GlobalSuite

Whistleblowing channel module inside the GlobalSuite GRC platform from Spanish vendor GlobalSuite Solutions, aligned with Spain's Ley 2/2023.

Part of GlobalSuite

Rubric score

26 / 50

Evidence tier P

Public pages only. No reporter submission or handler environment was reviewed.

How this score is produced →

Facts

Website: globalsuitesolutions.com/whistleblower-channel(opens in new tab)
Headquarters: Madrid, Spain
Hosting: Data centres within the European Union, described as three geo-distributed processing centres (vendor-stated)
Pricing: Not published. The whistleblowing channel is offered in Starter, Enterprise, and Plus versions; prices are quote-only via a demo request.
No prices for any version are shown on the public pages reviewed. The three named versions are listed without a feature-by-feature or price comparison. Procurement runs through a demo/contact request.
Languages on reporting form: Not published
Founded: 2006
Domain registered: October 2014 globalsuitesolutions.com
Ownership: Private, GlobalSuite Solutions (Spain)
Product scope: Module of GlobalSuite

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Enforced (quarantine)
DNSSEC: Signed

Capabilities

Anonymous reporting ✓
Multi-channel intake ✓
Public API —
Free trial ✗
Two-factor authentication ✓
Audit log —
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

ISO/IEC 27001 (vendor-stated, company-level)
ISO 22301 (vendor-stated, company-level)
ISO 20000 (vendor-stated, company-level)
ISO 9001 (vendor-stated, company-level)
ISO 37001 (vendor-stated, company-level)
UNE 19601 (vendor-stated, company-level)
ENS (vendor-stated, company-level)

National laws referenced

EU Directive 2019/1937
Spain (Ley 2/2023)

Typical buyer

Spanish organisations that want a whistleblowing channel from an established, multi-certified GRC vendor and are comfortable with quote-based procurement.

Distinctive features

Whistleblowing module sits inside a broader GRC platform from a vendor building GRC software since 2006
Company itself states ISO/IEC 27001 and multiple other management-system certifications, not just hosting-provider certification
Web questionnaire plus an optional dedicated secure telephone channel for oral reports
Anonymous reporting with a secure two-way comments channel that preserves anonymity
Automatic alerts for receipt, acknowledgement of receipt, and monitoring of legal deadlines
Data centres stated to be within the European Union

Add-ons and conditions

Costs or terms not included in the headline price.

No pricing is published for any version on the public pages reviewed
Starter, Enterprise, and Plus versions are named but not compared feature-by-feature publicly
Specific EU hosting country is not named on the public pages reviewed
No self-serve trial; procurement is demo/contact-led
Sub-processor list and a downloadable DPA/DPIA were not found on public pages reviewed

Notable

GlobalSuite Solutions is a Madrid-based GRC software vendor that states it has been building GRC software since 2006; the whistleblowing channel is a module within its broader GlobalSuite platform.
The whistleblowing channel was publicly launched in a partnership with WTW (Willis Towers Watson) but is developed and operated by GlobalSuite Solutions.
The product supports anonymous, encrypted reporting through a simple questionnaire, plus an optional dedicated secure telephone number for oral reports.
Case management covers report viewing, file review, manager collaboration, status reports, dashboards, and full traceability of actions taken.
Deadline handling includes automatic alerts for receipt, acknowledgement of receipt, and monitoring of legal deadlines, with manager notifications for overdue cases.
The channel is presented as fully customisable with corporate logos, colours, and linked policies, and offers native-language selection for reporters.
Compliance positioning references Spain’s Ley 2/2023, EU Directive 2019/1937, GDPR (with automatic and manual data anonymisation), and related standards such as ISO 37001 and ISO 37301.
The vendor states company-level certifications including ISO/IEC 27001, ISO 22301, ISO 20000, ISO 9001, ISO 37001, UNE 19601, and Spain’s ENS; this is vendor certification, not hosting-provider-only certification.
Security pages state TLS 1.2/1.3 in transit, encryption at rest, multi-factor authentication, and data centres located within the European Union across geo-distributed processing centres; the specific EU country was not named.
The channel is offered in Starter, Enterprise, and Plus versions, but no prices and no feature-by-feature version comparison were found on the public pages reviewed; procurement runs through a demo request.
No sub-processor list, downloadable DPA/DPIA, self-serve trial, or public API documentation was found on the public pages reviewed.

Frequently asked questions about GlobalSuite

Answers derived from vendor-published materials dated on this page.

Is GlobalSuite suitable for SMEs under 250 employees?

GlobalSuite does not publish entry-tier pricing, so SME buyers need to request a quote to assess fit. Buying path: Sales contact required. Spanish organisations that want a whistleblowing channel from an established, multi-certified GRC vendor and are comfortable with quote-based procurement.

Which national whistleblower laws does GlobalSuite explicitly reference?

GlobalSuite explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, Spain (Ley 2/2023). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does GlobalSuite process whistleblower report content with AI?

No — GlobalSuite does not process report content with AI or machine translation per its vendor materials. Verify the vendor's subprocessor list to confirm no downstream AI processing occurs.