myETHOS

Notable

• Based in Chania, Crete — positioning as a Greek-native compliance-services company.
• Site operates in Greek and English with an EL/EN toggle.
• Product scope wider than whistleblowing: explicitly includes labour-dispute resolution, incident and crisis management, and background checks.
• Positioned for small and medium-sized entities and state organisations.
• Minimal public content depth: no customer logos, no case studies, no customer testimonials visible on the homepage.
• No founding year, pricing, hosting location, or certifications disclosed.
• Homepage does not explicitly cite Greece’s Law 4990/2022 (the Directive 2019/1937 transposition) at time of review; law coverage implied by overall positioning.

Handler-app surface (from first-party demo, 2026-04-19)

• Sidebar structure: Home, Cases, Statistics, Settings, Manage users, Manage departments, Manage categories, Billing history.
• Departments exist as a first-class concept; categories are editable per tenant.
• Case record fields: ID, Status, Subject, Category, Severity (1–5 dropdown, no legend), Assigned to (single assignee), Next deadline, Last activity.
• Cases list includes a “Spam” bulk-flag button for workforce-exposed-URL abuse.
• Persistent “Your subscription expires in N days” ribbon on every admin page during free trial.
• Settings page exposes per-language introductory text editors powered by CKEditor 4.12.1; CKEditor’s own end-of-life warning renders inside the admin UI.

Reporter-app surface

• Report-submission confirmation returns a raw UUID as the access code (single-factor access to follow-up).
• Follow-up page shows Date, Subject, Description, File Attachments, Messages thread, and a form to post a new message with attachments.
• No voice intake, no structured questions (relationship to org, source of info, prior external reporting), no writing guide, no consent-record or privacy-notice step visible in the demo flow.
• Reporter-facing pages branded “Powered by MyEthos”.

Given the thin public presence, the Greek-language moat, and the demo-verified product weaknesses (CKEditor 4 EOL, single-factor UUID access, minimal reporter form), the Greek market remains one of the least contested in the EU at the vendor level — and the incumbent is weaker in practice than its marketing implies.

Scoring review — 2026-04-19

Scored under the 25-criterion rubric v2 at access tier P + R + H (handler + reporter flows reviewed via first-party demo).

Base score: 20 / 50. Greece country bonus: 4 / 6.

The commercial story is the strongest of any tool in this review — €120/mo monthly billing, self-serve registration, transparent tier matrix. Few incumbents in any EU market publish all three on a public page.

The security story negates most of that. The CKEditor 4 EOL warning rendered inside the Settings admin UI is disqualifying for DPO or IT reviewers; single-factor UUID access to existing reports is below the EU-Commission two-factor benchmark. Together these drop a category to zero.

Two fixes that would move the base 20 → ~26: upgrade off CKEditor 4 and add a user-chosen passcode to reporter access. Both are days-to-weeks of work.

Buyer fit: plausible for a Greek SME (50–150 employees) that wants to tick the Law 4990/2022 box cheaply and has no DPO asking about library versions or two-factor benchmarks. Fails any DPO-led procurement.