of Company policy took place, help determine and implement the right corrective action for the circumstances. Our goal is to correct the situation and mitigate or prevent future misconduct. We rely on people to escalate their good-faith concerns to us so we can operate safely, effectively, ethically and legally.

We investigate matters as expeditiously as possible. However, the more complex the matter, the longer it may take us to complete our fact-finding. Additional factors, some outside of our control, may also impact the length of an investigation. These can include the total volume of cases, the availability of witnesses or the time it takes to process or translate key evidence.

If you have additional information relevant to the investigation, please reach out and provide it to investigators. You’re welcome to check in periodically but please know that investigators will generally not be able to tell you how long they’ll need to complete their work. Constantly asking for updates can delay the appropriate resolution of your concerns.

In short, nothing. It doesn’t matter if we ultimately determine that no one did anything wrong. So long as you’re not reporting something in bad faith (i.e., falsely and maliciously), it doesn’t matter if you’re wrong. Never investigate on your own. As soon as you believe something is wrong, report it and the Company will assign a trained investigator to address the issue.

Please come to us with any good-faith concern or if you have questions relevant to ensuring we do business ethically. If you honestly believe something isn’t right, report it so we can address it. For example, a report may result in clarifying our policies or procedures. Or it may result in creating training that takes the reported scenario into account. This is how we make sure our Company, employees and business partners fully understand and meet the highest ethical standards demanded by our management and our Board of Directors.

The Company will take action in accordance with all applicable legal and privacy requirements to resolve acts of misconduct. This includes coaching, discipline, corrective actions, remediation, training or other actions. It may also result in adjustments to our controls, guidelines, policies and/or procedures.

Please periodically check the Helpline or contact information you provided to us. We’ll be happy to let you know where we stand in connection with addressing your concern. As a matter of course, we’ll notify you once we’ve finished our work, even where you reported anonymously. Legal and privacy requirements, including the need to protect the confidentiality and anonymity of relevant parties, may limit our ability to share information with you. However, we’ll do our best to let you know the outcome and, where possible, inform you where your report has led to improvements.