Every European whistleblowing-software tool reviewed
Aarhus, Denmark
Core from EUR 99 to EUR 349 a month and Advanced from EUR 149 to EUR 529 a month by employee band (under 50 up to 999 staff), billed yearly with 30 days’ notice before renewal; above 1,000 employees quoted individually
None stated; published pricing instead
Best for: Single-entity EU companies wanting a firm price before talking to sales
Whistleblower Software is built by Formalize and operates out of Aarhus. It stands out in this category for one reason: it publishes exact prices.
Two plans, Core and Advanced, scale across employee bands from under 50 staff up to 999, with pricing rising from EUR 99 to EUR 349 a month on Core and EUR 149 to EUR 529 a month on Advanced.
Organisations above 1,000 employees are quoted individually, and both plans bill annually with 30 days’ notice before renewal. The product covers what the EU Whistleblower Directive requires: a confidential intake channel, case routing and the acknowledgement and feedback deadlines a compliance team has to track.
International case management, a phone hotline and extra languages are sold as add-ons rather than bundled in, which keeps the base price low but means a multinational rollout adds cost quickly.
For a single-entity EU company that wants a firm number before speaking to anyone, that published pricing is close to unique among its peers. The trade-offs are that no ISO 27001 or SOC 2 certificate is listed on the vendor’s site and that case management is lighter than at enterprise-focused vendors such as EQS Group.
What Whistleblower Software does well
- Fully published pricing across two plans and six employee bands
- Meets the Directive’s core intake and case-management requirements out of the box
- Straightforward annual billing with a defined 30-day cancellation window
- Danish company with a clear operating entity
Where Whistleblower Software falls short
- Phone hotline, international case management and extra languages are paid add-ons
- No independent security certification listed on the vendor’s site
- Case-management depth is lighter than enterprise competitors
Standout feature. Published, per-employee-band pricing: a compliance officer can price a whole rollout without booking a sales call.
Varberg, Sweden
From EUR 79 a month for up to 49 employees to EUR 299 a month for 500 to 999 employees; larger organisations quoted directly; Hotline Live phone reporting is a paid add-on
30-day free trial, no credit card required
Best for: Nordic and EU companies that must name one country for report storage
Whistlelink keeps every report and every server inside Sweden, which answers a question many EU buyers ask and rarely get a straight answer to: which specific country holds this data. The operating company is Whistleblowing Solutions AB in Varberg.
Pricing is published in the employee-band shape common to the category’s few transparent vendors, starting at EUR 79 a month for up to 49 employees and rising to EUR 299 for 500 to 999 employees. The platform is ISO 27001 certified and supports more than 35 languages.
A 30-day free trial with no credit card required makes it one of the easiest tools here to test before buying. A 24/7 phone reporting add-on called Hotline Live and an Intake Management Service cover the parts a web-only tool usually leaves out.
For a Swedish or Nordic company, or any EU organisation that wants to point to a single named country when asked where reports are stored, it is a direct answer. The limits are the usual ones: phone reporting costs extra, the case-management feature set is narrower than EQS Group or SpeakUp, and organisations above 999 employees need a custom quote.
What Whistlelink does well
- Published pricing by employee band, undercutting most competitors at entry level
- All data hosted in Sweden, a named jurisdiction rather than "the EU"
- 30-day free trial with no credit card
- ISO 27001 certified with 35+ languages
Where Whistlelink falls short
- 24/7 phone reporting is a paid add-on
- Narrower case-management feature set than EQS Group or SpeakUp
- Above 999 employees a custom quote is required
Standout feature. Data hosted entirely inside Sweden, with a 30-day free trial that needs no credit card.
Düsseldorf, Germany
Founded 2019
Flat EUR 79 a month for unlimited users, cases and storage at any company size, with a 12-month minimum term; custom Enterprise tier on request
None stated; flat pricing instead
Best for: Growing companies that want one predictable monthly bill
Vispato charges one flat rate, EUR 79 a month, regardless of whether the company has 20 employees or 2,000, with unlimited users, cases and storage and no per-employee scaling.
A 12-month minimum term applies, and a separate custom Enterprise tier exists for organisations that need more support or configuration. Founded in Düsseldorf in 2019 by Christian Bürger and Bastian Halbach, Vispato built a base of more than 350 companies, including AOK and Fressnapf, before HR WORKS, a German HR software company backed by private equity firm Maguar Capital, acquired it in April 2025.
It continues to operate as a standalone product under the Vispato name, with end-to-end encryption and GDPR compliance built in. For a fast-growing company that would otherwise watch its whistleblowing bill climb with headcount, the flat rate is the whole appeal.
For a five-person firm the same flat rate is worse value than an employee-banded alternative, and the change of ownership is worth watching for roadmap or pricing shifts. On published figures its EUR 79 matches Whistlelink’s entry price and undercuts the entry price of Whistleblower Software and Hintbox, while TrueSpeak’s Starter, Professional and Voice tiers are cheaper still.
What Vispato does well
- One flat price regardless of company size
- Unlimited users, cases and storage at that price
- 350+ customers including AOK and Fressnapf
- End-to-end encryption and GDPR compliance
Where Vispato falls short
- 12-month minimum contract term
- A very small employer pays the same flat rate as a mid-sized one
- Owned by HR WORKS since April 2025, a change in independence
Standout feature. A single flat monthly price with no per-employee scaling, the most predictable bill for a company that is growing quickly.
Munich, Germany
Founded 2000
Quote only across three named tiers (Essential, Professional, Enterprise), scaled by employee count with add-ons for phone reporting and extra channels
None stated
Best for: Large multinationals wanting one enterprise-scale compliance vendor
EQS Group is the closest thing to an incumbent in this category. The Munich company has sold compliance software since 2000, and its product, EQS Integrity Line, serves more than 14,000 customer organisations across 80 countries.
It was listed on the Frankfurt Stock Exchange from 2006 until 2023, when US private equity firm Thoma Bravo took it private. EQS Group GmbH continues to operate as an independently managed German entity under that ownership. In December 2024 EQS acquired the Convercent ethics and compliance business from OneTrust, absorbing a large block of enterprise customers in one move.
The product includes AI-assisted transcription of voice reports, translation across more than 80 languages, intelligent case routing and full investigation audit trails, certified to ISO/IEC 27001 and ISAE 3000 Type II by PwC.
Pricing across the three named tiers, Essential, Professional and Enterprise, is quote-only and scaled by employee count, with add-ons for phone reporting and extra channels. For a large multinational that wants one vendor with enterprise scale and a long track record, EQS is the obvious shortlist entry. For a small company its size, quote-only pricing and US private equity owner work against it.
What EQS Group does well
- 14,000+ customer organisations across 80 countries
- AI-assisted transcription and translation across 80+ languages
- ISO/IEC 27001 and ISAE 3000 Type II audited by PwC
- Convercent acquisition adds enterprise depth
Where EQS Group falls short
- Quote-only pricing across all three tiers
- Majority-owned by Thoma Bravo, a US private equity firm, since 2023
- Sized and priced for large organisations
Standout feature. The December 2024 acquisition of Convercent from OneTrust makes it the largest EU-headquartered vendor here by customer count.
Amsterdam, Netherlands
Founded 2004
Quote only, sold through a demo request
None stated
Best for: Enterprises that need the longest track record and widest certification list
SpeakUp, formerly People Intouch, has run whistleblowing programmes since 2004 from Amsterdam, longer than any other vendor in this category, and counts Electrolux, Daimler, IKEA and BMW among its 700-plus customers.
Reports can arrive through a web form that requires no login, an AI-powered voice agent, a phone hotline with local numbers or iOS and Android apps, all landing in one case file. Certification is the thorough part of the offer: ISO 27001, ISO 27701, SOC 2 Type II and ISAE 3000 audited quarterly, and TISAX.
The platform supports the EU Whistleblower Directive alongside GDPR, the German Supply Chain Act, DORA and NIS2. SpeakUp claims a 49 percent average reporter check-back rate, which is a vendor figure rather than an independently audited one.
The company does not publish prices anywhere, so a demo call is the only way to see a number. It also has offices in Bengaluru and New York in addition to Amsterdam, which means some support and development may sit outside the EU. For an organisation that wants the most established vendor with the broadest certification list, that is a reasonable trade.
What SpeakUp does well
- Operating since 2004, the longest-running vendor in this category
- Web form, AI voice agent, phone hotline and mobile apps in one case file
- ISO 27001, ISO 27701, SOC 2 Type II and TISAX
- 700+ customers including Electrolux, Daimler, IKEA and BMW
Where SpeakUp falls short
- No published pricing; budgeting needs a demo call
- The 49 percent check-back rate is a vendor figure
- Offices in Bengaluru and New York mean some work sits outside the EU
Standout feature. Multi-channel intake unified in one case file, with more than 20 years of operating history behind it.
Brno, Czech Republic
Founded 2017
Modular: a platform fee plus selected capabilities, priced by headcount; no published tier prices; annual billing saves up to 30 percent
None stated
Best for: Global, multilingual or non-desk workforces
FaceUp started as a reporting tool for schools before expanding into corporate whistleblowing, and that dual customer base shows in its reach: 113 supported languages, a mobile app for reporters and customers in more than 70 countries.
Reporting channels include web forms, voice messages and QR codes, which suit organisations with a large, dispersed or non-desk workforce. The company is FaceUp Technology s.r.o. in Brno, founded in 2017. Rather than fixed tiers, a buyer assembles a platform fee plus the specific capabilities needed, priced by headcount, and annual billing can save up to 30 percent compared with paying monthly.
That avoids paying for features a smaller organisation will not use, but it also means no number appears anywhere on FaceUp’s public pricing page. For an organisation with a genuinely global workforce, the 113-language coverage is hard to match in this list.
For a buyer who wants to see a price before a sales conversation, the modular model is a step back from Whistlelink, Vispato or Hintbox. The product is GDPR-compliant and ISO 27001 certified, and its school origins mean case-management depth is newer on the corporate side.
What FaceUp does well
- 113 supported languages, the broadest language coverage in the list
- Web, voice message and QR code reporting for non-desk workforces
- Modular pricing avoids paying for unused capabilities
- GDPR-compliant and ISO 27001 certified
Where FaceUp falls short
- No published pricing anywhere
- School origins mean corporate case-management depth is newer
- Annual billing is required for the quoted discount
Standout feature. 113 supported languages and multi-channel intake including QR codes, built for large, dispersed workforces.
Milan, Italy (also Barcelona and Paris)
Starter EUR 19, Professional EUR 39, Voice EUR 49 and Enterprise EUR 119 a month, all published
No free tier; 30-day money-back guarantee on every plan
Best for: Small companies that want the lowest published price for the legal minimum
TrueSpeak, run by Milan-based True Solutions S.r.l. with additional offices in Barcelona and Paris, publishes the lowest entry price in this category: Starter at EUR 19 a month for basic anonymous reporting.
Professional steps up to EUR 39 a month for full EU compliance features, Voice adds voice reporting and two-factor authentication at EUR 49, and Enterprise reaches EUR 119 with broader configuration and multi-language support. All four tiers carry a 30-day money-back guarantee, and the company reports serving more than 1,000 European clients with a 4.8 out of 5 Trustpilot rating.
The vendor states that it meets EU Directive 2019/1937 and lists ISO 37301 for compliance management systems and ISO 14001 for environmental management. The structure means the cheapest plan covers only the legal minimum, while features that make a programme usable, voice intake and stronger authentication, sit two tiers up.
For a small company that wants the lowest possible cost to meet its obligation, Starter is the cheapest entry point in this ranking. For anything beyond the minimum, compare the EUR 49 and EUR 119 tiers, not the headline price. No founding date is published. Its Barcelona and Paris offices alongside Milan suit a company operating across those three markets.
What TrueSpeak does well
- Lowest published entry price in this category at EUR 19 a month
- Four clearly published tiers with no quote required
- 30-day money-back guarantee on every plan
- 1,000+ European clients and a 4.8/5 Trustpilot rating, per the vendor
Where TrueSpeak falls short
- Starter covers only basic anonymous reports
- Voice reporting and two-factor authentication need the EUR 49 tier
- No founding date or company history on the vendor’s site
Standout feature. Four published tiers from EUR 19 to EUR 119 a month with a 30-day money-back guarantee on each.
Frankfurt, Germany
Founded 2019
Not published by the vendor; quote only
None stated
Best for: German SMEs that must name sovereign German hosting to a works council
LegalTegrity is built for small and mid-sized German companies working through their EU Whistleblower Directive obligation for the first time. Founded in Frankfurt in 2019 and developed together with compliance lawyer Dr.
Thomas Altenbach, it hosts the entire system on Deutsche Telekom’s Open Telekom Cloud, with data centres named specifically as Magdeburg and Biere rather than a generic EU region. That named, German hosting is the clearest differentiator against larger competitors that describe their infrastructure only as EU-based. For an SME that must point to Deutsche Telekom and two German data centres in an audit or a works-council conversation, that specificity carries real weight in the procurement file.
The trade-off is transparency elsewhere. LegalTegrity publishes no pricing anywhere on its site: there is no tier table, flat rate or employee band to compare, only a request-a-quote path.
No independent security certification such as ISO 27001 or SOC 2 is publicly listed, and as a small vendor it has less case-management depth than EQS Integrity Line or SpeakUp. Against Hintbox, which also hosts in Germany and publishes a price, the missing number is the more obvious gap, while the Deutsche Telekom cloud naming is the more specific hosting claim.
What LegalTegrity does well
- Hosted on Deutsche Telekom’s Open Telekom Cloud with two named German data centres
- Built specifically for SMEs working through a first Directive rollout
- Developed with a named compliance lawyer, Dr. Thomas Altenbach
Where LegalTegrity falls short
- No pricing published anywhere, not even a starting figure
- No independent security certification publicly listed
- Less case-management depth than EQS Integrity Line or SpeakUp
Standout feature. Named, sovereign hosting on Deutsche Telekom’s Open Telekom Cloud in two German data centres rather than a generic EU claim.
Koblenz, Germany
From EUR 99 a month (EUR 1,188 billed yearly) excluding VAT, with unlimited users; the price page lists size bands from 1-49 to 250+ employees; onboarding EUR 390 one-off, training EUR 199 an hour; phone and email intake bookable as options
14-day free trial or a guided demo
Best for: German companies wanting a published price and a named data centre
Hintbox is operated by lawcode GmbH of Koblenz, registered at Amtsgericht Koblenz under HRB 28116, and is now part of the vendor’s lawcode Suite alongside modules for supply chain due diligence, CSRD and a policy manager.
It publishes a price: EUR 99 a month, EUR 1,188 billed yearly, excluding VAT, with unlimited users. The price page lists size bands from 1 to 49 up to 250 and above, and onboarding is a one-off EUR 390. There is a 14-day free trial. Support and regular updates are stated as included in the price.
The vendor states an information security management system implemented to ISO 27001, hosting in an ISO/IEC 27001 certified German data centre with no hosting or data transfer outside the EU, regular external penetration tests and end-to-end encryption.
Each customer gets a separate Hintbox instance, and 99.9 percent annual availability is stated. It supports 30 languages with AI translation of reports, automated deadline management, a two-way anonymous channel, configurable no-code forms and a multi-client structure for ombudspersons. Phone and email intake are optional add-ons. It lists no independent audit report of its own on the pages we read.
What Hintbox does well
- Published price from EUR 99 a month with unlimited users
- Named German ISO 27001 certified data centre, no transfer outside the EU
- End-to-end encryption and a separate instance for each customer
- 14-day free trial and 30 languages with AI translation
- Multi-client structure for ombudspersons and groups
Where Hintbox falls short
- Phone and email intake are optional paid extras
- Onboarding and training are charged separately
- ISO 27001 is stated for the ISMS and data centre, so ask for the certificate scope
- Now sold inside a wider suite, so product focus is shared
Standout feature. A published price, unlimited users and a named German data centre in one offer, aimed squarely at HinSchG compliance.
Milan, Italy
Founded 2011
Free under AGPLv3; costs are a technical team to install and run it, or a service provider offering it as a hosted service
Online demo and a free self-hosted install
Best for: Organisations with technical staff wanting open source and full control
GlobaLeaks is free, open-source whistleblowing software licensed under AGPLv3, developed since 2011 as a community project. The data controller named in its privacy policy is Whistleblowing Solutions Impresa Sociale S.r.l. in Milan.
It says it has been adopted by more than 30,000 organisations, from independent media and public agencies to corporations, and is translated into more than 70 languages. Security is the focus. The project documents encryption of reports and recipient communications, Tor integration, two-factor authentication, PGP-encrypted email notifications and sandboxing, and it has published independent audits by iSecPartners, Cure53, LeastAuthority, Subgraph, Radically Open Security and ISGroup.
It states compliance with ISO 37002 and EU Directive 2019/1937 and design in adherence to ISO/IEC 27001:2022. The catch is operational. There is no central vendor cloud, no price list and no sales team: a technical team or a service provider installs, patches and runs it, and the investigation procedure is yours to define.
Costs show up in staff time rather than licences. For regulated companies without IT capacity, a managed SaaS portal is the safer purchase. For a company with an IT team and strong privacy requirements it is a serious option; for one without, a managed portal such as Hintbox or Whistlelink is the lower-risk route.
What GlobaLeaks does well
- Free and open source under AGPLv3, with public code and continuous peer review
- Six independent security audits published in full
- Full encryption of reports, Tor integration and two-factor authentication
- More than 70 languages and a self-service demo
Where GlobaLeaks falls short
- You run the infrastructure yourself or pay a service provider
- No vendor-run SLA, support desk or bundled case procedure
- Procurement checklists often expect a vendor SLA and signed processing agreement, which only a service provider can supply
- Funding history leans on grants, which matters for long-term roadmap planning
Standout feature. The only open-source whistleblowing platform in this list, with every independent security audit report published in full.
Sunderland and London, United Kingdom
Founded 1999
Not published; enquiry form and sales call
None stated
Best for: Organisations that want an independent third party to answer the call
Safecall Limited, incorporated in England in May 1999 under company number 03769031, is a UK whistleblowing service provider that bundles hotlines, online reporting, case management software, investigations and training. It is a wholly owned subsidiary of The Law Debenture Corporation p.l.c.
It says it covers more than 5 million employees in over 1,000 organisations, with handling in more than 170 languages and dialects across 150 countries. Its distinguishing feature is staffing: calls are taken 24 hours a day, 365 days a year by call handlers who are former UK police officers, each with decades of witness-interview experience.
An independent third party between the reporter and the employer is the case for it, and it also offers outsourced and client-managed investigations, custom whistleblowing form building and EU Whistleblowing Directive guidance.
It is a managed service, not a self-serve SaaS tool, so it is not a like-for-like swap for Whistleblower Software or Hintbox. No price is published and sales run through an enquiry form. The vendor states UK-based data centres and ISO 27001 certification; it is outside the EU but inside this directory’s UK scope, and it lists offices in Dublin, Hong Kong and the United States as well as the UK.
What Safecall does well
- 24/7 telephone hotline staffed by experienced former police officer call handlers
- Hotline, online reporting, case management and investigations from one provider
- Wholly owned by a UK-listed group with no US parent
- Handling in 170+ languages and dialects
Where Safecall falls short
- No published pricing; sales run through an enquiry form
- Managed service model is not a like-for-like swap for a self-serve portal
- UK entity rather than EU, with offices in Hong Kong and the United States
- Hosting is stated as UK data centres, so the EU-to-UK transfer needs assessing
Standout feature. A staffed, independent 24/7 hotline combined with case management software and investigation support from the same provider.
