# Whistleblower Software (by Formalize)

> Whistleblower Software (Formalize) — from €50–100 a month, EU-hosted. Independent profile: vendor-published facts, each with its source and the date it was checked.

Canonical: https://whistleblowertools.eu/tools/formalize/
Last updated: 2026-10-24

## Notable

- Formalize presents Whistleblower Software as one product inside a broader compliance suite covering DORA, NIS2, GDPR, GRC, ISO 27001, SOC 2, ISMS, and AI Act workflows.
- The marketing site ships in 12 languages, and each locale names its own national transposition law rather than only the EU Directive: Loi Waserman (Sapin II) in French, Law 4990/2022 in Greek, Ley 2/2023 in Spanish, HinSchG in German.
- 80+ reporting languages are available, but the product page states only 10 are included as part of a standard setup.
- Core covers end-to-end encryption, SSO (OAuth 2.0), anonymized reporting and case management. SAML 2.0, SCIM 2.0, a custom DPA, a dedicated CSM and an SLA are Advanced-tier only. Hotline and international management are separate add-ons.
- The product page documents two-way messaging that continues to work when the reporter is anonymous, file upload, voice reporting, automatic case delegation and deadline reminders.
- The security page states data and backups are stored with AWS in Frankfurt, with end-to-end encryption, MFA, IP whitelisting, activity logs, and a June 2024 penetration test by Truesec; a second badge on the same page still reads May 2023.
- Certificate details on the security page: ISO/IEC 27001:2022 by Intertek (11 November 2024), scoped to the development, sales and service of whistleblower solutions; ISAE 3000 Type 2 report by Beierholm (1 June 2023); ENS category High (Alta) by BDO (3 May 2023); WCAG 2.1 AA by TÜV TRUST IT (27 September 2023). The ISAE 3000, ENS and WCAG dates are more than a year old; no later dates were shown.
- End-to-end encryption covers case free-text fields, which are encrypted before storage with keys held by the customer. The product page also lists metadata removal from uploads, voice distortion and a redaction feature.
- Formalize announced a €15M Series A in March 2024 and a €30M Series B in October 2025, and says it works with more than 850 consultancies and law firms (vendor claims).
- The personal data policy confirms sub-processors exist, including in third countries, but names none and describes no objection mechanism. Deletion is vendor-set at no later than 3 years after subscription termination.
- Public pages reviewed did not disclose API access, a downloadable DPA, DPIA support, or how a reporter returns to an existing case.

## Facts

- website: https://whistleblowersoftware.com

- headquarters: Copenhagen, Denmark

- pricing: Core: €99 / €149 / €199 / €249 / €349 per month for 0-49 / 50-149 / 150-249 / 250-499 / 500-999 employees. Advanced: €149 / €219 / €299 / €379 / €529 for the same bands. 1,000+ employees contact sales. Billed annually.

- pricing note: Annual billing is stated on the whistleblowing price page. A public 14-day free trial without a credit card is advertised; confirm the product and selected employee band before ordering.

- languages: 80

- founded: 2020

- domain registered: 2020-11-25

- ownership: Private

- customers: 8,000+ across the Formalize platform (vendor claim)

- product scope: suite_module

- suite name: Formalize

- encryption: e2e

- ideal for: Organizations wanting a dedicated whistleblowing product inside the broader Formalize compliance suite, with public employee-band pricing and EU hosting.

- last verified: 2026-10-24

| Capability | Published evidence |
| --- | --- |
| anonymous reporting | Yes |
| case management | Yes |
| multi channel | Yes |
| api access | Not published |
| free trial | Yes |
| two factor auth | Yes |
| audit log | Yes |
| uses ai | Yes |

## certifications

- ISO/IEC 27001:2022

- ISAE 3000 Type 2

- ENS audited

- WCAG 2.1 AA

## national laws supported

- EU Directive 2019/1937

- Germany (HinSchG)

- Spain (Ley 2/2023 de Protección al Informante)

- France (Loi Waserman / Sapin II)

- Greece (Law 4990/2022)

## strengths

- Public employee-band pricing for Core and Advanced

- 80+ reporting languages available and a marketing site published in 12 languages, each naming its national transposition law

- ISO 27001:2022, ISAE 3000 Type 2, ENS Alta, WCAG 2.1 AA, penetration test dated June 2024, and AWS Frankfurt hosting

## Assessment

Base score: 32/50. Access tier: P. Reviewed: 2026-09-21.

Public pages only. Try For Free CTAs exist, but the review did not enter a trial or handler environment.

### Is Whistleblower Software (Formalize) suitable for SMEs under 250 employees?

Likely yes — Whistleblower Software (Formalize)'s entry-tier pricing sits in the €50–100/month band, workable for most 50–249-employee organisations. Core: €99 / €149 / €199 / €249 / €349 per month for 0-49 / 50-149 / 150-249 / 250-499 / 500-999 employees. Advanced: €149 / €219 / €299 / €379 / €529 for the same bands. 1,000+ employees contact sales. Billed annually. Organizations wanting a dedicated whistleblowing product inside the broader Formalize compliance suite, with public employee-band pricing and EU hosting.

### Which national whistleblower laws does Whistleblower Software (Formalize) explicitly reference?

Whistleblower Software (Formalize) explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, Germany (HinSchG), Spain (Ley 2/2023 de Protección al Informante), France (Loi Waserman / Sapin II), Greece (Law 4990/2022). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

### Does Whistleblower Software (Formalize) process whistleblower report content with AI?

Yes — Whistleblower Software (Formalize) processes report content with AI (typically for translation, summarisation, or classification). If your compliance posture requires keeping disclosures out of third-party LLMs or machine-translation services, confirm data-processing terms and vendor subprocessors before procurement.

## Sources

- https://whistleblowersoftware.com/en/prices

- https://whistleblowersoftware.com/en/security

- https://whistleblowersoftware.com/en/product

- https://whistleblowersoftware.com/en/personal-data-policy

- https://whistleblowersoftware.com/en/eu-whistleblowing-directive-summary

- https://whistleblowersoftware.com/fr

- https://whistleblowersoftware.com/el

- https://whistleblowersoftware.com/es

- https://formalize.com/en

- https://formalize.com/en/formalize-raises-30-million

- https://whistleblowersoftware.com/en