Confidential Reporting System (CRS)

Notable

• CRS is the closest thing in the Bulgaria-native segment to a civil-society-backed compliance utility. Transparency International – Bulgaria is a named co-developer, and the About page ties the product explicitly to the national whistleblower law that entered into force on 4 May 2023 as the transposition of Directive 2019/1937.
• The commercial surface is unusually thin for a SaaS product. The Services and prices page publishes a clean BGN tier matrix — 295 / 395 / 595 / 995 BGN per month by employee band — but the “no activation fee until June 30, 2023” banner is still on the page, which suggests the marketing layer has not been refreshed.
• Signup is not self-serve. The app.crsys.org/register form asks for first name, last name, email, phone, company, VAT number, terms acceptance, and a Google reCAPTCHA. There is no free-trial copy anywhere; the practical path appears to be activation after billing.
• Security posture is phrased as infrastructure alignment rather than vendor-held certification. The footer on the public pages says the platform is hosted according to the standards of: PCI DSS, ISO 27001:2013, ISO 9001:2015. That is not the same as CRS itself holding those certificates, and a buyer should treat it as a hosting-partner signal.
• BlockChain is cited repeatedly as the integrity layer for incoming reports. The public copy does not describe the chain, ledger, or verification surface, so the claim is a marketing signal rather than an audited control.

Scoring review - 2026-04-23

Scored under the 25-criterion rubric v2 at access tier P (public pages only; signup was blocked by reCAPTCHA and no handler account was reviewed).

Base score: 11 / 50. No Bulgaria bonus is defined in the current rubric.

What lifts CRS up: the Transparency International Bulgaria co-authorship is a genuine credibility anchor, and the public law-and-transposition framing is explicit on the homepage. Public employee-band pricing is another positive: most Bulgaria-native peers do not publish a tier table at all.

What caps it: the product surface is almost entirely marketing. Workflow, retention, deadlines, RBAC, reporter access method, and hosting country are all undocumented publicly, and the site is visibly frozen in 2023 commercial copy. Buyers who want operational proof will need to reach the vendor directly for a walkthrough.