Methodology
How platforms in this directory are recorded, scored, and re-verified: the 25-criterion rubric, the point scale, the evidence tiers, what was deliberately left out, and how a vendor disputes a score.
Two different things happen on this site, and they are held to different standards.
Directory entries record what a vendor publishes about its own product. Every field is taken from the vendor’s own pricing, product, security, or legal pages, cited on the profile, and dated. Nothing in a directory entry is an assessment. Where a vendor does not publish something, the entry says so rather than inferring it — “not disclosed” is a finding, not a gap in our research.
Rankings are assessments. They score a platform against a fixed rubric that was written before any platform was scored against it, and every criterion carries evidence: a URL, a quotation, or a note describing what was observed in the product.
The distinction matters because the two are easy to confuse. A platform can be entirely accurately recorded and still be unscored. A platform can score poorly because it publishes little, not because it does little. The rubric below is designed so a reader can tell those cases apart.
The point scale
Each criterion scores 0, 1, or 2. Twenty-five criteria give a base of 50 points. Country modifiers are scored separately and never change the base.
- 2 points — fully meets the criterion, with evidence
- 1 points — partially meets it, or meets it in a weaker form than the criterion describes
- 0 points — does not meet it, or it could not be verified at the platform's evidence tier. These two cases look identical in the total, which is why the tier is published alongside every score.
The rubric
25 criteria across five categories, 50 points. The rubric is fixed before any platform is scored against it, and the scoring guide for each criterion is published here so a score can be checked rather than trusted.
Legal compliance — 8 criteria, 16 points
| # | Criterion | What earns each score |
|---|---|---|
| a1 | Local transposition law referenced with article numbers | ● law + article cited on product/legal page · ◐ generic "complies with EU Directive" only · ○ no legal reference |
| a2 | Directive 2019/1937 Article 2(1) categories in intake | ● matches Art 2(1) list · ◐ overlaps partially · ○ ad-hoc taxonomy or free text only |
| a3 | Anonymous reporting default-on or equal-status | ● anonymity is the default path · ◐ offered but less prominent than named · ○ name required |
| a4 | 7-day acknowledgment + 3-month feedback deadline tracking | ● both timers + reminders automated · ◐ one of the two · ○ neither |
| a5 | Configurable retention with automatic deletion | ● per-org config + auto-purge · ◐ system default or manual purge · ○ undefined |
| a6 | Report register / log | ● queryable register with legal fields · ◐ flat log · ○ none |
| a7 | Append-only handler audit trail | ● append-only, ideally hash-chained · ◐ editable log · ○ none |
| a8 | DPA + DPIA support documented | ● DPA downloadable + DPIA template provided · ◐ one of the two · ○ neither |
Reporter experience — 5 criteria, 10 points
| # | Criterion | What earns each score |
|---|---|---|
| b9 | Web form, mobile-responsive, with file upload | ● all three · ◐ two of three · ○ one or none |
| b10 | Two-factor reporter access (Case ID + passcode) | ● user-chosen passcode · ◐ Case ID + system-generated passcode · ○ single UUID |
| b11 | Two-way anonymous communication | ● live in-product thread · ◐ email-bridged or asymmetric · ○ one-way or none |
| b12 | Structured intake aligned to Article 2(1) | ● Directive-aligned guided fields · ◐ generic guided fields · ○ free text only |
| b13 | Reporter form in local language | ● yes · ○ no. ◐ reserved for partial translation (e.g. intake translated, FAQ not) |
Handler experience — 5 criteria, 10 points
| # | Criterion | What earns each score |
|---|---|---|
| c14 | Case management dashboard with status workflow | ● received → acknowledged → investigating → closed with transitions · ◐ freeform status labels · ○ email-only inbox |
| c15 | Assign cases to handlers (rotation or multi-handler) | ● per-case assignment + rotation · ◐ per-case manual · ○ single shared inbox |
| c16 | Deadline reminder notifications | ● scheduled reminders · ◐ single reminder · ○ none |
| c17 | Internal notes (not visible to reporter) | ● yes · ○ no |
| c18 | Role-based access control (≥3 roles) | ● ≥3 roles with scoped permissions · ◐ 2 roles · ○ all-admin |
Security and trust — 4 criteria, 8 points
| # | Criterion | What earns each score |
|---|---|---|
| d19 | ISO 27001 certified | ● current certificate + scope stated · ◐ in progress with auditor named · ○ none |
| d20 | No EOL software components | ● modern stack · ◐ older but supported · ○ visible EOL library or vendor's own EOL warning rendered in UI |
| d21 | EU data residency with country disclosed | ● EU + country named · ◐ EU region stated, country not · ○ non-EU or undefined |
| d22 | Sub-processor list + right to object | ● list + objection mechanism · ◐ list only · ○ none |
Commercial — 3 criteria, 6 points
| # | Criterion | What earns each score |
|---|---|---|
| e23 | Published pricing | ● full tier matrix · ◐ starting-from only · ○ quote-only |
| e24 | Free trial available (self-serve) | ● self-serve signup + trial · ◐ sandbox by request · ○ demo-gate only |
| e25 | Monthly contract option | ● monthly + cancellable · ◐ annual + monthly mixed · ○ annual only |
Country modifiers
A country ranking adds a modifier for local-law posture, local data residency, and a genuine local-language surface. Modifiers are a secondary sort key. They never move the base score, so a platform cannot climb a ranking on local marketing alone.
Belgium bonus — 6 points
- Belgian whistleblower law (28 Nov 2022) referenced
- Belgium or named EU residency
- Dutch- or French-language UI
Bulgaria bonus — 6 points
- Bulgarian whistleblower law referenced
- Bulgaria or named EU residency
- Bulgarian-language UI
Spain bonus — 6 points
- Ley 2/2023 referenced
- Spain or named EU residency
- Spanish-language UI
France bonus — 8 points
- Loi Waserman compliance stated
- Sapin 2 compliance stated
- France data residency available
- French-language UI (reporter + handler)
Greece bonus — 6 points
- Law 4990/2022 referenced
- Greece-acceptable residency
- Greek-language UI
Romania bonus — 6 points
- Law 361/2022 referenced
- Romania or named EU residency
- Romanian-language UI
Evidence tiers
A score is only as good as what could be examined to produce it. Every scored platform carries the tier of access the assessment actually had.
| Tier | What was examined | Platforms |
|---|---|---|
| P | Public pages only — the vendor's own product, pricing, security, and legal pages. Nothing behind a sign-up. | 113 |
| P+R | Public pages plus the reporter side — a report was actually submitted through the live form and the reporter's side of the exchange was observed. | 0 |
| P+H | Public pages plus the handler environment — the case workflow and settings were examined from inside the product, but no report was filed through the live reporter form. | 2 |
| P+R+H | Public pages, the reporter side, and the handler environment — the case workflow, roles, audit trail, and settings were examined from inside the product. | 1 |
Read tiers before you read totals
Almost every platform here is scored at P, because almost every platform is sold through a demo gate that a directory cannot pass without the vendor's cooperation. A P score therefore measures what a vendor publishes at least as much as what it built, and a platform that documents little will score lower than an equivalent one that documents well. That is a real limitation, not a hidden one — compare totals within a tier, and treat a low P score as a question to put to the vendor rather than a verdict. Any vendor can raise its own tier at no cost by granting access, and we will re-score and republish.
Grant access and be re-scoredScoring integrity rules
- The rubric is fixed and published before a platform is scored against it. Criteria are never added or reweighted to change a result.
- Every criterion carries evidence — a URL, a quotation, or a note describing what was observed in the product. A score with no evidence line is a bug.
- A criterion that cannot be verified at the platform's evidence tier scores zero and is marked as unverifiable, not as failed.
- No vendor pays for a listing, a score, a position, or a review. There is no paid placement and no affiliate revenue on this site.
- Vendors may dispute any score. Disputes are published as dated addenda alongside the score, whether or not the score changes.
- Scores are tied to a dated rubric version. When the rubric changes, affected rankings are re-scored and the change is recorded in the version history rather than applied quietly.
What the rubric deliberately leaves out
A rubric is defined as much by what it refuses to score. These were considered and cut, either because every serious product already meets them or because they separate nothing between finalists. Each is reversible if buyers start to weigh it.
| Not scored | Why |
|---|---|
| Voice intake with pitch modification | A single-vendor capability rather than a requirement buyers weigh across a shortlist. Scoring it would reward one product for being unlike the others. |
| Writing guide / tips | Nice-to-have, not tie-breaker. |
| WCAG 2.1 AA accessibility | Default expectation in 2026, not differentiator. |
| Custom branding / white-label | Buyers rarely check beyond logo + colour, which is table stakes. |
| "Powered by" removal | Sub-point of branding. |
| Dedicated mobile app | Employees click a poster URL; app install is hostile to anonymity. |
| Multilingual count / UI language count | Folded into "available in local language" for reporter and into country-UI bonus for handler. |
| Multi-entity / capital-group support | Not a 50–250-employee-buyer concern. Enterprise only. |
| Severity / priority classification | Every handler renames it anyway. |
| Statistics dashboard | Opened once a year, not a tie-breaker. |
| Bulk actions / spam flagging | Nice-to-have, not a finalist differentiator. |
| Template responses | Same. |
| Report export CSV/PDF as standalone | Covered by audit trail and GDPR DSR mechanics. |
| Internal vs external reporting channels (split) | Internal is required by Directive Art 7, so it's table stakes; external is optional and rarely drives selection. |
| Retaliation reporting / conflict of interest / legal hold | Corner cases, not shortlist discriminators. |
| Privacy policy shown + GDPR consent (split) | Both roll up under DPA/DPIA (A8). |
| Reporter protection info display | Required by Directive Art 14; if a product lacks it, it fails A1 anyway. |
| End-to-end encryption | Almost no vendor has true E2E (reporter has no key to hold), so it becomes a false signal. |
| TLS grade | A+ on SSL Labs is default for everyone; no discrimination. |
| SOC 2 / ISAE 3000 | EU buyers anchor on ISO 27001; SOC 2 is a US framework. One is enough. |
| Penetration-testing disclosure, uptime SLA, backup/DR | Marketing artefacts; claims rarely verified. |
| Self-serve signup + setup time | Collapses into E24 (free trial). |
| Customer logos / references | Vendor marketing, not function. |
| Certifications beyond ISO 27001 | Inflates score without buyer-relevance. |
| UI language count | Redundant with B13 and the country-UI bonuses. |
Rubric version history
A score is only comparable to another score produced under the same rubric. Every platform's profile records the version it was scored against.
v2_25_criteria ·
Current, and the version every published ranking uses. Reduced to 25 criteria carrying only what a compliance lead weighs when choosing between realistic finalists. Dropped table-stakes items, vendor-marketing artefacts, and anything that does not separate one shortlisted product from another. Country modifiers are scored separately so they cannot move the 50-point base.
v1
Superseded, and never used for a published ranking. It scored a broader list that mixed real differentiators with expectations every product already met, which compressed the range and made the result harder to act on. The criteria it carried and the reason each was dropped are listed above.