# OpenWhistle > OpenWhistle — from under €50 a month, EU-hosted. Independent profile: vendor-published facts, each with its source and the date it was checked. Canonical: https://whistleblowertools.eu/tools/openwhistle/ Last updated: 2026-10-18 ## Notable - The public site and cited pages were reachable again on 18 October 2026; the earlier Cloudflare certificate-error warning has been removed. This checks public availability, not successful report delivery. - OpenWhistle is a brand of Canelinfinita, Unipessoal Lda, a Portuguese company (NIPC 518494128) with its registered office in Porto and a contact address in Águas Santas, Maia. - Positioned as a whistleblowing channel for companies in compliance with Portugal's Lei 93/2021, the GDPR, and EU Directive 2019/1937; the copy references the MENAC and RGPC obligation for organisations with 50 or more employees. - Pricing is flat per organisation with unlimited users: EUR 22/month, or EUR 17.60/month billed annually (EUR 211.20/year), with VAT added on top. The vendor states the monthly fee stays the same whether the organisation has 30 or 300 employees. - The included plan covers one configured form, initial setup with up to 5 recipients, custom branding, interface in up to 3 languages, hosting, maintenance and updates, and email support within one business day; additional recipients, forms and languages are self-managed afterward. - The feature set is characteristic of the GlobaLeaks open-source platform: a 16-digit anonymous receipt, a custodian role authorising access to a whistleblower's identity, Tor support, PGP email notifications, more than 90 languages, and an OSI-approved AGPL 3.0 licence are all listed. - The platform is described as designed in accordance with ISO 27001:2022, ISO 37002:2021, CSA STAR and OWASP recommendations; these are framed as design references, not as held certifications, and no certification evidence was found on public pages reviewed. - Security claims include full encryption of reports and communications, TLS 1.3, AES-256 at rest, RBAC, 2FA (TOTP RFC 6238), no IP address registration, and periodic penetration tests. - The home page states data is stored within the European Union, while the privacy policy notes data may be transferred to cloud providers based outside the EEA under GDPR safeguards; no specific hosting country or named subprocessor list is published. - The how-it-works page mentions submission via web, secure email or telephone, but the dedicated channel list shows only a web portal, so multi-channel intake beyond the online reporting form was not clearly confirmed. - Onboarding is demo-led: pricing is public but every call to action routes to a demo request, and no free trial was found on public pages reviewed. - The privacy policy cites specific GDPR legal bases (Art. 6(1)(b), (c) and (f)) and lists retention periods, but no separate DPA download or DPIA support was found on public pages reviewed. ## Facts - website: https://openwhistle.pt - headquarters: Porto, Portugal - hosting: Vendor states data is stored within the European Union; specific country and provider not named. Privacy policy notes data may be transferred to cloud providers outside the EEA under GDPR safeguards. - pricing: Single plan: EUR 22/month, or EUR 17.60/month billed annually (EUR 211.20/year, described as 20% saving). VAT added on top. Price is per organisation with unlimited users. - pricing note: Includes 1 configured form, initial setup with up to 5 recipients, custom branding, interface in up to 3 languages, hosting, maintenance and updates, and email support within 1 business day. Additional recipients, forms and languages are self-managed after setup. All CTAs route to a demo request rather than self-serve signup. - languages: 90 - ownership: Private, brand of Canelinfinita, Unipessoal Lda (Portugal, NIPC 518494128) - product scope: standalone - ideal for: Portuguese SMEs and public bodies needing a Lei 93/2021 compliant whistleblowing channel with fixed, per-organisation pricing that does not scale with headcount. - last verified: 2026-10-18 | Capability | Published evidence | | --- | --- | | anonymous reporting | Yes | | case management | Yes | | multi channel | No | | api access | Not published | | free trial | No | | two factor auth | Yes | | audit log | Not published | | uses ai | No | ## national laws supported - EU Directive 2019/1937 - Portugal (Lei 93/2021) ## strengths - Flat per-organisation pricing with unlimited users, so cost does not rise with headcount - Public pricing shown on the site, including monthly and discounted annual rates - Anonymous two-way communication with a 16-digit receipt code for follow-up - Support for more than 90 reporting languages, including right-to-left scripts - Role-based access with named roles (whistleblower, recipient, custodian) and 2FA (TOTP RFC 6238) - GDPR-aligned privacy policy citing specific GDPR article bases and EU data storage ## Assessment Base score: 30/50. Access tier: P. Reviewed: 2026-07-19. Public pages only. No reporter submission or handler environment was reviewed. ### Is OpenWhistle suitable for SMEs under 250 employees? Yes — OpenWhistle's entry-tier pricing is published under €50/month, inside the range most 50–249-employee organisations budget for a whistleblowing channel. Single plan: EUR 22/month, or EUR 17.60/month billed annually (EUR 211.20/year, described as 20% saving). VAT added on top. Price is per organisation with unlimited users. Portuguese SMEs and public bodies needing a Lei 93/2021 compliant whistleblowing channel with fixed, per-organisation pricing that does not scale with headcount. ### Which national whistleblower laws does OpenWhistle explicitly reference? OpenWhistle explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, Portugal (Lei 93/2021). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly. ### Does OpenWhistle process whistleblower report content with AI? No — OpenWhistle does not process report content with AI or machine translation per its vendor materials. Verify the vendor's subprocessor list to confirm no downstream AI processing occurs. ## Sources - https://openwhistle.pt/en/ - https://openwhistle.pt/en/quem-somos/ - https://openwhistle.pt/en/funcionalidades-do-canal-de-denuncias/ - https://openwhistle.pt/en/como-funciona/ - https://openwhistle.pt/en/politica-de-privacidade/