Edition I, 2026 · Tested September 2026

Whistleblowing software in Germany — scored ranking

Independent scored ranking of whistleblower-reporting tools for Germany under the Hinweisgeberschutzgesetz (HinSchG), the local transposition of EU Directive 2019/1937. 25-criterion rubric fixed before scoring; every score carries evidence.

Of the 32 platforms scored against HinSchG, EthicsPortal ranks first with 53 of 56 points, ahead of Confidly at 48.

Platforms covering it: 36
Sold only here: 17
EU data centre: 28
Self-serve sign-up: 19
Scored against the rubric: 32

The law a channel in Germany has to satisfy

Germany transposes EU Directive 2019/1937 through HinSchG. A platform has to satisfy the national text, not only the Directive, so check obligations against the statute rather than against a vendor's compliance claim.

Germany is the most crowded whistleblowing software market in the EU — 32 scored platforms here against 12 in Italy and 7 in the Netherlands — and the crowding is what makes the ranking useful. When three dozen vendors all claim HinSchG compliance, the separation comes from what each one actually discloses.

Two details of the German regime drive the scoring. The act requires written and oral intake with an in-person meeting on request, so a web form alone is not a complete channel. And the 50–249 band may operate a joint internal reporting office, which makes multi-entity and shared-office handling a real product requirement rather than an enterprise nicety.

This edition uses two layers:

the 50-point base rubric, which stays country-agnostic and scores the product itself: legal workflow depth, reporter experience, handler workflow, security posture, and commercial clarity;
the 6-point Germany modifier, which rewards an explicit HinSchG reference, a named hosting country or EU provider, and a genuine German-language surface.

The modifier exposes a pattern worth naming: several German-domiciled vendors anchor their compliance copy on the Supply Chain Act (LkSG) or the Geldwäschegesetz rather than the HinSchG. That is a different obligation with a different scope, and it scores zero on the law criterion — not because the product is weak, but because the buyer researching a HinSchG channel is not being answered.

TOP 32 — summary

#	Tool	Tier	Base / 50	Germany bonus / 6	Total	Last reviewed
1	EthicsPortal	P+R+H	47	6	53	2026-06-21
2	Confidly	P	42	6	48	2026-07-19
3	Whistlelink	P+H	39	5	44	2026-05-24
4	OpenSource Hinweisgeberportal	P	33	6	39	2026-07-19
5	Hintbox	P	32	6	38	2026-05-24
6	IntegrityLog	P	33	5	38	2026-05-24
7	Whistleblower Software (Formalize)	P	32	6	38	2026-09-21
8	whistle.law	P	31	5	36	2026-05-24
9	whistly	P	29	6	35	2026-07-19
10	hinweis.de	P	28	6	34	2026-07-19
11	Legality Whistleblowing (DigitalPA)	P	29	5	34	2026-05-24
12	tell it	P	28	6	34	2026-07-19
13	Whispli	P	31	3	34	2026-05-24
14	WhistlePort	P	27	6	33	2026-07-19
15	EQS Integrity Line	P	27	5	32	2026-05-24
16	whizzla	P	28	4	32	2026-07-19
17	hintcatcher	P	25	6	31	2026-05-24
18	Zateo	P	25	6	31	2026-07-19
19	Cortina Compliance Hub	P	24	6	30	2026-05-24
20	FaceUp	P	26	4	30	2026-05-24
21	LegalTegrity	P	24	6	30	2026-05-24
22	NAVEX	P	27	3	30	2026-05-24
23	whistlebox	P	24	6	30	2026-07-19
24	Hintbird	P	24	4	28	2026-07-19
25	SpeakUp	P	26	2	28	2026-05-24
26	CLUE#ZO	P	22	5	27	2026-07-19
27	preeco	P	20	6	26	2026-05-24
28	otris	P	20	4	24	2026-05-24
29	WhistleFox	P	18	4	22	2026-07-19
30	PRIMA Compliance	P	15	6	21	2026-07-19
31	Fraud Line	P	16	3	19	2026-05-24
32	osapiens	P	15	4	19	2026-05-24

Criterion-by-criterion matrix

● fully meets ◐ partially meets ○ does not meet / not verifiable

Criterion	EthicsPortal	Confidly	Whistlelink	OpenSource Hinweisgeberportal	Hintbox	IntegrityLog	Whistleblower Software (Formalize)	whistle.law	whistly	hinweis.de	Legality Whistleblowing (DigitalPA)	tell it	Whispli	WhistlePort	EQS Integrity Line	whizzla	hintcatcher	Zateo	Cortina Compliance Hub	FaceUp	LegalTegrity	NAVEX	whistlebox	Hintbird	SpeakUp	CLUE#ZO	preeco	otris	WhistleFox	PRIMA Compliance	Fraud Line	osapiens
Legal compliance · 16 pts max
A1 Local transposition law referenced with article numbers	●	◐	◐	●	◐	◐	◐	◐	◐	●	◐	◐	◐	◐	◐	○	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐
A2 Directive 2019/1937 Article 2(1) categories in intake	●	◐	◐	◐	◐	◐	○	◐	◐	◐	◐	◐	◐	◐	○	◐	○	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	○	◐	○	○	◐
A3 Anonymous reporting default-on or equal-status	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●
A4 7-day acknowledgment + 3-month feedback deadline tracking	●	●	●	●	◐	●	◐	◐	◐	◐	◐	◐	◐	◐	◐	●	◐	○	◐	○	○	◐	◐	◐	◐	○	○	○	◐	○	○	○
A5 Configurable retention with automatic deletion	●	◐	●	●	○	●	◐	○	○	○	○	○	◐	○	○	◐	○	○	○	○	○	◐	○	○	○	○	○	○	○	○	○	○
A6 Report register / log	●	◐	◐	◐	◐	●	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	●	◐	◐	◐	◐	◐	◐	●
A7 Append-only handler audit trail	●	●	◐	◐	◐	○	◐	◐	○	◐	◐	○	◐	○	○	○	◐	○	◐	◐	○	◐	○	○	●	○	○	◐	○	○	○	◐
A8 DPA + DPIA support documented	●	●	◐	◐	◐	●	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	○	◐	◐	◐	◐	◐	◐	○
Reporter experience · 10 pts max
B9 Web form, mobile-responsive, with file upload	●	●	●	◐	●	●	●	●	●	●	●	●	●	◐	●	◐	●	◐	●	●	●	◐	◐	●	●	◐	●	●	◐	◐	◐	◐
B10 Two-factor reporter access (Case ID + passcode)	●	●	○	◐	○	○	○	○	○	○	○	◐	●	○	○	●	○	◐	○	○	○	○	◐	○	○	○	○	○	○	○	○	○
B11 Two-way anonymous communication	●	●	●	●	●	●	●	◐	●	●	●	●	●	●	●	●	●	◐	◐	●	●	◐	●	●	●	●	◐	◐	◐	◐	●	◐
B12 Structured intake aligned to Article 2(1)	●	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	○	◐	○	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	○	◐	○	○	◐
B13 Reporter form in local language	○	●	○	●	●	●	●	●	●	●	●	●	●	●	●	●	○	●	○	●	●	●	●	○	●	●	●	○	●	◐	○	○
Handler experience · 10 pts max
C14 Case management dashboard with status workflow	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	●	◐	●	◐	●
C15 Assign cases to handlers (rotation or multi-handler)	●	●	●	◐	◐	◐	●	○	◐	◐	◐	◐	●	●	○	◐	○	●	○	◐	○	◐	○	◐	◐	◐	○	○	○	○	◐	◐
C16 Deadline reminder notifications	●	●	◐	◐	◐	●	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	○	◐	○	○	◐	◐	◐	○	○	○	○	◐	○	○	○
C17 Internal notes (not visible to reporter)	●	●	●	◐	◐	○	◐	◐	◐	◐	◐	◐	◐	◐	◐	○	◐	◐	◐	◐	◐	◐	○	◐	◐	◐	◐	◐	○	○	○	○
C18 Role-based access control (≥3 roles)	●	●	●	◐	◐	●	◐	◐	○	◐	◐	○	◐	◐	◐	○	◐	◐	◐	◐	◐	○	○	◐	◐	○	◐	◐	○	○	○	◐
Security and trust · 8 pts max
D19 ISO 27001 certified	○	○	●	○	●	●	●	●	○	○	●	○	●	○	●	○	○	○	●	●	●	●	○	○	●	○	○	●	○	○	●	○
D20 No EOL software components	●	◐	●	◐	◐	●	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	◐	●	◐
D21 EU data residency with country disclosed	●	●	●	●	●	●	●	●	●	●	◐	●	◐	●	◐	●	●	●	◐	◐	●	◐	●	○	○	◐	●	◐	●	●	◐	○
D22 Sub-processor list + right to object	●	●	●	◐	◐	◐	◐	●	◐	◐	●	○	●	◐	●	◐	◐	◐	○	●	◐	◐	◐	◐	○	○	◐	○	◐	◐	○	○
Commercial · 6 pts max
E23 Published pricing	●	●	●	●	◐	○	●	◐	●	●	◐	◐	○	●	◐	●	◐	◐	◐	○	◐	◐	◐	●	●	●	○	◐	○	◐	○	○
E24 Free trial available (self-serve)	◐	●	●	○	●	○	●	●	●	○	○	●	○	◐	◐	○	●	●	○	◐	○	○	●	○	○	○	○	○	○	○	○	○
E25 Monthly contract option	●	●	○	●	●	○	○	●	●	○	◐	●	○	○	●	●	●	○	●	○	○	●	○	●	○	●	○	●	○	○	○	○
Germany bonus · 6 pts max · modifier, not in base
DE·LAW HinSchG referenced	●	●	●	●	●	●	●	●	●	●	●	●	◐	●	●	○	●	●	●	●	●	○	●	●	○	●	●	●	○	●	○	●
DE·RESIDENCY Germany or named EU residency	●	●	◐	●	●	◐	●	●	●	●	◐	●	◐	●	◐	●	●	●	●	◐	●	◐	●	○	○	◐	●	◐	●	●	◐	○
DE·UI German-language UI	●	●	●	●	●	●	●	◐	●	●	●	●	◐	●	●	●	●	●	●	◐	●	●	●	●	●	●	●	◐	●	●	●	●
Total	53	48	44	39	38	38	38	36	35	34	34	34	34	33	32	32	31	31	30	30	30	30	30	28	28	27	26	24	22	21	19	19

Per-tool reviews

EthicsPortal

Poland · Whistleblowing channel hosted on Hetzner in Germany. Flat €60/month plan, with a published DORA evidence set.

53 / 56

Base 47 · Bonus 6 · Tier P+R+H

Legal

16/16

Reporter

0/10

Handler

10/10

Security

6/8

Commercial

5/6

Strengths

Article-level legal framing: /compliance/ enumerates Directive 2019/1937 Articles 4, 6, 8, 9, 16, 18, 19–21 and links to a dedicated page for each of the 27 EU transpositions
All 27 EU national whistleblower laws are named on public /whistleblower-laws/<country>/ pages with official source citations
Oral reporting (Art 9(2)(b)) is built into the portal as in-browser voice recording and is privacy-engineered: the raw audio is automatically pitch-shifted, only the anonymized clip is ever served, and the original recording is purged after processing (fail-closed — nothing is exposed to handlers until anonymization succeeds)
Report categories are tagged to specific Directive Art 2(1) Union-law domains, with the article reference shown as a handler-side badge while reporters pick plain-language categories
Structured intake: five optional, Directive-aligned questions (relationship to org per Art 4, source of knowledge, incident timing, prior reporting, retaliation concern per Art 19) presented as a skippable guided step, surfaced to handlers and the PDF export with retaliation flagged as an urgency badge — a built-in default set where most tools leave these to per-org custom-field configuration
Three role tiers (member / admin / viewer): viewer is a read-only seat for auditors and external counsel that sees every report plus the full audit trail without any write or management path
GDPR Art 20 portability: admins can export the full organization dataset (reports, messages, attachments, with encrypted fields decrypted for portability) as a ZIP; export and download are audit-logged and the ZIP auto-purges after 7 days
Real deadline tracking: 7-day acknowledgement and 3-month feedback deadlines with overdue/due-soon tracking and a lifecycle stepper in both reporter and handler views
Configurable retention (12/24/36/48/60 months) with automatic purge of expired closed reports; open reports left inactive for 18 months auto-close so the retention clock starts (GDPR Art 5(1)(e) storage limitation), closing the open-forever gap
Two-factor reporter access: case reference (WB-XXXX-XXXX) plus a reporter-chosen 6-digit passcode, session-gated inbox. Reporters can also download a PDF copy of their own report from the follow-up portal (audit-logged)
Audit log surfaced to handlers on each report; append-only at the database level
Modern stack with no end-of-life liabilities
Transparent monthly pricing (€60/mo) with 14 live product locales (13 EU official languages — bg, de, el, en, es, fr, hr, it, nl, pl, pt, ro, sl — plus Luxembourgish)
Multi-handler case assignment: each report can be assigned to a handler, admins see all reports and members see only assigned, assignment changes are audit-logged, and deactivated members are auto-unassigned from open reports
Handler-set case priority (low / normal / high / urgent) recorded at assessment as an audit-logged change and surfaced as a badge on the report list, plus a priority breakdown in the exportable compliance report
SCIM 2.0 provisioning so an identity provider (Okta, Microsoft Entra ID) can provision case handlers and — the core value — auto-deprovision them the moment someone leaves the directory; admins generate, rotate, and enable/disable a per-organization token and pick the default role
SAML 2.0 single sign-on so staff authenticate through the organization's identity provider (Okta, Microsoft Entra ID); configured per organization, covers one or more email domains, with optional enforcement (require SSO for those domains) and optional just-in-time account provisioning on first sign-in — the authentication half of the SSO + SCIM enterprise-identity pair
Published ISO 37002:2021 guidance-alignment map (/iso-37002/) walking the standard's operating clauses against shipped features, alongside the ISO 27001 Annex A self-assessment
Published DPA grants the Controller an explicit right to object to subprocessor changes (§6.4, 30-day notice + termination remedy) and commits to 72-hour breach notification (§6.6); /trust/ publishes contracting party, backups, RTO/RPO, and session lifecycle
DORA evidence set published for financial-entity buyers: /dora/ lists Article 30(2) and 30(3) provisions with status and location, supplies the register-of-information fields under Implementing Regulation (EU) 2024/2956 including the S19 (Cloud services: SaaS) classification, names the ICT service supply chain, and links a signable contractual addendum at /dora-addendum/
Zero-AI commitment codified contractually: DPA §6.10 prohibits transmission of personal data to any LLM or AI inference provider; /subprocessors/ lists no AI sub-processor

Weaknesses

Audit log is append-only but not hash-chained
Only 14 portal-facing languages (13 EU official languages + Luxembourgish) against 24 EU official languages
No ISO 27001 certification of EthicsPortal itself (only Hetzner infrastructure is certified)
Pay-first with 30-day money-back rather than an upfront self-serve free trial
Role tiers are org-scoped, not per-case ACLs: the viewer role adds the auditor seat, but a handler's report visibility is still governed by assignment/participant scoping rather than a per-case permission model

Standout

Article-level Directive framing paired with a 27-page country-law reference and privacy-engineered oral reporting, all surfaced in the live product alongside working deadline, retention, two-factor passcode, audit-log, voice-anonymization, and subprocessor-notification flows.

Full profile Visit EthicsPortal

Confidly

Tallinn, Estonia · EU-built anonymous whistleblowing channel from Confidly OU (Estonia), self-serve from EUR 39/month, EU-hosted with AI-assisted investigation.

48 / 56

Base 42 · Bonus 6 · Tier P

Legal

12/16

Reporter

9/10

Handler

10/10

Security

5/8

Commercial

6/6

Full profile Visit Confidly

Whistlelink

Sweden · Swedish whistleblowing platform with Romanian-language pages, public Romanian pricing, and Romania-law positioning.

44 / 56

Base 39 · Bonus 5 · Tier P+H

Legal

11/16

Reporter

0/10

Handler

9/10

Security

8/8

Commercial

4/6

Strengths

Hands-on trial confirmed the full compliance toolkit: configurable retention, configurable case deadline, dashboard tiles for near-deadline and to-be-deleted cases, an action log, rule-based auto-assignment, and a five-role RBAC grid with org-wide 2FA enforcement
Sub-processor transparency goes past marketing: the in-app consent text explicitly names DeepL (Germany) for auto-translation and Mistral (France) for AI case summaries, and both AI features are opt-in rather than default-on
Romania public materials remain substantial: Romanian-language product/pricing pages, Law 361/2022 positioning, Romania case-study content, and local territory-manager contact details

Weaknesses

Annual subscription only; no monthly cancellation option
Action log captures user, timestamp, and before-after values but is not claimed as append-only or hash-chained
Legal surface still stops short of article-by-article Law 361/2022 mapping inside the app

Standout

The P+H-tier pass recorded configurable retention, configurable case deadline, rule-based auto-assignment, and opt-in sub-processor disclosure for AI/translation features.

Full profile Visit Whistlelink

OpenSource Hinweisgeberportal

Hamburg, Germany · Managed GlobaLeaks whistleblowing channel operated by splice digital GmbH, hosted in German data centres, with published pricing from EUR 39/month on annual billing.

39 / 56

Base 33 · Bonus 6 · Tier P

Legal

12/16

Reporter

7/10

Handler

6/10

Security

4/8

Commercial

4/6

Full profile Visit OpenSource Hinweisgeberportal

Hintbox

Germany · German whistleblowing platform with flat Basic/Premium pricing from EUR 49/month, 30 languages, AI translation, and ISO 27001 certification.

38 / 56

Base 32 · Bonus 6 · Tier P

Legal

8/16

Reporter

7/10

Handler

6/10

Security

6/8

Commercial

5/6

Full profile Visit Hintbox

IntegrityLog

Sweden · Whistleblowing module inside Euronext Corporate Solutions' ComplyLog compliance suite, with ISO 27001-certified infrastructure positioning.

38 / 56

Base 33 · Bonus 5 · Tier P

Legal

12/16

Reporter

7/10

Handler

7/10

Security

7/8

Commercial

0/6

Strengths

Public product detail covers statuses, reminders, permissions, and communication
2025 ComplyLog factsheet adds GDPR role clarity, EEA storage, ISO/IEC 27001, encryption, access logging, retention, and DPA/sub-processor disclosures
Product page and factsheet support anonymous case handling, written/audio reports, and EU Whistleblowing Directive positioning

Weaknesses

No explicit public Waserman or Sapin II framing found
Pricing is not published publicly
Reporter return-access mechanism and append-only audit guarantees are not fully documented publicly

Standout

IntegrityLog has moved under the Euronext Corporate Solutions surface; the most detailed current evidence comes from the 2025 ComplyLog privacy factsheet rather than a France-law sales page.

Full profile Visit IntegrityLog

Whistleblower Software (Formalize)

Copenhagen, Denmark · Whistleblower Software product from Formalize with public Core and Advanced annual pricing.

38 / 56

Base 32 · Bonus 6 · Tier P

Legal

8/16

Reporter

7/10

Handler

7/10

Security

6/8

Commercial

4/6

Strengths

Each locale of the marketing site names its own transposition law, including Loi Waserman (Sapin II) in French, Law 4990/2022 in Greek, Ley 2/2023 in Spanish and HinSchG in German.
The product page documents two-way anonymous messaging, file upload, voice reporting, automatic case delegation and deadline reminders.
Security page names ISO 27001:2022, ISAE 3000 Type 2, ENS Alta, WCAG 2.1 AA, a June 2024 penetration test, end-to-end encryption and AWS Frankfurt hosting.

Weaknesses

No named sub-processor list, no downloadable DPA and no right-to-object mechanism; the personal data policy states only that sub-processors exist and that some are in third countries.
API access, DPIA support, reporter return-access mechanism and Directive article-level mapping were not disclosed on public pages reviewed.
Retention is a vendor-set 3 years after subscription termination, not per-organisation configurable purge.

Standout

The July review read only the English pages and scored France and Greece at 1 of 8 and 1 of 6 for laws the vendor names on its own French and Greek sites; re-reading the locale sites moved the two country bonuses by 10 points and the base by 5.

Full profile Visit Whistleblower Software (Formalize)

whistle.law

Germany · German HinSchG-focused whistleblowing platform with published EUR 50-150/month pricing and public GDPR/security documentation.

36 / 56

Base 31 · Bonus 5 · Tier P

Legal

8/16

Reporter

6/10

Handler

5/10

Security

7/8

Commercial

5/6

Full profile Visit whistle.law

whistly

Berlin, Germany · Berlin-based whistleblowing channel from whistly digital GmbH, positioned for German HinSchG and supply-chain (LkSG) compliance, from EUR 59 per month regardless of headcount.

35 / 56

Base 29 · Bonus 6 · Tier P

Legal

7/16

Reporter

7/10

Handler

5/10

Security

4/8

Commercial

6/6

Full profile Visit whistly

#10

hinweis.de

Kiel, Germany · German whistleblowing channel from digitalNORD GmbH in cooperation with KIEL-IT GmbH, citing Section 12 HinSchG, hosted in Germany, with published package pricing from EUR 38/month.

34 / 56

Base 28 · Bonus 6 · Tier P

Legal

9/16

Reporter

7/10

Handler

6/10

Security

4/8

Commercial

2/6

Full profile Visit hinweis.de

#11

Legality Whistleblowing (DigitalPA)

Cagliari, Italy (offices in Milan, Rome, Sulmona, and Barcelona) · Italian whistleblowing platform from DigitalPA. Tiered pricing from €29/month for SMEs.

34 / 56

Base 29 · Bonus 5 · Tier P

Legal

8/16

Reporter

7/10

Handler

6/10

Security

6/8

Commercial

2/6

Full profile Visit Legality Whistleblowing (DigitalPA)

#12

tell it

Hohen Neuendorf, Germany · German whistleblowing channel from Tell IT GmbH with self-signup pricing from EUR 40/month (Essential) and EUR 60/month (Professional), plus a quote-only Enterprise tier.

34 / 56

Base 28 · Bonus 6 · Tier P

Legal

7/16

Reporter

8/10

Handler

5/10

Security

3/8

Commercial

5/6

Full profile Visit tell it

#13

Whispli

Sydney, Australia (Paris office) · Enterprise whistleblowing, disclosure, hotline, and investigation platform operating in 60+ countries.

34 / 56

Base 31 · Bonus 3 · Tier P

Legal

9/16

Reporter

9/10

Handler

7/10

Security

6/8

Commercial

0/6

Strengths

France-specific public content names Loi Waserman and compares it with Sapin 2.
Product pages support 70+ languages, Safe Inbox, web/mobile/email/QR/Voice AI intake, configurable workflows, SLAs, retention, routing, and audit logs.
Security page supports ISO 27001, SOC 2 Type II, customer-managed encryption keys, regional hosting/data residency, API/integrations, 2FA, SSO, and penetration testing.

Weaknesses

Pricing amounts, self-serve trial, exact EU official-language coverage, subprocessor objection mechanics, and article-by-article Directive mapping were not disclosed on public pages reviewed.
The previous /solutions/whistleblower/ and /whispli-pricing/ URLs were not usable current evidence.

Standout

Whispli publishes France-specific legal framing and security architecture for a sales-led enterprise product.

Full profile Visit Whispli

#14

WhistlePort

Berlin, Germany · German whistleblowing channel operated by the law firm VON RUEDEN, with a self-serve platform tier from EUR 69/month and an optional attorney-run case-handling service.

33 / 56

Base 27 · Bonus 6 · Tier P

Legal

7/16

Reporter

6/10

Handler

7/10

Security

4/8

Commercial

3/6

Full profile Visit WhistlePort

#15

EQS Integrity Line

Munich, Germany · Whistleblowing module of the EQS Compliance COCKPIT with Essential, Professional, and Enterprise packages. EQS acquired France's Data Legal Drive (DLD Sapin II) in 2024.

32 / 56

Base 27 · Bonus 5 · Tier P

Legal

6/16

Reporter

6/10

Handler

5/10

Security

6/8

Commercial

4/6

Strengths

Packages page supports 80+ languages, anonymous dialogue, case management, deadline monitoring, telephone reporting on higher tiers, 2FA, and European hosting.
Security page supports ISO 27001, ISAE 3000 Type I/II, WACA Bronze, end-to-end encryption, no tracking, and Munich East data-centre disclosure.
Localized UK page publishes starting prices, so the prior fully quote-only claim was too broad.

Weaknesses

Customer-held PGP/RSA key custody, API access, public DPA, and subprocessor list were not disclosed on public pages reviewed.
France Waserman/Sapin II and Greece Law 4990/2022 were not found on public pages reviewed.

Standout

Integrity Line publishes package details and security/accessibility evidence; the earlier customer-held-key claim was not supported in current vendor pages reviewed.

Full profile Visit EQS Integrity Line

#16

whizzla

Bad Orb, Germany · German cloud whistleblowing channel from lexato GmbH with plug-and-play deployment and published monthly tiers from EUR 49 net.

32 / 56

Base 28 · Bonus 4 · Tier P

Legal

8/16

Reporter

8/10

Handler

4/10

Security

4/8

Commercial

4/6

Full profile Visit whizzla

#17

hintcatcher

Göppingen, Germany · German whistleblowing platform from product kitchen GmbH. Flat pricing from €39/month, independent of headcount.

31 / 56

Base 25 · Bonus 6 · Tier P

Legal

7/16

Reporter

4/10

Handler

5/10

Security

4/8

Commercial

5/6

Full profile Visit hintcatcher

#18

Zateo

Wietzen, Germany · German whistleblowing SaaS from Selfox UG with published tiers from EUR 79/month, anonymous reporting, and Germany-based hosting on an ISO/IEC 27001-certified provider.

31 / 56

Base 25 · Bonus 6 · Tier P

Legal

6/16

Reporter

6/10

Handler

6/10

Security

4/8

Commercial

3/6

Full profile Visit Zateo

#19

Cortina Compliance Hub

Münster, Germany · Modular German compliance platform from Cortina Consult. Whistleblowing (HinSchG) is one of three core modules; from €45/month.

30 / 56

Base 24 · Bonus 6 · Tier P

Legal

8/16

Reporter

4/10

Handler

5/10

Security

4/8

Commercial

3/6

Full profile Visit Cortina Compliance Hub

#20

FaceUp

Czech Republic · Whistleblowing, employee-relations, and workplace-compliance platform from the Czech Republic.

30 / 56

Base 26 · Bonus 4 · Tier P

Legal

7/16

Reporter

7/10

Handler

5/10

Security

6/8

Commercial

1/6

Strengths

Current public pricing page no longer exposes the previously captured EUR/GBP/USD/CZK employee-band amounts in the page output reviewed.
Public feature/pricing pages support 113 languages, anonymous reporting, two-way chat, online form, voice recording, automated/live/AI hotline add-ons, iOS/Android apps, multiple forms, webhooks, API, Zapier, and Make.
Security/DPA pages support ISO 27001:2022, SOC 2, E2EE, no IP storage, metadata removal, SSO, 2FA, penetration testing, selectable AWS regions, subprocessor details, and OpenAI use limited to the AI-powered hotline.

Weaknesses

Pricing amounts were not found on the current public pricing page output reviewed.
Exact EU official-language list, article-by-article Directive mapping, Loi Waserman, Sapin II, and Greece Law 4990/2022 were not disclosed on public pages reviewed.

Standout

FaceUp has public trial, security, DPA, and integration disclosure; the main correction is removing the stale public price matrix.

Full profile Visit FaceUp

#21

LegalTegrity

Frankfurt am Main, Germany · German SME whistleblowing platform. Tiered pricing €49–€165.83/month by employee count.

30 / 56

Base 24 · Bonus 6 · Tier P

Legal

6/16

Reporter

7/10

Handler

4/10

Security

6/8

Commercial

1/6

Full profile Visit LegalTegrity

#22

NAVEX

Lake Oswego, Oregon, United States · EthicsPoint hotline and WhistleB whistleblowing products within the NAVEX One GRC suite.

30 / 56

Base 27 · Bonus 3 · Tier P

Legal

9/16

Reporter

5/10

Handler

5/10

Security

5/8

Commercial

3/6

Strengths

Current whistleblowing page supports web and phone reporting, case tracking, anonymous reporting, AI-powered whistleblowing, and 13,000+/88M+ vendor scale claims.
WhistleB pages support ISO 27001, SOC 2 Type II, EU data storage, customer-controlled encryption, MFA, activity logs, Microsoft Azure hosting, Microsoft Translator localization, and up to 150 languages.
EthicsPoint service-hosting provider page is public and lists hosting, translation, interpretation, analytics, and platform service providers.

Weaknesses

EthicsPoint pricing, trial, API access, DPA, retention configuration, and Directive article-level mapping were not disclosed on public pages reviewed.
The previous Goldman Sachs/Blackstone acquisition completion date and ISO date were not verified on vendor pages reviewed.

Standout

NAVEX publishes WhistleB starting-price and security evidence plus EthicsPoint service-provider disclosure, while EthicsPoint pricing and deeper package evidence remain sales-led.

Full profile Visit NAVEX

#23

whistlebox

Dachau, Germany · German whistleblowing channel from DSM-Online GmbH aimed at the Mittelstand, with public headcount pricing from EUR 69/year and a 14-day self-serve trial.

30 / 56

Base 24 · Bonus 6 · Tier P

Legal

7/16

Reporter

7/10

Handler

3/10

Security

4/8

Commercial

3/6

Full profile Visit whistlebox

#24

Hintbird

Stutensee, Germany · German whistleblowing platform (Hinweisgebersystem) from VELIT Consulting GmbH & Co. KG with published tiers from EUR 49/month for organizations up to 50 employees.

28 / 56

Base 24 · Bonus 4 · Tier P

Legal

7/16

Reporter

5/10

Handler

6/10

Security

2/8

Commercial

4/6

Full profile Visit Hintbird

#25

SpeakUp

Amsterdam, Netherlands · Whistleblowing and ethics platform from People Intouch / SpeakUp (Amsterdam).

28 / 56

Base 26 · Bonus 2 · Tier P

Legal

9/16

Reporter

7/10

Handler

5/10

Security

3/8

Commercial

2/6

Strengths

Web, phone, and app reporting with 99+ reporting languages and large-scale customer claims.
Strong public assurance posture: ISO 27001, ISO 27701, ISAE 3000 Type II / SOC 2 quarterly audit, and TISAX.
Public entry price for Essential up to 1,000 employees.

Weaknesses

EU hosting location, public DPA, subprocessor list, API access, retention automation, and exact local-law mapping were not disclosed on public pages reviewed.
Enterprise and above-1,000-employee pricing remains custom.

Standout

The certification stack is among the strongest reviewed, but procurement and data-residency evidence remains sales-led.

Full profile Visit SpeakUp

#26

CLUE#ZO

Hamburg, Germany · German digital whistleblowing system from CAS Concepts and Solutions AG, delivered on SAP Business Technology Platform with integration to SAP S/4HANA and chatbot-guided report intake.

27 / 56

Base 22 · Bonus 5 · Tier P

Legal

6/16

Reporter

6/10

Handler

4/10

Security

2/8

Commercial

4/6

Full profile Visit CLUE#ZO

#27

preeco

Germany · German HinSchG-focused whistleblower platform with 26 reporting languages and German data hosting.

26 / 56

Base 20 · Bonus 6 · Tier P

Legal

6/16

Reporter

6/10

Handler

4/10

Security

4/8

Commercial

0/6

Full profile Visit preeco

#28

otris

Germany (Dortmund) · German legal-tech suite vendor from Dortmund with public SaaS whistleblower pricing and ISO 27001-certified hosting.

24 / 56

Base 20 · Bonus 4 · Tier P

Legal

6/16

Reporter

3/10

Handler

4/10

Security

4/8

Commercial

3/6

Full profile Visit otris

#29

WhistleFox

Düsseldorf, Germany · Law-firm-operated whistleblowing service from Heuking Kühn Lüer Wojtek, bundling a digital reporting channel with legal case handling by the firm's compliance lawyers.

22 / 56

Base 18 · Bonus 4 · Tier P

Legal

7/16

Reporter

5/10

Handler

2/10

Security

4/8

Commercial

0/6

Full profile Visit WhistleFox

#30

PRIMA Compliance

Niedererbach, Germany · German whistleblowing system operated by law firm Gebrueder Brands & Seehaus GbR, with tiered subscriptions from a self-service cloud plan up to a lawyer ombudsperson service.

21 / 56

Base 15 · Bonus 6 · Tier P

Legal

5/16

Reporter

3/10

Handler

2/10

Security

4/8

Commercial

1/6

Full profile Visit PRIMA Compliance

#31

Fraud Line

Greece (Athens) · Greek whistleblowing-services provider with ISO 27001, ISO 27701, and ISO 37002 certifications, deployed across multiple countries.

19 / 56

Base 16 · Bonus 3 · Tier P

Legal

5/16

Reporter

0/10

Handler

2/10

Security

5/8

Commercial

0/6

Strengths

Dedicated /bg/ commercial surface is live
Anonymous reporting plus an open communication channel are documented publicly
ISO 27001, ISO 27701, and ISO 37002 are claimed publicly
Microsoft Azure hosting in Western Europe is disclosed publicly

Weaknesses

Commercial surface is opaque: no pricing, no self-serve trial, and no monthly contract signal
Bulgaria-specific legal framing is limited; the page references whistleblower laws generically rather than the Bulgarian act itself
Handler workflow disclosure is limited at public-page tier: no explicit status workflow, reminders, or role model are documented

Standout

Fraud Line is presented as a managed software-plus-services operator, so public product evidence is more limited than for self-serve SaaS entries.

Full profile Visit Fraud Line

#32

osapiens

Mannheim, Germany · Complaint-management and whistleblower module of the osapiens HUB ESG/compliance platform.

19 / 56

Base 15 · Bonus 4 · Tier P

Legal

7/16

Reporter

3/10

Handler

4/10

Security

1/8

Commercial

0/6

Strengths

Complaint-management module covers whistleblower complaints and supply-chain grievance mechanisms in one osapiens HUB workflow.
Public copy supports anonymous/pseudonymous or identified reports, automated case management, custom forms/workflows, time-stamped records, and audit readiness.
AI-powered pre-grouping of incoming complaints is disclosed publicly.

Weaknesses

Pricing, hosting location, certifications, DPA, subprocessor list, public API, and reporting-language coverage were not disclosed on public pages reviewed.
Germany-specific whistleblower law posture is weaker than the broader LkSG/CSDDD grievance positioning.

Standout

Best understood as an ESG/supply-chain compliance suite module rather than a standalone whistleblowing-only product.

Full profile Visit osapiens

Methodology

Scoring rubric

25 criteria across 5 categories, weighted by criterion count. Each criterion scores 0, 1, or 2 — rendered as ○ / ◐ / ●. Maximum base score is 50. Germany-specific bonuses add up to 6 on top (modifier, not part of base).

Access tiers

Each tool carries an access tier reflecting what was testable:

P — public pages only (marketing, pricing, security, reporter URL).
P + R — above plus a test report submission.
P + R + H — above plus handler / admin dashboard (via free trial or demo).

Criteria that cannot be verified at the current tier score 0 with the evidence line "Requires handler tier" or "Not documented publicly". Scores depressed by tier, not by product quality, are explicitly flagged on each tool's profile.

Data residency

Every country modifier scores residency the same way:

2 — Data residency in the ranked country itself.
1 — EU or EEA residency is disclosed, but not in the ranked country.
0 — No EU or EEA residency is disclosed.

Integrity guarantees

The rubric was fixed before scoring. No criterion was added mid-test to favour or punish a specific tool.
Every score carries evidence — a URL, a quote, or a file path — visible in each tool's profile.
Tools operated by the publisher are scored by the same rubric. Placement is by score, not by construction.
Each tool carries a Last reviewed date and is re-tested at least annually.
Vendors can dispute a score or submit evidence of a shipped fix using the contact address in the site footer. Any resulting change is dated on the respective tool profile.

Law applied

Hinweisgeberschutzgesetz (HinSchG), in force 2 July 2023 (the Germany transposition of EU Directive 2019/1937). Tools are scored against the Directive first and against the local law's specifics second.

Coverage note

This ranking covers 32 tools with a scoring block published. Additional tools are being added as scoring completes. Unscored tools will appear in the ranking once they have a published scoring block.

Read this market summary in the local language of Germany →

Platforms covering Germany

20 of 36 publish an entry price. The rest require contact with sales before a figure is given.

Whistleblowing software in Germany — scored ranking
Platform	Headquarters	Pricing	How you buy	Data hosting	Security certification
EthicsPortal	Poland	€60/month, or €41.67/month billed annually (€500/year)	Self-serve sign-up	EU	ISO 27001
Ashio	Tallinn, Estonia	€30/month billed monthly, or €23/month billed yearly (€276/year). One plan, all features, unlimited team members, no per-report fee.	Self-serve sign-up	Not disclosed	—
CLUE#ZO	Hamburg, Germany	Basic EUR 99/month (12 reports/year, 3 users); Standard EUR 299/month (50 reports/year, 6 users); Enterprise EUR 1,499/month (unlimited reports, 15 users). Prices are ex-VAT.	Sales contact required	EU	—
Confidly	Tallinn, Estonia	Starter EUR 39/month billed annually (EUR 468/year, up to 100 employees); Pro EUR 124/month billed annually (EUR 1,488/year, 100-500 employees); Enterprise EUR 332/month billed annually (EUR 3,984/year, up to 2,000 employees / 5 channels). Monthly billing also offered; annual billing stated to save roughly 17%.	Self-serve sign-up	EU	—
Cortina Compliance Hub	Münster, Germany	Compliance Hub from €45/month for one core module, including the Hinweisgeberschutz/whistleblowing module. Separate managed services, including external whistleblower officer, are advertised from €125/month.	Sales contact required	EU	ISO 27001
EQS Integrity Line	Munich, Germany	English global package page does not publish prices. UK package page publishes Essential from £85/month and Professional from £170/month; Enterprise on request.	Self-serve sign-up	EU	ISO 27001 plus others
FaceUp	Czech Republic	Not published — pricing page now uses quote/contact-sales CTAs instead of the previously embedded EUR/GBP/USD/CZK matrix.	Sales contact required	EU region selectable	ISO 27001 plus others
flustron	Vienna, Austria	essentials €19.90/month annual or €21.90 monthly. advanced €24.90/month annual or €27.40 monthly. tailored €34.90/month annual or €38.40 monthly.	Self-serve sign-up	Not disclosed	—
Fraud Line	Greece (Athens)	Not published — quote-based.	Sales contact required	EU	ISO 27001 plus others
Hintbird	Stutensee, Germany	Essential EUR 49/month (up to 3 user accounts, up to 50 employees); Advanced EUR 99/month (up to 10 user accounts, up to 250 employees); Enterprise EUR 249/month (up to 50 user accounts, 250+ employees, dedicated tenant). All prices exclude VAT.	Sales contact required	Not disclosed	—
Hintbox	Germany	Basic from EUR 49/month; Premium from EUR 69/month. Annual billing shown as EUR 588 / EUR 828.	Self-serve sign-up	EU	ISO 27001
hintcatcher	Göppingen, Germany	LITE €39, PLUS €59, PREMIUM €99 per month (net of VAT). PARTNER multi-tenant tier quote-based.	Self-serve sign-up	EU	—
hinweis.de	Kiel, Germany	Basis EUR 38/month per mandant (up to 5 users); Plus EUR 98/month per mandant (unlimited users, phone channel and handler training included); Meldestelle S/M/L from EUR 168/month (outsourced reporting office with in-house legal review). Prices exclude VAT.	Sales contact required	EU	—
IntegrityLog	Sweden	Not published publicly; demo-led procurement.	Sales contact required	EU	ISO 27001
Legality Whistleblowing (DigitalPA)	Cagliari, Italy (offices in Milan, Rome, Sulmona, and Barcelona)	Annual billing excluding VAT. Standard: from €29/month for <50 employees; Premium: from €41/month for <50 employees. Medium/Large/Enterprise tiers quote-based.	Sales contact required	EU	ISO 27001 plus others
LegalTegrity	Frankfurt am Main, Germany	Annual billing: Essential €588/year (€49/mo) for <50 employees; Professional 250 €1,188/year (€99/mo) for <250; Professional 1,000 €1,990/year (€165.83/mo) for <1,000; Enterprise on request for 1,000+.	Self-serve sign-up	EU	ISO 27001
OpenSource Hinweisgeberportal	Hamburg, Germany	Company Bundle EUR 49/month or EUR 39/month annual (EUR 0 setup); Professional Bundle EUR 209/month or EUR 169/month annual (EUR 249 setup); Enterprise from EUR 249/month or EUR 199/month annual (from EUR 349 setup, dedicated hardware). All prices exclude VAT.	Sales contact required	EU	—
osapiens	Mannheim, Germany	Not published — demo required.	Sales contact required	Not disclosed	—
otris	Germany (Dortmund)	Standard from EUR 299/month for 50-249 employees; Enterprise from EUR 499/month for 250-999 employees; Enterprise plus quote-based for 1,000+ employees. Prices require at least 24 months.	Sales contact required	EU	ISO 27001
preeco	Germany	Not published on the public page.	Sales contact required	EU	—
PRIMA Compliance	Niedererbach, Germany	Ombudsperson packages (net, per year): Starter EUR 1,500 (up to 150 employees, 6 ombudsperson hours), Business EUR 2,700 (up to 249 employees, 12 hours), Premium EUR 6,000 (250-1,000 employees, 20 hours); Individual quote for 1,000+ employees. Add-on telephone hotline EUR 15-25/month.	Sales contact required	EU	—
SpeakUp	Amsterdam, Netherlands	Essential starts at €3,000/year for organizations up to 1,000 employees. Enterprise is custom-priced.	Sales contact required	Not disclosed	ISO 27001 plus others
tell it	Hohen Neuendorf, Germany	Essential EUR 40/month or EUR 480/year; Professional EUR 60/month or EUR 720/year; Enterprise on request. All prices plus 19% VAT.	Self-serve sign-up	EU	—
TrueSpeak	Milan, Italy (Barcelona and Paris offices)	Starter €19/month or €190/year. Professional €39/month or €390/year. Voice €49/month or €490/year. Enterprise €119/month or €1,190/year. Annual billing is 17% cheaper than monthly.	Self-serve sign-up	EU	—
Walor	Copenhagen, Denmark	Tiered by employee count, billed annually: €60/mo (1–49), €87/mo (50–249), €127/mo (250–499), €187/mo (500–999). Excluding VAT.	Self-serve sign-up	EU	—
whistle.law	Germany	EUR 50/month for up to 99 employees, EUR 100/month for up to 249 employees, EUR 150/month for up to 999 employees; 1,000+ quote-based.	Self-serve sign-up	EU	ISO 27001
Whistleblower Software (Formalize)	Copenhagen, Denmark	Core: €99 / €149 / €199 / €249 / €349 per month for 0-49 / 50-149 / 150-249 / 250-499 / 500-999 employees. Advanced: €149 / €219 / €299 / €379 / €529 for the same bands. 1,000+ employees contact sales. Billed annually.	Self-serve sign-up	EU	ISO 27001 plus others
whistlebox	Dachau, Germany	Up to 50 employees EUR 69/year; 51-250 EUR 249/year; 251-500 EUR 499/year; 501-1,000 EUR 999/year; 1,000+ quote-only. Prices are annual on a 12-month contract.	Self-serve sign-up	EU	—
WhistleFox	Düsseldorf, Germany	Not published. WhistleFox is engaged as a managed legal service, so pricing is quote-only via the firm.	Sales contact required	EU	—
Whistlelink	Sweden	Tiered by employee count: €79 (0–49), €99 (50–149), €149 (150–249), €199 (250–499), €299 (500–999), contact for 1,000+. Annual subscription.	Self-serve sign-up	EU	ISO 27001
WhistlePort	Berlin, Germany	Paket 1 (platform) EUR 69/month; Paket 2 (platform + employee training) EUR 69/month plus a one-time EUR 499 setup fee; Paket 3 (full-service) EUR 69/month plus EUR 79/month for attorney-run case handling. All prices plus 19% VAT.	Self-serve sign-up	EU	—
whistly	Berlin, Germany	Two published packages: Essential EUR 59/month and Pro EUR 99/month, charged regardless of employee count.	Self-serve sign-up	EU	—
whizzla	Bad Orb, Germany	Starter EUR 49/month net (up to 50 employees, 1 organization, 2 languages, 2 user accounts); KMU EUR 149/month net (up to 500 employees, 3 organizations, 3 languages, 5 accounts); Konzerne EUR 249/month net (500+ employees, 5 organizations, 5 languages, 10 accounts). Enterprise on request.	Self-serve sign-up	EU	—
Zateo	Wietzen, Germany	Compliance Basic EUR 79/month, Compliance Pro EUR 119/month, Compliance Ultimate from EUR 399/month; all quoted monthly but billed annually, plus German VAT (zzgl. MwSt.).	Self-serve sign-up	EU	—
NAVEX	Lake Oswego, Oregon, United States Non-EU	EthicsPoint pricing not published. NAVEX's UK WhistleB page says new customers can get started from £75/month; other WhistleB and NAVEX One pricing remains sales-led.	Sales contact required	EU region selectable	ISO 27001
Whispli	Sydney, Australia (Paris office) Non-EU	Plan names are public (Essential, Standard, Advanced, Enterprise), but amounts are not published; pricing remains sales-led.	Sales contact required	EU region selectable	ISO 27001 plus others

Open these Germany platforms in the filterable directory →

All tools Methodology

The law a channel in Germany has to satisfy

TOP 32 — summary

Criterion-by-criterion matrix

Per-tool reviews

Strengths

Weaknesses

Standout

Strengths

Weaknesses

Standout

Strengths

Weaknesses

Standout

Strengths

Weaknesses

Standout

Strengths

Weaknesses

Standout

Strengths

Weaknesses

Standout

Strengths

Weaknesses

Standout

Strengths

Weaknesses

Standout

Strengths

Weaknesses

Standout

Strengths

Weaknesses

Standout

Strengths

Weaknesses

Standout

Methodology

Scoring rubric

Access tiers

Data residency

Integrity guarantees

Law applied

Coverage note

Platforms covering Germany

Other member states