# Heimdal

> Heimdal — from under €50 a month, EU-hosted. Independent profile: vendor-published facts, each with its source and the date it was checked.

Canonical: https://whistleblowertools.eu/tools/heimdal/
Last updated: 2026-10-18

## Notable

- Operated by Heimdal Systems AB, based at Kungsgatan 17, Stockholm, Sweden, founded in 2025 and part of the Aglander Nyman AB corporate group, with the technical platform developed together with Flowbic AB.
- Distinct from the well-known Danish cybersecurity brand Heimdal Security (heimdalsecurity.com); this is a separate whistleblowing SaaS at heimdal.io.
- Positioned as a low-cost Swedish whistleblowing system, marketed in Swedish as "Sveriges billigaste visselblasarsystem" (Sweden's cheapest whistleblower system).
- Free for non-profit organizations and companies with fewer than 50 employees; EUR 499/year (4,995 SEK/year) for organizations with 50 or more employees.
- Paid plan runs on a 12-month agreement from order confirmation, with termination notice due no later than one month before the period ends; no monthly option was found on public pages reviewed.
- Reporting is via an online reporting form (implementation described as adding a link from the customer's website), accessible 24/7 from any device, with support for uploading most file and document types.
- Anonymous reporting is the core feature: the reporter receives a unique key/link for an encrypted two-way chat, and the vendor states that no IP addresses or metadata are stored and no identity information is logged in the channel.
- Compliance framing references the Swedish Whistleblower Protection Act (Lag 2021:890), EU Directive 2019/1937, NIS2 obligations, and GDPR; statutory 7-day acknowledgment and 3-month feedback deadlines are stated with on-screen deadlines and reminders.
- Data is stated to be stored on servers within the EU/EEA and encrypted in transit and at rest, with automatic deletion no later than 2 years after a case is closed; the specific hosting country and any sub-processor list were not disclosed on public pages reviewed.
- Accessibility is stated to meet WCAG 2.2 AA.
- No ISO 27001 or other certification, two-factor handler access, role-based access detail, API documentation, DPA/DPIA materials, or a published count of reporting languages were found on public pages reviewed.

## Facts

- website: https://heimdal.io

- headquarters: Stockholm, Sweden

- hosting: Servers within the EU/EEA (vendor-stated); specific country not named

- pricing: Free for non-profit organizations and companies with fewer than 50 employees; EUR 499/year for organizations with 50 or more employees (stated in Swedish as 4,995 SEK/year).

- pricing note: Paid agreement runs annually (12 months) from order confirmation, with termination notice due no later than one month before the 12-month period ends. No monthly billing option documented on public pages reviewed.

- founded: 2025

- domain registered: 2025-08-28

- ownership: Private, Heimdal Systems AB (Sweden), part of the Aglander Nyman AB group; technical platform developed with Flowbic AB

- product scope: standalone

- ideal for: Swedish SMEs and non-profits that want a low-cost, EU-Directive-compliant whistleblowing channel aligned to the Swedish Whistleblower Protection Act.

- last verified: 2026-10-18

| Capability | Published evidence |
| --- | --- |
| anonymous reporting | Yes |
| case management | Yes |
| multi channel | No |
| api access | Not published |
| free trial | No |
| two factor auth | Not published |
| audit log | Not published |
| uses ai | No |

## national laws supported

- EU Directive 2019/1937

- Sweden (Lag 2021:890)

## strengths

- Free tier for non-profit organizations and companies with fewer than 50 employees

- Published flat paid price (EUR 499/year) for organizations with 50 or more employees

- Anonymous encrypted two-way chat with a unique reporter access key

- Statutory 7-day acknowledgment and 3-month feedback deadlines are shown with reminders

- EU/EEA data storage with encryption in transit and at rest, stated to log no IP addresses or metadata

- Accessibility stated to meet WCAG 2.2 AA

## Assessment

Base score: 26/50. Access tier: P. Reviewed: 2026-07-19.

Public pages only. No reporter submission or handler environment was reviewed.

### Is Heimdal suitable for SMEs under 250 employees?

Yes — Heimdal's entry-tier pricing is published under €50/month, inside the range most 50–249-employee organisations budget for a whistleblowing channel. Free for non-profit organizations and companies with fewer than 50 employees; EUR 499/year for organizations with 50 or more employees (stated in Swedish as 4,995 SEK/year). Swedish SMEs and non-profits that want a low-cost, EU-Directive-compliant whistleblowing channel aligned to the Swedish Whistleblower Protection Act.

### Which national whistleblower laws does Heimdal explicitly reference?

Heimdal explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, Sweden (Lag 2021:890). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

### Does Heimdal process whistleblower report content with AI?

No — Heimdal does not process report content with AI or machine translation per its vendor materials. Verify the vendor's subprocessor list to confirm no downstream AI processing occurs.

## Sources

- https://heimdal.io/en

- https://heimdal.io/en/faq