whistlebox

German whistleblowing channel from DSM-Online GmbH aimed at the Mittelstand, with public headcount pricing from EUR 69/year and a 14-day self-serve trial.

Rubric score

24 / 50

Evidence tier P

Public pages only. No reporter submission or handler environment was reviewed.

How this score is produced →

Facts

Website: www.whistlebox.de(opens in new tab)
Headquarters: Dachau, Germany
Hosting: German data centre (vendor-stated); hosting provider not named on public pages reviewed
Pricing: Up to 50 employees EUR 69/year; 51-250 EUR 249/year; 251-500 EUR 499/year; 501-1,000 EUR 999/year; 1,000+ quote-only. Prices are annual on a 12-month contract.
Billed annually on a 12-month contract with automatic renewal and a four-week cancellation notice. A 14-day free self-serve test account is offered with no automatic renewal and no credit card required at signup; a live demo/consultation is also available.
Languages on reporting form: 12
Ownership: Private - DSM-Online GmbH (Dachau, Germany); the site also brands whistlebox as a product of CPExperts GmbH
Product scope: Standalone whistleblower product

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: None published
DNSSEC: Unsigned
Legal entity: DSM-Online GmbH HRB 234478 · imprint

Capabilities

Anonymous reporting ✓
Multi-channel intake ✗
Public API —
Free trial ✓
Two-factor authentication ✓
Audit log —
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

None published

National laws referenced

EU Directive 2019/1937
Germany (HinSchG)

Typical buyer

German SMEs (Mittelstand) wanting an HinSchG- and EU-Directive-compliant reporting channel with anonymous two-way chat, German data-centre hosting, and low published entry pricing.

Distinctive features

Public headcount pricing from EUR 69/year, with only the 1,000+ tier left quote-only
14-day self-serve free test account with no automatic renewal
Anonymous, end-to-end encrypted reporting with an anonymous two-way live chat
Reporter intake stated in 12 languages including German, English, French, Spanish, Italian, Dutch, Greek, Polish and Hungarian
Positioned as HinSchG- and GDPR-compliant, implementing EU Directive 2019/1937, with German data-centre hosting

Add-ons and conditions

Costs or terms not included in the headline price.

Contracts run 12 months with automatic renewal and a four-week cancellation notice; no month-to-month option was found
The 1,000+ employee tier is quote-only
ISO 27001 is attributed to the data centre, not to the vendor, on public pages reviewed
The hosting provider is not named and no whistleblowing sub-processor list was found on public pages reviewed
The Impressum names DSM-Online GmbH while the site's copyright credits CPExperts GmbH

Notable

whistlebox is a digital whistleblowing reporting system marketed to the German Mittelstand for implementing the EU Whistleblowing Directive and HinSchG (German Whistleblower Protection Act).
The Impressum names DSM-Online GmbH (Fraunhoferstrasse 9, 85221 Dachau, Germany; managing directors Mirko Tasch and Oliver Sauer; VAT DE312905465; HRB 234478, Amtsgericht Muenchen); the “Ueber uns” page describes whistlebox as a product of DSM-Online GmbH while the site copyright credits CPExperts GmbH.
Reporting is anonymous and end-to-end encrypted, with an anonymous two-way live chat so handlers can request follow-up information while preserving anonymity; reporters can voluntarily waive anonymity.
Handlers get a central dashboard showing new, ongoing and closed cases with filter functions, status changes, PDF export, multi-tenant support, and customisable branding and questions.
Reporters can upload documents, images and other evidence, and two-factor authentication is listed among the technical security measures.
Deadline handling is supported through a calendar function that tracks cases against the Directive’s statutory deadlines, and processors are notified when new reports arrive.
Reporter intake is stated in 12 languages: German, English, French, Spanish, Italian, Turkish, Dutch, Norwegian, Greek, Polish, Hungarian and Ukrainian.
Pricing is published by headcount and billed annually: EUR 69 (up to 50), EUR 249 (51-250), EUR 499 (251-500) and EUR 999 (501-1,000) per year, with 1,000+ employees quote-only; contracts run 12 months with automatic renewal and a four-week cancellation notice.
A 14-day free self-serve test account is available (first name, last name and email) with no automatic renewal; a live demo/consultation is also offered.
Hosting is stated to be in a German data centre with daily backups and described as ISO 27001 certified; this certification is attributed to the data centre, not to the vendor, and the hosting provider is not named on public pages reviewed. No ISO 27001 vendor certification, configurable retention with automatic deletion, role-based access control, internal handler notes, or API access were found on the public pages reviewed.

Frequently asked questions about whistlebox

Answers derived from vendor-published materials dated on this page.

Is whistlebox suitable for SMEs under 250 employees?

Yes — whistlebox's entry-tier pricing is published under €50/month, inside the range most 50–249-employee organisations budget for a reporting channel. Up to 50 employees EUR 69/year; 51-250 EUR 249/year; 251-500 EUR 499/year; 501-1,000 EUR 999/year; 1,000+ quote-only. Prices are annual on a 12-month contract. German SMEs (Mittelstand) wanting an HinSchG- and EU-Directive-compliant reporting channel with anonymous two-way chat, German data-centre hosting, and low published entry pricing.

Which national whistleblower laws does whistlebox explicitly reference?

whistlebox explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, Germany (HinSchG). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does whistlebox process whistleblower report content with AI?

No — whistlebox does not process report content with AI or machine translation per its vendor materials. Verify the vendor's subprocessor list to confirm no downstream AI processing occurs.