Whistlelink

Notable

• Signup provisions a working handler account in minutes. The register/ form asks for name, work email, phone, country, language, company, and password; after email confirmation the handler picks a subdomain (companyname.whistlelink.com) and a reporter-site language, and the dashboard opens immediately with a six-step start guide.
• The handler admin exposes the pieces buyers check in procurement, not just a brochure. Settings / Compliance configures retention time (default 12 months) and default case deadline (default 3 months). The dashboard has tiles for New cases, Open cases, Cases with new messages, Cases near deadline, and Cases to be deleted — the retention and deadline timers are observable on the landing page.
• Settings / Automations is a priority-ordered rules engine for auto-assignment; the default rule ships as Assign users with role Owner.
• User Management exposes a real five-role RBAC grid (Owner, Administrator, Case handler, Content Manager, Viewer) plus a per-user MFA status column and an org-wide Enforce two factor authentication toggle.
• Sub-processors are named at the consent point. Settings / Case Handling offers two opt-in AI features: Automatic Translation names DeepL (Germany) as a new sub-processor; AI: Case Summary names Mistral (France). Both are off by default.
• Settings / Action log records who changed what, when, with before-after values — timestamped and user-attributed.
• Romania-specific materials remain visible. Reporter-site language selector includes Romanian; the prior handler review found Romanian compliance categories out of the box (Achiziții, Mită, corupție, conflict de interese, Hărțuire sexuală, Economie, finanțe, bani, spălare de bani, etc.); public pages still include Romanian pricing, Law 361/2022 guidance, local territory-manager details, an AmCham offer page, and a Sun Wave Pharma Romania case study.

Scoring review - 2026-05-24

Scored under the 25-criterion rubric v2 at access tier H (prior hands-on handler account plus 2026-05-24 public-page refresh; reporter portal was provisioned previously but a test submission was not filed).

Base score: 39 / 50. Romania country bonus: 6 / 6.

Evidence supporting the score: public materials and the prior handler review support the retention, case-deadline, auto-assignment, RBAC, 2FA, action-log, and sub-processor claims. Romanian product and pricing pages, Law 361/2022 positioning, a Romania case-study page, and local contact details are also public.

Unverified from this pass: embedded article-by-article Law 361/2022 mapping, reporter return-access mechanics, and append-only audit semantics. Public pricing still describes annual subscription terms.