Original research · 2026 edition
The state of EU whistleblowing software, 2026
What 116 whistleblower reporting platforms actually publish about price, hosting, certification, language coverage, and AI — measured across the whole EU market rather than a vendor shortlist.
Computed · 116 live platforms
Directive (EU) 2019/1937 has been in force across the Union since 2021, and every member state has now transposed it. A market grew to serve the obligation: at the time of writing this directory tracks 116 live platforms sold into it, most of them by companies you have never heard of, selling into one country each.
Almost everything written about that market is written by the people selling into it. This is an attempt at the other thing: a description of what the whole population of vendors actually publishes, counted rather than characterised.
The single clearest finding is that a large share of this market does not tell you the things procurement has to know. Not that the answers are bad — that they are absent. Where a vendor publishes nothing, that is recorded below as its own category rather than quietly dropped, because for a buyer it is the most consequential answer of the three.
Headline figures
- 50 / 116
- publish no entry price
- 41 / 116
- do not say where data is hosted
- 80 / 116
- publish no security certification
- 2 / 116
- cover all 24 official EU languages
Most of this market will not tell you what it costs
50 of 116 platforms publish no entry price at all. The 66 that do cluster hard at the bottom: the modal European whistleblowing platform costs under €50 a month, which is roughly what the obligation is worth to a 60-person company. That gap is not really about price. A published figure means a product standardised enough to quote without a discovery call; an absent one means the number is set per deal, and a buyer cannot plan a budget against it.
Entry price, where published
Cheapest tier a vendor publishes on its own pricing page, monthly equivalent.
- Under €50 / month
- 42 · 36%
- €50–100 / month
- 17 · 15%
- €100–200 / month
- 6 · 5%
- Over €200 / month
- 1 · 1%
- Not published
- 50 · 43%
A third of the market does not say where the data lives
71 of 116 platforms name an EU data centre. 41 say nothing at all about hosting location on any public page, and 11 are run by companies headquartered outside the EU. For a system holding untested allegations about named employees, hosting location is a question that appears on essentially every procurement questionnaire in Europe — and a third of the market has decided not to answer it on its website.
Where report data is hosted
- EU data centre
- 71 · 61%
- EU region selectable
- 4 · 3%
- Not disclosed
- 41 · 35%
Security certification is the exception, not the norm
80 of 116 platforms publish no security certification of any kind. 33 publish ISO 27001, alone or with others. The absence is not evidence of weak security — certification is expensive and many of these vendors are very small — but it does mean that for most of this market a buyer has no external attestation to rely on and has to do the assurance work itself.
Published security certification
- ISO 27001 plus others
- 13 · 11%
- ISO 27001
- 20 · 17%
- National scheme (ENS, ACN)
- 3 · 3%
- None published
- 80 · 69%
Almost nobody covers the languages the Union actually speaks
Exactly 2 of 116 platforms cover all 24 official EU languages. 67 publish a partial list, and 47 do not say. The Directive requires a channel that workers can actually use, and a multinational with staff across several member states is the buyer most likely to need that and least likely to find it. This is the widest gap in the dataset and the one vendors discuss least.
Reporting-form language coverage
- All 24 official languages
- 2 · 2%
- Partial, count published
- 67 · 58%
- Not published
- 47 · 41%
The market is split down the middle on whether you may buy without talking to it
43 of 116 platforms let you open an account yourself. 63 put a demo or a sales call between you and the product. For a compliance obligation with a statutory deadline, that is a real difference in how fast the obligation can be closed, and it tends to track company size on both sides of the transaction.
How the product is bought
- Self-serve sign-up
- 43 · 37%
- Demo required
- 33 · 28%
- Sales call required
- 30 · 26%
- Mixed
- 10 · 9%
On AI, the market has mostly decided to be explicit
85 of 116 platforms state that report content is not processed by AI. 23 confirm that it is, typically for translation or triage. Only 8 leave it unanswered — which makes this the most consistently disclosed field in the whole dataset, and a striking contrast with hosting location.
AI processing of report content
- No AI processing
- 85 · 73%
- Uses AI
- 23 · 20%
- Not disclosed
- 8 · 7%
This is a market of national vendors, not European ones
79 of 116 platforms sell into a single country. 24 are not standalone products at all but modules of a broader compliance, ESG, or legal-tech suite. The Directive is Union-wide; its software market is not. A buyer operating in more than two member states will find the shortlist collapses very quickly.
Geographic reach
- One country
- 79 · 68%
- Regional
- 6 · 5%
- Multiple EU states
- 20 · 17%
- Global
- 11 · 9%
Method, and what these numbers cannot tell you
- Population: 116 platforms marketed for EU Directive 2019/1937 compliance and reachable at the time of writing. Platforms recorded as defunct or absorbed into another company are excluded from every figure.
- Every field is taken from the vendor's own published pages — pricing, product, security, legal — and cited and dated on that platform's profile. Nothing is inferred from a competitor, a reseller, or a review site.
- "Not published" means exactly that. It is not a judgement about the product, and several platforms that publish nothing are demonstrably capable. It is a statement about what a buyer can establish without entering a sales process.
- This measures disclosure, not quality. No figure here should be read as saying a platform does or does not do something — only that it does or does not say so in public.
Every figure is computed at build time from the directory dataset, so the numbers on this page and the numbers on the platform profiles cannot disagree.
Cite this
Published under CC BY 4.0. Reuse the figures with attribution; the underlying dataset is public and machine-readable, so they can be checked or recomputed.
EU Whistleblower Directory (2026). The state of EU whistleblowing software, 2026. https://whistleblowertools.eu/report/2026/