Skip to main content
EU Whistleblower Directory

Edition I, 2026 · Tested September 2026

Whistleblowing software in Sweden — scored ranking

Independent scored ranking of whistleblower-reporting tools for Sweden under Lag (2021:890), the local transposition of EU Directive 2019/1937. 25-criterion rubric fixed before scoring; every score carries evidence.

Of the 14 platforms scored against Lag (2021:890), EthicsPortal ranks first with 50 of 56 points, ahead of Whistlelink at 45.

Platforms covering it
18
Sold only here
5
EU data centre
15
Self-serve sign-up
11
Scored against the rubric
14

The law a channel in Sweden has to satisfy

Sweden transposes EU Directive 2019/1937 through SFS 2021:890. A platform has to satisfy the national text, not only the Directive, so check obligations against the statute rather than against a vendor's compliance claim.

Sweden is the second-largest field in this directory after Germany, at fourteen scored platforms, and it is the strongest anywhere on data residency: five vendors name Swedish hosting outright, several of them naming the data centre and city. Sweden transposed early, in December 2021, and the domestic market has had the longest run of any EU market to mature.

It is also the one ranking where the publisher’s own product is beaten on a criterion by most of the field. EthicsPortal has no Swedish reporter or handler locale and scores zero on Swedish-language UI, against twelve of fourteen platforms scoring full marks. It leads on base product score; it does not lead here, and the matrix shows exactly where.

The criterion that still separates the Swedish field is the law. Eleven of fourteen name Lag (2021:890); three describe national coverage generically, including two Swedish vendors who might be expected to name their own statute.

This edition uses two layers:

  • the 50-point base rubric, which stays country-agnostic and scores the product itself: legal workflow depth, reporter experience, handler workflow, security posture, and commercial clarity;
  • the 6-point Sweden modifier, which rewards an explicit Lag (2021:890) reference, a named hosting country or EU provider, and a genuine Swedish-language surface.

TOP 14 — summary

#ToolTierBase
/ 50
Sweden bonus
/ 6
TotalLast reviewed
1EthicsPortal logo EthicsPortalP+R+H473502026-06-21
2Whistlelink logo WhistlelinkP+H396452026-05-24
3IntegrityLog logo IntegrityLogP335382026-05-24
4NorthWhistle logo NorthWhistleP324362026-07-19
5Visslan logo VisslanP306362026-05-24
6WhistleSecure logo WhistleSecureP275322026-07-19
7Heimdal logo HeimdalP265312026-07-19
8Visselblåsaren logo VisselblåsarenP246302026-07-19
92Whistle logo 2WhistleP245292026-07-19
10Interaktiv Säkerhet logo Interaktiv SäkerhetP236292026-07-19
11Lumgo logo LumgoP215262026-07-19
12Qnister Whistle logo Qnister WhistleP215262026-05-24
13Lantero logo LanteroP166222026-07-19
14Tissla logo TisslaP154192026-07-19

Criterion-by-criterion matrix

● fully meets ◐ partially meets ○ does not meet / not verifiable

CriterionEthicsPortal logo EthicsPortalWhistlelink logo WhistlelinkIntegrityLog logo IntegrityLogNorthWhistle logo NorthWhistleVisslan logo VisslanWhistleSecure logo WhistleSecureHeimdal logo HeimdalVisselblåsaren logo Visselblåsaren2Whistle logo 2WhistleInteraktiv Säkerhet logo Interaktiv SäkerhetLumgo logo LumgoQnister Whistle logo Qnister WhistleLantero logo LanteroTissla logo Tissla
Legal compliance · 16 pts max
A1 Local transposition law referenced with article numbers●◐◐◐●◐◐◐◐◐◐◐◐○
A2 Directive 2019/1937 Article 2(1) categories in intake●◐◐◐◐◐◐◐◐◐◐○○◐
A3 Anonymous reporting default-on or equal-status●●●●●●●●●●●●●●
A4 7-day acknowledgment + 3-month feedback deadline tracking●●●◐◐○●◐●◐○○○○
A5 Configurable retention with automatic deletion●●●◐○○◐◐○○○○◐○
A6 Report register / log●◐●◐◐◐◐◐◐◐◐◐◐◐
A7 Append-only handler audit trail●◐○◐◐○○○○○○○○○
A8 DPA + DPIA support documented●◐●◐◐◐◐◐◐◐◐◐◐○
Reporter experience · 10 pts max
B9 Web form, mobile-responsive, with file upload●●●●●◐●◐◐◐◐●◐◐
B10 Two-factor reporter access (Case ID + passcode)●○○○◐○◐○●○○○○○
B11 Two-way anonymous communication●●●●●●●●●●●◐◐◐
B12 Structured intake aligned to Article 2(1)●◐◐◐◐◐◐◐◐◐◐○○◐
B13 Reporter form in local language○○●●●●●●●●●○●●
Handler experience · 10 pts max
C14 Case management dashboard with status workflow●●●●●●◐●◐◐◐●●●
C15 Assign cases to handlers (rotation or multi-handler)●●◐●◐◐◐◐◐○○●○◐
C16 Deadline reminder notifications●◐●◐○◐●◐◐◐○○○○
C17 Internal notes (not visible to reporter)●●○◐◐◐○◐○○○◐○◐
C18 Role-based access control (≥3 roles)●●●◐◐◐○○○○○◐○○
Security and trust · 8 pts max
D19 ISO 27001 certified○●●○○○○○○○○●○○
D20 No EOL software components●●●◐◐◐◐◐◐◐◐◐◐◐
D21 EU data residency with country disclosed●●●◐●●◐●◐●●◐●○
D22 Sub-processor list + right to object●●◐●○◐○◐◐◐◐◐◐○
Commercial · 6 pts max
E23 Published pricing●●○◐●●●◐◐●●◐○◐
E24 Free trial available (self-serve)◐●○●●●◐○○○●○○○
E25 Monthly contract option●○○●◐◐○○◐●○◐○○
Sweden bonus · 6 pts max · modifier, not in base
SE·LAW Lag (2021:890) referenced●●●●●●●●●●●●●●
SE·RESIDENCY Sweden or named EU residency◐●◐◐●◐◐●◐●◐◐●○
SE·UI Swedish-language UI○●●◐●●●●●●●●●●
Total5045383636323130292926262219

Per-tool reviews

#1
EthicsPortal logo

EthicsPortal

Poland · Whistleblowing channel hosted on Hetzner in Germany. Flat €60/month plan, with a published DORA evidence set.

50 / 56
Base 47 · Bonus 3 · Tier P+R+H
Legal
16/16
Reporter
0/10
Handler
10/10
Security
6/8
Commercial
5/6

Strengths

  • Article-level legal framing: /compliance/ enumerates Directive 2019/1937 Articles 4, 6, 8, 9, 16, 18, 19–21 and links to a dedicated page for each of the 27 EU transpositions
  • All 27 EU national whistleblower laws are named on public /whistleblower-laws/<country>/ pages with official source citations
  • Oral reporting (Art 9(2)(b)) is built into the portal as in-browser voice recording and is privacy-engineered: the raw audio is automatically pitch-shifted, only the anonymized clip is ever served, and the original recording is purged after processing (fail-closed — nothing is exposed to handlers until anonymization succeeds)
  • Report categories are tagged to specific Directive Art 2(1) Union-law domains, with the article reference shown as a handler-side badge while reporters pick plain-language categories
  • Structured intake: five optional, Directive-aligned questions (relationship to org per Art 4, source of knowledge, incident timing, prior reporting, retaliation concern per Art 19) presented as a skippable guided step, surfaced to handlers and the PDF export with retaliation flagged as an urgency badge — a built-in default set where most tools leave these to per-org custom-field configuration
  • Three role tiers (member / admin / viewer): viewer is a read-only seat for auditors and external counsel that sees every report plus the full audit trail without any write or management path
  • GDPR Art 20 portability: admins can export the full organization dataset (reports, messages, attachments, with encrypted fields decrypted for portability) as a ZIP; export and download are audit-logged and the ZIP auto-purges after 7 days
  • Real deadline tracking: 7-day acknowledgement and 3-month feedback deadlines with overdue/due-soon tracking and a lifecycle stepper in both reporter and handler views
  • Configurable retention (12/24/36/48/60 months) with automatic purge of expired closed reports; open reports left inactive for 18 months auto-close so the retention clock starts (GDPR Art 5(1)(e) storage limitation), closing the open-forever gap
  • Two-factor reporter access: case reference (WB-XXXX-XXXX) plus a reporter-chosen 6-digit passcode, session-gated inbox. Reporters can also download a PDF copy of their own report from the follow-up portal (audit-logged)
  • Audit log surfaced to handlers on each report; append-only at the database level
  • Modern stack with no end-of-life liabilities
  • Transparent monthly pricing (€60/mo) with 14 live product locales (13 EU official languages — bg, de, el, en, es, fr, hr, it, nl, pl, pt, ro, sl — plus Luxembourgish)
  • Multi-handler case assignment: each report can be assigned to a handler, admins see all reports and members see only assigned, assignment changes are audit-logged, and deactivated members are auto-unassigned from open reports
  • Handler-set case priority (low / normal / high / urgent) recorded at assessment as an audit-logged change and surfaced as a badge on the report list, plus a priority breakdown in the exportable compliance report
  • SCIM 2.0 provisioning so an identity provider (Okta, Microsoft Entra ID) can provision case handlers and — the core value — auto-deprovision them the moment someone leaves the directory; admins generate, rotate, and enable/disable a per-organization token and pick the default role
  • SAML 2.0 single sign-on so staff authenticate through the organization's identity provider (Okta, Microsoft Entra ID); configured per organization, covers one or more email domains, with optional enforcement (require SSO for those domains) and optional just-in-time account provisioning on first sign-in — the authentication half of the SSO + SCIM enterprise-identity pair
  • Published ISO 37002:2021 guidance-alignment map (/iso-37002/) walking the standard's operating clauses against shipped features, alongside the ISO 27001 Annex A self-assessment
  • Published DPA grants the Controller an explicit right to object to subprocessor changes (§6.4, 30-day notice + termination remedy) and commits to 72-hour breach notification (§6.6); /trust/ publishes contracting party, backups, RTO/RPO, and session lifecycle
  • DORA evidence set published for financial-entity buyers: /dora/ lists Article 30(2) and 30(3) provisions with status and location, supplies the register-of-information fields under Implementing Regulation (EU) 2024/2956 including the S19 (Cloud services: SaaS) classification, names the ICT service supply chain, and links a signable contractual addendum at /dora-addendum/
  • Zero-AI commitment codified contractually: DPA §6.10 prohibits transmission of personal data to any LLM or AI inference provider; /subprocessors/ lists no AI sub-processor

Weaknesses

  • Audit log is append-only but not hash-chained
  • Only 14 portal-facing languages (13 EU official languages + Luxembourgish) against 24 EU official languages
  • No ISO 27001 certification of EthicsPortal itself (only Hetzner infrastructure is certified)
  • Pay-first with 30-day money-back rather than an upfront self-serve free trial
  • Role tiers are org-scoped, not per-case ACLs: the viewer role adds the auditor seat, but a handler's report visibility is still governed by assignment/participant scoping rather than a per-case permission model

Standout

Article-level Directive framing paired with a 27-page country-law reference and privacy-engineered oral reporting, all surfaced in the live product alongside working deadline, retention, two-factor passcode, audit-log, voice-anonymization, and subprocessor-notification flows.

#3
IntegrityLog logo

IntegrityLog

Sweden · Whistleblowing module inside Euronext Corporate Solutions' ComplyLog compliance suite, with ISO 27001-certified infrastructure positioning.

38 / 56
Base 33 · Bonus 5 · Tier P
Legal
12/16
Reporter
7/10
Handler
7/10
Security
7/8
Commercial
0/6

Strengths

  • Public product detail covers statuses, reminders, permissions, and communication
  • 2025 ComplyLog factsheet adds GDPR role clarity, EEA storage, ISO/IEC 27001, encryption, access logging, retention, and DPA/sub-processor disclosures
  • Product page and factsheet support anonymous case handling, written/audio reports, and EU Whistleblowing Directive positioning

Weaknesses

  • No explicit public Waserman or Sapin II framing found
  • Pricing is not published publicly
  • Reporter return-access mechanism and append-only audit guarantees are not fully documented publicly

Standout

IntegrityLog has moved under the Euronext Corporate Solutions surface; the most detailed current evidence comes from the 2025 ComplyLog privacy factsheet rather than a France-law sales page.

#4
NorthWhistle logo

NorthWhistle

Stockholm, Sweden · Swedish plug-and-play whistleblowing channel from Nebulr AB with published monthly pricing from EUR 50 and anonymous voice and text reporting.

36 / 56
Base 32 · Bonus 4 · Tier P
Legal
9/16
Reporter
7/10
Handler
7/10
Security
4/8
Commercial
5/6
#5
Visslan logo

Visslan

Sweden · Swedish whistleblower platform, acquired by Whistlelink in June 2025. Public annual pricing from SEK 6,000 / €600.

36 / 56
Base 30 · Bonus 6 · Tier P
Legal
9/16
Reporter
8/10
Handler
5/10
Security
3/8
Commercial
5/6

Strengths

  • Transparent SEK/EUR banded pricing, 14-day free trial, no startup fees, and no binding period.
  • Swedish-law positioning, written/voice/in-person channels, two-way anonymous communication via case codes, and optional external case management.
  • Vendor-stated Sweden/EU infrastructure, penetration testing, ISO 27001-certified hosting, and end-to-end encryption.

Weaknesses

  • No Visslan company/product ISO 27001 certificate scope, public DPA/subprocessor list, API documentation, retention automation, or AI posture was found.
  • Paid fees are annual and not refunded despite no binding period.

Standout

A practical Swedish domestic profile with strong commercial clarity and good reporter-channel evidence.

#6
WhistleSecure logo

WhistleSecure

Stockholm, Sweden · Swedish whistleblowing channel from Tech brows AB with published tiers from SEK 280/month and EU hosting in Belgium.

32 / 56
Base 27 · Bonus 5 · Tier P
Legal
6/16
Reporter
6/10
Handler
6/10
Security
4/8
Commercial
5/6
#7
Heimdal logo

Heimdal

Stockholm, Sweden · Swedish whistleblowing system from Heimdal Systems AB, free for organizations under 50 employees and EUR 499/year above that.

31 / 56
Base 26 · Bonus 5 · Tier P
Legal
9/16
Reporter
8/10
Handler
4/10
Security
2/8
Commercial
3/6
#8
Visselblåsaren logo

Visselblåsaren

Stockholm, Sweden · Swedish managed whistleblowing service from Visselblåsaren SM AB with published annual pricing from SEK 7,000 and Sweden-based hosting.

30 / 56
Base 24 · Bonus 6 · Tier P
Legal
8/16
Reporter
6/10
Handler
5/10
Security
4/8
Commercial
1/6
#9
2Whistle logo

2Whistle

Stockholm, Sweden · Swedish managed whistleblowing channel where 2Secure's own investigators receive and triage each report, with published SEK pricing across employee-band tiers.

29 / 56
Base 24 · Bonus 5 · Tier P
Legal
8/16
Reporter
8/10
Handler
3/10
Security
3/8
Commercial
2/6
#10
Interaktiv Säkerhet logo

Interaktiv Säkerhet

Varberg, Sweden · Swedish managed whistleblowing service that bundles a Whistlelink-based reporting channel with optional external case reception, advisory, and investigation, priced from 1,500 SEK/month.

29 / 56
Base 23 · Bonus 6 · Tier P
Legal
7/16
Reporter
6/10
Handler
2/10
Security
4/8
Commercial
4/6
#11
Lumgo logo

Lumgo

Stockholm, Sweden · Swedish whistleblowing SaaS from Lumgo AB with EU-only hosting, Microsoft 365 / Google Workspace sign-in, and published per-employee pricing from SEK 4,500/year.

26 / 56
Base 21 · Bonus 5 · Tier P
Legal
6/16
Reporter
6/10
Handler
1/10
Security
4/8
Commercial
4/6
#12
Qnister Whistle logo

Qnister Whistle

Sweden (Jönköping) · Swedish whistleblowing service with published SEK tier pricing (Swedish market), ISO 27001 certification, Swedish servers, and an optional external-lawyer receiver function.

26 / 56
Base 21 · Bonus 5 · Tier P
Legal
5/16
Reporter
3/10
Handler
6/10
Security
5/8
Commercial
2/6
#13
Lantero logo

Lantero

Stockholm, Sweden · Swedish whistleblowing channel and case handling from Lantero AB, offered since 2014 with optional independent-lawyer case assessment and a dedicated French entity.

22 / 56
Base 16 · Bonus 6 · Tier P
Legal
6/16
Reporter
4/10
Handler
2/10
Security
4/8
Commercial
0/6
#14
Tissla logo

Tissla

Sundbyberg, Sweden · Swedish whistleblowing SaaS from Tissla AB with published annual pricing from 8,000 kr and an optional tier where Tissla handles your cases.

19 / 56
Base 15 · Bonus 4 · Tier P
Legal
4/16
Reporter
5/10
Handler
4/10
Security
1/8
Commercial
1/6

Methodology

Scoring rubric

25 criteria across 5 categories, weighted by criterion count. Each criterion scores 0, 1, or 2 — rendered as ○ / ◐ / ●. Maximum base score is 50. Sweden-specific bonuses add up to 6 on top (modifier, not part of base).

Access tiers

Each tool carries an access tier reflecting what was testable:

  • P — public pages only (marketing, pricing, security, reporter URL).
  • P + R — above plus a test report submission.
  • P + R + H — above plus handler / admin dashboard (via free trial or demo).

Criteria that cannot be verified at the current tier score 0 with the evidence line "Requires handler tier" or "Not documented publicly". Scores depressed by tier, not by product quality, are explicitly flagged on each tool's profile.

Data residency

Every country modifier scores residency the same way:

  • 2 — Data residency in the ranked country itself.
  • 1 — EU or EEA residency is disclosed, but not in the ranked country.
  • 0 — No EU or EEA residency is disclosed.

Integrity guarantees

  1. The rubric was fixed before scoring. No criterion was added mid-test to favour or punish a specific tool.
  2. Every score carries evidence — a URL, a quote, or a file path — visible in each tool's profile.
  3. Tools operated by the publisher are scored by the same rubric. Placement is by score, not by construction.
  4. Each tool carries a Last reviewed date and is re-tested at least annually.
  5. Vendors can dispute a score or submit evidence of a shipped fix using the contact address in the site footer. Any resulting change is dated on the respective tool profile.

Law applied

Lag (2021:890) om skydd för personer som rapporterar om missförhållanden, in force 17 December 2021 (the Sweden transposition of EU Directive 2019/1937). Tools are scored against the Directive first and against the local law's specifics second.

Coverage note

This ranking covers 14 tools with a scoring block published. Additional tools are being added as scoring completes. Unscored tools will appear in the ranking once they have a published scoring block.

Platforms covering Sweden

16 of 18 publish an entry price. The rest require contact with sales before a figure is given.

Whistleblowing software in Sweden — scored ranking
PlatformHeadquartersPricingHow you buyData hostingSecurity certification
EthicsPortal logo EthicsPortalPoland€60/month, or €41.67/month billed annually (€500/year)Self-serve sign-upEUISO 27001
2Whistle logo 2WhistleStockholm, Sweden0-50 employees SEK 1,700/month; 50-250 employees SEK 2,500/month; 250-500 employees SEK 3,750/month; 500+ employees custom quote.Sales contact requiredNot disclosed—
Ashio logo AshioTallinn, Estonia€30/month billed monthly, or €23/month billed yearly (€276/year). One plan, all features, unlimited team members, no per-report fee.Self-serve sign-upNot disclosed—
Heimdal logo HeimdalStockholm, SwedenFree for non-profit organizations and companies with fewer than 50 employees; EUR 499/year for organizations with 50 or more employees (stated in Swedish as 4,995 SEK/year).Self-serve sign-upEU—
IntegrityLog logo IntegrityLogSwedenNot published publicly; demo-led procurement.Sales contact requiredEUISO 27001
Interaktiv Säkerhet logo Interaktiv SäkerhetVarberg, SwedenThree fixed monthly tiers: Nivå 1 1,500 SEK/month, Nivå 2 2,500 SEK/month, Nivå 3 4,800 SEK/month. Each package includes 10 users and 10 languages.Sales contact requiredEU—
Lantero logo LanteroStockholm, SwedenNot published. Sold by tender and by license subscription; buyers request a quote.Sales contact requiredEU—
Lumgo logo LumgoStockholm, SwedenUnder 50 employees SEK 4,500/year; up to 250 employees SEK 9,500/year; over 250 employees SEK 15,000/year. VAT added. Vendor states this equals from about EUR 45/month.Self-serve sign-upEU—
NorthWhistle logo NorthWhistleStockholm, SwedenBasic EUR 50/month (1 channel, 2 case managers, 1 language); Standard EUR 150/month (customisable forms, 3 languages, 15 case managers); Plus EUR 300/month (3 channels, unlimited languages and managers, routing/assignment groups); Enterprise custom quote (SSO, dedicated virtual private cloud, on-premise, legal counsel, custom integrations).Self-serve sign-upEU—
Qnister Whistle logo Qnister WhistleSweden (Jönköping)Swedish-market pricing: 695 SEK/month for 0-99 employees, 895 SEK/month for 100-249 employees, 1,295 SEK/month for 250-999 employees; 1,000+ quote-based.Sales contact requiredEUISO 27001
Tissla logo TisslaSundbyberg, SwedenBas from 8,000 kr/year; Premium from 13,900 kr/year; Enterprise from quote. Currently no implementation fee on any tier.Sales contact requiredNot disclosed—
TrueSpeak logo TrueSpeakMilan, Italy (Barcelona and Paris offices)Starter €19/month or €190/year. Professional €39/month or €390/year. Voice €49/month or €490/year. Enterprise €119/month or €1,190/year. Annual billing is 17% cheaper than monthly.Self-serve sign-upEU—
Visselblåsaren logo VisselblåsarenStockholm, SwedenUp to 49 employees SEK 7,000/year; 50-100 employees SEK 9,000/year; over 100 employees by quote (Begär offert).Sales contact requiredEU—
Visslan logo VisslanSwedenBanded by employee count: SEK 6,000/year (<50), SEK 8,000/year (50–249), SEK 11,000/year (250–499), SEK 15,000/year (500–999), quote for 1,000+. English page shows €600 / €800 / €1,100 / €1,500 equivalents. No startup fees or binding period.Self-serve sign-upEU—
Walor logo WalorCopenhagen, DenmarkTiered by employee count, billed annually: €60/mo (1–49), €87/mo (50–249), €127/mo (250–499), €187/mo (500–999). Excluding VAT.Self-serve sign-upEU—
Whistlechannel logo WhistlechannelSwedenBasic 99 kr/month up to 1,000 employees. Standard 299 kr/month up to 5,000. Premium 899 kr/month unlimited. No lock-in and no setup fee.Self-serve sign-upEU—
Whistlelink logo WhistlelinkSwedenTiered by employee count: €79 (0–49), €99 (50–149), €149 (150–249), €199 (250–499), €299 (500–999), contact for 1,000+. Annual subscription.Self-serve sign-upEUISO 27001
WhistleSecure logo WhistleSecureStockholm, SwedenSEK 280/month (0-49 employees); SEK 480/month (50-249); SEK 980/month (250+). Setup, policy, and weekday support included in all tiers.Self-serve sign-upEU—

Open these Sweden platforms in the filterable directory →

All tools Methodology

Other member states