GlobaLeaks
Open-source whistleblowing software from Milan with published security audits and 70+ languages
Quick Overview
| Company | Whistleblowing Solutions Impresa Sociale S.r.l. |
|---|---|
| Category | Whistleblowing Software |
| Headquarters | Milan, Italy |
| Founded | 2011 |
| EU Presence | EU (Italy) |
| Data Location | Wherever you run it; there is no central vendor cloud for the open-source software |
| Open Source | Yes |
| Compliance | Stated as compliant with ISO 37002 and EU Directive 2019/1937 and designed in adherence to ISO/IEC 27001:2022; six independent security audits published in full |
| Pricing | Free under AGPLv3; costs are a technical team to install and run it, or a service provider offering it as a hosted service |
| Free Option | Online demo and a free self-hosted install |
| Replaces | NAVEX EthicsPoint, Convercent, Case IQ |
Detailed Review
GlobaLeaks is free, open-source whistleblowing software licensed under AGPLv3, developed since 2011 as a community project. The data controller named in its privacy policy is Whistleblowing Solutions Impresa Sociale S.r.l. in Milan.
It says it has been adopted by more than 30,000 organisations, from independent media and public agencies to corporations, and is translated into more than 70 languages. Security is the focus. The project documents encryption of reports and recipient communications, Tor integration, two-factor authentication, PGP-encrypted email notifications and sandboxing, and it has published independent audits by iSecPartners, Cure53, LeastAuthority, Subgraph, Radically Open Security and ISGroup.
It states compliance with ISO 37002 and EU Directive 2019/1937 and design in adherence to ISO/IEC 27001:2022. The catch is operational. There is no central vendor cloud, no price list and no sales team: a technical team or a service provider installs, patches and runs it, and the investigation procedure is yours to define.
Costs show up in staff time rather than licences. For regulated companies without IT capacity, a managed SaaS portal is the safer purchase. For a company with an IT team and strong privacy requirements it is a serious option; for one without, a managed portal such as Hintbox or Whistlelink is the lower-risk route.
What GlobaLeaks does well
- Free and open source under AGPLv3, with public code and continuous peer review
- Six independent security audits published in full
- Full encryption of reports, Tor integration and two-factor authentication
- More than 70 languages and a self-service demo
Where GlobaLeaks falls short
- You run the infrastructure yourself or pay a service provider
- No vendor-run SLA, support desk or bundled case procedure
- Procurement checklists often expect a vendor SLA and signed processing agreement, which only a service provider can supply
- Funding history leans on grants, which matters for long-term roadmap planning
Standout feature. The only open-source whistleblowing platform in this list, with every independent security audit report published in full.
Pros and Cons
Pros
- Free and open source under AGPLv3, with public code and continuous peer review
- Six independent security audits published in full
- Full encryption of reports, Tor integration and two-factor authentication
- More than 70 languages and a self-service demo
Cons
- You run the infrastructure yourself or pay a service provider
- No vendor-run SLA, support desk or bundled case procedure
- Procurement checklists often expect a vendor SLA and signed processing agreement, which only a service provider can supply
- Funding history leans on grants, which matters for long-term roadmap planning
Alternatives to GlobaLeaks
Frequently Asked Questions
What is GlobaLeaks?
GlobaLeaks is free, open-source whistleblowing software licensed under AGPLv3, developed since 2011 as a community project. The data controller named in its privacy policy is Whistleblowing Solutions Impresa Sociale S.r.l. in Milan.
It says it has been adopted by more than 30,000 organisations, from independent media and public agencies to corporations, and is translated into more than 70 languages. Security is the focus. The project documents encryption of reports and recipient communications, Tor integration, two-factor authentication, PGP-encrypted email notifications and sandboxing, and it has published independent audits by iSecPartners, Cure53, LeastAuthority, Subgraph, Radically Open Security and ISGroup.
Where is GlobaLeaks based?
GlobaLeaks operates from Milan, Italy, which places it under EU (Italy). Compliance: Stated as compliant with ISO 37002 and EU Directive 2019/1937 and designed in adherence to ISO/IEC 27001:2022; six independent security audits published in full.
What does GlobaLeaks cost?
Free under AGPLv3; costs are a technical team to install and run it, or a service provider offering it as a hosted service. Online demo and a free self-hosted install.
Who is GlobaLeaks best for?
Organisations with technical staff wanting open source and full control. The only open-source whistleblowing platform in this list, with every independent security audit report published in full.
What are the drawbacks of GlobaLeaks?
You run the infrastructure yourself or pay a service provider. No vendor-run SLA, support desk or bundled case procedure. Procurement checklists often expect a vendor SLA and signed processing agreement, which only a service provider can supply. Funding history leans on grants, which matters for long-term roadmap planning.
Is GlobaLeaks a good alternative to NAVEX EthicsPoint?
GlobaLeaks is built as a European alternative to NAVEX EthicsPoint: Open-source whistleblowing software from Milan with published security audits and 70+ languages. It will not be a like-for-like feature match in every respect, so check the review above for where the two genuinely differ before switching.
How does GlobaLeaks compare to other Whistleblowing Software?
GlobaLeaks is one of several European Whistleblowing Software we cover. It is most often compared with NAVEX EthicsPoint, Convercent, Case IQ.