Clym

Privacy-compliance suite where whistleblowing is one module alongside consent, DSAR, accessibility, and related compliance tools.

Non-EU HQ Part of Clym

Non-EU headquarters — data sovereignty risk

United States (exact legal seat not disclosed on public pages reviewed). This vendor is headquartered in the United States. US-incorporated providers are subject to the CLOUD Act, which can compel disclosure of EU customer data regardless of where it is hosted. Transfers require the EU-US Data Privacy Framework or Standard Contractual Clauses — both are subject to legal challenge (see Schrems I and II). For institutional buyers prioritising European data sovereignty, prefer an EU-headquartered provider.

AI processes report content — EU AI Act consideration

This vendor applies AI or machine learning to whistleblower reports (for example summarisation, severity or category classification, drafting replies, or machine translation). Automated processing of disclosures can bring the deployment within scope of the EU AI Act and routes sensitive personal data through a third-party inference provider. Confirm the model provider, its data-retention terms, and whether report content can be excluded before relying on it.

Rubric score

20 / 50

Evidence tier P

Public pages only. No reporter submission or handler environment was reviewed.

How this score is produced →

Facts

Website: www.clym.io(opens in new tab)
Headquarters: United States (exact legal seat not disclosed on public pages reviewed)
Hosting: Not specified on public pages; Enterprise tier offers choice of data server location
Pricing: Start $49/month (no whistleblowing); Grow $149/month (includes whistleblowing); Enterprise starts at $449/month with custom annual plan, data server choice, API integration, dedicated account manager, email/phone support, and SLA.
Start and Grow show free-trial CTAs with no credit card required. Installation assistance is $349; additional AI assistant credits are $5 per 100.
Languages on reporting form: Not published
Domain registered: December 2017 clym.io
Ownership: Private
Product scope: Module of Clym

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Enforced (quarantine)
DNSSEC: Unsigned

Capabilities

Anonymous reporting ✓
Multi-channel intake ✗
Public API ✓
Free trial ✓
Two-factor authentication —
Audit log —
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

SOC 2 Type 2 (pricing page logo)
Google CMP (pricing page logo)

National laws referenced

EU Whistleblower Directive (general)

Typical buyer

Organizations already using Clym for web privacy and accessibility compliance that want whistleblowing bundled into the same platform.

Distinctive features

Whistleblowing is included in the $149/month Grow plan
Free trial with no credit card on public pricing page
Enterprise tier discloses API integration, custom data server location, dedicated instance option, email/phone support, and SLA

Add-ons and conditions

Costs or terms not included in the headline price.

Whistleblowing is not included in the $49/month Start plan
Pricing page displays SOC 2 Type 2 and Google CMP logos, but certificate reports, dates, scope, and a trust center were not found on public pages reviewed
Reporting languages, EU hosting location, DPA, and subprocessor list were not disclosed on public pages reviewed

Notable

Clym is primarily an all-in-one web compliance platform for consent, DSAR, privacy policies, accessibility, video privacy, HIPAA authorization, age gating, content takedown, and whistleblowing.
Whistleblowing is included in Grow at $149/month and Enterprise from $449/month; it is not included in Start at $49/month.
Public whistleblowing copy supports anonymous/confidential structured reporting, protected communication, documentation, investigation tracking, customizable categories, automated response email templates, granular access control, and business-continuity reporting.
Enterprise adds custom data server location, shared or dedicated instance, API integration, dedicated account manager, and business support with email, phone, and SLA.
Pricing page displays SOC 2 Type 2 and Google CMP logos under certifications and memberships; public pages reviewed did not disclose certificate reports, dates, scope, ISO 27001, reporting-language coverage, public DPA, subprocessor list, or a specific EU hosting location.

Frequently asked questions about Clym

Answers derived from vendor-published materials dated on this page.

Is Clym suitable for SMEs under 250 employees?

Clym does not publish entry-tier pricing, so SME buyers need to request a quote to assess fit. Buying path: Self-serve sign-up. Organizations already using Clym for web privacy and accessibility compliance that want whistleblowing bundled into the same platform.

Which national whistleblower laws does Clym explicitly reference?

Clym explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Whistleblower Directive (general). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does Clym process whistleblower report content with AI?

Yes — Clym processes report content with AI (typically for translation, summarisation, or classification). If your compliance posture requires keeping disclosures out of third-party LLMs or machine-translation services, confirm data-processing terms and vendor subprocessors before procurement.