Phoenix

Swiss whistleblowing SaaS with Bulgarian and Romanian language pages, public pricing, and a free starter tier.

Non-EU HQ

Non-EU headquarters — data sovereignty risk

Switzerland. This vendor is headquartered outside the European Union. EU personal data processed by the vendor is a cross-border transfer under GDPR Chapter V and depends on an adequacy decision, Standard Contractual Clauses, or a derogation. Non-EU providers introduce jurisdictional exposure to third-country data-access regimes. For institutional buyers prioritising European data sovereignty, prefer an EU-headquartered provider.

Rubric score

23 / 50

Evidence tier P+H

The tier records what could be examined to produce this score. Totals are only comparable within the same tier.

How this score is produced →

Facts

Website: www.phoenix-whistleblowing.com/(opens in new tab)
Headquarters: Switzerland
Hosting: Switzerland for standard hosting; Starter setup page lists Switzerland, Singapore, and Indonesia server-location options
Pricing: Starter free; Basic $65/month or $650/year; Premium $110/month or $995/year; Enterprise custom.
Starter tier says no credit card required and no hidden fees. Public pricing also lists CHF, USD, and EUR as currency choices, but the English pricing page reviewed displayed USD plan prices.
Languages on reporting form: 50
Domain registered: July 2022 phoenix-whistleblowing.com
Ownership: Integrity International SA
Product scope: Standalone whistleblower product
Encryption posture: Not published

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Published but not enforcing
DNSSEC: Unsigned

Capabilities

Anonymous reporting ✓
Multi-channel intake ✓
Public API —
Free trial ✗
Two-factor authentication —
Audit log —
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

None published

National laws referenced

EU Whistleblower Directive (generic)
GDPR

Typical buyer

Buyers who want multilingual whistleblowing software with public self-serve pricing and a free entry tier, but do not require EU data residency or country-specific Bulgaria/Romania law positioning.

Distinctive features

Bulgarian- and Romanian-language public site and pricing pages are live
Public pricing lists a free Starter tier, monthly Basic/Premium prices, annual Basic/Premium prices, and Enterprise custom pricing
Public pages describe multi-channel intake, case management, secure inbox communication, pipelines, and multi-role accounts

Add-ons and conditions

Costs or terms not included in the headline price.

Starter setup page lists Switzerland, Singapore, and Indonesia as server-location choices; no EU server option was found on public pages reviewed
No public DPA, sub-processor list, API documentation, AI documentation, or ISO 27001 certification was found on public pages reviewed
A free Starter plan is published, but no time-limited free trial was found on public pages reviewed

Notable

Public pricing was updated after the prior review. The English pricing page now lists Starter as free, Basic at $65/month or $650/year, Premium at $110/month or $995/year, and Enterprise as custom.
Starter is a free self-serve plan, not a time-limited trial. Public pages say no credit card and no hidden fees, but no free-trial term was found on public pages reviewed.
The Starter setup page asks for organisation name, server location, subdomain, and Phoenix domain. Server-location choices shown publicly are Switzerland, Singapore, and Indonesia; no EU option was found.
Public pricing lists Starter with webform only, one Manager account, one language, a default theme, server choice, Phoenix web-domain choice, and self-serve knowledge base support.
Public paid tiers add channels: Basic lists email, phone, instant messaging, and postal address; Premium adds online chat, customizable questionnaire, Operator and Agent accounts, custom domain, and theme library access.
The multi-channel page describes web forms, phone numbers, short-message service numbers, chat, mobile app reporting, and a secure inbox for confidential exchanges.
The confidentiality page describes three reporter identity modes: confidential, anonymous, and disclosed. It says secure-inbox access uses credentials provided by the system; user-chosen reporter passcodes were not disclosed on public pages reviewed.
Case-management pages describe tags/categories, report sharing, comments, chronology/case tree, Kanban, triage, status reporting, PDF export, and dashboard reporting.
Public FAQ material describes four roles: Administrator, Manager, Operator, and Agent. The public pricing page exposes Operator and Agent accounts only from Premium upward.
No public DPA, sub-processor list, ISO 27001 certificate/scope, API documentation, AI documentation, file-upload disclosure, retention configuration, deadline timers, or Bulgaria/Romania-specific law page was found on public pages reviewed.

Scoring review - 2026-05-24

Scored under the 25-criterion rubric v2 at access tier P+H (prior self-serve handler account plus 2026-05-24 public-page refresh; no new test submission was filed).

Base score: 23 / 50 in Bulgaria and Romania contexts. Bulgaria country bonus: 1 / 6. Romania country bonus: 1 / 6.

Category	Score	Max
A. Legal compliance	4	16
B. Reporter experience (BG)	7	10
B. Reporter experience (RO)	7	10
C. Handler experience	6	10
D. Security	0	8
E. Commercial	6	6

Evidence supporting the score: public pages support the self-serve commercial path, free Starter tier, public BG/RO language surfaces, multiple reporting channels, secure inbox communication, case-management tooling, role separation, and monthly paid options.

Unverified from public pages: EU residency, Bulgaria- or Romania-specific law posture, public DPA, sub-processor list, ISO 27001 certificate/scope, API documentation, and AI documentation. Switzerland / Singapore / Indonesia are the public server-location choices reviewed.

Frequently asked questions about Phoenix

Answers derived from vendor-published materials dated on this page.

Is Phoenix suitable for SMEs under 250 employees?

Phoenix does not publish entry-tier pricing, so SME buyers need to request a quote to assess fit. Buying path: Self-serve sign-up. Buyers who want multilingual whistleblowing software with public self-serve pricing and a free entry tier, but do not require EU data residency or country-specific Bulgaria/Romania law positioning.

Which national whistleblower laws does Phoenix explicitly reference?

Phoenix explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Whistleblower Directive (generic), GDPR. Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does Phoenix process whistleblower report content with AI?

Phoenix does not publicly disclose whether report content is processed by AI or machine-translation services. For a no-AI compliance posture, obtain written confirmation and a subprocessor list before procurement.