Buyer comparison
How to compare EU whistleblowing platforms — and how Whistlechannel measures up
Whistlechannel supports receiving and following up whistleblower reports. The organisation remains responsible for independent case handling, information, procedures and applicable legal duties.
| What to require | Whistlechannel |
|---|---|
EU data residency Which providers receive which data? | GDPR permits transfers outside the EU/EEA with an appropriate legal basis and transfer mechanism. EU hosting is an operational choice, not a universal legal requirement. The subprocessor list distinguishes providers and data types; billing data is handled separately. |
Genuine anonymity What can identify a reporter? | Confidentiality and anonymity differ. The EU directive protects identity; national law determines duties to accept anonymous reports. A voice, attachments and report details can identify a reporter. |
Encryption Who can access the decryption keys? | TLS protects data in transit. Sensitive report fields and private attachments use server-side AES-256-GCM encryption. The application decrypts for authorised users and server-side analysis; operators with access to the service and its keys can also decrypt. |
Security standards Which certificate can the supplier show? | We hold no ISO 27001 certification or SOC 2 attestation. We make no blanket guarantee of NIS 2 or AI Act compliance. |
Pricing transparency Do price and delivered service match? | Published pricing from 199 SEK / month. No setup fee, no minimum term. |
Comparison questions
Does my company need a whistleblower channel?
National law determines which organisations need an internal reporting channel. The EU directive generally covers private entities with 50 or more workers, with sector-specific rules and public-sector provisions. Check the applicable national law and implementation dates.
How is anonymity guaranteed?
Confidentiality and anonymity differ. The EU directive protects identity; national law determines duties to accept anonymous reports. A voice, attachments and report details can identify a reporter.
Where is data stored?
GDPR permits transfers outside the EU/EEA with an appropriate legal basis and transfer mechanism. EU hosting is an operational choice, not a universal legal requirement. The subprocessor list distinguishes providers and data types; billing data is handled separately.