Whistlechannel

Swedish reporting channel from 99 kr/month with a versioned sub-processor list, Hetzner Finland hosting, and an explicit statement that it holds no certification.

AI processes report content — EU AI Act consideration

This vendor applies AI or machine learning to whistleblower reports (for example summarisation, severity or category classification, drafting replies, or machine translation). Automated processing of disclosures can bring the deployment within scope of the EU AI Act and routes sensitive personal data through a third-party inference provider. Confirm the model provider, its data-retention terms, and whether report content can be excluded before relying on it. Vendor detail: AI-assisted categorisation is stated to run on the vendor's own EU infrastructure, with no third-party or US AI provider receiving report content.

Facts

Website: whistlechannel.eu(opens in new tab)
Headquarters: Sweden
Hosting: Hetzner Online GmbH in Finland for application and database infrastructure, with Bunny.net (Slovenia) for CDN and DNS, named on the sub-processor page.
Pricing: Basic 99 kr/month up to 1,000 employees. Standard 299 kr/month up to 5,000. Premium 899 kr/month unlimited. No lock-in and no setup fee.
All three tiers include the same 24 EU languages and unlimited reports; the difference is headcount ceiling and support level. A trial with no credit card is advertised. SLA guarantee and custom branding start at the 899 kr Premium tier.
Languages on reporting form: 24
Product scope: Standalone whistleblower product
Encryption posture: Not published

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Published but not enforcing
DNSSEC: Unsigned
Legal entity: Manpro AB Org. nr 556699-1807 · imprint

Capabilities

Anonymous reporting ✓
Multi-channel intake ✗
Public API —
Free trial ✓
Two-factor authentication —
Audit log ✓
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

None published

National laws referenced

EU Directive 2019/1937
Sweden (Visselblåsarlagen, SFS 2021:890)

Typical buyer

Swedish employers that need a Visselblåsarlagen channel at a published monthly price with no lock-in, and a data-protection review that can be answered from a published sub-processor list rather than a sales call.

Distinctive features

The sub-processor list is versioned and dated, names each party's country and data scope, and states that the DPA incorporates the list as published on its effective date — so the version a customer signed does not silently change
Certification status is stated rather than implied: "we hold no formal certification at this time and are transparent about remaining gaps", against ISO 27001 and NIS 2 alignment claims
Full price matrix published in kronor with no lock-in, no setup fee and no card required for the trial, across 24 EU languages at every tier

Add-ons and conditions

Costs or terms not included in the headline price.

No certification is held; ISO 27001 appears on the homepage under the label "Aligned"
Encryption is described as AES-256 in transit; no encryption-at-rest claim appears on the pages reviewed
The homepage states "inga underleverantörer utanför EU/EES", while the sub-processor page names Stripe Payments Europe Ltd with a US parent — flagged by the vendor itself, but the two pages read differently
Report data is hosted in Finland, not Sweden, despite the Swedish-sovereignty framing
No legal entity, address or company number appears on the homepage or in a footer imprint; Manpro AB is named only inside the privacy policy
Standard and Premium differ from Basic only by headcount and support, so a small employer needing an SLA pays the 899 kr tier

Notable

Operated by Manpro AB (org. nr 556699-1807). The company name appears only in the privacy policy and sub-processor page; the marketing site itself carries no imprint.
The sub-processor page is the strongest artefact here. Version 1.0, effective 4 September 2026, lists Bunny.net d.o.o. (Slovenia) for CDN and DNS, Hetzner Online GmbH (Finland) for hosting, Stripe Payments Europe Ltd (Ireland) for billing and One.com / team.blue (Denmark) for transactional email, each with a stated data scope, plus a version history and a customer right to object under the DPA.
Data-sovereignty framing is the product’s main pitch: no US cloud providers, no Cloud Act or FISA 702 exposure, and the claim that standard contractual clauses are unnecessary because data never leaves the EU/EEA. The one qualification the vendor surfaces itself is Stripe’s US parent.
Security claims are narrower than the marketing suggests. The privacy policy states data is encrypted in transit (TLS/AES-256), reporter IP addresses are not logged, and access to report content is restricted to authorised case handlers. No at-rest encryption claim was found on the pages reviewed.
Legal positioning is precise for Sweden: SFS 2021:890 by number, the 50-employee threshold, the December 2021 and December 2023 phase dates, and both the 7-day and 3-month deadlines.
The site is built for machine reading as much as human reading — the homepage carries question-and-answer blocks phrased as assistant prompts (“Vem erbjuder en säker, molnbaserad visselblåsarplattform för organisationer i EU?”). That is a plausible reason this vendor surfaced in the citation audit at a volume its market presence would not otherwise predict.

Status: not yet scored

Whistlechannel was added from the September 2026 AI-citation coverage audit. The entry above records what the vendor publishes. It carries no 25-criterion rubric score yet and does not appear in the Sweden ranking; a score will be added when the product has been reviewed under the same tier rules as every other scored tool.

Frequently asked questions about Whistlechannel

Answers derived from vendor-published materials dated on this page.

Is Whistlechannel suitable for SMEs under 250 employees?

Yes — Whistlechannel's entry-tier pricing is published under €50/month, inside the range most 50–249-employee organisations budget for a reporting channel. Basic 99 kr/month up to 1,000 employees. Standard 299 kr/month up to 5,000. Premium 899 kr/month unlimited. No lock-in and no setup fee. Swedish employers that need a Visselblåsarlagen channel at a published monthly price with no lock-in, and a data-protection review that can be answered from a published sub-processor list rather than a sales call.

Which national whistleblower laws does Whistlechannel explicitly reference?

Whistlechannel explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, Sweden (Visselblåsarlagen, SFS 2021:890). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does Whistlechannel process whistleblower report content with AI?

Yes — Whistlechannel processes report content with AI (typically for translation, summarisation, or classification). If your compliance posture requires keeping disclosures out of third-party LLMs or machine-translation services, confirm data-processing terms and vendor subprocessors before procurement. AI-assisted categorisation is stated to run on the vendor's own EU infrastructure, with no third-party or US AI provider receiving report content.