Falcony

Finnish whistleblowing module within the Falcony reporting platform, offering an anonymous online reporting form and case management; the vendor acquired the First Whistle whistleblowing product in 2026.

Part of Falcony platform

Rubric score

23 / 50

Evidence tier P

Public pages only. No reporter submission or handler environment was reviewed.

How this score is produced →

Facts

Website: www.falcony.io(opens in new tab)
Headquarters: Finland
Hosting: Amazon Web Services European data centres (vendor-stated)
Pricing: Not published on vendor pages reviewed. FAQ states site-based pricing is available upon request, annual billing only, and credit-card payment is not accepted. Third-party listings cite a starting price around EUR 120/month, unverified on vendor pages.
Annual billing only; no monthly contract option stated. A 30-day free trial is offered, but pricing is quote-on-request rather than a published tier table.
Languages on reporting form: Not published
Founded: 2012
Domain registered: December 2020 falcony.io
Ownership: Private, part of the WeKomply group (VIA equity portfolio); Falcony based in Finland
Product scope: Module of Falcony platform

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Enforced (reject)
DNSSEC: Signed

Capabilities

Anonymous reporting ✓
Multi-channel intake ✗
Public API —
Free trial ✓
Two-factor authentication —
Audit log —
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

None published

National laws referenced

EU Directive 2019/1937

Typical buyer

Finnish and Nordic organizations wanting an EU-Directive whistleblowing channel bundled inside a broader HSEQ, security, and risk reporting platform from a single Finnish vendor.

Distinctive features

Anonymous online reporting form with case-specific credentials for confidential follow-up
Two-way protected dialogue between reporters and predefined investigators
Built-in case management with customisable categories and branded reporting links
EU hosting on Amazon Web Services European data centres, with AES-256 at rest and TLS in transit (vendor-stated)
30-day free trial and rapid setup described as a few days
Data processing agreements signed with subprocessors, with a subprocessor list stated to be in the help centre

Add-ons and conditions

Costs or terms not included in the headline price.

Vendor pages do not publish a pricing tier table; pricing is site-based and quote-on-request
Annual billing only, with no monthly contract option and credit card not accepted
Falcony itself holds no ISO 27001 certification found on public pages reviewed; the ISO 27001 / SOC 2 references apply to the AWS hosting infrastructure, not the vendor
Specific AWS EU country/region, Finnish transposition law, and statutory 7-day/3-month deadline tracking were not documented on public pages reviewed
Reporter-facing language count and API access were not documented on public pages reviewed

Notable

Falcony is a Finnish software company founded in 2012, offering HSEQ, security, ESG, facilities, risk, and GRC reporting suites; whistleblowing is one module within that platform.
Falcony is part of the WeKomply group (a portfolio company of Danish private equity firm VIA equity); the WeKomply/Falcony partnership was announced in April 2025.
In February 2026, Falcony acquired First Whistle, a Finnish whistleblowing product originally developed by business ethics consultancy Juuriharja Consulting Group Oy in response to the EU Whistleblowing Directive, aimed at organizations with 50 or more employees.
The whistleblowing offering provides an anonymous online reporting form via branded open links, case-specific credentials for confidential follow-up, anonymous IDs, and two-way protected dialogue with predefined investigators.
Case management includes customisable categories, evidence and attachment collection, linking of related reports, and role-based access rights for notifications.
The vendor states data is hosted in Amazon Web Services European data centres, with AES-256 encryption at rest and TLS in transit, and daily/weekly/monthly backups.
ISO 27001, PCI DSS, and SOC 2 references in the FAQ describe AWS infrastructure certifications, not a Falcony organizational certification; no vendor-held ISO 27001 was found on public pages reviewed.
The FAQ states a 180-day post-contract data retention period, DPAs signed with subprocessors, and assistance with GDPR data subject requests.
Pricing is not published as a tier table; the FAQ states site-based pricing on request, annual billing only, and that credit-card payment is not accepted. A starting price around EUR 120/month appears only in third-party listings.
A 30-day free trial is offered; only web-based reporting was documented, with no phone or in-person channel found on public pages reviewed.

Frequently asked questions about Falcony

Answers derived from vendor-published materials dated on this page.

Is Falcony suitable for SMEs under 250 employees?

Falcony does not publish entry-tier pricing, so SME buyers need to request a quote to assess fit. Buying path: Sales contact required. Finnish and Nordic organizations wanting an EU-Directive whistleblowing channel bundled inside a broader HSEQ, security, and risk reporting platform from a single Finnish vendor.

Which national whistleblower laws does Falcony explicitly reference?

Falcony explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937. Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does Falcony process whistleblower report content with AI?

No — Falcony does not process report content with AI or machine translation per its vendor materials. Verify the vendor's subprocessor list to confirm no downstream AI processing occurs.