EticAlert

Spanish self-service whistleblowing channel from FONCAD GROUP for SMEs under Ley 2/2023, with published pricing from EUR 9/month and EU hosting.

Rubric score

36 / 50

Evidence tier P

Public pages only. No reporter submission or handler environment was reviewed.

How this score is produced →

Facts

Website: eticalert.com(opens in new tab)
Headquarters: Madrid, Spain
Hosting: Cloud infrastructure located in the European Union (vendor-stated); provider and specific country not named
Pricing: Starter EUR 9/month or EUR 81/year (up to 20 employees); Business EUR 19/month or EUR 190/year (21-49); Company EUR 39/month or EUR 390/year (50-150); Enterprise custom quote (150+).
15-day free trial with no credit card required. Monthly or annual billing via Stripe (card or SEPA), month-to-month with cancellation anytime. Annual billing saves roughly two to three months. No per-user fees; each tier includes a fixed number of handler seats (3 to 5). SSO/SAML and REST API are Enterprise-only.
Languages on reporting form: Not published
Domain registered: March 2026 eticalert.com
Ownership: Private, FONCAD GROUP, S.L. (Spain, CIF B70713532)
Product scope: Standalone whistleblower product

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: None published
DNSSEC: Unsigned

Capabilities

Anonymous reporting ✓
Multi-channel intake ✗
Public API ✓
Free trial ✓
Two-factor authentication —
Audit log —
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

None published

National laws referenced

EU Directive 2019/1937
Spain (Ley 2/2023)

Typical buyer

Spanish SMEs needing an affordable, self-serve reporting channel compliant with Ley 2/2023 and the EU Whistleblowing Directive.

Distinctive features

Published self-serve tiers from EUR 9/month with a 15-day free trial and no credit card required
map[Explicit statutory deadline tracking:automatic 7-day acknowledgment (cites art. 18) and 3-month feedback alert]
Append-only audit log plus a public SHA-256 hash verification tool for report integrity
Three compartmentalized handler roles documented (admin, coordinator, resolver)
Encrypted anonymous two-way messaging with reporter follow-up by tracking code, no registration
EU data residency, AES-256 at rest, TLS 1.2+ in transit, and a published DPA with sub-processor right to object

Add-ons and conditions

Costs or terms not included in the headline price.

Enterprise tier (150+ employees) is custom quote only; REST API and SSO/SAML are Enterprise-exclusive
No vendor ISO 27001 or SOC 2 certification; ISO/SOC/pentest reports are referenced only as artifacts EticAlert may provide in lieu of an on-site audit
EU hosting is stated but the provider and specific EU country are not named on public pages reviewed
The full sub-processor list is available on request rather than published in full
Language count is not specified; the interface is described as multilingual without a number

Notable

Operated by FONCAD GROUP, S.L. (CIF B70713532), registered at C/ Iglesia 12, 28019 Madrid, Spain.
Positioned as proprietary self-service software for Spanish SMEs operating an internal reporting channel under Ley 2/2023; it is not a reseller of another platform.
Four employee-band tiers: Starter (up to 20), Business (21-49), Company (50-150, marketed as the Ley 2/2023 mandatory band), and Enterprise (150+, custom quote).
Published pricing starts at EUR 9/month (Starter), with a 15-day free trial requiring no credit card; billing is monthly or annual via Stripe (card or SEPA), month-to-month with cancellation anytime.
No per-user pricing; each tier includes a fixed number of handler seats (3 to 5). REST API and SSO/SAML are limited to the Enterprise tier.
Web-based online reporting form only; no phone, in-person, or postal channels are mentioned. Reporters follow up via a tracking code without registering.
Statutory workflow features are explicit: automatic 7-day acknowledgment (tied to art. 18), 3-month expiration alerts, append-only audit log, and read traceability.
Three case-management roles are documented (admin, coordinator, resolver) with compartmentalized access, plus a feature letting reporters exclude specific handlers.
Security posture: AES-256 encryption at rest, TLS 1.2+ in transit, encrypted anonymous messaging, signed attachment URLs (30-minute TTL), and a public SHA-256 hash verification tool.
Data is stored on cloud infrastructure in the EU (provider and specific country not named); a dedicated DPA lists sub-processor categories and grants a right to object with 30 days notice.
No vendor ISO 27001 or SOC 2 certification is claimed; those reports are referenced only as artifacts EticAlert may provide instead of an on-site audit. No AI features are advertised.

Frequently asked questions about EticAlert

Answers derived from vendor-published materials dated on this page.

Is EticAlert suitable for SMEs under 250 employees?

Yes — EticAlert's entry-tier pricing is published under €50/month, inside the range most 50–249-employee organisations budget for a reporting channel. Starter EUR 9/month or EUR 81/year (up to 20 employees); Business EUR 19/month or EUR 190/year (21-49); Company EUR 39/month or EUR 390/year (50-150); Enterprise custom quote (150+). Spanish SMEs needing an affordable, self-serve reporting channel compliant with Ley 2/2023 and the EU Whistleblowing Directive.

Which national whistleblower laws does EticAlert explicitly reference?

EticAlert explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, Spain (Ley 2/2023). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does EticAlert process whistleblower report content with AI?

No — EticAlert does not process report content with AI or machine translation per its vendor materials. Verify the vendor's subprocessor list to confirm no downstream AI processing occurs.