Whistleblowing software in Romania — scored ranking
Independent scored ranking of whistleblower-reporting tools for Romania under Law 361/2022, the local transposition of EU Directive 2019/1937. 25-criterion rubric fixed before scoring; every score carries evidence.
Platforms covering it
8
Sold only here
5
EU data centre
4
Self-serve sign-up
5
Scored against the rubric
7
The law a channel in Romania has to satisfy
Romania transposes EU Directive 2019/1937 through Legea 361/2022. A platform has to satisfy the national text, not only the Directive, so check obligations against the statute rather than against a vendor's compliance claim.
Romania is not just a local-vendor market. Local-law posture still matters, but several imported tools now maintain Romanian-language commercial surfaces, public pricing, partner motions, or local case studies. The result is a market with thin domestic software depth, but more real cross-border competition than a first pass suggests.
This edition therefore uses two layers:
the 50-point base rubric, which stays country-agnostic and scores the product itself: legal workflow depth, reporter experience, handler workflow, security posture, and commercial clarity;
the 6-point Romania modifier, which rewards explicit Law 361/2022 framing, a named Romania-acceptable hosting posture, and a real Romanian-language reporter / handler surface.
That combination penalises the three most common Romania-market failure modes: local vendors with strong legal copy but weak product disclosure; foreign tools with Romanian-language marketing but no Romania-law posture; and service-led compliance offers whose underlying product is not independently reviewable.
This ranking is software-only and includes both Romania-native vendors and foreign tools with concrete Romania-market go-to-market signal. Advisory or investigations-led service firms are excluded unless the underlying whistleblowing product is identifiable and independently reviewable.
Poland · Whistleblower reporting portal hosted on Hetzner in Germany. Flat €60/month plan.
53 / 56
Base 47 · Bonus 6 · Tier P+R+H
Legal
16/16
Reporter
10/10
Handler
10/10
Security
6/8
Commercial
5/6
Strengths
Article-level legal framing: /compliance/ enumerates Directive 2019/1937 Articles 4, 6, 8, 9, 16, 18, 19–21 and links to a dedicated page for each of the 27 EU transpositions
All 27 EU national whistleblower laws are named on public /whistleblower-laws/<country>/ pages with official source citations
Oral reporting (Art 9(2)(b)) is built into the portal as in-browser voice recording and is privacy-engineered: the raw audio is automatically pitch-shifted, only the anonymized clip is ever served, and the original recording is purged after processing (fail-closed — nothing is exposed to handlers until anonymization succeeds)
Report categories are tagged to specific Directive Art 2(1) Union-law domains, with the article reference shown as a handler-side badge while reporters pick plain-language categories
Structured intake: five optional, Directive-aligned questions (relationship to org per Art 4, source of knowledge, incident timing, prior reporting, retaliation concern per Art 19) presented as a skippable guided step, surfaced to handlers and the PDF export with retaliation flagged as an urgency badge — a built-in default set where most tools leave these to per-org custom-field configuration
Three role tiers (member / admin / viewer): viewer is a read-only seat for auditors and external counsel that sees every report plus the full audit trail without any write or management path
GDPR Art 20 portability: admins can export the full organization dataset (reports, messages, attachments, with encrypted fields decrypted for portability) as a ZIP; export and download are audit-logged and the ZIP auto-purges after 7 days
Real deadline tracking: 7-day acknowledgement and 3-month feedback deadlines with overdue/due-soon tracking and a lifecycle stepper in both reporter and handler views
Configurable retention (12/24/36/48/60 months) with automatic purge of expired closed reports; open reports left inactive for 18 months auto-close so the retention clock starts (GDPR Art 5(1)(e) storage limitation), closing the open-forever gap
Two-factor reporter access: case reference (WB-XXXX-XXXX) plus a reporter-chosen 6-digit passcode, session-gated inbox. Reporters can also download a PDF copy of their own report from the follow-up portal (audit-logged)
Audit log surfaced to handlers on each report; append-only at the database level
Modern stack with no end-of-life liabilities
Transparent monthly pricing (€60/mo) with 13 live product locales (12 EU official languages — bg, de, el, en, es, fr, hr, it, nl, pl, pt, ro — plus Luxembourgish)
Multi-handler case assignment: each report can be assigned to a handler, admins see all reports and members see only assigned, assignment changes are audit-logged, and deactivated members are auto-unassigned from open reports
Handler-set case priority (low / normal / high / urgent) recorded at assessment as an audit-logged change and surfaced as a badge on the report list, plus a priority breakdown in the exportable compliance report
SCIM 2.0 provisioning so an identity provider (Okta, Microsoft Entra ID) can provision case handlers and — the core value — auto-deprovision them the moment someone leaves the directory; admins generate, rotate, and enable/disable a per-organization token and pick the default role
SAML 2.0 single sign-on so staff authenticate through the organization's identity provider (Okta, Microsoft Entra ID); configured per organization, covers one or more email domains, with optional enforcement (require SSO for those domains) and optional just-in-time account provisioning on first sign-in — the authentication half of the SSO + SCIM enterprise-identity pair
Published ISO 37002:2021 guidance-alignment map (/iso-37002/) walking the standard's operating clauses against shipped features, alongside the ISO 27001 Annex A self-assessment
Published DPA grants the Controller an explicit right to object to subprocessor changes (§6.4, 30-day notice + termination remedy) and commits to 72-hour breach notification (§6.6); /trust/ publishes contracting party, backups, RTO/RPO, and session lifecycle
Zero-AI commitment codified contractually: DPA §6.10 prohibits transmission of personal data to any LLM or AI inference provider; /subprocessors/ lists no AI sub-processor
Weaknesses
Audit log is append-only but not hash-chained
Only 13 portal-facing languages (12 EU official languages + Luxembourgish) against 24 EU official languages
No ISO 27001 certification of EthicsPortal itself (only Hetzner infrastructure is certified)
Pay-first with 30-day money-back rather than an upfront self-serve free trial
Role tiers are org-scoped, not per-case ACLs: the viewer role adds the auditor seat, but a handler's report visibility is still governed by assignment/participant scoping rather than a per-case permission model
Standout
Article-level Directive framing paired with a 27-page country-law reference and privacy-engineered oral reporting, all surfaced in the live product alongside working deadline, retention, two-factor passcode, audit-log, voice-anonymization, and subprocessor-notification flows.
Sweden · Swedish whistleblowing platform with Romanian-language pages, public Romanian pricing, and Romania-law positioning.
45 / 56
Base 39 · Bonus 6 · Tier P+H
Legal
11/16
Reporter
7/10
Handler
9/10
Security
8/8
Commercial
4/6
Strengths
Hands-on trial confirmed the full compliance toolkit: configurable retention, configurable case deadline, dashboard tiles for near-deadline and to-be-deleted cases, an action log, rule-based auto-assignment, and a five-role RBAC grid with org-wide 2FA enforcement
Sub-processor transparency goes past marketing: the in-app consent text explicitly names DeepL (Germany) for auto-translation and Mistral (France) for AI case summaries, and both AI features are opt-in rather than default-on
Romania public materials remain substantial: Romanian-language product/pricing pages, Law 361/2022 positioning, Romania case-study content, and local territory-manager contact details
Weaknesses
Annual subscription only; no monthly cancellation option
Action log captures user, timestamp, and before-after values but is not claimed as append-only or hash-chained
Legal surface still stops short of article-by-article Law 361/2022 mapping inside the app
Standout
The P+H-tier pass recorded configurable retention, configurable case deadline, rule-based auto-assignment, and opt-in sub-processor disclosure for AI/translation features.
Bucharest, Romania · Romanian whistleblowing software marketed via Whistleblow.ro and sold through avertizori.eu, with a live public demo at app.whistleblow.ro.
28 / 56
Base 23 · Bonus 5 · Tier P
Legal
6/16
Reporter
4/10
Handler
3/10
Security
7/8
Commercial
3/6
Strengths
Most complete Romania-native commercial package reviewed: public pricing, public signup, and a 14-day self-serve trial
Public pages disclose named EU hosting, 2FA, audit logs, encryption, DPA/subprocessor disclosure, and certification claims
Whistleblow.ro shows pricing, avertizori.eu handles the self-serve product flow, and app.whistleblow.ro exposes a live demo endpoint
Weaknesses
The 14-day free trial is advertised publicly, but provisioning was not re-tested in this pass
Two separate brand / pricing surfaces create avoidable confusion for buyers
Reporter follow-up access still appears to rely on a single system-issued 16-digit identifier rather than a two-factor model
Workflow depth is limited publicly: deadlines, status transitions, structured intake, and note-taking are not clearly documented
Standout
The split public surface includes pricing on Whistleblow.ro, self-serve commerce on avertizori.eu, and a live demo endpoint on app.whistleblow.ro.
Switzerland · Swiss whistleblowing SaaS with Bulgarian and Romanian language pages, public pricing, and a free starter tier.
24 / 56
Base 23 · Bonus 1 · Tier P+H
Legal
4/16
Reporter
7/10
Handler
6/10
Security
0/8
Commercial
6/6
Strengths
Public pricing now shows a free Starter tier, Basic at $65/month or $650/year, Premium at $110/month or $995/year, and Enterprise custom pricing
Prior self-serve review provisioned a dedicated per-tenant subdomain and a working handler admin in minutes; public pages still describe the same setup shape
Public materials describe multi-channel intake, secure inbox communication, case management, pipelines, triage, roles, and dashboard reporting
Starter is published as a free plan with no credit card and no hidden fees; no time-limited free trial was found on public pages reviewed
Weaknesses
Starter setup page lists Switzerland, Singapore, and Indonesia as server-location options; no EU residency option was found on public pages reviewed
No public Bulgaria-law or Romania-law positioning was found on public pages reviewed
No ISO 27001 certification, public DPA, public sub-processor list, API documentation, or AI documentation was found on public pages reviewed
The Starter tier public feature list includes one Manager account only; Operator and Agent accounts are listed on the Premium tier
Standout
Public pages show self-serve pricing, a free Starter tier, BG/RO language surfaces, and published product features; DPA/sub-processor documentation and EU-only hosting were not found.
Bucharest, Romania · Romanian whistleblowing platform with public monthly pricing and Law 361/2022 / Directive 2019/1937 positioning.
23 / 56
Base 19 · Bonus 4 · Tier P
Legal
5/16
Reporter
5/10
Handler
3/10
Security
2/8
Commercial
4/6
Strengths
Public monthly pricing remains clear for a Romania-native product: €49/month for one legal entity and €99/month for groups up to five entities
Public pages directly cite Law 361/2022 and Directive 2019/1937 and describe anonymous reporting, QR/link intake, mobile/desktop access, and designated-person-only access
The public app shell exposes reporter-side status checking and a handler login surface
Weaknesses
Security and operations disclosures remain limited: no ISO claim, hosting country, DPA, sub-processor list, retention controls, or public audit-log guarantees were found
Free trial was not disclosed on public pages reviewed, so the prior trial-based claims were not retained
Reporter intake depth, handler register fields, retention automation, deadline reminders, internal notes, and RBAC granularity were not verifiable from public pages alone
Standout
Whistle UP is transparent on Romanian legal positioning and monthly price, but the 2026-05-24 review was public-page-only, so product-depth claims from prior authenticated testing were removed or downgraded.
25 criteria across 5 categories, weighted by criterion count. Each criterion scores 0, 1, or 2 — rendered as ○ / ◐ / ●. Maximum base score is 50. Romania-specific bonuses add up to 6 on top (modifier, not part of base).
Access tiers
Each tool carries an access tier reflecting what was testable:
P — public pages only (marketing, pricing, security, reporter URL).
P + R — above plus a test report submission.
P + R + H — above plus handler / admin dashboard (via free trial or demo).
Criteria that cannot be verified at the current tier score 0 with the evidence line "Requires handler tier" or "Not documented publicly". Scores depressed by tier, not by product quality, are explicitly flagged on each tool's profile.
Integrity guarantees
The rubric was fixed before scoring. No criterion was added mid-test to favour or punish a specific tool.
Every score carries evidence — a URL, a quote, or a file path — visible in each tool's profile.
Tools operated by the publisher are scored by the same rubric. Placement is by score, not by construction.
Each tool carries a Last reviewed date and is re-tested at least annually.
Vendors can dispute a score or submit evidence of a shipped fix using the contact address in the site footer. Disputes and updates appear as dated addenda on the respective tool profile.
Law applied
Law 361/2022 (the Romania transposition of EU Directive 2019/1937). Tools are scored against the Directive first and against the local law's specifics second.
Coverage note
This ranking covers 7 tools with a scoring block published. Additional tools are being added as scoring completes. Unscored tools will appear in the ranking once they have a published scoring block.
Platforms covering Romania
2 of 8 publish an entry price. The rest require contact with sales before a figure is given.
Whistleblowing software in Romania — scored ranking
Partly public. Plans are rendered by the client app from its own API and include monthly and annual billing plus a quote-based request-demo tier. The contract page cites a package price of 280 lei (RON) including VAT.
Published monthly pricing: €49/month + VAT for a single entity, €99/month + VAT for groups with up to 5 entities, custom quote for larger or outsourced-service use cases.
Public pricing is split across two vendor domains: avertizori.eu lists RON 990/year excluding VAT for the annual software subscription plus RON 190 one-time documentation; whistleblow.ro lists RON 2,990/year including 19% VAT for the technical-implementation annual subscription plus RON 990 one-time documentation, invoiced in LEI. Outsourced handling is quote-based.
