Disclosurely

UK anonymous-reporting and case-management SaaS with published £39.99–£149 pricing and a security centre that states its own limits, including that the platform is not end-to-end encrypted.

Non-EU HQ

Non-EU headquarters — data sovereignty risk

London, United Kingdom. This vendor is headquartered in the United Kingdom. The UK is a third country under GDPR following Brexit; transfers currently rely on the UK adequacy decision, which is under review. UK providers are also subject to the Investigatory Powers Act 2016, granting domestic authorities broad data-access powers. For institutional buyers prioritising European data sovereignty, prefer an EU-headquartered provider.

AI processes report content — EU AI Act consideration

This vendor applies AI or machine learning to whistleblower reports (for example summarisation, severity or category classification, drafting replies, or machine translation). Automated processing of disclosures can bring the deployment within scope of the EU AI Act and routes sensitive personal data through a third-party inference provider. Confirm the model provider, its data-retention terms, and whether report content can be excluded before relying on it. Vendor detail: AI triage and risk scoring are on by default in the pricing feature list, but the security centre states AI runs only when an authorised user requests it and never as part of the default reporting path.

Facts

Website: disclosurely.com(opens in new tab)
Headquarters: London, United Kingdom
Hosting: Stated as UK/EU for production customer data, without naming a country or region. Named sub-processors are Vercel, Stripe, OpenAI and Resend.
Pricing: Pro £39.99/month, Organisation £149/month, Enterprise on quote. Annual billing gives two months free. Pro is described as introductory pricing held for the life of an active subscription.
A 7-day free trial is offered and billing can be switched between monthly and annual. Pro is marketed as an introductory rate that will rise for new customers, with the current price locked while the subscription stays active. API access, webhooks and custom integrations are all listed as coming soon on the Enterprise tier.
Languages on reporting form: undisclosed
Domain registered: March 2025 disclosurely.com
Product scope: Standalone whistleblower product
Encryption posture: At rest

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Enforced (quarantine)
DNSSEC: Unsigned
Legal entity: Umbrella Rank Ltd Registered in England and Wales, registered office London EC1V 2NX · imprint

Capabilities

Anonymous reporting ✓
Multi-channel intake ✗
Public API ✗
Free trial ✓
Two-factor authentication ✓
Audit log ✓
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

None published

National laws referenced

EU Directive 2019/1937

Typical buyer

UK employers wanting a self-serve reporting channel at a published price, and buyers who value a vendor that writes down what it does not yet have over one that implies more than it holds.

Distinctive features

The security centre states its own limits plainly, including that the platform "should not be described as end-to-end encrypted" and that authorised users inside the customer organisation can decrypt and read reports
Named sub-processors (Vercel, Stripe, OpenAI, Resend) with purpose and data scope, rather than a generic statement that sub-processors exist
Certification status is labelled honestly: SOC 2 and ISO 27001 are marked readiness work in progress, Cyber Essentials as planned, with the page stating none should be read as a completed certification

Add-ons and conditions

Costs or terms not included in the headline price.

No certification is held today; SOC 2 and ISO 27001 are readiness programmes, not reports
API access, webhooks and custom integrations are Enterprise features marked coming soon, so none is available at any price today
SSO is stated as planned, not available; authentication is single-use email codes plus MFA
Hosting is given as "UK/EU" with no country named, and OpenAI appears in the sub-processor list
Anonymous Feedback, the second module, starts at the £149 Organisation tier
The trial is 7 days, shorter than most of this field

Notable

Operated by Umbrella Rank Ltd, registered in England and Wales with a registered office at London EC1V 2NX. The operating company name does not carry the product name.
The security centre is the most candid document of its kind in this directory. It separates what is live from what is planned, states that encryption protects data in motion and at rest but does not stop authorised handlers reading reports, and tells buyers not to call the platform end-to-end encrypted.
Reporters return to a case with a tracking ID plus a private access secret, submit without an account, and have file metadata stripped where applicable. The vendor states organisations cannot identify anonymous reporters through the platform.
Audit records are described as including chained fields in the core audit table to support integrity review, and internal vendor support activity is logged separately from the customer’s own audit history.
Tenant isolation is described as logical, with row-level security on core customer tables and organisation-scoped access paths, in a shared multi-tenant platform.
Authentication deliberately avoids magic links, on the stated grounds that enterprise email security gateways follow links before the user does. Access uses single-use email codes with MFA available.
Legal positioning is thinner than the security posture. Pages reference the EU Whistleblowing Directive, UK requirements and GDPR in general terms; no transposition statute is named with article numbers on the pages reviewed.

Status: not yet scored

Disclosurely was added from the September 2026 AI-citation coverage audit. The entry above records what the vendor publishes. It carries no 25-criterion rubric score yet and does not appear in a country ranking; a score will be added when the product has been reviewed under the same tier rules as every other scored tool.

Frequently asked questions about Disclosurely

Answers derived from vendor-published materials dated on this page.

Is Disclosurely suitable for SMEs under 250 employees?

Yes — Disclosurely's entry-tier pricing is published under €50/month, inside the range most 50–249-employee organisations budget for a reporting channel. Pro £39.99/month, Organisation £149/month, Enterprise on quote. Annual billing gives two months free. Pro is described as introductory pricing held for the life of an active subscription. UK employers wanting a self-serve reporting channel at a published price, and buyers who value a vendor that writes down what it does not yet have over one that implies more than it holds.

Which national whistleblower laws does Disclosurely explicitly reference?

Disclosurely explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937. Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does Disclosurely process whistleblower report content with AI?

Yes — Disclosurely processes report content with AI (typically for translation, summarisation, or classification). If your compliance posture requires keeping disclosures out of third-party LLMs or machine-translation services, confirm data-processing terms and vendor subprocessors before procurement. AI triage and risk scoring are on by default in the pricing feature list, but the security centre states AI runs only when an authorised user requests it and never as part of the default reporting path.