Skip to main content
EU Whistleblower Directory
Confidly logo

Confidly

EU-built anonymous whistleblowing channel from Confidly OU (Estonia), self-serve from EUR 39/month, EU-hosted with AI-assisted investigation.

Confidly homepage screenshot
Typical buyer

EU companies of roughly 50 to 500 employees wanting a focused, self-serve, Directive-compliant reporting channel with anonymous intake and AI-assisted case handling, without a full GRC suite.

Distinctive features

  • Published self-serve pricing across three tiers with a 14-day free trial and no credit card
  • Anonymous-by-design intake (no IP, email, or device fingerprint; reporter gets a case code plus 6-digit secret)
  • EU data residency named (Hetzner Falkenstein, Germany) with a public sub-processor list and 30-day objection window
  • Automatic reporter status updates at 7 days and 3 months mapped to Directive Article 9
  • Append-only, hash-chained audit log exportable as CSV or JSON for regulator inspection
  • Country-specific intake templates referencing named national transposition laws across all 27 EU states plus EEA and UK

Add-ons and conditions

Costs or terms not included in the headline price.

  • Pricing is banded by total employee headcount, not per user; crossing a band moves you to the next tier
  • ISO 27001 and SOC 2 Type II are listed as in progress, not certified, on public pages reviewed
  • REST API, webhooks, SCIM, BYOK encryption, and configurable per-channel retention are Enterprise-only
  • AI classification and translation (beyond summaries) plus SSO require the Pro tier or higher
  • The public imprint reviewed lists Confidly OU in Tallinn but shows registry and VAT numbers as placeholders

Notable

  • Operated by Confidly OU, a private limited company registered in the Estonian Business Register with a registered office in Tallinn, Estonia; the site footer states the product is built in Helsinki and hosted in the EU.
  • Positioned as a focused, self-serve reporting channel for EU companies of roughly 50 to 500 employees, deliberately narrower than a full GRC or compliance suite.
  • Reporter intake is anonymous by design: no account, no IP, no email, and no device fingerprint; the reporter receives a case code plus a 6-digit secret (stated to be stored only in hashed form) for two-way anonymous follow-up.
  • Multiple intake channels are documented: web form, audio and video attachments, and mobile-first WhatsApp and SMS intake, plus printable QR-code posters in six EU languages.
  • AI features (Pro and Enterprise) summarise reports, classify severity, suggest categories, translate 25+ languages, and draft acknowledgement replies; all AI output is stated to be advisory and human-confirmed. Inference runs on AWS Bedrock eu-central-1 (Frankfurt) with stated zero data retention.
  • Compliance features include automatic reporter status updates at 7 days and 3 months (mapped to Directive Article 9), an append-only hash-chained audit log exportable as CSV or JSON, and an auto-generated country-tailored annual compliance report.
  • The trust page states EU data residency with production data in Hetzner Falkenstein, Germany, TLS 1.3 and AES-256 encryption, a public sub-processor list with a 30-day objection window, and an annual third-party penetration test (summary under NDA).
  • ISO 27001 and SOC 2 Type II are listed as in progress with target dates; ISO 27701 and TISAX are planned or on request. No certification was verified as complete on the public pages reviewed.
  • Public legal artifacts include an Article 28 DPA with SCCs, a privacy policy, a pre-filled Article 35 DPIA template, and a RoPA entry; some pen-test, TIA, and BCP documents are stated to be available only under NDA.
  • Pricing is published for all three standard tiers, banded by total employee headcount rather than per user, with a 14-day free trial (no credit card) and both monthly and annual billing. Deployments above 2,000 employees, on-prem, or custom integrations are handled via sales.
  • The public imprint lists Confidly OU in Tallinn but shows the registry number and VAT identification number as placeholders as of the reviewed date; the stated supervisory authority is the Estonian Data Protection Inspectorate (AKI).

Similar to Confidly

Other platforms in the directory with overlapping pricing model, certifications, or procurement path.

Frequently asked questions about Confidly

Answers derived from vendor-published materials dated on this page.

Is Confidly suitable for SMEs under 250 employees?
Yes — Confidly's entry-tier pricing is published under €50/month, inside the range most 50–249-employee organisations budget for a reporting channel. Starter EUR 39/month billed annually (EUR 468/year, up to 100 employees); Pro EUR 124/month billed annually (EUR 1,488/year, 100-500 employees); Enterprise EUR 332/month billed annually (EUR 3,984/year, up to 2,000 employees / 5 channels). Monthly billing also offered; annual billing stated to save roughly 17%. EU companies of roughly 50 to 500 employees wanting a focused, self-serve, Directive-compliant reporting channel with anonymous intake and AI-assisted case handling, without a full GRC suite.
Which national whistleblower laws does Confidly explicitly reference?
Confidly explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, Germany (HinSchG), France (Loi Sapin II), Italy (D.lgs 24/2023), Spain (Ley 2/2023), Netherlands (Wbk). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.
Does Confidly process whistleblower report content with AI?
Yes — Confidly processes report content with AI (typically for translation, summarisation, or classification). If your compliance posture requires keeping disclosures out of third-party LLMs or machine-translation services, confirm data-processing terms and vendor subprocessors before procurement. AI summarises reports, classifies severity, suggests categories, translates 25+ languages, and drafts acknowledgement replies; all suggestions advisory and human-confirmed. Inference via AWS Bedrock eu-central-1 (Frankfurt), stated zero data retention.

Compare Confidly with another platform

Direct side-by-side comparisons against other tools in this directory.

See alternatives to Confidly →