Heimdal

Swedish whistleblowing system from Heimdal Systems AB, free for organizations under 50 employees and EUR 499/year above that.

Rubric score

26 / 50

Evidence tier P

Public pages only. No reporter submission or handler environment was reviewed.

How this score is produced →

Facts

Website: heimdal.io(opens in new tab)
Headquarters: Stockholm, Sweden
Hosting: Servers within the EU/EEA (vendor-stated); specific country not named
Pricing: Free for non-profit organizations and companies with fewer than 50 employees; EUR 499/year for organizations with 50 or more employees (stated in Swedish as 4,995 SEK/year).
Paid agreement runs annually (12 months) from order confirmation, with termination notice due no later than one month before the 12-month period ends. No monthly billing option documented on public pages reviewed.
Languages on reporting form: Not published
Founded: 2025
Domain registered: August 2025 heimdal.io
Ownership: Private, Heimdal Systems AB (Sweden), part of the Aglander Nyman AB group; technical platform developed with Flowbic AB
Product scope: Standalone whistleblower product

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Published but not enforcing
DNSSEC: Unsigned

Capabilities

Anonymous reporting ✓
Multi-channel intake ✗
Public API —
Free trial ✗
Two-factor authentication —
Audit log —
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

None published

National laws referenced

EU Directive 2019/1937
Sweden (Lag 2021:890)

Typical buyer

Swedish SMEs and non-profits that want a low-cost, EU-Directive-compliant reporting channel aligned to the Swedish Whistleblower Protection Act.

Distinctive features

Free tier for non-profit organizations and companies with fewer than 50 employees
Published flat paid price (EUR 499/year) for organizations with 50 or more employees
Anonymous encrypted two-way chat with a unique reporter access key
Statutory 7-day acknowledgment and 3-month feedback deadlines are shown with reminders
EU/EEA data storage with encryption in transit and at rest, stated to log no IP addresses or metadata
Accessibility stated to meet WCAG 2.2 AA

Add-ons and conditions

Costs or terms not included in the headline price.

Paid plan is annual only (12-month agreement); no monthly option found on public pages reviewed
No ISO 27001 or other security certification found on public pages reviewed
Specific EU/EEA country and sub-processor list not disclosed on public pages reviewed
No API, two-factor handler access, or role-based access detail found on public pages reviewed
Number of supported reporting languages not published on public pages reviewed

Notable

Operated by Heimdal Systems AB, based at Kungsgatan 17, Stockholm, Sweden, founded in 2025 and part of the Aglander Nyman AB corporate group, with the technical platform developed together with Flowbic AB.
Distinct from the well-known Danish cybersecurity brand Heimdal Security (heimdalsecurity.com); this is a separate whistleblowing SaaS at heimdal.io.
Positioned as a low-cost Swedish whistleblowing system, marketed in Swedish as “Sveriges billigaste visselblasarsystem” (Sweden’s cheapest whistleblower system).
Free for non-profit organizations and companies with fewer than 50 employees; EUR 499/year (4,995 SEK/year) for organizations with 50 or more employees.
Paid plan runs on a 12-month agreement from order confirmation, with termination notice due no later than one month before the period ends; no monthly option was found on public pages reviewed.
Reporting is via an online reporting form (implementation described as adding a link from the customer’s website), accessible 24/7 from any device, with support for uploading most file and document types.
Anonymous reporting is the core feature: the reporter receives a unique key/link for an encrypted two-way chat, and the vendor states that no IP addresses or metadata are stored and no identity information is logged in the channel.
Compliance framing references the Swedish Whistleblower Protection Act (Lag 2021:890), EU Directive 2019/1937, NIS2 obligations, and GDPR; statutory 7-day acknowledgment and 3-month feedback deadlines are stated with on-screen deadlines and reminders.
Data is stated to be stored on servers within the EU/EEA and encrypted in transit and at rest, with automatic deletion no later than 2 years after a case is closed; the specific hosting country and any sub-processor list were not disclosed on public pages reviewed.
Accessibility is stated to meet WCAG 2.2 AA.
No ISO 27001 or other certification, two-factor handler access, role-based access detail, API documentation, DPA/DPIA materials, or a published count of reporting languages were found on public pages reviewed.

Frequently asked questions about Heimdal

Answers derived from vendor-published materials dated on this page.

Is Heimdal suitable for SMEs under 250 employees?

Yes — Heimdal's entry-tier pricing is published under €50/month, inside the range most 50–249-employee organisations budget for a reporting channel. Free for non-profit organizations and companies with fewer than 50 employees; EUR 499/year for organizations with 50 or more employees (stated in Swedish as 4,995 SEK/year). Swedish SMEs and non-profits that want a low-cost, EU-Directive-compliant reporting channel aligned to the Swedish Whistleblower Protection Act.

Which national whistleblower laws does Heimdal explicitly reference?

Heimdal explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, Sweden (Lag 2021:890). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does Heimdal process whistleblower report content with AI?

No — Heimdal does not process report content with AI or machine translation per its vendor materials. Verify the vendor's subprocessor list to confirm no downstream AI processing occurs.