Confidential Reporting System

Notable

• The commercial site exposes public pricing, LOGIN and REGISTRATION links to app.crsys.org, and a distinct product identity rather than only advisory copy.
• Public positioning is tightly local. The site repeatedly cites the Bulgarian whistleblowing act, frames the product as an internal channel for Bulgarian private and public organisations, and explicitly targets municipalities, private employers with 50+ staff, and certain regulated employers regardless of headcount.
• The product story is institutional for a local entrant. The public site says the system was created by Transparency International Bulgaria and Happi Company Ltd / HAPPY COMPANY Ltd, while the domain and site policy are owned by "CONFIDENTIAL REPORTING SYSTEM" Ltd. in Sofia.
• The pricing page publishes BGN 295, 395, 595, and 995 monthly bands by headcount, with onboarding support included. Billing is annual and the CTA still routes to /contact, so pricing is public but procurement is not self-serve.
• The public legal explainer spells out written and oral reports, phone and in-person channels, 7-day acknowledgement, 3-month feedback, and routing to the CPDP where relevant.
• The public app bundle exposes Bulgarian and English locale support and operational product strings such as public reporting pages, internal correspondence, forwarding to external institutions, hidden staff-only notes, deanonymisation requests, registration success, activation emails, and login history.
• Anonymity needs buyer confirmation: anonymous written reports are listed, but the same explainer says proceedings cannot be initiated from them.
• BlockChain is listed in package/pricing copy. The public copy does not describe the chain, ledger, or verification surface, so it should be treated as an unexplained product claim rather than an audited control.

Scoring review - 2026-05-24

Scored under the 25-criterion rubric v2 at access tier P (public pages, app shell, and current public bundle inspection only; no reporter submission or handler account reviewed).

Base score: 20 / 50 in the Bulgaria context. Bulgaria country bonus: 4 / 6.

Evidence supporting the score: public local-law framing, public price bands, and a live software surface beyond a contact form. The app bundle also shows handler-side mechanics such as status buckets, hidden notes, and correspondence modes.

Unverified from public pages: hosting country, self-serve onboarding, vendor-held ISO certification, sub-processor posture, and how anonymous written reports are handled in practice given the vendor legal explainer.