# WhistleSafe (WhistleSafe ApS)

> WhistleSafe (WhistleSafe ApS) — from under €50 a month, EU-hosted. Independent profile: vendor-published facts, each with its source and the date it was checked.

Canonical: https://whistleblowertools.eu/tools/whistlesafe/
Last updated: 2026-10-25

## Product and operator

WhistleSafe at whistlesafe.dk is operated by WhistleSafe ApS, CVR 44412667. The Danish business register showed normal status and a start date of 26 October 2023 when checked on 25 October 2026. This is the software supplied by WhistleSafe ApS, distinct from other services using the WhistleSafe name.

The vendor documents anonymous intake, attachments, two-way dialogue, case assignment, internal notes and deadline notifications. Its eight advertised interface languages are Danish, English, German, French, Spanish, Italian, Norwegian and Swedish. Seven are official EU languages. An authenticated trial was tested on 25 October 2026. A named customer reference and translation completeness remain unverified.

## Pricing and continuity

Monthly billing is DKK 249 excluding VAT. Annual prepayment is DKK 2,490 excluding VAT, equivalent to DKK 207.50 per month, and renews for another 12 months unless cancelled. Both options include the same functions and have no employee-count price bands.

The 30-day trial requires no payment card. Without adding payment, case handling pauses after the trial and new intake stops seven days later. The terms do not promise a measurable uptime percentage. Buyers should check the trial-to-paid transition before using the channel for real reports.

The registration form requires an organisation name, VAT number, postal address and invoice email. On 25 October 2026 its country selector offered Denmark, Germany, United Kingdom, Spain, France, Italy, Norway and Sweden. Poland was not offered. A trial account was activated with explicitly labelled synthetic organisation details. Availability for organisations in unlisted countries remains unverified.

## Reporter access and case handling

Reporters can return with the report ID alone or choose an additional password during intake. The live form offers password confirmation and a 12-character minimum. The review tested the default ID-only path; password-protected return remains untested. Optional email notifications do not require sharing the address with the case handler. The tested intake used role, department, subject and description, without a Directive breach-category selector.

A synthetic report was submitted without a name or email and reopened after reload. Reporter and handler messages worked in both directions. Moving the case to review recorded acknowledgement and displayed the feedback deadline; assignment and closure persisted. A private handler note was absent from the reporter conversation, while the final conclusion remained visible after closure.

The case ZIP contained a readable PDF of the report and conversation, the labelled internal note, and the uploaded attachment with identical contents. The CSV exported after closure included the case number, state, assignment and lifecycle dates. The PDF was an earlier in-review snapshot. Neither inspected export exposed the reporter return ID. The vendor claims metadata removal for supported image, PDF and Office attachments; that was not tested with the plain-text attachment.

The access editor offered administrator, report-handler and read-only presets alongside other roles and individual permissions. These controls were inspected without changing access or inviting another user, so permission enforcement remains untested. Automatic retention settings were inspected without changing them or deleting a case.

## Security and procurement

Report storage is documented in Microsoft Azure's North Europe region in Ireland. Encryption in transit and at rest is described; end-to-end encryption is not claimed here. Handler authenticator-app MFA is optional. The public subprocessor register qualifies international access and separately identifies Stripe's billing processing. EU storage should not be read as a guarantee that every service interaction stays exclusively in the EU.

The in-app DPA, version 2026-10-15, was downloaded and inspected. It describes an append-only case audit trail; the trial displayed persisted case events, but storage-level immutability was not tested. DPA acceptance remained pending during the synthetic workflow. A DPIA is offered on request. The security page describes the vendor's own testing and hosting-provider certifications; those do not establish independent product testing or ISO 27001 certification of WhistleSafe ApS.

## Scoring review — 2026-10-25

Scored under the [25-criterion rubric](https://whistleblowertools.eu/methodology/) at access tier **P+R+H**, with **40/50** points. The trial supports the anonymous conversation, status workflow, internal-note separation and export findings. Newly inspected password controls, role presets and audit documentation correct the earlier public-source score of 33/50.

Password enforcement, separate-user permissions, MFA, scheduled reminders, automatic deletion and non-English translation completeness remain untested. Certification and component-support zeroes are evidence gaps; the missing Directive intake taxonomy was directly observed. Published hosting and security statements remain vendor claims, not an independent security audit.

## Facts

- website: https://whistlesafe.dk

- headquarters: Dragør, Denmark

- hosting: Microsoft Azure North Europe, Ireland. Billing data is processed separately by Stripe; international access is qualified in the subprocessor terms.

- pricing: DKK 249/month or DKK 2,490/year prepaid (DKK 207.50/month equivalent), excluding VAT.

- pricing note: Same features and price regardless of employee count. Annual subscriptions renew for 12 months; monthly subscriptions end at month-end after cancellation. 30-day trial without a payment card.

- languages: 8

- ownership: Private — WhistleSafe ApS

- product scope: standalone

- encryption: at_rest

- ideal for: Danish organisations that want a self-serve whistleblowing channel and will handle cases themselves.

- last verified: 2026-10-25

- legal entity: WhistleSafe ApS

- company id: 44412667

| Capability | Published evidence |
| --- | --- |
| anonymous reporting | Yes |
| case management | Yes |
| multi channel | Not published |
| api access | Not published |
| free trial | Yes |
| two factor auth | Yes |
| audit log | Yes |
| uses ai | Not published |

## national laws supported

- EU Directive 2019/1937

- Danish Whistleblower Protection Act (Law 1436/2021)

## strengths

- Published monthly and annual prices without employee bands

- Documented Danish-law deadlines and anonymous dialogue

- Configurable automatic deletion of closed cases

- Department-based access and individually configurable permissions

- Public subprocessor list and named Irish hosting region

## Assessment

Base score: 40/50. Access tier: P+R+H. Reviewed: 2026-10-25.

Synthetic trial tested on 25 October 2026, including anonymous intake, return access, two-way replies, private notes, assignment, closure and exports. Optional password controls and role presets inspected; password enforcement, separate-user permissions, MFA, reminder delivery and automatic deletion not tested. Append-only audit protection remains a documented claim.

### Is WhistleSafe (WhistleSafe ApS) suitable for SMEs under 250 employees?

Yes — WhistleSafe (WhistleSafe ApS)'s entry-tier pricing is published under €50/month, inside the range most 50–249-employee organisations budget for a whistleblowing channel. DKK 249/month or DKK 2,490/year prepaid (DKK 207.50/month equivalent), excluding VAT. Danish organisations that want a self-serve whistleblowing channel and will handle cases themselves.

### Which national whistleblower laws does WhistleSafe (WhistleSafe ApS) explicitly reference?

WhistleSafe (WhistleSafe ApS) explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, Danish Whistleblower Protection Act (Law 1436/2021). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

### Does WhistleSafe (WhistleSafe ApS) process whistleblower report content with AI?

WhistleSafe (WhistleSafe ApS) does not publicly disclose whether report content is processed by AI or machine-translation services. For a no-AI compliance posture, obtain written confirmation and a subprocessor list before procurement.

## Sources

- https://whistlesafe.dk/en

- https://app.whistlesafe.dk/

- https://whistlesafe.dk/produkt

- https://whistlesafe.dk/priser

- https://whistlesafe.dk/sikkerhed

- https://whistlesafe.dk/underdatabehandlere

- https://whistlesafe.dk/vilkaar

- https://datacvr.virk.dk/enhed/virksomhed/44412667