https://whistleblowertools.eu/features/Shortlists built from a single procurement requirement — EU hosting, a published price, no sales call, no AI on report content — across every platform in the directory.enThu, 17 Sep 2026 17:13:12 +0000https://whistleblowertools.eu/favicon.svghttps://whistleblowertools.eu/https://whistleblowertools.eu/features/self-serve/Thu, 17 Sep 2026 19:11:07 +0200https://whistleblowertools.eu/features/self-serve/Platforms with self-serve sign-up: a published price, an account you open yourself, and no demo gate before you can evaluate the product.<p>A reporting channel is a legal obligation with a deadline, not a strategic purchase. For an organisation just over the 50-employee threshold, a procurement cycle that starts with a discovery call and ends with a quote can take longer than the compliance window it exists to close.</p> <p>These platforms let you open an account, see the price, and operate the channel without speaking to anyone. That is a procurement property, not a quality judgement — several sales-led platforms below the fold are more capable. It is listed here because it is the single requirement that most often decides the shortlist.</p>https://whistleblowertools.eu/features/eu-hosted/Thu, 17 Sep 2026 19:11:07 +0200https://whistleblowertools.eu/features/eu-hosted/Platforms that name an EU data centre for report storage, and the ones that leave the hosting location undisclosed.<p>Reports under Directive 2019/1937 routinely contain special-category personal data about named individuals, often before anything is substantiated. Where that data physically sits, and which jurisdiction can compel access to it, is a question most procurement teams have to answer in writing.</p> <p>These platforms name an EU data centre on their own published materials. Naming one is not the same as certifying it, and a platform absent from this list has not necessarily failed the test — a substantial number simply never publish the location at all, which is itself the finding.</p>https://whistleblowertools.eu/features/iso-27001/Thu, 17 Sep 2026 19:11:07 +0200https://whistleblowertools.eu/features/iso-27001/Platforms publishing an ISO 27001 certification, alone or alongside further schemes such as SOC 2, ISO 27701, or a national scheme.<p>ISO 27001 does not certify that a whistleblowing product is good. It certifies that the organisation running it operates a documented information-security management system that an external auditor has examined. For a channel handling untested allegations about named people, that distinction is usually worth paying for.</p> <p>A certification claimed on a marketing page is not a certificate. Where a platform below publishes a certificate number or a registry entry, its profile links to it; where it publishes only the logo, the profile says so.</p>https://whistleblowertools.eu/features/no-ai/Thu, 17 Sep 2026 19:11:07 +0200https://whistleblowertools.eu/features/no-ai/Platforms that state no AI or machine-translation processing is applied to report content, and the ones that apply it or stay silent.<p>Running a report through a language model means the allegation, and usually the identity of the person making it, leaves the case file and enters a processing pipeline the reporter never agreed to. Under the AI Act, systems used in employment contexts attract additional obligations, and a whistleblowing triage tool can fall within that scope.</p> <p>These platforms state that report content is not processed by AI. It is the majority position, and notably a deliberate one: only eight platforms in the directory leave the question unanswered, while twenty-three confirm that AI touches report content. This is one of the few fields where the market has largely decided to be explicit.</p>https://whistleblowertools.eu/features/published-pricing/Thu, 17 Sep 2026 19:11:07 +0200https://whistleblowertools.eu/features/published-pricing/Platforms that publish an entry price on their own website, banded by monthly cost, against the ones that price only on request.<p>Whether a vendor publishes a price is the cheapest available signal about how it expects to sell to you. A published figure means the product is standardised enough to quote without a discovery call; an absent one usually means pricing is set per deal.</p> <p>Neither is a defect. But an organisation that needs a channel operating by a fixed date, and needs the cost approved before it commits, can only plan against the first group.</p>https://whistleblowertools.eu/features/free-trial/Thu, 17 Sep 2026 19:11:07 +0200https://whistleblowertools.eu/features/free-trial/Platforms that let you run the product before you pay, so the reporting form and case workflow can be assessed rather than demonstrated.<p>A demo shows you the product a vendor wants you to see. A trial shows you the reporting form your staff will actually face, the case view your handler will work in, and whether an anonymous reporter can hold a two-way conversation without creating an account.</p> <p>For a channel whose usefulness depends almost entirely on whether people trust it enough to use it, that difference matters more than the feature list.</p>https://whistleblowertools.eu/features/public-api/Thu, 17 Sep 2026 19:11:07 +0200https://whistleblowertools.eu/features/public-api/Platforms documenting a public API, for organisations that need cases to reach an existing case-management, GRC, or SIEM system.<p>Most organisations that already run a GRC or case-management system do not want a second inbox. An API is what determines whether a whistleblowing channel becomes part of the existing compliance workflow or a silo somebody has to remember to check.</p> <p>This is also the field vendors most often leave undisclosed, so treat absence from this list as unknown rather than unavailable, and confirm before it becomes a requirement.</p>https://whistleblowertools.eu/features/standalone/Thu, 17 Sep 2026 19:11:07 +0200https://whistleblowertools.eu/features/standalone/Platforms where whistleblowing is the product, not one module of a broader ESG, GRC, or legal-tech suite.<p>Whistleblowing arrives in two shapes: a product built for it, and a module added to a compliance suite sold for something else. The second can be the better buy when the suite is already in place — one vendor, one contract, one login.</p> <p>It changes what you are buying, though. A module’s price, roadmap, and support follow the suite, and the whistleblowing-specific parts of Directive 2019/1937 — acknowledgement deadlines, reporter anonymity, retaliation tracking — compete for attention with everything else in it.</p>