Whistleblowing software in Poland — scored ranking
Independent scored ranking of whistleblower-reporting tools for Poland under the Act of 14 June 2024 on the Protection of Whistleblowers, the local transposition of EU Directive 2019/1937. 25-criterion rubric fixed before scoring; every score carries evidence.
Of the 12 platforms scored against Ustawa o ochronie sygnalistów, EthicsPortal ranks first with 52 of 56 points, ahead of Sygnali at 40.
Platforms covering it
13
Sold only here
9
EU data centre
8
Self-serve sign-up
9
Scored against the rubric
12
The law a channel in Poland has to satisfy
Poland transposes EU Directive 2019/1937 through Ustawa o ochronie sygnalistów. A platform has to satisfy the national text, not only the Directive, so check obligations against the statute rather than against a vendor's compliance claim.
Poland is the most locally served market in this directory: ten of the twelve scored platforms are Polish vendors, every one of them ships a Polish reporter surface, and ten name the Act of 14 June 2024 explicitly. Poland transposed late, in September 2024, and the domestic market filled the gap quickly.
That density changes what a ranking can tell you. Where German or Italian buyers can separate vendors on whether the law is named at all, here almost everyone clears that bar, and Polish-language UI separates nobody — all twelve score full marks.
Hosting disclosure is the only criterion that still sorts this field. Two vendors name Poland-resident hosting, eight assert EU hosting without naming a country or provider, and two disclose nothing at all. In a market this crowded and this uniform on the obvious criteria, where the data physically sits is the question a procurement reviewer is left with.
This edition uses two layers:
the 50-point base rubric, which stays country-agnostic and scores the product itself: legal workflow depth, reporter experience, handler workflow, security posture, and commercial clarity;
the 6-point Poland modifier, which rewards an explicit reference to the Act, a named hosting country or EU provider, and a genuine Polish-language surface.
Poland · Whistleblowing channel hosted on Hetzner in Germany. Flat €60/month plan, with a published DORA evidence set.
52 / 56
Base 47 · Bonus 5 · Tier P+R+H
Legal
16/16
Reporter
0/10
Handler
10/10
Security
6/8
Commercial
5/6
Strengths
Article-level legal framing: /compliance/ enumerates Directive 2019/1937 Articles 4, 6, 8, 9, 16, 18, 19–21 and links to a dedicated page for each of the 27 EU transpositions
All 27 EU national whistleblower laws are named on public /whistleblower-laws/<country>/ pages with official source citations
Oral reporting (Art 9(2)(b)) is built into the portal as in-browser voice recording and is privacy-engineered: the raw audio is automatically pitch-shifted, only the anonymized clip is ever served, and the original recording is purged after processing (fail-closed — nothing is exposed to handlers until anonymization succeeds)
Report categories are tagged to specific Directive Art 2(1) Union-law domains, with the article reference shown as a handler-side badge while reporters pick plain-language categories
Structured intake: five optional, Directive-aligned questions (relationship to org per Art 4, source of knowledge, incident timing, prior reporting, retaliation concern per Art 19) presented as a skippable guided step, surfaced to handlers and the PDF export with retaliation flagged as an urgency badge — a built-in default set where most tools leave these to per-org custom-field configuration
Three role tiers (member / admin / viewer): viewer is a read-only seat for auditors and external counsel that sees every report plus the full audit trail without any write or management path
GDPR Art 20 portability: admins can export the full organization dataset (reports, messages, attachments, with encrypted fields decrypted for portability) as a ZIP; export and download are audit-logged and the ZIP auto-purges after 7 days
Real deadline tracking: 7-day acknowledgement and 3-month feedback deadlines with overdue/due-soon tracking and a lifecycle stepper in both reporter and handler views
Configurable retention (12/24/36/48/60 months) with automatic purge of expired closed reports; open reports left inactive for 18 months auto-close so the retention clock starts (GDPR Art 5(1)(e) storage limitation), closing the open-forever gap
Two-factor reporter access: case reference (WB-XXXX-XXXX) plus a reporter-chosen 6-digit passcode, session-gated inbox. Reporters can also download a PDF copy of their own report from the follow-up portal (audit-logged)
Audit log surfaced to handlers on each report; append-only at the database level
Modern stack with no end-of-life liabilities
Transparent monthly pricing (€60/mo) with 14 live product locales (13 EU official languages — bg, de, el, en, es, fr, hr, it, nl, pl, pt, ro, sl — plus Luxembourgish)
Multi-handler case assignment: each report can be assigned to a handler, admins see all reports and members see only assigned, assignment changes are audit-logged, and deactivated members are auto-unassigned from open reports
Handler-set case priority (low / normal / high / urgent) recorded at assessment as an audit-logged change and surfaced as a badge on the report list, plus a priority breakdown in the exportable compliance report
SCIM 2.0 provisioning so an identity provider (Okta, Microsoft Entra ID) can provision case handlers and — the core value — auto-deprovision them the moment someone leaves the directory; admins generate, rotate, and enable/disable a per-organization token and pick the default role
SAML 2.0 single sign-on so staff authenticate through the organization's identity provider (Okta, Microsoft Entra ID); configured per organization, covers one or more email domains, with optional enforcement (require SSO for those domains) and optional just-in-time account provisioning on first sign-in — the authentication half of the SSO + SCIM enterprise-identity pair
Published ISO 37002:2021 guidance-alignment map (/iso-37002/) walking the standard's operating clauses against shipped features, alongside the ISO 27001 Annex A self-assessment
Published DPA grants the Controller an explicit right to object to subprocessor changes (§6.4, 30-day notice + termination remedy) and commits to 72-hour breach notification (§6.6); /trust/ publishes contracting party, backups, RTO/RPO, and session lifecycle
DORA evidence set published for financial-entity buyers: /dora/ lists Article 30(2) and 30(3) provisions with status and location, supplies the register-of-information fields under Implementing Regulation (EU) 2024/2956 including the S19 (Cloud services: SaaS) classification, names the ICT service supply chain, and links a signable contractual addendum at /dora-addendum/
Zero-AI commitment codified contractually: DPA §6.10 prohibits transmission of personal data to any LLM or AI inference provider; /subprocessors/ lists no AI sub-processor
Weaknesses
Audit log is append-only but not hash-chained
Only 14 portal-facing languages (13 EU official languages + Luxembourgish) against 24 EU official languages
No ISO 27001 certification of EthicsPortal itself (only Hetzner infrastructure is certified)
Pay-first with 30-day money-back rather than an upfront self-serve free trial
Role tiers are org-scoped, not per-case ACLs: the viewer role adds the auditor seat, but a handler's report visibility is still governed by assignment/participant scoping rather than a per-case permission model
Standout
Article-level Directive framing paired with a 27-page country-law reference and privacy-engineered oral reporting, all surfaced in the live product alongside working deadline, retention, two-factor passcode, audit-log, voice-anonymization, and subprocessor-notification flows.
Estonia (Ethicontrol OÜ); offices listed in Tallinn, Berlin, Warsaw, and Kyiv · Estonia-headquartered, Ukrainian-founded whistleblowing platform. Published entry price €89/month, with audit log and MFA starting at the Advanced tier (€369/month).
38 / 56
Base 35 · Bonus 3 · Tier P
Legal
12/16
Reporter
6/10
Handler
7/10
Security
6/8
Commercial
4/6
Strengths
Published rate card, EU Frankfurt data-centre option, ISO 27001 and ISO 27701, and public Trust Center.
Poland · Polish whistleblowing channel for the Act on Protection of Whistleblowers. Tiered pricing in PLN.
36 / 56
Base 31 · Bonus 5 · Tier P
Legal
9/16
Reporter
8/10
Handler
8/10
Security
2/8
Commercial
4/6
Strengths
Strong Polish-law positioning with public pricing, free trial, end-to-end encryption, and 12 reporting languages.
Public copy documents report register, exports, response templates, internal notes, delegation between handlers, full audit history, and penetration testing.
Anonymous, explicit, and optional-identity reporting modes with anonymous two-way correspondence.
Weaknesses
No ISO 27001 certification, public API, subprocessor list, right-to-object terms, or named hosting country was found.
Pricing is annual and net of VAT.
Standout
One of the stronger Polish domestic profiles on product workflow and encryption evidence, despite missing formal certification.
Rzeszów, Poland · Polish whistleblowing channel from ITSM Software S.A. built on the Mint Service Desk platform, with cloud and on-premises deployment and published PLN package pricing.
Warsaw, Poland · Whistleblower module on Astrafox's AMODIT workflow and document-management platform, offered as cloud or on-premises with published PLN pricing.
Warsaw, Poland · Polish whistleblowing channel from E-nform Sp. z o.o. with Azure-hosted or on-premises deployment, IP-free intake, and published Silver/Gold tiers.
Poland (Kraków) · Polish whistleblowing channel from Kraków with public package pricing and ODO24 ranking history.
15 / 56
Base 11 · Bonus 4 · Tier P
Legal
4/16
Reporter
4/10
Handler
1/10
Security
1/8
Commercial
1/6
Strengths
Polish domestic positioning and repeated ODO24 ranking inclusion across 2022, 2023, and 2024.
Legacy public pricing page and current checkout subdomain provide some commercial visibility.
Weaknesses
Current package details are client-rendered; public technical evidence is thin.
No vendor/product ISO 27001 certificate, public DPA, subprocessor list, hosting country, deadline automation, retention automation, API, or detailed handler workflow was found.
Standout
Market-visible in Poland, but not yet documented enough publicly to score well under a product-evidence rubric.
25 criteria across 5 categories, weighted by criterion count. Each criterion scores 0, 1, or 2 — rendered as ○ / ◐ / ●. Maximum base score is 50. Poland-specific bonuses add up to 6 on top (modifier, not part of base).
Access tiers
Each tool carries an access tier reflecting what was testable:
P — public pages only (marketing, pricing, security, reporter URL).
P + R — above plus a test report submission.
P + R + H — above plus handler / admin dashboard (via free trial or demo).
Criteria that cannot be verified at the current tier score 0 with the evidence line "Requires handler tier" or "Not documented publicly". Scores depressed by tier, not by product quality, are explicitly flagged on each tool's profile.
Data residency
Every country modifier scores residency the same way:
2 — Data residency in the ranked country itself.
1 — EU or EEA residency is disclosed, but not in the ranked country.
0 — No EU or EEA residency is disclosed.
Integrity guarantees
The rubric was fixed before scoring. No criterion was added mid-test to favour or punish a specific tool.
Every score carries evidence — a URL, a quote, or a file path — visible in each tool's profile.
Tools operated by the publisher are scored by the same rubric. Placement is by score, not by construction.
Each tool carries a Last reviewed date and is re-tested at least annually.
Vendors can dispute a score or submit evidence of a shipped fix using the contact address in the site footer. Any resulting change is dated on the respective tool profile.
Law applied
Act of 14 June 2024 on the Protection of Whistleblowers, in force 25 September 2024 (the Poland transposition of EU Directive 2019/1937). Tools are scored against the Directive first and against the local law's specifics second.
Coverage note
This ranking covers 12 tools with a scoring block published. Additional tools are being added as scoring completes. Unscored tools will appear in the ranking once they have a published scoring block.
Platforms covering Poland
9 of 13 publish an entry price. The rest require contact with sales before a figure is given.
Whistleblowing software in Poland — scored ranking
Lite: 1,500 PLN per year (no customization). Standard: 6,000 PLN per year plus a one-time 500 PLN activation fee. Add-ons: additional reporting language 5,000 PLN each; data encryption 20% of licence value; phone/email intake 100 PLN per month readiness plus 250 PLN per report; legal document templates 1,500 PLN; legal consultation 4,500 PLN. Net prices.
Legacy public price page states Minimum 2,388 zł/year, Standard 5,988 zł/year, Premium 10,788 zł/year, net of VAT; two-year subscriptions reduce the monthly equivalent to 169 / 424 / 764 zł. Current navigation points buyers to kup.whiblo.pl.
