Compare whistleblowing software

Distinctive features

• Flat EUR 60/month or EUR 500/year regardless of headcount, users or report volume
• EXIF, GPS, and author metadata stripped from uploads automatically
• Article-by-article mapping of features to Directive 2019/1937, plus a dedicated public page for each of the 27 EU member-state transpositions
• Written, voice and email reports, with voice disguised automatically
• Published DORA procurement materials with stated limitations; any additional contractual rights require a bilateral signed order

Limitations and evidence gaps

• EthicsPortal does not hold accredited ISO 27001 certification; Hetzner infrastructure certification is separate
• No upfront free trial; the offer is a 30-day money-back guarantee
• Reporters have 14 locales, covering 13 of the 24 EU official languages
• Public DORA materials state limitations; additional rights require a bilateral signed order

Distinctive features

• Dedicated whistleblowing module within a Portuguese compliance suite
• Published anonymous reporting, case workflows, access controls and audit history
• Portugal-specific Lei 93/2021 positioning
• Suite-wide integrations, configurable workflows and reporting

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published SEK pricing across three employee-band tiers (top band quote-only)
• Web, phone, and postal whistleblowing channels available 24/7
• Reporter follow-up via case number and password, with two-way anonymous messaging
• 7-day acknowledgment and 3-month feedback stated in line with the Swedish whistleblower law
• Reports received and triaged by 2Secure's own independent investigators (managed service)
• Reporting tool stated to be available in roughly 20 languages

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Public annual pricing matrix with employee-band segmentation
• France-specific positioning around Sapin II, Loi Waserman, and anonymous reporting
• Optional external mediation / handling service for buyers that do not want to run the channel alone
• Vendor states that reports can be submitted online or by post

Limitations and evidence gaps

• The reporting surface carries end-of-life front-end components (Bootstrap 3.3.7, Font Awesome 4.7)
• No SPF record is published, and DMARC is set to p=none, so neither enforces anything on a confidential reporting domain
• Public product detail is limited: no documented reporter return-access mechanism, no public handler demo
• No public security certifications or sub-processor documentation found
• Annual contract model with referent caps is less flexible than monthly self-serve tools
• French-language product only, so a buyer with non-French subsidiaries is not covered

Distinctive features

• map[Three whistleblowing channels:online reporting form, phone hotline, and email]
• map[Three reporter modes:anonymous, confidential, and open, with an anonymous tracking link and two-way anonymous dialogue]
• Cloud or on-premises deployment offered for the Standard version
• Full public price list in PLN for both Lite and Standard tiers plus add-ons
• Astrafox holds its own ISO/IEC 27001 certificate (no. 4802510), distinct from the Azure hosting certifications
• Multi-factor authentication supported via third-party providers (vendor-stated)

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• One plan at €23–30/month with every feature included, unlimited team members and no per-report charge — the tier-gating that complicates most comparisons is simply absent
• Eighteen site locales, each with a dedicated page for that market's transposition law, named by statute rather than by "EU Directive compliant"
• The encryption design is described concretely enough to assess: a per-report AES-256-GCM key wrapped to each recipient with P-256 ECDH, ECDSA P-256 message signatures, handler keys derived with Argon2id, and ciphertext-only storage

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Romanian transposition law (Law 361/2022) named directly on public pages
• Anonymous reporting with two-way communication through the platform stated publicly
• Multi-step online reporting form is publicly reachable, with anonymity guidance and a data-protection consent step
• Dedicated DPA page and detailed GDPR privacy policy referencing Articles 6, 9, 21, and 25

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Public page states Signalement.Net has become BeSignal
• Voice and written reports, anonymous reporting, and optional automatic translation/document analysis are public claims
• Vendor pages reference Directive 2019/1937, Sapin II, and Loi Waserman

Limitations and evidence gaps

• Pricing, API access, and self-serve trial are not published publicly
• ISO 27001 and HDS badges are displayed, but no public certificate, scope statement, or complete public sub-processor register was found
• Deadline timer automation and append-only audit guarantees are not disclosed on public pages reviewed

Distinctive features

• Flat €96/month regardless of organisation size
• Voice and written reporting modes included in base plan
• Public page references UNE 19601, UNE-ISO 37001, and ISO 37002 compliance programs as contexts where anonymous whistleblowing mailboxes may be needed
• Implementation typically completed in 1–2 business days (vendor-stated)

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Chatbot-guided structured report intake
• Anonymous reporting with two-way mailbox follow-up
• Published three-tier monthly pricing (Basic, Standard, Enterprise)
• Delivered on SAP Business Technology Platform, integrated with SAP S/4HANA, and listed in the SAP Store
• Multilingual intake via GDPR-compliant real-time translation
• GDPR-compliant hosting stated to be exclusively in European data centres

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Whistleblowing is included in the $149/month Grow plan
• Free trial with no credit card on public pricing page
• Enterprise tier discloses API integration, custom data server location, dedicated instance option, email/phone support, and SLA

Limitations and evidence gaps

• No EU hosting country, reporting-language coverage, public DPA, subprocessor list, ISO 27001 certificate, retention automation, or deadline tracking was found on public pages reviewed.
• Whistleblowing is one module in a broader privacy/compliance suite rather than the primary product.

Distinctive features

• Published ENS Medium scope names Complylaw Canal Ético; the linked certificate expired on 14 August 2026
• Backed by Aranzadi LA LEY, part of Karnov Group
• Aligned to ISO 37002:2021 guidance
• GDPR and LOPD-GDD compliance stated on the product page

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Long-established Italian vendor (Unione Fiduciaria S.p.A., founded 1958) with a whistleblowing product launched in 2015
• Publicly stated adoption by more than 200,000 users, with named banking and insurance references
• Web/app platform plus a multilingual voicemail and phone channel with operator recording and translation
• Anonymous reporting and encrypted access (AES with dynamic keys) stated on public pages
• Explicitly aligned to D.Lgs 24/2023 and ANAC requirements for private and public sector

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Founder-led by Pav Gill, the whistleblower who exposed the Wirecard fraud
• ISO 27001, SOC 2, and GDPR compliance stated on public pages
• Multi-channel intake via forms, voice, meetings, and API
• Case management from intake to resolution with dashboards, reports, and export
• Anonymous reporting listed as a supported feature
• Default report-data hosting in Frankfurt, Germany

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Bulgaria-native product co-developed by Transparency International Bulgaria and Happi Company Ltd
• Public monthly pricing by employee band, which is still uncommon in this category
• Live app endpoints for login and registration plus a real web-app shell at app.crsys.org
• map[Publicly described multi-channel intake:web form, telephone, and in-person meeting]
• Site and app bundle show Bulgarian and English language support

Limitations and evidence gaps

• Commercial conversion is still contact-led despite public pricing
• Hosting country is not disclosed publicly
• Anonymous reporting is qualified by the vendor's own legal explainer: anonymous written reports do not initiate proceedings
• Security and trust disclosures are limited: no public ISO 27001 certification or sub-processor posture

Distinctive features

• Published self-serve pricing across three tiers with a 14-day free trial and no credit card
• Anonymous-by-design intake (no IP, email, or device fingerprint; reporter gets a case code plus 6-digit secret)
• EU data residency named (Hetzner Falkenstein, Germany) with a public sub-processor list and 30-day objection window
• Automatic reporter status updates at 7 days and 3 months mapped to Directive Article 9
• Append-only, hash-chained audit log exportable as CSV or JSON for regulator inspection
• Country-specific intake templates referencing named national transposition laws across all 27 EU states plus EEA and UK

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Modular pricing — €45/month for just the whistleblower module
• REST API with pre-built integrations for Personio, Azure, and SAP SuccessFactors
• map[Hybrid model:pair the software with a managed External Whistleblower Officer (eMSB) service from €125/month]
• German data-residency positioning is public
• Vendor states Compliance Hub is ISO 27001-certified

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Underlying TalkNow platform certified to ISO 27001:2013 and ISO 27701:2019 (vendor-stated)
• EU-hosted ("secure servers within the EU")
• Anonymous or named reporting with a 16-digit follow-up code and reporter↔officer chat
• Report auto-deletion within the regulatory timeframe
• 90+ languages; explicit Law 4990/2022 and Directive 2019/1937 framing

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Public pricing and self-serve trial for the Pro plan
• Encryption limits and certification status stated explicitly
• Published case-management, anonymous messaging and audit-history features

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• All five pricing tiers are published on the public site, keyed to employee count
• Explicitly built around Portugal's Lei 93/2021, which transposes EU Directive 2019/1937
• Truly anonymous submissions with anonymous two-way dialogue
• Case-management dashboard with tracking, automated email notifications, and color-coded legal-deadline alerts
• Multi-language reporting for internationally distributed teams
• Password-protected ZIP export and SSL, with data described as encrypted at rest ("Always Encrypted")

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Whistleblowing channel stated to be activated within about 36 hours
• Anonymous written and verbal reporting, including voice distortion
• 7-day acknowledgement of receipt and case tracking with restricted access
• Two-way confidential communication between reporter and investigator
• Servers stated to be located in Spain, with an optional external investigation service from EUR 150 per report

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published Silver and Gold tiers with both monthly and annual prices, plus a stated Platinum entry point
• Anonymous reporting with no IP logging and automatic metadata stripping from attachments
• Two-way anonymous chat with reporter return access via a case identifier and PIN
• Report registry with sorting, filtering, full-text search, case linking, and a handling-history audit trail
• On-premises deployment offered on the Platinum tier alongside vendor-managed Azure hosting
• Annual external security testing referenced on public pages

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Purpose-built for Slovenia's ZZPri (Zakon o zaščiti prijaviteljev) and the EU Directive
• Anonymous reporting with a self-selected unique code plus a named-reporting option
• Secure two-way communication between reporter and trustee (zaupnik)
• Basic and Multi-user tiers show fixed monthly prices on the public site
• Built-in reporting toward organization leadership and the KPK (Anti-Corruption Commission)

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• 14-day free trial with no credit-card charge during trial
• Published self-signup tiers with annual and monthly billing
• More than 30 reporting languages are stated on the public features page
• Anonymous two-way communication and statutory deadline reminders
• Third-party technical security audit referenced publicly (2NS, 2023)

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• ISO 27001 certified and SOC 2 attested, with a Vanta trust portal published for buyer review and certificates available on request
• Annual full-stack penetration testing by independent testers, staff background checks and vendor risk management are all described on the security page
• SSO through Microsoft Entra and Active Directory, with role-based access control and client-visible permission management

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• 80+ reporting languages with automated or configurable translation
• ISAE 3000 Type I/II audits and WACA Bronze accessibility certification
• Anonymous dialogue, no IP/location/device data storage, and Europe-hosted ISO 27001-certified data storage

Limitations and evidence gaps

• API access, public DPA, and subprocessor list were not disclosed on public pages reviewed. The UK packages FAQ claims the key is held by the customer, but the key-custody mechanism is not described further.
• France Waserman/Sapin II and Greece Law 4990/2022 were not found on public pages reviewed.

Distinctive features

• Rare monthly option (€30/month) alongside annual (€300/year), both VAT-inclusive
• EU data residency stated; encryption in transit (TLS/SSL) and at rest both claimed
• Anonymous reporting supported, with branded reporting pages and a secure encrypted case inbox

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published rate card down to €89/month entry tier
• ISO 27001 and ISO 27701 certified across all tiers (privacy certification is uncommon at this price band)
• 60+ languages available (though gated — only Pro is unlimited)
• On-premise license option (€13,900 one-time) for buyers needing full data control
• Unlimited users, admins and reports on every tier, including the €89 entry plan
• Up to 90% non-profit / education discount
• Reference deployment with Ukrainian state-owned transmission-system operator Ukrenergo

Limitations and evidence gaps

• Directive-ready controls are tier-gated; audit log, MFA, machine translation, and custom roles start at Advanced.
• Contracting entity, subprocessor flow, and exact trial terms require buyer confirmation.

Distinctive features

• Premium tier is fully managed by ethics lawyers, adding attorney-client privilege to whistleblower confidentiality
• SaaS platforms hosted in France with in-country data replication (vendor-stated); on-premise option available
• ISO 37002 (whistleblowing management) and ISO 37008 (internal investigations) audited by Bureau Veritas
• Reporter intake offered in 28+ languages including French
• Named public client references include RATP, CNR, Eau de Paris, AG2R, and Manutan

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published self-serve tiers from EUR 9/month with a 15-day free trial and no credit card required
• map[Explicit statutory deadline tracking:automatic 7-day acknowledgment (cites art. 18) and 3-month feedback alert]
• Append-only audit log plus a public SHA-256 hash verification tool for report integrity
• Three compartmentalized handler roles documented (admin, coordinator, resolver)
• Encrypted anonymous two-way messaging with reporter follow-up by tracking code, no registration
• EU data residency, AES-256 at rest, TLS 1.2+ in transit, and a published DPA with sub-processor right to object

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Trial subscriptions are described in the terms, subject to provider agreement; no public self-serve trial form was found
• 113 languages, web/mobile/hotline intake, two-way anonymous chat, iOS/Android apps, multiple forms, webhooks, API, Zapier, and Make integrations
• ISO 27001:2022, SOC 2 hosting servers, optional E2EE, metadata removal, no IP logging, altered voice messages, SSO, 2FA, penetration testing, public DPA, and public subprocessor details

Limitations and evidence gaps

• Pricing amounts were not found on the current public pricing page output reviewed.
• Exact EU official-language list, article-by-article Directive mapping, Loi Waserman, Sapin II, and Greece Law 4990/2022 were not disclosed on public pages reviewed.

Distinctive features

• Anonymous online reporting form with case-specific credentials for confidential follow-up
• Two-way protected dialogue between reporters and predefined investigators
• Built-in case management with customisable categories and branded reporting links
• EU hosting on Amazon Web Services European data centres, with AES-256 at rest and TLS in transit (vendor-stated)
• 30-day free trial and rapid setup described as a few days
• Data processing agreements signed with subprocessors, with a subprocessor list stated to be in the help centre

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published fixed monthly pricing across all three tiers with a 10% annual discount
• Self-serve registration with the whistleblowing channel live within about 5 minutes of payment
• Web and automated telephone reporting (phone line on STANDARD tier and above)
• Anonymous two-way communication, encrypted data, and administrator two-factor authentication
• Automated legal-deadline monitoring with email alerts
• Vendor operates its own EU data centre and states no personal data transfer outside the EU

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Entry tier is the complete product: end-to-end protected communication, archiving and the full whistleblowing channel are all in the €19.90 plan, with higher tiers buying handler seats and support rather than features
• Multi-client and white-label operation is addressed directly, with dedicated pages for consultants, law firms and ombudspersons — a segment most SME-priced vendors leave to enterprise quotes
• A large guide library covers HinSchG and HSchG obligations, works-council co-determination, the procedural rules for an internal reporting office, and template documents, with a named author

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• ISO 27001, ISO 27701, and ISO 37002 certifications claimed publicly
• Documented deployments across DE, FR, AT, MT, PT, CY, GR, BG, RO, plus Kuwait and Colombia
• Services model — handling support in addition to software
• Roughly 130 legal bodies and 10,000 employees covered per vendor reporting

Limitations and evidence gaps

• Commercial surface is opaque: no pricing, no self-serve trial, and no monthly contract signal
• Bulgaria-specific legal framing is limited; the page references whistleblower laws generically rather than the Bulgarian act itself
• Handler workflow disclosure is limited at public-page tier: no explicit status workflow, reminders, or role model are documented

Distinctive features

• Whistleblowing module sits inside a broader GRC platform from a vendor building GRC software since 2006
• Company itself states ISO/IEC 27001 and multiple other management-system certifications, not just hosting-provider certification
• Web questionnaire plus an optional dedicated secure telephone channel for oral reports
• Anonymous reporting with a secure two-way comments channel that preserves anonymity
• Automatic alerts for receipt, acknowledgement of receipt, and monitoring of legal deadlines
• Data centres stated to be within the European Union

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Purpose-built for Belgian whistleblowing compliance from an established Belgian legal publisher
• Adviser model where one account can set up and manage whistleblowing channels and files for multiple client organizations
• Live online reporting form served per organization through a public access link
• Three tiers (PRO, PLUS, EXPERT) scoped to organization size and adviser caseload
• Bundles guidance and template communications for setting up the mandatory whistleblowing channel

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published pricing across all three tiers (Normal, Premium, À Medida)
• AES-256 encryption stated on the product and pricing pages
• Anonymous reporting with stated confidentiality controls
• Native mobile apps for Android and iOS (À Medida tier or paid add-on)
• Portuguese-domestic vendor referencing Lei 93/2021 and EU Directive 2019/1937
• White-label branding, custom subdomain, and multi-entity support

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Free tier for non-profit organizations and companies with fewer than 50 employees
• Published flat paid price (EUR 499/year) for organizations with 50 or more employees
• Anonymous encrypted two-way chat with a unique reporter access key
• Statutory 7-day acknowledgment and 3-month feedback deadlines are shown with reminders
• EU/EEA data storage with encryption in transit and at rest, stated to log no IP addresses or metadata
• Accessibility stated to meet WCAG 2.2 AA

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Two delivery models are publicly offered: fully outsourced managed processing and a self-managed white-label platform
• Managed-service annual prices are published through 1,000 employees, with larger organisations quoted individually
• Positioned as HinSchG- and GDPR-compliant, implementing EU Directive 2019/1937
• Written, verbal, and (on request) in-person channels are offered alongside the digital platform
• Current tribeta offer advertises anonymous dialogue, deadline tracking and German servers / EU hosting

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published pricing across all three tiers, including the top tier
• Anonymous reporting with a two-way anonymous mailbox for reporter and handler exchange
• Online and telephone whistleblowing channels
• Case management with deadline tracking (Fristenkontrolle) and role-based access rights
• German-domestic vendor addressing HinSchG reporting-channel obligations

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published employee-band pricing with unlimited handler accounts
• ISO 27001 certification and German data residency are stated by the vendor
• 30 reporting languages with AI translation between handler and reporter

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Flat pricing — €39 / €59 / €99 regardless of employee count
• German hosting on an ISO 27001-certified hoster
• End-to-end encrypted reports with anonymous two-way dialogue
• Self-serve setup; no demo or training required
• 1-month contract with 14-day cancellation notice

Limitations and evidence gaps

• Public documentation describes two roles with access to all cases; no read-only role verified
• Caseworker seats and enabled languages depend on the plan
• A current vendor ISO 27001 certificate and public subprocessor list were not verified
• Reporter submissions and handler workflows have not been tested

Distinctive features

• Published package pricing from EUR 38/month with a per-organization subdomain (yourfirm.hinweis.de)
• Cites Section 12 HinSchG and offers Section 15 handler training with certification
• Two-way anonymous chat-style communication and audit-secure case documentation
• Data processing in a German data centre (Hetzner), with regular OWASP penetration testing referenced
• Optional external ombudsperson and outsourced reporting office (Meldestelle S/M/L)

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published monthly pricing with a two-month free trial cancellable during the trial
• Anonymous or identified reporting with restricted, authorized-handler access
• Optional external confidant (vertrouwenspersoon) service alongside the channel
• Public content maps the Dutch Wbk 7-day acknowledgement and 3-month feedback deadlines
• Implementation package includes the internal procedure and a communication kit

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Explicit focus on Portugal Law 93/2021 (the Portuguese transposition of Directive 2019/1937)
• FAQ maps reportable subjects to Law 93/2021 Article 2(1) categories
• Package matrix includes multi-company / multi-entity support
• Package matrix includes anonymised dialogs, 2FA, team case assignments, secure discussions, SSO, and case workflows
• Services page describes a secure box for messages and evidence, deadlines/decisions, profiles, access segregation, and audit logs

Limitations and evidence gaps

• All tiers are quote-based; no public pricing, trial, hosting country, DPA, subprocessor list, or certificate document was found.
• Several security standards are referenced as controls, but no certification scope or certifying body was found.

Distinctive features

• Operated by an established institutional provider, the Finland Chamber of Commerce service company
• Fully published pricing tiers with member and non-member rates and a stated setup fee
• Anonymous reporting and two-way anonymous communication between handler and reporter clearly documented
• Multiple notification forms can route reports on different topics to different handlers
• Security page references regular external security testing with good results and least-privilege access design

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Live-answer hotline staffed 24/7 with agents who directly support English, French and Spanish, and interpretation for 150 further languages; the web form is described as multilingual but its language list is not published
• Four intake routes documented for reporters: web, telephone, a per-client email address, and postal mail
• Three anonymity levels documented, including one where the vendor itself does not learn the reporter's identity
• Named case-scoped roles (Case Manager, Investigator, Restricted Manager) with permissions scoped by case type, location or department

Limitations and evidence gaps

• Report data is held in Canada with no EU region offered, and the GDPR position rests on the Canadian adequacy decision rather than on a published DPA or sub-processor list.
• No national transposition law is named on either locale of the site, and the EU Directive page still describes transposition and the 250-employee deadline as forthcoming.
• Nothing is published on retention, automatic deletion, DPIA support, the 7-day acknowledgment deadline, or the 3-month feedback deadline.
• Commercial disclosure scores 0 of 6: no price, no trial, no contract term.

Distinctive features

• Strong public feature detail for case handling, reminders, and permissions
• ISO 27001 platform positioning is stated publicly
• 2025 ComplyLog privacy factsheet publishes EEA storage, DPA, DPO, encryption, retention/deletion, and sub-processor-process evidence

Limitations and evidence gaps

• No explicit public Waserman or Sapin II framing found
• Pricing is not published publicly
• Reporter return-access mechanism and append-only audit guarantees are not fully documented publicly

Distinctive features

• Replacement product page describes secure reporting, structured case management and deadline handling
• Existing customers are told that their current service continues and transition support is available
• Managed whistleblowing experience alongside the company’s separate moderation business

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Dedicated PAWhistleblowing variant for Italian public-administration procurement through ACN-qualified cloud delivery
• Vendor states the platform is based on the open-source GlobaLeaks foundation
• Public private-sector pricing with unlimited reports, 2FA for managers, anonymous chat, alert planning, and data hosted in Italy
• Offices in Avezzano (AQ) and Roma

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Basic plan from €29/month with free-start CTA
• Security page states ISO 27001 certification, German hosting, SSL 256, WAF, and optional 2FA
• Modular suite — Incident Manager (DORA/GDPR/NIS2), Rights, Policy, Third Party, Trust Center

Limitations and evidence gaps

• Deadline automation, retention automation, public API, and AI posture for the whistleblowing module were not documented.
• Some Trust Center documents require corporate-email registration.

Distinctive features

• Operating a whistleblowing channel since 2014 with a long public client list across Swedish municipalities and companies
• Optional independent-lawyer case assessment and the choice to have Lantero handle investigations
• map[EU data residency named specifically:GleSYS servers in Falkenberg and Stockholm, Sweden]
• Multiple reporter languages stated (French, Swedish, Danish, English)
• Dedicated French entity (SAS Ethique et Conformite) referencing Loi Sapin II and Loi Waserman

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• DigitalPA publishes ISO 9001, 27001, 27017, 27018, and 22301 certifications for its management and cloud controls
• Multi-channel intake — written and voice reports, phone reports, and in-person meeting requests
• Native iOS and Android reporter app with more than 10 app languages claimed

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Low monthly entry price (Essential from €25/month)
• Integrates online, telephone, and in-person whistleblowing channels (multi-channel intake)
• Anonymous reporting with confidential two-way communication via tracking codes
• Bundled annual legal advice from a lawyer
• Multi-language support

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Phone whistleblowing channel included on every plan
• Hosted on Deutsche Telekom Open Telekom Cloud (German sovereign cloud, ISO 27001)
• 3-month money-back guarantee

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published per-employee pricing across all three tiers with a 14-day free trial
• EU-only hosting stated in Nantes, France, with vendor claim of EU-owned suppliers and no AWS or Azure
• Sign-in delegated to Microsoft 365 or Google Workspace, with no usernames or passwords stored by the vendor
• Anonymous reporting with PIN-code case tracking and two-way secure chat
• Nine reporting languages listed (Swedish, Danish, Norwegian, Finnish, German, French, English, Italian, Dutch)

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• ISO/IEC 27001:2022 held by the vendor DigitaliQ AS, not only by a hosting provider
• Anonymous or named reporting, with reporter credentials to log back in and follow the case
• Two-way dialogue that works for anonymous reporters via a login-based dashboard
• Voice reporting via microphone that is transcribed to text, plus file attachments
• Case-handling roles (Administrator, Case Handler, Read-Only User) and targeted assignment to specific handlers
• Public reporter user guide documents the end-to-end submission and follow-up flow

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Greek- and English-language public site, with Law 4990/2022 named on the whistleblowing page
• Published SME price at €120/month plus VAT and public free-trial/demo route
• map[Bundled offering:whistleblowing, labour-dispute resolution, incident/crisis management, and background checks]
• Public whistleblowing copy describes platform, telephone, and physical-meeting whistleblowing channels

Limitations and evidence gaps

• Hosting country/provider, certifications, DPA, subprocessor list, API access, and two-factor authentication are not disclosed on public pages reviewed
• Advanced tier pricing and trial limits are not disclosed publicly
• Public pages describe case management at a high level but do not document retention rules, audit-log semantics, role granularity, or deadline automation
• The in-app report-link editor runs an end-of-life CKEditor 4.12.1 build that displays its own 'not secure' upgrade banner

Distinctive features

• Part of Zucchetti Group — distribution reach into Italian SME and enterprise ERP/payroll base
• Public online purchase path for Smart and Flex configurations up to 250 employees
• AES 256 encryption and Microsoft Azure EU server storage stated on the product page
• Named enterprise customers on site include Stellantis, BNL, Humanitas, and ThyssenKrupp

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published per-manager entry price (EUR 7.95/month per gestor) with self-serve online signup
• 7-day free trial with no charge before day 7
• map[Three reporter modes:fully anonymous, registered with hidden identity, or identified]
• Two-way communication with the reporter, including anonymous cases
• Named report register (libro de registro) and encrypted case files hidden from system administrators
• Two-factor authentication for case managers (password plus 6-digit code)

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Web and phone reporting through EthicsPoint Essentials / Professional
• WhistleB pages state EU storage, customer-controlled encryption, web and mobile reporting in 60+ languages, and IVR in 40
• Public service-hosting provider page for EthicsPoint

Limitations and evidence gaps

• EthicsPoint pricing, trial, API access, DPA, retention configuration, and Directive article-level mapping were not disclosed on public pages reviewed.
• The homepage links news of the Goldman Sachs Alternatives-led majority acquisition, but its completion date and the ISO 27001 certificate date and scope were not verified on vendor pages reviewed; the WhistleB page describes both ISO 27001 certification and ISO/IEC 27001-aligned practices.

Distinctive features

• Three standard tiers publicly priced (EUR 50 / 150 / 300 per month) with a free trial
• Anonymous voice and text reporting with voice scrambling and file metadata stripping
• Named public sub-processor list (AWS, MongoDB, Twilio, Stripe, Mailgun), all stated EU-located
• Case data automatically deleted 30 days after a case is closed (stated in the app privacy policy)
• Routing and assignment groups plus custom user roles for case handling
• Telephone hotline available as an add-on alongside web form and secure chat

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published flat pricing of 149 CZK/month with unlimited users, and a free tier for schools and nonprofits
• Names both Act No. 171/2023 Coll. and EU Directive 2019/1937 on public pages
• Vendor-stated domestic Czech hosting on Q-COM's own QML platform
• Consolidates web-form, email, and in-person reports in one administration environment
• Anonymous reporting with encrypted transmission and configurable user permissions

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• AgID/ACN SaaS qualification is stated, aligning it to Italian public-sector cloud procurement
• Available as SaaS or as an on-premise install inside the customer's own infrastructure
• Native support for D.Lgs 24/2023, D.Lgs 231/01, and GDPR is stated
• Implements the operational roles required by the law plus customizable roles and separation of duties
• Customizable questionnaires, workflow states, and a multilingual web interface accessible on PC, tablet, and smartphone
• Multi-instance support for corporate groups and holdings; service enlisted in Cloud Security Alliance STAR

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Fully published pricing with monthly and annual bundles, unusual for a managed EU whistleblowing vendor
• German legal entity (splice digital GmbH, Hamburg) with public Impressum, VAT ID, and commercial-register number
• Public pages cite German transposition-law sections (HinSchG § 16 Abs. 3, § 17 Abs. 1 Nr. 1) alongside EU Directive 2019/1937
• Anonymous reporting with a 16-digit receipt and two-way anonymous follow-up, including Tor access
• Automated deadline management referencing the statutory 7-day acknowledgment and 3-month feedback duties, plus configurable retention with automatic deletion
• Over 90 reporting languages and stated WCAG 2.2 accessibility alignment

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Flat per-organisation pricing with unlimited users, so cost does not rise with headcount
• Public pricing shown on the site, including monthly and discounted annual rates
• Anonymous two-way communication with a 16-digit receipt code for follow-up
• Support for more than 90 reporting languages, including right-to-left scripts
• Role-based access with named roles (whistleblower, recipient, custodian) and 2FA (TOTP RFC 6238)
• GDPR-aligned privacy policy citing specific GDPR article bases and EU data storage

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Single osapiens HUB module covers whistleblower complaints and supply-chain grievance mechanisms
• AI-powered pre-grouping sorts complaints by topic on arrival
• Anonymous/pseudonymous or identified reporting, automated case management, custom forms, workflows, and time-stamped records

Limitations and evidence gaps

• Pricing, hosting location, certifications, DPA, subprocessor list, public API, and reporting-language coverage were not disclosed on public pages reviewed.
• Germany-specific whistleblower law posture is weaker than the broader LkSG/CSDDD grievance positioning.

Distinctive features

• ISO 27001-certified hosting / cloud operation is stated by the vendor
• Reporter interface meets WCAG 2.1 accessibility criteria
• Published starting SaaS prices for STANDARD and ENTERPRISE
• Part of an established legal-tech suite with stated SSO and interface options

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Bulgarian- and Romanian-language public site and pricing pages are live
• Public pricing lists a free Starter tier, monthly Basic/Premium prices, annual Basic/Premium prices, and Enterprise custom pricing
• Public pages describe multi-channel intake, case management, secure inbox communication, pipelines, and multi-role accounts

Limitations and evidence gaps

• Starter setup page lists Switzerland, Singapore, and Indonesia as server-location options; no EU residency option was found on public pages reviewed
• No public Bulgaria-law or Romania-law positioning was found on public pages reviewed
• No ISO 27001 certification, public DPA, public sub-processor list, API documentation, or AI documentation was found on public pages reviewed
• The Starter tier public feature list includes one Manager account only; Operator and Agent accounts are listed on the Premium tier

Distinctive features

• Three tiers with monthly prices published in full (EUR 47 / 67 / 97)
• Portuguese-domestic vendor addressing Lei 93/2021 and EU Directive 2019/1937 directly
• Anonymous reporting with file, image, and document upload stated on public pages
• Internal and external reporting channels offered
• Free demonstration environment available before purchase

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Data hosting in Germany is stated on the public product page
• 26 reporting languages are stated on the public product page
• Reporting form ships with the HinSchG breach categories pre-populated and example report content per category
• GDPR compliance stated with 2FA and automated anonymization controls

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Operated by a German law firm with an optional lawyer ombudsperson tier
• Data processed in Germany, otherwise within the EU, with no transfers outside the EU (vendor-stated)
• Tiered model spanning a self-service cloud plan up to a fully managed ombudsperson service
• Published annual package prices for the ombudsperson tiers
• Standard packages orderable through an online form without a sales call

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published annual pricing bands by organization size, with the entry tier at EUR 299 per year
• Anonymous reporting is the core function, aligned to EU Directive 2019/1937
• Extended version offers Finnish, English, and Swedish reporter forms and multi-channel reporting
• Mobile-friendly web reporting with photo/file attachments
• Whistleblowing sits inside a broader responsibility system that also covers ethics guidelines, DPIA, and incident reporting

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• ISO 27001 certification and GDPR alignment
• Swedish-hosted servers
• 500+ customers cited
• Optional external-lawyer receiver function (Swedish market) for organisations without internal capacity
• Public SEK pricing (Swedish market) and starter-package templates

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Self-serve onboarding, choose a plan, auto-fill company data from the ANAF tax registry by CUI, and pay online by card
• Explicitly built around Romania's Law 361/2022 and EU Directive 2019/1937
• Anonymous reporting with a report tracker and two-way anonymous messaging
• Operated by a Romanian law firm, with generated internal reporting procedure and contract documents
• States that reports and communications are encrypted in transit and at rest

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• The two documents D.Lgs. 24/2023 requires — the reporting procedure and the privacy notice — ship pre-written with the platform and can be replaced with the organisation's own
• A 60-day free trial, the longest in this field, with cancellation at any point during it and a single published price after
• Written, voice-recording and in-person reporting are all listed, alongside investigative registers, an internal chat with the reporter, and handler roles

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Fully managed 24/7 hotline with call handlers who are former UK police officers with 25+ years investigative experience
• Anonymous phone and online reporting with secure two-way follow-up via a platform login
• Web reporting in 68+ languages and interpreting across 175+ languages and dialects
• Data hosted in UK-based data centres with AES256 encryption, role-based access controls, and two-factor authentication
• More than 20 years operating; wholly owned by The Law Debenture Corporation p.l.c.

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• One published plan with monthly and annual payment options
• 30-day self-serve trial without a payment card
• Vendor advertises 36 languages, including all 24 official EU languages
• Public DPA names hosting locations, subprocessors and an objection process
• Documented case PDF, case-list CSV and full-organisation export

Limitations and evidence gaps

• Retention settings do not automatically delete cases
• Built-in MFA for email/password accounts is not yet available according to the DPA
• No current vendor ISO 27001 certificate verified
• Homepage describes 90-day reminders; calendar three-month calculation remains untested
• Reporter and handler workflows and named customer references remain unverified

Distinctive features

• Written and oral reporting with integrated voice messaging
• Anonymous reporting with a reserved PIN for status tracking and no registration required
• Confidential two-way messaging between reporter and handler
• Multi-role handler management, work groups, and report assignment to handlers
• Dashboard with analytics, statistics, and interactive charts
• Published entry price (from EUR 125/month) with unlimited handler and collaborator users

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published flat annual pricing (EUR 300/year base plus EUR 200/year per additional report type)
• Managed activation stated within 48 hours, with implementation and support included
• Anonymous two-way communication between reporter and designated handlers is described
• Built on the open-source GlobaLeaks platform, with end-to-end encryption stated
• Handles multiple report types (whistleblowing, gender-equality PdR 125, SA 8000 ethics, ESG) in one platform

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Both French statutes are cited by number and date — Loi n° 2016-1691 of 9 December 2016 and Loi n° 2022-401 of 21 March 2022 — with their substantive changes summarised, rather than a generic Directive-compliance claim
• Deadline handling is specific: automatic calculation on receipt, reminders at J-2 and J-1 for the acknowledgment and J-7 and J-3 for the three-month feedback, and an alert when a deadline passes
• Case access is segmented by unité de travail and service, with primary référents, secondary référents filtered by report type and service, and read-only roles

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Wbk deadlines are the product's organising principle — 7-day acknowledgment and 3-month feedback are described as automatically tracked, not as a manual checklist
• Board and works-council reporting is aggregated with a stated minimum group size of seven people, so a figure cannot be traced back to an individual
• Case access is scoped per file with parties to the case automatically excluded, which is the control most often missing when a report concerns a manager

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• 100+ reporting languages stated on homepage, product and pricing pages
• Web, mobile app, phone line, phone drop box, and AI voice agent reporting
• Product FAQ states that no IP addresses, metadata, or identifying information is collected or stored
• ISO 27001; ISO 27701 (described as certification or as guidance on different pages); ISAE 3000 Type II / SOC 2 and TISAX assurance claims

Limitations and evidence gaps

• EU hosting location, public DPA, subprocessor list, API access, retention automation, and exact local-law mapping were not disclosed on public pages reviewed.
• All pricing is now customized to company size and features.

Distinctive features

• ODO24 ranked SygnaApp first in its 2024 comparison of Polish whistleblower applications
• 15+ named customer logos including Polsat, Plus, eSky.pl, Ministerstwo Aktywów Państwowych
• Polish-native product anchored on Ustawa o ochronie sygnalistów (June 2024)
• Public 30-day trial registration
• Bundled technical support, legal counsel, and specialist training services

Limitations and evidence gaps

• No formal security certification, public DPA/subprocessor list, API documentation, retention automation, or AI posture was verified.
• Some demo/free-until-law text appears stale after the Polish act entered into force.

Distinctive features

• Published three-tier pricing in PLN with monthly and annual billing and a free first month
• map[Three intake channels:online reporting form, anonymous email relay, and a PIN-protected phone line with AI audio-to-text]
• Anonymous reporting with an identifier plus password for reporter return access and two-way messaging
• Poland-based hosting (Warsaw data centre) with a Cloudflare proxy stated to mask reporter IP addresses
• Category-based routing of reports to designated handler users, with internal notes hidden from reporters
• Explicitly references the Polish Whistleblower Protection Act (in force 25 September 2024)

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published PLN package pricing for both cloud and on-premises deployment
• 7-day free trial referenced for the cloud model
• Two-factor reporter return access via ticket number and password documented
• Anonymous two-way communication with full message history
• Both cloud and customer-hosted on-premises options offered
• Built on the established Mint Service Desk ticketing platform

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Channel implementation, procedures and ongoing maintenance offered together
• Jeton states that implementation is performed by an ISO 27001-certified partner
• Subscription scope is tailored to organization size and support needs
• Top-10 placement in the 2024 ODO24 ranking (#8)

Limitations and evidence gaps

• Public product evidence is thin: no hosting location, certificate scope, subprocessor list, DPA, free trial, API, retention controls, deadline automation, or detailed handler workflow was verified.
• ISO 27001 evidence is partner-implementation language rather than a product/vendor certificate.

Distinctive features

• End-to-end encryption — vendor states it has no access to report content
• 12 reporting languages with case-handler panel in PL/EN/DE/FR
• External reporting channel bundled free for public bodies on the internal-reporting licence

Limitations and evidence gaps

• No ISO 27001 certification, public API, subprocessor list, right-to-object terms, or named hosting country was found.
• Pricing is annual and net of VAT.

Distinctive features

• 30-day trial on every plan with no credit card required
• Published monthly and annual pricing for the two lower tiers
• German legal entity (Tell IT GmbH) with servers stated to be in Germany
• More than 30 reporting languages stated on public pages
• Anonymous two-way communication and statutory deadline tracking

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Flat published price of 29,000 HUF/month plus VAT with unlimited admin users
• Anonymous reporting with two-way reporter-to-investigator communication via unique case identifiers
• Web intake works on desktop and mobile with document and photo attachments
• Names Hungary's Act XXV of 2023 alongside EU Directive 2019/1937
• EU-based server hosting with no third-country transfers (vendor-stated)
• Hungarian and English reporter languages

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published ISK subscription tiers (Grunnur and Voxtur) with a 30-day free trial on all plans
• Anonymous two-way communication with reporter return access via an identification number and password, plus two-factor authentication
• Immutable event log that records all actions for a traceable case history
• Multiple reporting areas on per-department subdomains, with customizable questions and information pages
• Privacy policy states automatic deletion of case data within 6 months of case closure
• Built for Iceland's whistleblower protection law by an Icelandic vendor (Slidesome ehf.)

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published annual pricing for the Bas and Premium tiers (8,000 kr and 13,900 kr per year)
• Currently no implementation fee stated across all tiers
• Full anonymity and multilingual reporting stated on the pricing page
• Optional managed service on Premium where Tissla handles cases, alongside self-managed handling
• Whistleblower policy and communication materials included from the entry tier
• Named reference customers including ICA, Hestra, and Elbit

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Full price matrix published for four tiers, monthly and annual, with no quote gate
• Each of the eight locale sites names its own transposition law in the page title, and the Italian site adds Modello 231 information flows and PEC notification
• Monthly security audits are published as a dated timeline, with the four most recent audit dates listed and the next one scheduled

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Full price matrix published by headcount band, with an identical feature set at every tier
• Hosting provider, city and backup regions are all named — OVHcloud Roubaix, with Strasbourg, Croix and Gravelines
• A dedicated page maps the French obligation to the product, and blog guides cover the Belgian and Luxembourg obligations

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• All four tiers publicly priced in EUR with monthly billing and a monthly/annual toggle
• Anonymous two-way communication and attachment metadata stripping documented
• Public sub-processor list (Render, Resend, Cloudflare Turnstile) in the privacy policy
• More than 30 reporting languages stated on the features page
• Dedicated Estonian-law, EU Directive, and NIS2 explainer pages

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published whistleblowing tiers at EUR 49 / 69 / 99 per month, billed annually
• Secure two-way dialogue and basic case handling included from LITE
• Seven-day trial with conversion only after confirmation
• German default hosting, with other regions available on request

Limitations and evidence gaps

• LITE now includes dialogue and basic case handling; LITE has one user/language and STANDARD two.
• No company/product ISO certification, DPA, subprocessor list, API, retention automation, or detailed handler workflow was disclosed on public pages reviewed.
• Whistleblowing is billed annually; monthly contracts are not published.

Distinctive features

• Fully public annual pricing (€150/year SME, €450/year enterprise) — rare in the Spanish market
• Fully anonymous reporting with encrypted two-way messaging to the reporter
• Self-serve free trial ('Pruébalo gratis')
• Explicit Ley 2/2023 positioning

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published SME pricing tiers with both annual and monthly billing
• Anonymous two-way communication between reporter and handler
• Case management with triage, assignment, deadlines, and an audit trail
• Dutch and English included in Start; additional languages on higher plans
• No implementation fee on any tier
• EU hosting stated with GDPR (AVG) alignment

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published fixed annual pricing for the two smaller tiers (SEK 7,000 and SEK 9,000)
• Sweden-based hosting at a Glesys data centre in Stockholm (vendor-stated)
• Web, phone, and in-person whistleblowing channels
• Anonymous reporting with encrypted two-way communication via a unique case code
• In-house lawyers review cases assessed as being in the public interest
• Statutory 7-day acknowledgment and 3-month feedback timelines referenced

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published Swedish pricing from SEK 6,000/year; English under-50 pricing is quote-based
• 14-day free trial, no startup fees, and no binding period
• Vendor-stated ISO 27001-certified hosting/infrastructure in Sweden/EU, penetration testing, and end-to-end encryption
• 350+ organisations claimed by vendor after the Whistlelink acquisition

Limitations and evidence gaps

• No Visslan company/product ISO 27001 certificate scope, public DPA/subprocessor list, API documentation, retention automation, or AI posture was found.
• Paid fees are annual and not refunded despite no binding period.

Distinctive features

• Flat USD 1/employee/month with all features included
• 14-day free trial
• AES-256 encryption and anonymous-reporting positioning are public
• GDPR and EU Whistleblower Directive marketed as day-one ready

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Four published employee-band tiers up to 999 employees, with no quote-only step and no per-report charge
• Self-serve registration and a 14-day trial with full feature access, rather than a demo gate
• States EU-only hosting and two-factor authentication as the login standard
• Marketing site maintained in Danish, Swedish, Dutch, German and English

Limitations and evidence gaps

• The Danish transposition act is not named on the Danish-language site, which cites only EU Directive 2019/1937.
• Deadline alerts exist but neither Directive timer is named; audit trail, handler roles, file upload, reporter return access and sub-processors are absent from the public pages.

Distinctive features

• Dashboard and reporting page in 25 languages
• Free-trial onboarding path without a sales call
• Public pricing page includes 2FA, antivirus protection, activity log, corrective-actions registry, and Enterprise DPA support
• Feature page states EU data residency in Frankfurt for case data

Limitations and evidence gaps

• France-law positioning is limited; no public Waserman or Sapin II framing was found
• Named sub-processors remain under-documented publicly
• Reporter return-access mechanism is not documented publicly

Distinctive features

• ODO24 ranking pages list Whiblo across 2022, 2023, and 2024 editions
• Kraków-based sales and support team
• Public and private sector references

Limitations and evidence gaps

• Current package details are client-rendered; public technical evidence is thin.
• No vendor/product ISO 27001 certificate, public DPA, subprocessor list, hosting country, deadline automation, retention automation, API, or detailed handler workflow was found.

Distinctive features

• Hungarian-native product anchored on Act XXV/2023
• Separate whisly.sk domain indicates active Slovak presence
• Interface available in Hungarian, Slovak, English, French, Portuguese
• Role-based access control, document templates, task automation, analytics

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• ACN-certified positioning and ISO 9001, 27001, 27017, and 27018 badges published on the vendor page
• End-to-end encryption, AES 256 encryption, and two-factor authentication listed as included features
• Custom URL per deployment
• Public Stripe purchase links for the 100- and 250-employee packages

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published monthly starting prices for all three tiers plus a 14-day free trial
• Web form, email, and automated telephone line offered as whistleblowing channels
• Anonymous reporting and a centralized case-management dashboard with role-based access
• Reporting forms available in any number of languages with AI-powered translation
• Bundles legal support, including a managed outsourcing tier with a qualified legal professional

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Web, mobile app, email, QR code, and Voice AI hotline intake are disclosed publicly
• 70+ languages, anonymous two-way Safe Inbox, configurable workflows, SLAs, retention, routing, and audit logs
• ISO 27001, SOC 2 Type II, customer-managed encryption keys (Enterprise package), API/integrations, and selectable hosting regions including France and Germany

Limitations and evidence gaps

• Pricing amounts, self-serve trial, exact EU official-language coverage, subprocessor objection mechanics, and article-by-article Directive mapping were not disclosed on public pages reviewed.
• The previous /solutions/whistleblower/ and /whispli-pricing/ URLs were not usable current evidence.

Distinctive features

• Published Standard, Premium, and Enterprise pricing
• Legal advisory input from Olesiński i Wspólnicy
• European AWS region stated in FAQ
• WCAG 2.1 AA accessibility compliance for the reporter interface
• 7-day trial access available on request
• ODO24 2022 app-ranking placement reported by Olesiński i Wspólnicy

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Public monthly pricing with clear single-entity and group packaging
• Public site cites Directive 2019/1937 and Romania Law 361/2022 directly
• Anonymous reporting and reporter status checking visible in the public app shell
• Link and QR-code based reporting described for desktop and mobile
• Public page states configurable access rights and designated-person-only access to report contents

Limitations and evidence gaps

• Security and operations disclosures remain limited: no ISO claim, hosting country, DPA, sub-processor list, retention controls, or public audit-log guarantees were found
• Start now offers 60 free days without a card; Pro has no trial
• Reporter intake depth, handler register fields, retention automation, deadline reminders, internal notes, and RBAC granularity were not verifiable from public pages alone

Distinctive features

• Published EUR 60 / EUR 120 / EUR 180 monthly equivalents with annual billing
• Public GDPR/security page with German hosting, 2FA, and encrypted storage
• Reporting interface advertised in all official EU languages

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Public self-serve signup and 14-day free trial
• map[EU hosting is disclosed at country level:Germany]
• Publicly claimed security detail includes 2FA, audit logs, PGP email encryption, backups, and end-to-end encryption claims
• map[Strong standalone software signal:homepage pricing, avertizori.eu checkout flow, and a live app.whistleblow.ro demo endpoint]

Limitations and evidence gaps

• The 14-day free trial is advertised publicly, but provisioning was not re-tested in this pass
• Two separate brand / pricing surfaces create avoidable confusion for buyers
• Reporter follow-up access still appears to rely on a single system-issued 16-digit identifier rather than a two-factor model
• Workflow depth is limited publicly: deadlines, status transitions, structured intake, and note-taking are not clearly documented

Distinctive features

• Public employee-band pricing for Core and Advanced
• 80+ reporting languages available and a marketing site published in 12 languages, each naming its national transposition law
• ISO 27001:2022, ISAE 3000 Type 2, ENS Alta, WCAG 2.1 AA, penetration test dated June 2024, and AWS Frankfurt hosting

Limitations and evidence gaps

• No named sub-processor list, no downloadable DPA and no right-to-object mechanism; the personal data policy states only that sub-processors exist and that some are in third countries.
• API access, DPIA support, reporter return-access mechanism and Directive article-level mapping were not disclosed on public pages reviewed.
• Retention is a vendor-set 3 years after subscription termination, not per-organisation configurable purge.

Distinctive features

• Italian-first product surface for D.Lgs 24/2023
• Anonymous web form with shareable link and printable QR code
• Reporter receipt and tracking page disclosed publicly
• Case history, corrective action, deadline date, PDF print, attachments view, and Excel export listed as platform functions

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Public headcount pricing from EUR 69/year, with only the 1,000+ tier left quote-only
• 14-day self-serve free test account with no automatic renewal
• Anonymous, end-to-end encrypted reporting with an anonymous two-way live chat
• Reporter intake stated in 12 languages including German, English, French, Spanish, Italian, Dutch, Greek, Polish and Hungarian
• Positioned as HinSchG- and GDPR-compliant, implementing EU Directive 2019/1937, with German data-centre hosting

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• The sub-processor list is versioned and dated, names each party's country and data scope, and states that the DPA incorporates the list as published on its effective date — so the version a customer signed does not silently change
• Certification status is stated rather than implied: "we hold no formal certification at this time and are transparent about remaining gaps", against ISO 27001 and NIS 2 alignment claims
• Full price matrix published in kronor with no lock-in, no setup fee and no card required for the trial, across 24 EU languages at every tier

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Developer Innovio SpA holds ISO/IEC 27001 and ISO 9001 certifications directly, not only via the cloud host
• Three of four tiers publish monthly prices (Basic, Standard, Premium)
• Anonymous reporting with no personal data required, plus voice reporting with transcript
• Blockchain notarization is stated to keep each report immutable
• Italian and English product versions and European Azure or AWS hosting are stated
• Positioned explicitly on the EU Directive 2019/1937 and Italy's D.Lgs 24/2023

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Managed ombudsman model where sworn Heuking lawyers receive and process reports under a duty of confidentiality
• map[Multi-channel intake:24/7 online reporting form, phone, email, postal mail, and in-person meetings]
• Bundled legal services include initial assessment, risk analysis, internal investigations on request, deadline management, and case, quarterly, and annual reporting
• Data hosted on Heuking's own servers in Germany, with the firm claiming no storage of whistleblower-identifying metadata
• Backed by Heuking Kühn Lüer Wojtek, a German full-service firm of roughly 450 lawyers with eight German offices

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Public Romanian pricing with a 30-day free trial
• Explicit Romania-law positioning around Law 361/2022
• Public security/DPA material covering ISO 27001, Sweden hosting, encryption, retention, and sub-processors

Limitations and evidence gaps

• Annual subscription only; no monthly cancellation option
• Action log captures user, timestamp, and before-after values but is not claimed as append-only or hash-chained
• Legal surface still stops short of article-by-article Law 361/2022 mapping inside the app

Distinctive features

• Published tiered pricing (starts at €69/month for <50 employees)
• Voice and WhatsApp AI-assisted intake with end-to-end encryption
• Parent Ouvidor Digital publicly states 5,000+ customers and 30+ countries
• Training library available in five languages
• Public page discloses Google Cloud Platform europe-west1 (Belgium) for European company data

Limitations and evidence gaps

• No formal certification, public DPA/subprocessor list, API documentation, retention automation, deadline automation, or free trial was found.
• AI-assisted intake means report content is processed by AI, which some buyers will reject.

Distinctive features

• Operated by an established German law firm, with an optional tier where attorneys act as the external case-handling body
• All three package prices are published, including the platform tier at EUR 69/month
• Anonymous reporting with no email required and two-way communication with the reporter
• Per-organization subdomain (unternehmensname.whistleport.de) with corporate-design customization
• German hosting in a Nuremberg data centre stated as ISO/IEC 27001:2013 certified
• Unlimited case handlers with assignment, case linking, PDF export, and a follow-up/deadline function

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published monthly and annual prices without employee bands
• Documented Danish-law deadlines and anonymous dialogue
• Configurable automatic deletion of closed cases
• Department-based access and individually configurable permissions
• Public subprocessor list and named Irish hosting region

Limitations and evidence gaps

• Intake uses role and free text, without Directive breach categories
• No current vendor ISO 27001 certificate verified
• Role presets inspected, but separate-user permission enforcement not tested
• No independent customer reference verified

Distinctive features

• Published per-employee tiers with prices shown in static HTML
• Free testing period stated with no payment details required
• Setup, policy help, and weekday support bundled into the license fee
• Anonymous two-way communication is documented
• EU hosting with the storage country named (Belgium)

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Fully published tier matrix from €67/month — unusual transparency in this market
• Anonymity-first positioning with anonymous two-way dialogue in product
• ISO 27001 and ISO 27701 certification claims plus concrete security details (encrypted attachments with metadata stripping, no IP-logging, Schrems II framing)

Limitations and evidence gaps

• No Danish transposition law or article numbers, no 7-day/3-month deadline tracking, no DPA/DPIA documents, and no sub-processor list were found on public pages.
• No RBAC role tiers, deadline reminders, audit trail, or reporter return-access mechanism documented; trial is demo-gated and the contract is annual only.

Distinctive features

• Flat pricing from EUR 59/month regardless of employee count
• 10-day free trial advertised
• Anonymous two-way communication with reporters
• Explicit German HinSchG and LkSG supply-chain positioning
• German data residency stated (ISO 27001 hosting provider)

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published monthly tiers from EUR 49 net with a self-serve ordering flow
• 7-day acknowledgment and 3-month feedback deadlines stated on public pages
• Anonymous two-way encrypted communication via PIN and case number
• German hosting via a named sub-processor with a data processing agreement
• Six reporter languages (German, English, Spanish, Italian, French, Dutch)

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Romania-native positioning around Law 361/2022, especially for private companies
• ISO 27001 certification is claimed prominently on the product site
• Public feature claims include electronic register reporting, automatic acknowledgement, reminders, statistics, and 5-year storage
• Backed by Corporate Intelligence Agency, which positions WIBSO alongside fraud investigation and risk-management services

Limitations and evidence gaps

• No public pricing, no public trial, and no live reporter or handler environment found
• Hosting country is not disclosed publicly despite detailed Romania-law positioning
• Structured intake, reporter access method, assignment logic, and RBAC depth are not verifiable at public tier

Distinctive features

• Vendor states its hosting infrastructure is ISO 27001 and HDS (French healthcare data hosting) certified
• Vendor states product data is hosted in France / Europe and not used to train AI models
• Public API plus a webhook engine
• Covers RGPD, Sapin II, the EU AI Act, NIS 2 and DORA from one platform
• 3,000+ compliance teams across 7 languages (vendor claim)

Limitations and evidence gaps

• No Directive 2019/1937 reference on pages reviewed; Loi Waserman named on the Sapin II page without an article citation
• 36-month contract is still the default commercial model; monthly billing only exists as a surcharge option
• No public reporter demo; most product proof remains marketing-page level
• No breach taxonomy published; nothing shown aligned to Directive 2019/1937 Article 2(1)
• Two-factor reporter access not documented
• Privacy policy names several processors, but no public sub-processor objection workflow was found

Distinctive features

• Truly anonymous two-way conversations documented on public pages
• Combined anonymous speak-up and HR case management in one platform
• UK (AWS) data storage is clearly disclosed
• Listed on the UK G-Cloud framework with a published per-user price range
• Cyber Essentials, IASME assurance, and NHS Data Security and Protection Toolkit referenced

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.

Distinctive features

• Published three-tier pricing (Basic, Pro, Ultimate) visible without a sales call
• Free trial with no payment required is advertised
• Anonymous reporting with a personal code for follow-up
• Automatic metadata removal from uploaded images
• Germany-based hosting on an ISO/IEC 27001-certified provider (Hetzner, vendor-stated)
• Multilingual reporting (three languages of choice on the entry tier)

Limitations and evidence gaps

No limitations recorded. This is an evidence gap, not confirmation that there are none.