I sat in my car in the parking garage for fifteen minutes before I did anything.
Not crying. Just sitting. Hands on the wheel. Thinking about the red dot in the corner of the Zoom window and whether Derek Whitmore knew it was there.
He didn’t. I was sure of it.
Three months earlier, our IT department had rolled out a compliance policy: all meetings on company Zoom accounts would auto-record to a cloud archive. It was buried in an all-staff email that most people deleted without reading. The recordings were retained for ninety days and accessible to the account holder.
I was the account holder of that meeting. I’d scheduled it on my calendar before Derek commandeered it to fire me.
Which meant the recording was sitting in my cloud archive right now.
Thirty-seven minutes of Derek Whitmore explaining, in his own words, that he was terminating me because I filed a product safety report that “caused unnecessary alarm.”
In most states, that’s textbook whistleblower retaliation.
In Colorado, it’s illegal under both state law and the federal protections covering consumer-data safety disclosures.
I drove home. I made coffee. I logged into the company cloud portal — they hadn’t revoked my access yet; HR is always slower than they think. I found the recording. I downloaded a copy to my personal drive. Then I generated a share link.
I watched the whole thing first. All thirty-seven minutes.
It was worse than I remembered. Derek said the word “retaliation” himself — “This isn’t retaliation, Janelle” — which, combined with the explicit reference to my safety report as the reason, was the kind of statement that makes employment lawyers very happy.
He also said, at minute twenty-two: “The vulnerability you flagged isn’t a real problem. Even if it is, fixing it would delay the quarter. We’re not doing that.”
Thirty thousand users’ data. He said that on camera.
I called an employment attorney the next morning. Her name was Priya Desai. I sent her the link. She called me back within an hour.
“Janelle,” she said. “Do you understand what you have?”
“I think so.”
“You have a VP of a publicly traded company admitting, on a recorded call, that he fired you in retaliation for a safety disclosure AND that he knowingly chose not to fix a data vulnerability affecting thirty thousand users. This isn’t a wrongful termination case. This is a wrongful termination case wrapped around a consumer-protection violation wrapped around a securities-disclosure problem.”
“So what do I do?”
“We file with the Department of Labor. And then,” she said, “we make some phone calls.”
Before I filed anything, I did something Priya told me to do: I documented the chain. I exported the original safety report with its timestamp. I saved the email where I’d CC’d the compliance team six weeks earlier. I screenshotted the calendar invite that proved the meeting was scheduled on my account — which is why the auto-record had captured it.
I built a folder. Methodical. Dated. The kind of folder that makes a defense attorney’s stomach drop.
Because I knew how these things go. I knew the company would claim the firing was about “performance.” I knew they’d produce a paper trail — a hastily backdated performance review, a manufactured complaint, a “documented pattern.”
So I needed my own paper trail to be unimpeachable.
It was.
Every date lined up. The safety report came first. The retaliation came second. The recording connected them in Derek’s own voice.
We filed the whistleblower retaliation complaint that week. The recording was attached as Exhibit A.
The Department of Labor opened an investigation within ten days. They subpoenaed the company’s internal records on the safety report — the one I’d filed through proper channels, the one with my name and timestamp and the compliance team CC’d.
It was all there. Documented. The report. The vulnerability. Derek’s dismissal of it.
The company’s general counsel called Priya before the investigation even got rolling. They wanted to settle.
Priya told them we’d discuss it after the data vulnerability was disclosed to affected users and patched.
Here’s the part that mattered most to me: the vulnerability got fixed.
Thirty thousand users got notified. The company issued a patch. A potential breach that Derek Whitmore had decided wasn’t worth a quarter’s delay — that breach never happened, because the report I filed and the recording I kept forced their hand.
The settlement came four months later. I’m not allowed to discuss the figure. But I can tell you it was enough that I don’t think about money the way I used to.
Derek Whitmore was terminated.
Not quietly. The board conducted an internal review after the DOL investigation, and the recording — his own words, his own voice, leaning back in that leather chair — was the centerpiece. You cannot defend a man who said “this isn’t retaliation” immediately before describing the retaliation in detail.
He walked into work one Monday and walked out an hour later with a box.
Amira Osman, the HR director who sat tense beside me in that glass conference room — she testified in the internal review. She confirmed she’d advised against the termination and been overruled. Her testimony helped. She still works there. She runs the whistleblower protection training now. She asked me to be a guest speaker once. I said yes.
I got my job back, technically. The settlement included reinstatement as an option.
I didn’t take it.
I work for a consumer-advocacy nonprofit now. I analyze product safety for a living — except now, when I find a vulnerability, nobody tells me it’ll delay the quarter.
People ask me if I was scared. Sitting in that meeting. Knowing I was being fired. Watching that red dot.
I was.
But here’s what I learned: the most powerful thing you can do when someone is lying about you is let them keep talking. Let them say it out loud. Let them put it on the record.
I keep a copy of that recording. Not to watch — I never watch it. But knowing it exists steadies me.
The last time I saw Derek was at a coffee shop near the old office, eight months after everything. He was in line ahead of me. He didn’t recognize me at first. When he did, his whole body went rigid.
He didn’t say anything. Neither did I.
He took his coffee and left.
I thought I’d feel triumphant. I didn’t. I just felt tired, in the good way — the way you feel after carrying something heavy and finally setting it down.
The thirty thousand users never knew their data was almost compromised. They never knew a VP decided a quarter’s revenue was worth more than their safety. They never knew that the patch protecting them existed because one analyst filed a report and kept a recording.
They don’t need to know.
That’s the thing about doing the right thing. Most of the time, nobody claps. The people you protect never learn your name. You just file the report, keep the records, and trust that the truth is sturdier than the lie.
Because sometimes the record is already running.
And they just forgot.