Lumgo

Swedish whistleblowing SaaS from Lumgo AB with EU-only hosting, Microsoft 365 / Google Workspace sign-in, and published per-employee pricing from SEK 4,500/year.

AI processes report content — EU AI Act consideration

This vendor applies AI or machine learning to whistleblower reports (for example summarisation, severity or category classification, drafting replies, or machine translation). Automated processing of disclosures can bring the deployment within scope of the EU AI Act and routes sensitive personal data through a third-party inference provider. Confirm the model provider, its data-retention terms, and whether report content can be excluded before relying on it. Vendor detail: Markets a legal AI assistant named Paige that offers guidance on incoming cases.

Rubric score

21 / 50

Evidence tier P

Public pages only. No reporter submission or handler environment was reviewed.

How this score is produced →

Facts

Website: www.lumgo.com(opens in new tab)
Headquarters: Stockholm, Sweden
Hosting: EU-hosted in Nantes, France; vendor states it uses only EU-owned suppliers and does not use AWS or Azure (vendor-stated)
Pricing: Under 50 employees SEK 4,500/year; up to 250 employees SEK 9,500/year; over 250 employees SEK 15,000/year. VAT added. Vendor states this equals from about EUR 45/month.
Billed annually by invoice or credit card. 14-day free trial with automatic account closure if not continued. Vendor states no contract is required. All tiers include unlimited users, SSO, all languages, secure communication, and support.
Languages on reporting form: 9
Domain registered: December 2013 lumgo.com
Ownership: Private, Lumgo AB (Sweden), org. nr 559380-4247
Product scope: Standalone whistleblower product

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Published but not enforcing
DNSSEC: Unsigned

Capabilities

Anonymous reporting ✓
Multi-channel intake ✗
Public API —
Free trial ✓
Two-factor authentication ✗
Audit log —
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

None published

National laws referenced

EU Directive 2019/1937
Sweden (Lag 2021:890)

Typical buyer

Swedish and Nordic SMEs wanting a self-serve, EU-only-hosted reporting channel with Microsoft 365 or Google Workspace sign-in and published per-employee pricing.

Distinctive features

Published per-employee pricing across all three tiers with a 14-day free trial
EU-only hosting stated in Nantes, France, with vendor claim of EU-owned suppliers and no AWS or Azure
Sign-in delegated to Microsoft 365 or Google Workspace, with no usernames or passwords stored by the vendor
Anonymous reporting with PIN-code case tracking and two-way secure chat
Nine reporting languages listed (Swedish, Danish, Norwegian, Finnish, German, French, English, Italian, Dutch)

Add-ons and conditions

Costs or terms not included in the headline price.

Billing is annual; a monthly contract option was not found on public pages reviewed
No ISO 27001 or SOC 2 certification found on public pages reviewed
No sub-processor list, DPA download, or DPIA material found on public pages reviewed
Article-level EU Directive or Swedish law mapping and statutory 7-day/3-month deadline tracking were not found on public pages reviewed
API access not advertised on public pages reviewed

Notable

Operated by Lumgo AB, a Swedish company (org. nr 559380-4247) based in the Stockholm region, described as made in Stockholm and hosted in Nantes, France.
Positioned as a modern whistleblowing application supporting the EU Whistleblowing Directive and the Swedish whistleblowing law (Lag 2021:890), with GDPR framed as a core design goal.
Reporters can submit anonymously and follow their case with a PIN code, with a built-in secure chat for two-way follow-up questions.
Organizations can create unlimited reporting channels with customizable, branded reporting pages.
Sign-in for the organization side is delegated to Microsoft 365 or Google Workspace single sign-on; the vendor states it does not store usernames or passwords, and deleting a user in the identity provider automatically removes Lumgo access.
Markets a legal AI assistant named Paige that provides guidance on incoming cases, and mentions external recipients such as partner law firms that can receive reports independently.
States it encrypts all sensitive data, stores data within the EU, and uses only EU-owned suppliers, explicitly avoiding AWS and Azure to address Schrems II concerns.
Nine reporting languages are listed: Swedish, Danish, Norwegian, Finnish, German, French, English, Italian, and Dutch.
Pricing is published across three per-employee tiers billed annually (SEK 4,500 / 9,500 / 15,000 per year plus VAT), with a 14-day free trial and vendor statement that no contract is required.
No ISO 27001 or SOC 2 certification, sub-processor list, DPA download, DPIA material, or API documentation was found on public pages reviewed.

Frequently asked questions about Lumgo

Answers derived from vendor-published materials dated on this page.

Is Lumgo suitable for SMEs under 250 employees?

Yes — Lumgo's entry-tier pricing is published under €50/month, inside the range most 50–249-employee organisations budget for a reporting channel. Under 50 employees SEK 4,500/year; up to 250 employees SEK 9,500/year; over 250 employees SEK 15,000/year. VAT added. Vendor states this equals from about EUR 45/month. Swedish and Nordic SMEs wanting a self-serve, EU-only-hosted reporting channel with Microsoft 365 or Google Workspace sign-in and published per-employee pricing.

Which national whistleblower laws does Lumgo explicitly reference?

Lumgo explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, Sweden (Lag 2021:890). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does Lumgo process whistleblower report content with AI?

Yes — Lumgo processes report content with AI (typically for translation, summarisation, or classification). If your compliance posture requires keeping disclosures out of third-party LLMs or machine-translation services, confirm data-processing terms and vendor subprocessors before procurement. Markets a legal AI assistant named Paige that offers guidance on incoming cases.