VoxWel

Whistleblowing platform with flat USD 1 per-employee pricing, marketed for EU Directive and Sapin II compliance; legal entity details are not clearly disclosed.

Non-EU HQ

Non-EU headquarters — data sovereignty risk

Ilford, Essex, United Kingdom (footer also lists a Kuliyapitiya, Sri Lanka office); the privacy policy contact lists Lumora Ventures in San Francisco.. This vendor is headquartered in the United Kingdom. The UK is a third country under GDPR following Brexit; transfers currently rely on the UK adequacy decision, which is under review. UK providers are also subject to the Investigatory Powers Act 2016, granting domestic authorities broad data-access powers. For institutional buyers prioritising European data sovereignty, prefer an EU-headquartered provider.

Rubric score

23 / 50

Evidence tier P

Public pages only. No reporter submission or handler environment was reviewed.

How this score is produced →

Facts

Website: voxwel.com(opens in new tab)
Headquarters: Ilford, Essex, United Kingdom (footer also lists a Kuliyapitiya, Sri Lanka office); the privacy policy contact lists Lumora Ventures in San Francisco.
Hosting: Vendor-stated European hosting on the France-localized page; privacy policy names only generic cloud-provider categories and allows safeguarded international transfers.
Pricing: USD 1 per employee per month, billed as a single flat-rate plan with all features included; French page localizes this as approximately €0.92 per employee per month.
14-day free trial. Primary pricing is denominated in USD; France-localized page also presents an EUR equivalent.
Languages on reporting form: 200
Domain registered: December 2025 voxwel.com
Ownership: VoxWel by Lumora Ventures (legal entity details not found on public pages reviewed)
Product scope: Standalone whistleblower product
Encryption posture: End-to-end

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Enforced (quarantine)
DNSSEC: Signed

Capabilities

Anonymous reporting ✓
Multi-channel intake ✓
Public API ✗
Free trial ✓
Two-factor authentication —
Audit log —
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

None published

National laws referenced

EU Directive 2019/1937
France (Loi Sapin II, amended)

Typical buyer

Cost-sensitive SMEs with employee counts up to roughly 200 that want a flat, predictable per-head price.

Distinctive features

Flat USD 1/employee/month with all features included
14-day free trial
AES-256 encryption and anonymous-reporting positioning are public
GDPR and EU Whistleblower Directive marketed as day-one ready

Add-ons and conditions

Costs or terms not included in the headline price.

Pricing is primarily denominated in USD, with a France-localized EUR estimate
ISO 27001 or ISO 37002 certification not disclosed on the public site
Privacy policy lists generic processor categories rather than named sub-processors
Legal entity and headquarters are unclear across the public pages reviewed
UK and Sri Lanka offices with undisclosed hosting put EU customer data under third-country jurisdiction (UK Investigatory Powers Act 2016; UK–US Data Access Agreement under the CLOUD Act framework)

Notable

VoxWel markets into France for Directive 2019/1937 and Loi Sapin II compliance, but its legal entity is not clearly disclosed on the public pages reviewed.
The site footer (verified 2026-06-05) lists offices in Ilford, Essex (UK) and Kuliyapitiya (Sri Lanka) under “VoxWel by Lumora Ventures”, with no data-hosting location disclosed. Like other non-EU-headquartered vendors, EU customer data is exposed to third-country access regimes — the UK Investigatory Powers Act 2016 and the UK–US Data Access Agreement operating under the CLOUD Act framework.
Pricing is a flat USD 1 per employee per month on the main page; the France-localized page presents approximately €0.92 per employee per month.
14-day trial is public; AES-256 / end-to-end encryption, GDPR readiness, EU Directive readiness, audit trail, QR onboarding, and a seven-stage workflow are public homepage claims.
France page claims European hosting and 200+ languages. The privacy policy does not name hosting providers and separately describes international-transfer safeguards, so EU hosting is treated as vendor-stated and provider-unverified.
Privacy policy processor disclosure is generic, not a named sub-processor list; no ISO certification or public DPA pack was found.
Anonymous-reporting copy says identifying metadata is stripped, but the privacy policy still describes ordinary site/account log data including IP addresses. Treat the no-IP claim as specific to anonymous reports, not the whole website.

Frequently asked questions about VoxWel

Answers derived from vendor-published materials dated on this page.

Is VoxWel suitable for SMEs under 250 employees?

Yes — VoxWel's entry-tier pricing is published under €50/month, inside the range most 50–249-employee organisations budget for a reporting channel. USD 1 per employee per month, billed as a single flat-rate plan with all features included; French page localizes this as approximately €0.92 per employee per month. Cost-sensitive SMEs with employee counts up to roughly 200 that want a flat, predictable per-head price.

Which national whistleblower laws does VoxWel explicitly reference?

VoxWel explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, France (Loi Sapin II, amended). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does VoxWel process whistleblower report content with AI?

No — VoxWel does not process report content with AI or machine translation per its vendor materials. Verify the vendor's subprocessor list to confirm no downstream AI processing occurs.