Soterna

Dutch social-safety platform built around the Wet bescherming klokkenluiders, with a confidential-adviser module and k-anonymous board reporting. Quote-only.

AI processes report content — EU AI Act consideration

This vendor applies AI or machine learning to whistleblower reports (for example summarisation, severity or category classification, drafting replies, or machine translation). Automated processing of disclosures can bring the deployment within scope of the EU AI Act and routes sensitive personal data through a third-party inference provider. Confirm the model provider, its data-retention terms, and whether report content can be excluded before relying on it. Vendor detail: Trust Intelligence performs early-signal detection on aggregated metadata with a human in the loop; the Reorganisatiekamer uses a confidential moderator rather than automated release.

Facts

Website: www.soterna.eu(opens in new tab)
Headquarters: Amsterdam, Netherlands
Hosting: Stated as entirely within the EU with European cloud providers; no country or provider is named. Data-residency arrangements are offered on the Enterprise tier.
Pricing: Quote-only. Three packages — Core, Trust and Enterprise — priced as a fixed annual fee per organisation based on headcount. No amounts published; the vendor commits to a proposal within two working days.
The pricing page explains the absence of figures directly: a meaningful price depends on organisation size and configuration, and a "from" price "is fairer than a starting price that is right for almost nobody". The Neutral Line advice line is an add-on available only with Trust and Enterprise.
Languages on reporting form: 2
Product scope: Standalone whistleblower product
Encryption posture: At rest

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Enforced (reject)
DNSSEC: Signed
Legal entity: Soterna KvK 42105823 · imprint

Capabilities

Anonymous reporting ✓
Multi-channel intake ✓
Public API —
Free trial ✗
Two-factor authentication —
Audit log ✓
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

None published

National laws referenced

EU Directive 2019/1937
Netherlands (Wet bescherming klokkenluiders)

Typical buyer

Dutch municipalities, care groups and works-council-governed employers that need the Wbk deadlines tracked and aggregated reporting a supervisory board or OR can be shown, and that already run a vertrouwenspersoon function.

Distinctive features

Wbk deadlines are the product's organising principle — 7-day acknowledgment and 3-month feedback are described as automatically tracked, not as a manual checklist
Board and works-council reporting is aggregated with a stated minimum group size of seven people, so a figure cannot be traced back to an individual
Case access is scoped per file with parties to the case automatically excluded, which is the control most often missing when a report concerns a manager

Add-ons and conditions

Costs or terms not included in the headline price.

No price is published at any tier; every figure comes through a quote
The Neutral Line independent advice line cannot be bought on its own — it is an add-on to Trust or Enterprise
ISO 27001 is described as "traject voorbereid" (preparation under way), not held
Hosting is stated as EU-only but no country or cloud provider is named; residency commitments are an Enterprise-tier negotiation
Multi-entity support is described on the Enterprise tier as being on the roadmap rather than available
The DPA model is issued during the quote process rather than published for download

Notable

Positioned as “social safety” infrastructure rather than as a compliance channel: the Wbk reporting route sits alongside a vertrouwenspersoon (confidential adviser) module, a psychosocial-risk view, and a Reorganisatiekamer for anonymous questions during a restructuring.
Reporters submit without an account or email address. Return access to an existing case is by case number plus an access code, and the vendor states identity, IP address and device stay shielded while two-way messaging continues.
Aggregated board reporting enforces a minimum group size of seven before a figure is shown, and the works council receives its own signal pack. This is a stated k-anonymity threshold rather than a generic “anonymised dashboard” claim.
Conflict-of-interest routing with customer-defined rules, retaliation check-ins that carry no content, and an evidence store with EXIF stripping, virus scanning and SHA-256 integrity are all Trust-tier or above.
The security page states encryption in storage and transport, separation of reporter identity from report content, an immutable action log, and EU hosting with European cloud providers. It names no provider, no country and no certification, and says ISO 27001 work is prepared rather than complete.
The marketing site is published in Dutch and English only, and every legal reference is to the Dutch transposition. There is no signal of a market outside the Netherlands.

Status: not yet scored

Soterna was added from the September 2026 AI-citation coverage audit. The entry above records what the vendor publishes. It carries no 25-criterion rubric score yet and does not appear in the Netherlands ranking; a score will be added when the product has been reviewed under the same tier rules as every other scored tool.

Frequently asked questions about Soterna

Answers derived from vendor-published materials dated on this page.

Is Soterna suitable for SMEs under 250 employees?

Soterna does not publish entry-tier pricing, so SME buyers need to request a quote to assess fit. Buying path: Sales contact required. Dutch municipalities, care groups and works-council-governed employers that need the Wbk deadlines tracked and aggregated reporting a supervisory board or OR can be shown, and that already run a vertrouwenspersoon function.

Which national whistleblower laws does Soterna explicitly reference?

Soterna explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, Netherlands (Wet bescherming klokkenluiders). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does Soterna process whistleblower report content with AI?

Yes — Soterna processes report content with AI (typically for translation, summarisation, or classification). If your compliance posture requires keeping disclosures out of third-party LLMs or machine-translation services, confirm data-processing terms and vendor subprocessors before procurement. Trust Intelligence performs early-signal detection on aggregated metadata with a human in the loop; the Reorganisatiekamer uses a confidential moderator rather than automated release.