whistly

Berlin-based whistleblowing channel from whistly digital GmbH, positioned for German HinSchG and supply-chain (LkSG) compliance, from EUR 59 per month regardless of headcount.

Rubric score

29 / 50

Evidence tier P

Public pages only. No reporter submission or handler environment was reviewed.

How this score is produced →

Facts

Website: whistly.org(opens in new tab)
Headquarters: Berlin, Germany
Hosting: ISO 27001 certified servers in Germany (hosting-provider certification, provider not named; vendor-stated)
Pricing: Two published packages: Essential EUR 59/month and Pro EUR 99/month, charged regardless of employee count.
10-day free trial. Essential is stated to cover English and German; Pro is stated to cover five languages (English, German, French, Spanish, Chinese). Pricing is rendered inside a JavaScript app; package figures were corroborated via the pricing page meta description and a third-party review listing.
Languages on reporting form: 5
Domain registered: January 2023 whistly.org
Ownership: Private, whistly digital GmbH (District Court of Charlottenburg, Berlin, HRB 249593 B)
Customers: 100+ to 500+ organizations (vendor claims vary by page: 100+ on the LkSG page, over 200 on the about page, 500+ on the vendor blog)
Product scope: Standalone whistleblower product

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Enforced (reject)
DNSSEC: Unsigned

Capabilities

Anonymous reporting ✓
Multi-channel intake ✗
Public API —
Free trial ✓
Two-factor authentication —
Audit log —
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

None published

National laws referenced

EU Directive 2019/1937
Germany (Hinweisgeberschutzgesetz, HinSchG)
Germany (Lieferkettensorgfaltspflichtengesetz, LkSG)

Typical buyer

German SMEs needing a HinSchG-compliant reporting channel with flat, headcount-independent pricing, optionally paired with supply-chain (LkSG) reporting.

Distinctive features

Flat pricing from EUR 59/month regardless of employee count
10-day free trial advertised
Anonymous two-way communication with reporters
Explicit German HinSchG and LkSG supply-chain positioning
German data residency stated (ISO 27001 hosting provider)

Add-ons and conditions

Costs or terms not included in the headline price.

Vendor customer-count claims are inconsistent across pages (100+, over 200, and 500+)
ISO 27001 refers to the hosting provider's servers, not to whistly as a vendor
Only English and German are included on the entry Essential package; more languages require Pro
No public API documentation, sub-processor list, or DPA download found on pages reviewed
Pricing and product pages render via JavaScript and expose little static HTML

Notable

Operated by whistly digital GmbH, Berlin, registered at the District Court of Charlottenburg under HRB 249593 B. This is a distinct vendor from the Hungarian Whisly (whisly.hu).
Standalone whistleblowing SaaS positioned first for German compliance: the Hinweisgeberschutzgesetz (HinSchG), the Supply Chain Due Diligence Act (LkSG), and the General Equal Treatment Act (AGG), alongside EU Directive 2019/1937.
Public materials describe a customizable report page, automated case management, anonymous two-way communication with reporters, file upload, and an ombudsperson option.
Two published packages: Essential at EUR 59/month (English and German) and Pro at EUR 99/month (five languages: English, German, French, Spanish, Chinese), both priced regardless of employee count.
A 10-day free trial is advertised.
Security messaging states end-to-end encryption and hosting on ISO 27001 certified servers in Germany; the certification is the hosting provider’s, not a whistly vendor certification, and the provider is not named.
Customer-count claims are inconsistent across the site: the LkSG page says 100+ companies, the about page says over 200 businesses, and the vendor blog says 500+ European companies.
No public API documentation, sub-processor list, DPA download, or article-level Directive/HinSchG mapping was found on pages reviewed; the site renders via JavaScript and exposes little static HTML.

Frequently asked questions about whistly

Answers derived from vendor-published materials dated on this page.

Is whistly suitable for SMEs under 250 employees?

Likely yes — whistly's entry-tier pricing sits in the €50–100/month band, workable for most 50–249-employee organisations. Two published packages: Essential EUR 59/month and Pro EUR 99/month, charged regardless of employee count. German SMEs needing a HinSchG-compliant reporting channel with flat, headcount-independent pricing, optionally paired with supply-chain (LkSG) reporting.

Which national whistleblower laws does whistly explicitly reference?

whistly explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, Germany (Hinweisgeberschutzgesetz, HinSchG), Germany (Lieferkettensorgfaltspflichtengesetz, LkSG). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does whistly process whistleblower report content with AI?

No — whistly does not process report content with AI or machine translation per its vendor materials. Verify the vendor's subprocessor list to confirm no downstream AI processing occurs.