CLUE#ZO

German digital whistleblowing system from CAS Concepts and Solutions AG, delivered on SAP Business Technology Platform with integration to SAP S/4HANA and chatbot-guided report intake.

Part of SAP Business Technology Platform

AI processes report content — EU AI Act consideration

This vendor applies AI or machine learning to whistleblower reports (for example summarisation, severity or category classification, drafting replies, or machine translation). Automated processing of disclosures can bring the deployment within scope of the EU AI Act and routes sensitive personal data through a third-party inference provider. Confirm the model provider, its data-retention terms, and whether report content can be excluded before relying on it. Vendor detail: A chatbot assistant guides whistleblowers through structured report intake; the product page states GDPR-compliant real-time translation, and the vendor is listed among SAP's AI partners.

Rubric score

22 / 50

Evidence tier P

Public pages only. No reporter submission or handler environment was reviewed.

How this score is produced →

Facts

Website: www.c-a-s.de/digitales-hinweisgebersystem-cluezo/(opens in new tab)
Headquarters: Hamburg, Germany
Hosting: European data centres (vendor states ISO 27001 certified data centres); built on SAP Business Technology Platform
Pricing: Basic EUR 99/month (12 reports/year, 3 users); Standard EUR 299/month (50 reports/year, 6 users); Enterprise EUR 1,499/month (unlimited reports, 15 users). Prices are ex-VAT.
Report volume and user seats are capped per tier. Overage per additional report is EUR 28 (Basic) and EUR 19 (Standard); overage is included on Enterprise.
Languages on reporting form: Not published
Ownership: Private, CAS Concepts and Solutions AG (Hamburg, Commercial Register HRB 69127)
Product scope: Module of SAP Business Technology Platform

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Published but not enforcing
DNSSEC: Unsigned
Legal entity: CAS AG VAT DE812620974 · imprint

Capabilities

Anonymous reporting ✓
Multi-channel intake ✗
Public API —
Free trial ✗
Two-factor authentication —
Audit log —
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

None published

National laws referenced

EU Directive 2019/1937
Germany (Hinweisgeberschutzgesetz, HinSchG)

Typical buyer

German private and public sector organizations, especially SAP customers, wanting an SAP-integrated HinSchG-compliant whistleblowing channel with chatbot-guided intake.

Distinctive features

Chatbot-guided structured report intake
Anonymous reporting with two-way mailbox follow-up
Published three-tier monthly pricing (Basic, Standard, Enterprise)
Delivered on SAP Business Technology Platform, integrated with SAP S/4HANA, and listed in the SAP Store
Multilingual intake via GDPR-compliant real-time translation
GDPR-compliant hosting stated to be exclusively in European data centres

Add-ons and conditions

Costs or terms not included in the headline price.

Plans cap the number of reports per year (12 on Basic, 50 on Standard) with per-report overage fees
User seats are capped per tier (3, 6, or 15)
Large jump from Standard (EUR 299) to Enterprise (EUR 1,499) per month
ISO 27001 is stated for the data centres, not as a vendor or product certification
No free trial found on public pages reviewed

Notable

Offered by CAS Concepts and Solutions AG (CAS AG), Hamburg, Germany (Commercial Register HRB 69127).
CLUE#ZO is a digital whistleblowing system positioned for private and public sector organizations to comply with the EU Whistleblowing Directive (2019/1937) and the German Hinweisgeberschutzgesetz (HinSchG, in force since 2023).
Delivered as SaaS on SAP Business Technology Platform, integrated with SAP S/4HANA, and listed in the SAP Store as a whistleblower service.
A chatbot assistant guides whistleblowers through structured report intake, described as dialogue-guided receipt of reports.
Anonymous reporting is supported, with a mailbox function for ongoing two-way communication with anonymous reporters about case progress.
A separate web application is provided for employees to review and handle submissions.
Multilingual support is provided through GDPR-compliant real-time translation; a specific language count was not stated on public pages reviewed.
The vendor states data is hosted GDPR-compliant exclusively in certified European data centres, with encryption of stored and transmitted data; ISO 27001 is stated for the data centres, not as a vendor or product certification.
Pricing is published in three monthly tiers: Basic EUR 99 (12 reports/year, 3 users), Standard EUR 299 (50 reports/year, 6 users), and Enterprise EUR 1,499 (unlimited reports, 15 users), all ex-VAT, with per-report overage fees on the lower tiers.
No free trial or API documentation was found on public pages reviewed.

Frequently asked questions about CLUE#ZO

Answers derived from vendor-published materials dated on this page.

Is CLUE#ZO suitable for SMEs under 250 employees?

CLUE#ZO does not publish entry-tier pricing, so SME buyers need to request a quote to assess fit. Buying path: Sales contact required. German private and public sector organizations, especially SAP customers, wanting an SAP-integrated HinSchG-compliant whistleblowing channel with chatbot-guided intake.

Which national whistleblower laws does CLUE#ZO explicitly reference?

CLUE#ZO explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, Germany (Hinweisgeberschutzgesetz, HinSchG). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does CLUE#ZO process whistleblower report content with AI?

Yes — CLUE#ZO processes report content with AI (typically for translation, summarisation, or classification). If your compliance posture requires keeping disclosures out of third-party LLMs or machine-translation services, confirm data-processing terms and vendor subprocessors before procurement. A chatbot assistant guides whistleblowers through structured report intake; the product page states GDPR-compliant real-time translation, and the vendor is listed among SAP's AI partners.