Ethicontrol

Estonia-headquartered, Ukrainian-founded whistleblowing platform. Published entry price €89/month, with audit log and MFA starting at the Advanced tier (€369/month).

Vendor-reviewed

AI processes report content — EU AI Act consideration

This vendor applies AI or machine learning to whistleblower reports (for example summarisation, severity or category classification, drafting replies, or machine translation). Automated processing of disclosures can bring the deployment within scope of the EU AI Act and routes sensitive personal data through a third-party inference provider. Confirm the model provider, its data-retention terms, and whether report content can be excluded before relying on it. Vendor detail: Pricing page lists an AI intake agent for the web portal and WhatsApp from Standard tier (€174/mo) upward.

Rubric score

35 / 50

Evidence tier P

Public pages only. No reporter submission or handler account was reviewed.

How this score is produced →

Facts

Website: ethicontrol.com(opens in new tab)
Headquarters: Estonia (Ethicontrol OÜ); offices listed in Tallinn, Berlin, Warsaw, and Kyiv
Hosting: European data center in Frankfurt; vendor also lists data centers in the US, Ukraine, UAE, Brazil, India, and more depending on client needs.
Pricing: Starter €89/mo · Standard €174/mo · Advanced €369/mo · Pro €919/mo. Annual billing saves 8%. Standard plans cap at <2,000 employees; >2,000 routes to sales. On-premise license: €13,900 one-time (15-year, 36 months updates).
Homepage still says tariff plans get test access to all features for the first 6 months; the pricing page does not repeat that trial language. Up to 90% discount available for non-profits and education via cover-letter application. Final pricing 'determined based on individual discussions' per vendor disclaimer.
Languages on reporting form: 60
Domain registered: December 2013 ethicontrol.com
Ownership: Ethicontrol OU (Estonia) and Ethicontrol LLC (United States)
Product scope: Standalone whistleblower product

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Enforced (reject)
DNSSEC: Unsigned

Capabilities

Anonymous reporting ✓
Multi-channel intake ✓
Public API —
Free trial ✓
Two-factor authentication —
Audit log —
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

ISO 27001
ISO 27701

National laws referenced

EU Directive 2019/1937
France (Sapin II)
United Kingdom (PIDA)
Various international frameworks (ISO 37002, ISO 37001, US DoJ guidelines)

Typical buyer

Multi-jurisdiction operators that want published pricing, EU data residency options, ISO 27701 privacy certification, and a feature set that can extend beyond basic whistleblowing into incident and case management.

Distinctive features

Published rate card down to €89/month entry tier
ISO 27001 and ISO 27701 certified across all tiers (privacy certification is uncommon at this price band)
60+ languages available (though gated — only Pro is unlimited)
On-premise license option (€13,900 one-time) for buyers needing full data control
Unlimited users, admins and reports on every tier, including the €89 entry plan
Up to 90% non-profit / education discount
Reference deployment with Ukrainian state-owned transmission-system operator Ukrenergo

Add-ons and conditions

Costs or terms not included in the headline price.

Headline €89/mo Starter omits MFA, audit log, machine translation, custom roles — Directive-ready feature set is at Advanced (€369/mo), 4× the entry price
Toll-free helpline is a paid add-on (from €99/mo), not bundled even at Pro
VPS isolation only at Pro tier — Starter / Standard / Advanced share infrastructure
SSO only at Pro tier (€919/mo)
Standard plans hard-cap at <2,000 employees; larger orgs must enter a sales process
On-premise license self-discloses "limitations on reporters' confidentiality and anonymity protection" — unusual admission for a compliance vendor
Dual legal-entity footer (Ethicontrol OÜ and Ethicontrol LLC) — confirm contracting entity, data-processing flow, and sub-processor list in the DPA
Annual discount is 8%
Vendor disclaimer "Final pricing agreement determined based on individual discussions" — published rate card is not contractually binding

Notable

Estonia-headquartered, Ukrainian-founded. Ethicontrol identifies Ethicontrol OÜ as HQ and lists offices in Tallinn, Berlin, Warsaw, and Kyiv; the footer also names Ethicontrol LLC. Contracting entity and sub-processor details should be checked in the DPA.
Audit log and MFA start at Advanced (€369/mo). The Starter and Standard tiers include the basic reporting/case-management cycle, but audit log, MFA, machine translation, and custom roles are listed from Advanced.
Unlimited users on every tier. The pricing page states “Unlimited users, admins, employees, messages, cases, and reports” across Starter through Pro, so cost does not rise with the number of case handlers. Language coverage, not seats, is what the tiers gate.
Headcount ceiling: 2,000 employees on self-serve tiers. Larger organisations enter a sales-led process.
Ukrenergo is a public case-study reference — Ethicontrol’s own 2019 case-study post says Ukraine’s state-owned transmission-system operator introduced an ethics hotline using Ethicontrol.
UNIC member. Ethicontrol participates in the Ukrainian Network of Integrity and Compliance (unic.org.ua), the main Ukrainian compliance community — useful context for buyers evaluating local presence.
On-premise license: €13,900 one-time (15-year license, 36 months updates / support). Self-disclosed caveat: “Limitations on reporters’ confidentiality and anonymity protection” — a notable admission for a compliance vendor and worth scrutinising in the contract.
Non-profit / education programme: up to 90% discount by cover-letter application from an org/edu email.
Toll-free helpline is an add-on (from €99/mo, 180 countries) — not bundled at any standard tier.
Messaging-app intake from Standard tier. Web, email and phone are in all tiers; WhatsApp, Telegram, Viber and Facebook chatbots start at Standard.
Language coverage is tier-gated, and the vendor’s own pages disagree on the total. The homepage says 60+ languages and the About page says 70+. Included languages are 4 on Starter and Standard, 10 on Advanced, and unlimited only on Pro.
Vendor pages conflict on scale. The homepage states 254k+ client employees across 17 jurisdictions, while the About page states 354k client employees and 37 jurisdictions. Treat exact scale as vendor-claimed and inconsistent across public pages reviewed.
ISO 27701 privacy certification (in addition to ISO 27001) across all tiers is uncommon at this price band.
Trial language is inconsistent. The pricing page does not foreground a current free trial, while the homepage still says all tariff plans get test access to all features for the first 6 months. Re-verify with the vendor before relying on the exact trial terms.

Frequently asked questions about Ethicontrol

Answers derived from vendor-published materials dated on this page.

Is Ethicontrol suitable for SMEs under 250 employees?

Likely yes — Ethicontrol's entry-tier pricing sits in the €50–100/month band, workable for most 50–249-employee organisations. Starter €89/mo · Standard €174/mo · Advanced €369/mo · Pro €919/mo. Annual billing saves 8%. Standard plans cap at <2,000 employees; >2,000 routes to sales. On-premise license: €13,900 one-time (15-year, 36 months updates). Multi-jurisdiction operators that want published pricing, EU data residency options, ISO 27701 privacy certification, and a feature set that can extend beyond basic whistleblowing into incident and case management.

Which national whistleblower laws does Ethicontrol explicitly reference?

Ethicontrol explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, France (Sapin II), United Kingdom (PIDA), Various international frameworks (ISO 37002, ISO 37001, US DoJ guidelines). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does Ethicontrol process whistleblower report content with AI?

Yes — Ethicontrol processes report content with AI (typically for translation, summarisation, or classification). If your compliance posture requires keeping disclosures out of third-party LLMs or machine-translation services, confirm data-processing terms and vendor subprocessors before procurement. Pricing page lists an AI intake agent for the web portal and WhatsApp from Standard tier (€174/mo) upward.