Whispli

Enterprise whistleblowing, disclosure, hotline, and investigation platform operating in 60+ countries.

Non-EU HQ

Non-EU headquarters — data sovereignty risk

Sydney, Australia (offices in Paris and Boston). This vendor is headquartered outside the European Union. EU personal data processed by the vendor is a cross-border transfer under GDPR Chapter V and depends on an adequacy decision, Standard Contractual Clauses, or a derogation. Non-EU providers introduce jurisdictional exposure to third-country data-access regimes. For institutional buyers prioritising European data sovereignty, prefer an EU-headquartered provider.

AI processes report content — EU AI Act consideration

This vendor applies AI or machine learning to whistleblower reports (for example summarisation, severity or category classification, drafting replies, or machine translation). Automated processing of disclosures can bring the deployment within scope of the EU AI Act and routes sensitive personal data through a third-party inference provider. Confirm the model provider, its data-retention terms, and whether report content can be excluded before relying on it. Vendor detail: Voice AI hotline captures, structures, and routes hotline reports into cases.

Rubric score

32 / 50

Evidence tier P

Public pages only. No reporter submission or handler environment was reviewed.

How this score is produced →

Facts

Website: www.whispli.com(opens in new tab)
Headquarters: Sydney, Australia (offices in Paris and Boston)
Pricing: Plan names and features are public, but numeric prices are not published; procurement remains quote-based.
The pricing page names four quote-only packages (Essentials, Plus, Business, Enterprise) and states a three-year contract with annualized payment, excluding tax. Hosting-region choice starts at Plus; customer-managed keys (KMS) sit in Enterprise. Confirm the selected package, seats, hosting region and add-ons with sales.
Languages on reporting form: 70
Domain registered: December 2015 whispli.com
Customers: 300+ organisations; deployed in 60+ countries (vendor claim)
Product scope: Standalone whistleblower product
Encryption posture: Customer-held key (vendor cannot decrypt)

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Published but not enforcing
DNSSEC: Unsigned

Capabilities

Anonymous reporting ✓
Multi-channel intake ✓
Public API ✓
Free trial ✗
Two-factor authentication ✓
Audit log ✓
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

ISO 27001
SOC 2 Type II

National laws referenced

EU Directive 2019/1937
France (Loi Sapin II)
France (Loi Waserman)
Germany
United States (SOX)
Australia
United Kingdom FCA rules

Typical buyer

Large multinational organizations needing configurable workflows, Safe Inbox, Voice AI hotline, regional hosting, and customer-managed encryption keys.

Distinctive features

Web, mobile app, email, QR code, and Voice AI hotline intake are disclosed publicly
70+ languages, anonymous two-way Safe Inbox, configurable workflows, SLAs, retention, routing, and audit logs
ISO 27001, SOC 2 Type II, customer-managed encryption keys (Enterprise package), API/integrations, and selectable hosting regions including France and Germany

Add-ons and conditions

Costs or terms not included in the headline price.

Pricing page names packages but does not publish amounts
No self-serve trial found
Exact EU official-language coverage was not disclosed on public pages reviewed

Notable

Whispli now uses current product paths such as /use-case/whistleblowing, /whistleblowing-management-system, and /whistleblowing-hotline; the previously listed /solutions/whistleblower/ URL returned 404.
Product pages state 300+ organisations, deployment in 60+ countries, 70+ languages (the features page says 60 languages for translation), anonymous two-way Safe Inbox, web/mobile/email/QR/Voice AI intake, configurable forms, automated case creation, routing, SLAs, retention, and audit-ready logs.
The security page states ISO 27001 certification, SOC 2 Type II certification, 2FA, SSO, penetration testing, metadata removal, no IP address or caller ID collection, secure translation on Whispli infrastructure, and regional hosting. Product pages describe ISO 27001 as covering the whole platform, not just hosting, name AWS, Azure and Scaleway as hosting options, say customer keys stay with the customer, and mention structured data export for audits and regulators.
France-specific pages name Loi Waserman and Sapin 2. Public pages also reference the EU Whistleblower Protection Directive, GDPR, SOX, UK FCA rules, Australian laws, and ISO 37002 principles.
The pricing page publishes four packages (Essentials, Plus, Business, Enterprise) without numeric prices and states a three-year contract with annualized payment. Standard hosting regions are the USA, France, Germany and Australia, with region choice from Plus; mobile apps and self on-boarding are listed in Essentials; KMS is listed in Enterprise. No public self-serve trial was found.
The company story page lists offices in Boston, Paris and Sydney.

Frequently asked questions about Whispli

Answers derived from vendor-published materials dated on this page.

Is Whispli suitable for SMEs under 250 employees?

Whispli does not publish entry-tier pricing, so SME buyers need to request a quote to assess fit. Buying path: Sales contact required. Large multinational organizations needing configurable workflows, Safe Inbox, Voice AI hotline, regional hosting, and customer-managed encryption keys.

Which national whistleblower laws does Whispli explicitly reference?

Whispli explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, France (Loi Sapin II), France (Loi Waserman), Germany, United States (SOX), Australia, United Kingdom FCA rules. Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does Whispli process whistleblower report content with AI?

Yes — Whispli processes report content with AI (typically for translation, summarisation, or classification). If your compliance posture requires keeping disclosures out of third-party LLMs or machine-translation services, confirm data-processing terms and vendor subprocessors before procurement. Voice AI hotline captures, structures, and routes hotline reports into cases.