Tilkynna

Icelandic whistleblowing channel from Slidesome ehf. with anonymous two-way reporting and published ISK subscription tiers.

Non-EU HQ

Non-EU headquarters — data sovereignty risk

Iceland. This vendor is headquartered outside the European Union. EU personal data processed by the vendor is a cross-border transfer under GDPR Chapter V and depends on an adequacy decision, Standard Contractual Clauses, or a derogation. Non-EU providers introduce jurisdictional exposure to third-country data-access regimes. For institutional buyers prioritising European data sovereignty, prefer an EU-headquartered provider.

Rubric score

28 / 50

Evidence tier P

Public pages only. No reporter submission or handler environment was reviewed.

How this score is produced →

Facts

Website: tilkynna.is(opens in new tab)
Headquarters: Iceland
Pricing: Grunnur ISK 15,900/month; Voxtur ISK 24,900/month; Sersnidid quote-only. All prices plus VAT, billed on annual commitment.
Prices are in Icelandic krona (ISK), quoted per month but billed on an annual commitment, plus VAT. 30-day free trial on all tiers. Tiers scale by reporting areas, information pages, users, and storage rather than by employee count. The Custom (Sersnidid) tier is quote-only.
Languages on reporting form: Not published
Ownership: Private, Slidesome ehf. (Iceland, company reg. 410618-0790)
Product scope: Standalone whistleblower product

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Published but not enforcing
DNSSEC: Unsigned

Capabilities

Anonymous reporting ✓
Multi-channel intake ✗
Public API —
Free trial ✓
Two-factor authentication ✓
Audit log —
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

None published

National laws referenced

Iceland (Log nr. 40/2020 um vernd uppljostrara)

Typical buyer

Icelandic organizations wanting a domestic, GDPR-aligned whistleblowing channel with published ISK subscription tiers under Iceland's whistleblower protection law.

Distinctive features

Published ISK subscription tiers (Grunnur and Voxtur) with a 30-day free trial on all plans
Anonymous two-way communication with reporter return access via an identification number and password, plus two-factor authentication
Immutable event log that records all actions for a traceable case history
Multiple reporting areas on per-department subdomains, with customizable questions and information pages
Privacy policy states automatic deletion of case data within 6 months of case closure
Built for Iceland's whistleblower protection law by an Icelandic vendor (Slidesome ehf.)

Add-ons and conditions

Costs or terms not included in the headline price.

Prices are in ISK plus VAT and billed on an annual commitment; no month-to-month option found on public pages reviewed
The Custom (Sersnidid) tier is quote-only
No ISO 27001 certification found on public pages reviewed
Hosting provider and data-residency location are not disclosed on public pages reviewed
No subprocessor list or API documentation found on public pages reviewed
Reporter interface documented in Icelandic; additional reporter languages not published

Notable

Operated by Slidesome ehf. (Icelandic company registration 410618-0790), which describes Tilkynna as the first Icelandic whistleblowing system.
Positioned around Iceland’s whistleblower protection law (Log nr. 40/2020 um vernd uppljostrara, effective 1 January 2021), which the site links to on the Althingi (Icelandic Parliament) website; the vendor references the Icelandic law rather than EU Directive 2019/1937 directly, and Iceland applies whistleblower protection as an EEA state.
Reporting is delivered through an online reporting form; organizations can run multiple reporting areas on per-department subdomains (for example separate areas for employees and contractors), each with its own questions, information pages, and access rules.
Anonymous reporting is optional per organization, with an anonymous communication portal supporting two-way messaging and file sharing between the organization and the reporter.
Reporter return access uses an identification number and password, with two-factor authentication and electronic-ID authentication available.
Handler tooling includes case status (in process or completed), tagging, titles, internal comments, adding multiple managers to a case, and an immutable event log recording all actions.
The privacy policy states all data is stored and transmitted encrypted, names a data protection officer, and states registered information is deleted from the database within 6 months of case closure.
Pricing is published for two tiers: Grunnur at ISK 15,900/month and Voxtur at ISK 24,900/month, both plus VAT and billed on an annual commitment; a Custom (Sersnidid) tier is quote-only. A 30-day free trial is offered on all tiers.
Listed clients include VIS, Perlan, Samherji, Oryggismidstodin, and Icelandair.
No ISO 27001 certification, hosting-provider or data-residency disclosure, subprocessor list, or public API documentation was found on the pages reviewed.
The whistleblower.is domain redirects to an access-protected deployment; tilkynna.is is the canonical public site and carries an English version at tilkynna.is/en.

Frequently asked questions about Tilkynna

Answers derived from vendor-published materials dated on this page.

Is Tilkynna suitable for SMEs under 250 employees?

Tilkynna's entry-tier pricing starts above €100/month, on the heavy side for a 50–249-employee organisation comparing to flat-rate alternatives. Grunnur ISK 15,900/month; Voxtur ISK 24,900/month; Sersnidid quote-only. All prices plus VAT, billed on annual commitment. Icelandic organizations wanting a domestic, GDPR-aligned whistleblowing channel with published ISK subscription tiers under Iceland's whistleblower protection law.

Which national whistleblower laws does Tilkynna explicitly reference?

Tilkynna explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: Iceland (Log nr. 40/2020 um vernd uppljostrara). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does Tilkynna process whistleblower report content with AI?

No — Tilkynna does not process report content with AI or machine translation per its vendor materials. Verify the vendor's subprocessor list to confirm no downstream AI processing occurs.