This is often a stressful and tense moment for everyone involved. Don’t rush, and follow your process. If you’re currently in a public space or context, move the conversation to a private one.

Never contradict what the person making the report says to you, even if it doesn’t make sense at the time or you have different opinions about the people involved. Ask clarifing questions if needed to help you better understand the situation. Offer the person a quiet place to recover afterward, if the report is made in person.

Download our example form to modify and use.

Information to collect

Taking reports and being aware of privacy

It’s important to maintain the privacy of the reporter and all others involved during this process, so move the reporting to a private communication method or space as quickly as possible. Decide whether you’ll take reports via email, phone calls, other message systems, or in person. There are a number of tools that will let you set up a phone number and voicemail box all responders can access, and some also do SMS. For online reporting you should have a shared incoming email address like You could also connect this with a web form.

Agree with your fellow reporters and response team on what kinds of records you’ll keep and how they’ll be stored. You may need to consider trade-offs between privacy, security, and accountability, as well as any legal implications for the information you gather.

Factors that may affect your handling of these records:

Follow up and response

Make sure to let people know how soon they’ll have a response from you, and what the time frame is for your actions. Posting an outline of your reporting process with your code of conduct is helpful. Learn how to create a incident response plan to determine your next actions.

Example situations

Group A leads a large open source project that also throws an annual conference. They have a contact email address that forwards a copy to everyone in their response team, and a phone number for the conference that allows voicemail and SMS. Forwarding of calls and messages from the phone number is rotated to whoever is currently on call — there’s someone available both during the daytime conference schedule and for evening events. Their reporting policies are linked on the website for both the conference and the project as a whole.

When they receive a report of an incident, all notes are placed in a Dropbox folder that individual responders are added and removed from as needed. Detailed reports are only kept until the situation is resolved, except in cases where there’s a permanent restriction or an ongoing legal reason. The remaining notes are only short summaries to help the organizers from each conference year spot repeat problems.

Group B is one person, the host of a monthly user group meeting, plus a second responder from another user group (they’ve agreed to team up so that each one has a backup). They’ve decided to each have their own reporting email address for their group so that it’s straightforward for participants. The organizers did not set up a phone number or other contact system, because one of them is always present and easy to identify at the event and they anticipate receiving most information in person. For similar reasons, they’re only keeping their notes on paper and shred them after they feel an incident has been handled appropriately.

More examples of reporting guidelines

Other resources