WhistleFox

Law-firm-operated whistleblowing service from Heuking Kühn Lüer Wojtek, bundling a digital reporting channel with legal case handling by the firm's compliance lawyers.

Rubric score

18 / 50

Evidence tier P

Public pages only. No reporter submission or handler environment was reviewed.

How this score is produced →

Facts

Website: whistlefox.heuking.de(opens in new tab)
Headquarters: Düsseldorf, Germany
Hosting: Heuking's own servers in Germany (vendor-stated)
Pricing: Not published. WhistleFox is engaged as a managed legal service, so pricing is quote-only via the firm.
No public pricing, tiers, or trial. The offering bundles legal case handling (initial assessment, risk analysis, investigations on request, deadline management, reporting) by Heuking lawyers, so it is contracted as a service rather than a self-serve subscription.
Languages on reporting form: 2
Ownership: Operated by Heuking Kühn Lüer Wojtek Partnerschaft mbB (Germany, VAT DE 119 459 367)
Product scope: Standalone whistleblower product

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Enforced (reject)
DNSSEC: Signed

Capabilities

Anonymous reporting ✓
Multi-channel intake ✓
Public API —
Free trial ✗
Two-factor authentication —
Audit log —
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

None published

National laws referenced

EU Directive 2019/1937
Germany (LkSG, Supply Chain Due Diligence Act)

Typical buyer

German-speaking businesses, public authorities, municipalities, and associations that want an external, lawyer-operated ombudsman reporting channel with legal case handling included rather than a self-serve reporting tool they run themselves.

Distinctive features

Managed ombudsman model where sworn Heuking lawyers receive and process reports under a duty of confidentiality
map[Multi-channel intake:24/7 online reporting form, phone, email, postal mail, and in-person meetings]
Bundled legal services include initial assessment, risk analysis, internal investigations on request, deadline management, and case, quarterly, and annual reporting
Data hosted on Heuking's own servers in Germany, with the firm claiming no storage of whistleblower-identifying metadata
Backed by Heuking Kühn Lüer Wojtek, a German full-service firm of roughly 450 lawyers with eight German offices

Add-ons and conditions

Costs or terms not included in the headline price.

No pricing, tiers, or free trial published on public pages reviewed
Positioned as a managed legal service, so the cost includes lawyer case handling and is quote-only
No ISO 27001 or other security certification found on public pages reviewed; the firm claims security that "outperforms requirements" without naming a standard
German whistleblowing transposition (HinSchG) is not explicitly cited with article numbers on public pages reviewed; the site references the EU Directive and LkSG
Only German and English versions found; broader EU language coverage not documented on public pages reviewed

Notable

WhistleFox is operated by Heuking Kühn Lüer Wojtek Partnerschaft mbB, a German full-service law firm of roughly 450 lawyers with offices in Berlin, Chemnitz, Düsseldorf, Frankfurt, Hamburg, Cologne, Munich, and Stuttgart; the registered seat is Düsseldorf (VAT DE 119 459 367).
Heuking positions WhistleFox as the first German law firm to develop its own digital whistleblowing system, combining a technical reporting channel with the firm’s own legal case handling.
This is a managed ombudsman service, not a self-serve SaaS: reports are received and processed by the firm’s confidential lawyers, who are bound by professional confidentiality obligations.
Reporting channels include a 24/7 online reporting form, phone, email, postal mail, and in-person meetings.
The firm states that anonymity is guaranteed on request and that no whistleblower-identifying metadata is stored, so identity cannot be inferred.
Bundled legal services include statutory intake confirmation, a legal preliminary assessment by compliance specialists, risk analysis and recommendations for action, internal investigations on request, a deadline-management system, and individual, quarterly, and annual reporting for management.
Data is hosted on Heuking’s own servers in Germany; the firm claims security that outperforms standard requirements but names no certification, and no ISO 27001 was found on public pages reviewed.
Public materials reference the EU Whistleblower Directive 2019/1937 (organizations with 50+ employees) and the German Supply Chain Due Diligence Act (LkSG); the German whistleblowing transposition (HinSchG) is not explicitly named with article numbers on the pages reviewed.
Target customers are businesses, public authorities, municipalities, and associations across all sectors, with national and international scope claimed.
The service is offered in German (primary) and English; broader EU language coverage was not documented.
No pricing, tiers, or free trial are published; because case handling by lawyers is included, WhistleFox is contracted as a service and priced by quote.

Frequently asked questions about WhistleFox

Answers derived from vendor-published materials dated on this page.

Is WhistleFox suitable for SMEs under 250 employees?

WhistleFox does not publish entry-tier pricing, so SME buyers need to request a quote to assess fit. Buying path: Sales contact required. German-speaking businesses, public authorities, municipalities, and associations that want an external, lawyer-operated ombudsman reporting channel with legal case handling included rather than a self-serve reporting tool they run themselves.

Which national whistleblower laws does WhistleFox explicitly reference?

WhistleFox explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, Germany (LkSG, Supply Chain Due Diligence Act). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does WhistleFox process whistleblower report content with AI?

No — WhistleFox does not process report content with AI or machine translation per its vendor materials. Verify the vendor's subprocessor list to confirm no downstream AI processing occurs.