# Confidly

> Confidly — from under €50 a month, EU-hosted. Independent profile: vendor-published facts, each with its source and the date it was checked.

Canonical: https://whistleblowertools.eu/tools/confidly/
Last updated: 2026-09-30

## Notable

- Operated by Confidly OU, a private limited company registered in the Estonian Business Register with a registered office in Tallinn, Estonia; the site footer states the product is built in Helsinki and hosted in the EU.
- Positioned as a focused, self-serve whistleblowing channel for EU companies of roughly 50 to 500 employees, deliberately narrower than a full GRC or compliance suite.
- Reporter intake is anonymous by design: no account, no IP, no email, and no device fingerprint; the reporter receives a case code plus a 6-digit secret (stated to be stored only in hashed form) for two-way anonymous follow-up.
- Multiple intake channels are documented: web form, audio and video attachments, and mobile-first WhatsApp and SMS intake, plus printable QR-code posters in six EU languages.
- AI features (Pro and Enterprise) summarise reports, classify severity, suggest categories, translate 25+ languages, and draft acknowledgement replies; all AI output is stated to be advisory and human-confirmed. Inference runs on AWS Bedrock eu-central-1 (Frankfurt) with stated zero data retention.
- Compliance features include automatic reporter status updates at 7 days and 3 months (mapped to Directive Article 9), an append-only hash-chained audit log exportable as CSV or JSON, and an auto-generated country-tailored annual compliance report.
- The trust page states EU data residency with production data in Hetzner Falkenstein, Germany, TLS 1.3 and AES-256 encryption, a public sub-processor list with a 30-day objection window, and an annual third-party penetration test (summary under NDA).
- Handler authentication is delegated to Clerk (clerk.com), a US-based identity platform: report data is EU-hosted, but sign-in and session identity run through a US sub-processor, a cross-border transfer consideration under GDPR Chapter V.
- ISO 27001 and SOC 2 Type II are listed as in progress with target dates; ISO 27701 and TISAX are planned or on request. No certification was verified as complete on the public pages reviewed.
- Public legal artifacts include an Article 28 DPA with SCCs, a privacy policy, a pre-filled Article 35 DPIA template, and a RoPA entry; some pen-test, TIA, and BCP documents are stated to be available only under NDA.
- Pricing is published for all three standard tiers, banded by total employee headcount rather than per user, with a 14-day free trial (no credit card) and both monthly and annual billing. Deployments above 2,000 employees, on-prem, or custom integrations are handled via sales.
- The public imprint lists Confidly OU in Tallinn but shows the registry number and VAT identification number as placeholders as of the reviewed date; the stated supervisory authority is the Estonian Data Protection Inspectorate (AKI).

## Facts

- website: https://confidly.eu

- headquarters: Tallinn, Estonia

- hosting: Hetzner Online GmbH, Falkenstein, Germany (vendor-stated)

- pricing: Starter EUR 39/month billed annually (EUR 468/year, up to 100 employees); Pro EUR 124/month billed annually (EUR 1,488/year, 100-500 employees); Enterprise EUR 332/month billed annually (EUR 3,984/year, up to 2,000 employees / 5 channels). Monthly billing also offered; annual billing stated to save roughly 17%.

- pricing note: Priced by total employee headcount, not per user. All plans include a 14-day free trial (full Pro features, no credit card). Prices are EUR plus VAT, reverse-charged for EU B2B. 10,000+ employees, on-prem, or custom integrations are quote-only via sales.

- languages: 25

- founded: 2026

- ownership: Private, Confidly OU (Estonia)

- product scope: standalone

- ideal for: EU companies of roughly 50 to 500 employees wanting a focused, self-serve, Directive-compliant whistleblowing channel with anonymous intake and AI-assisted case handling, without a full GRC suite.

- last verified: 2026-07-21

- legal entity: Confidly OÜ

- company id: VAT EE10XXXXXXXX

| Capability | Published evidence |
| --- | --- |
| anonymous reporting | Yes |
| case management | Yes |
| multi channel | Yes |
| api access | Yes |
| free trial | Yes |
| two factor auth | Yes |
| audit log | Not published |
| uses ai | Yes |

AI summarises reports, classifies severity, suggests categories, translates 25+ languages, and drafts acknowledgement replies; all suggestions advisory and human-confirmed. Inference via AWS Bedrock eu-central-1 (Frankfurt), stated zero data retention.

## national laws supported

- EU Directive 2019/1937

- Germany (HinSchG)

- France (Loi Sapin II)

- Italy (D.lgs 24/2023)

- Spain (Ley 2/2023)

- Netherlands (Wbk)

## strengths

- Published self-serve pricing across three tiers with a 14-day free trial and no credit card

- Anonymous-by-design intake (no IP, email, or device fingerprint; reporter gets a case code plus 6-digit secret)

- EU data residency named (Hetzner Falkenstein, Germany) with a public sub-processor list and 30-day objection window

- Automatic reporter status updates at 7 days and 3 months mapped to Directive Article 9

- Append-only, hash-chained audit log exportable as CSV or JSON for regulator inspection

- Country-specific intake templates referencing named national transposition laws across all 27 EU states plus EEA and UK

## Assessment

Base score: 42/50. Access tier: P. Reviewed: 2026-07-19.

Public pages only. No reporter submission or handler environment was reviewed.

### Is Confidly suitable for SMEs under 250 employees?

Yes — Confidly's entry-tier pricing is published under €50/month, inside the range most 50–249-employee organisations budget for a whistleblowing channel. Starter EUR 39/month billed annually (EUR 468/year, up to 100 employees); Pro EUR 124/month billed annually (EUR 1,488/year, 100-500 employees); Enterprise EUR 332/month billed annually (EUR 3,984/year, up to 2,000 employees / 5 channels). Monthly billing also offered; annual billing stated to save roughly 17%. EU companies of roughly 50 to 500 employees wanting a focused, self-serve, Directive-compliant whistleblowing channel with anonymous intake and AI-assisted case handling, without a full GRC suite.

### Which national whistleblower laws does Confidly explicitly reference?

Confidly explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, Germany (HinSchG), France (Loi Sapin II), Italy (D.lgs 24/2023), Spain (Ley 2/2023), Netherlands (Wbk). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

### Does Confidly process whistleblower report content with AI?

Yes — Confidly processes report content with AI (typically for translation, summarisation, or classification). If your compliance posture requires keeping disclosures out of third-party LLMs or machine-translation services, confirm data-processing terms and vendor subprocessors before procurement. AI summarises reports, classifies severity, suggests categories, translates 25+ languages, and drafts acknowledgement replies; all suggestions advisory and human-confirmed. Inference via AWS Bedrock eu-central-1 (Frankfurt), stated zero data retention.

## Sources

- https://confidly.eu/

- https://confidly.eu/features

- https://confidly.eu/pricing

- https://confidly.eu/trust

- https://confidly.eu/eu-directive

- https://confidly.eu/legal/imprint

- https://confidly.eu/legal/dpa

- https://confidly.eu/legal/privacy