The state of EU whistleblowing software, 2026

53 of 126 platforms publish no entry price at all. The 73 that do cluster hard at the bottom: the modal European whistleblowing platform costs under €50 a month, which is roughly what the obligation is worth to a 60-person company. That gap is not really about price. A published figure means a product standardised enough to quote without a discovery call; an absent one means the number is set per deal, and a buyer cannot plan a budget against it.

76 of 126 platforms name an EU data centre. 46 say nothing at all about hosting location on any public page, and 14 are run by companies headquartered outside the EU. For a system holding untested allegations about named employees, hosting location is a question that appears on essentially every procurement questionnaire in Europe — and a third of the market has decided not to answer it on its website.

89 of 126 platforms publish no security certification of any kind. 34 publish ISO 27001, alone or with others. The absence is not evidence of weak security — certification is expensive and many of these vendors are very small — but it does mean that for most of this market a buyer has no external attestation to rely on and has to do the assurance work itself.

Exactly 3 of 126 platforms cover all 24 official EU languages. 74 publish a partial list, and 49 do not say. The Directive requires a channel that workers can actually use, and a multinational with staff across several member states is the buyer most likely to need that and least likely to find it. This is the widest gap in the dataset and the one vendors discuss least.

55 of 126 platforms let you open an account yourself. 71 put a demo or a sales call between you and the product. For a compliance obligation with a statutory deadline, that is a real difference in how fast the obligation can be closed, and it tends to track company size on both sides of the transaction.

88 of 126 platforms state that report content is not processed by AI. 29 confirm that it is, typically for translation or triage. Only 9 leave it unanswered — which makes this the most consistently disclosed field in the whole dataset, and a striking contrast with hosting location.

83 of 126 platforms sell into a single country. 25 are not standalone products at all but modules of a broader compliance, ESG, or legal-tech suite. The Directive is Union-wide; its software market is not. A buyer operating in more than two member states will find the shortlist collapses very quickly.

43 of the 85 platforms whose domain registration date is public first registered it in 2021 or later — at or after the deadline for transposing the Directive into national law. Half this market's domains postdate the obligation that created the demand. A third of it predates the Directive entirely, and that older cohort looks different in kind: 41% of it is whistleblowing added to an existing compliance or GRC suite, against 9% of everything registered since. The market the Directive created is overwhelmingly standalone products built for the obligation.

78 of 126 platforms publish no enforcing DMARC policy on the domain they mail from, and 28 publish no policy at all. DMARC is the record that tells a receiving mail server what to do with a message claiming to come from a domain but failing authentication. It matters here because the Directive requires an acknowledgement within seven days, so reporters do receive mail from these domains — and a convincing forgery of that mail is a route to phish or mislead someone who has just filed a report.

Read it narrowly. This measures a published policy, not the security of the vendor's own mail, and says nothing about whether reports themselves can be intercepted. Large mail providers filter on their own signals regardless, so an absent policy does not mean a forgery arrives. The exposure concentrates on named reporters and on case handlers, whose addresses an adversary is more likely to know than an anonymous reporter's.