whistle.law

German HinSchG-focused whistleblowing platform with published EUR 50-150/month pricing and public GDPR/security documentation.

Rubric score

31 / 50

Evidence tier P

Public pages only. No reporter submission or handler environment was reviewed.

How this score is produced →

Facts

Website: whistle.law(opens in new tab)
Headquarters: Germany
Hosting: Germany; provider not named on public pages reviewed
Pricing: EUR 50/month for up to 99 employees, EUR 100/month for up to 249 employees, EUR 150/month for up to 999 employees; 1,000+ quote-based.
30-day free test advertised. Public pricing page says no hidden costs; add-on legal reporting channels such as ESG / LkSG are price-on-request.
Languages on reporting form: 24
Domain registered: July 2021 whistle.law
Ownership: whistle.law GmbH
Product scope: Standalone whistleblower product
Encryption posture: At rest

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Published but not enforcing
DNSSEC: Unsigned

Capabilities

Anonymous reporting ✓
Multi-channel intake ✗
Public API ✗
Free trial ✓
Two-factor authentication ✓
Audit log ✓
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

ISO 27001

National laws referenced

Germany (HinSchG)
EU Directive 2019/1937

Typical buyer

German companies and municipalities that want published HinSchG pricing, all EU official reporting languages, and a downloadable DPA.

Distinctive features

Published EUR 50 / EUR 100 / EUR 150 monthly price bands
Public GDPR/security page with German hosting, 2FA, encrypted storage, and DPA/AVV documentation
Reporting interface advertised in all official EU languages

Add-ons and conditions

Costs or terms not included in the headline price.

Add-on channels for ESG / LkSG and other regimes are described, but public add-on prices were not found
Hosting provider and subprocessor list were not disclosed on public pages reviewed

Notable

whistle.law is operated by whistle.law GmbH according to the current pricing page footer.
Public pricing is available from EUR 50 to EUR 150/month for organisations up to 999 employees; 1,000+ employees require an individual quote.
The online reporting form can be configured in all official EU languages according to vendor copy reviewed.
Security page documents German servers, ISO 27001, 2FA, encrypted storage, automated deadlines, and revision-safe documentation.
Vendor publishes a DPA/AVV page.
The public pages reviewed do not name the hosting provider or subprocessors and do not publish API documentation.
I did not find public evidence for phone, email, or oral intake beyond the web portal and topical add-on channels such as ESG/LkSG.

Frequently asked questions about whistle.law

Answers derived from vendor-published materials dated on this page.

Is whistle.law suitable for SMEs under 250 employees?

Yes — whistle.law's entry-tier pricing is published under €50/month, inside the range most 50–249-employee organisations budget for a reporting channel. EUR 50/month for up to 99 employees, EUR 100/month for up to 249 employees, EUR 150/month for up to 999 employees; 1,000+ quote-based. German companies and municipalities that want published HinSchG pricing, all EU official reporting languages, and a downloadable DPA.

Which national whistleblower laws does whistle.law explicitly reference?

whistle.law explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: Germany (HinSchG), EU Directive 2019/1937. Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does whistle.law process whistleblower report content with AI?

No — whistle.law does not process report content with AI or machine translation per its vendor materials. Verify the vendor's subprocessor list to confirm no downstream AI processing occurs.