WorkInConfidence

UK anonymous speak-up and whistleblowing channel with two-way anonymous conversations and HR case management, from WorkInConfidence Ltd.

Non-EU HQ Suite module

Non-EU headquarters — data sovereignty risk

East Grinstead, United Kingdom. This vendor is headquartered outside the European Union. EU personal data processed by the vendor is a cross-border transfer under GDPR Chapter V and depends on an adequacy decision, Standard Contractual Clauses, or a derogation. Non-EU providers introduce jurisdictional exposure to third-country data-access regimes. For institutional buyers prioritising European data sovereignty, prefer an EU-headquartered provider.

AI processes report content — EU AI Act consideration

This vendor applies AI or machine learning to whistleblower reports (for example summarisation, severity or category classification, drafting replies, or machine translation). Automated processing of disclosures can bring the deployment within scope of the EU AI Act and routes sensitive personal data through a third-party inference provider. Confirm the model provider, its data-retention terms, and whether report content can be excluded before relying on it. Vendor detail: Homepage states AI-enhanced analysis and case management, offered on an opt-in basis.

Rubric score

21 / 50

Evidence tier P

Public pages only. No reporter submission or handler environment was reviewed.

How this score is produced →

Facts

Website: www.workinconfidence.com(opens in new tab)
Headquarters: East Grinstead, United Kingdom
Hosting: Amazon Web Services (AWS); data stored in the United Kingdom (G-Cloud service definition)
Pricing: G-Cloud service definition lists GBP 0.06 to GBP 1.13 per user per month. The vendor's own website does not publish pricing and is demo-led.
The only published figure is the per-user range on the UK Digital Marketplace (G-Cloud); the vendor site routes buyers to a demo. No free trial is offered per the G-Cloud listing.
Languages on reporting form: Not published
Founded: 2012
Domain registered: February 2014 workinconfidence.com
Ownership: Private - WorkInConfidence Ltd (England and Wales company no. 08255296)
Product scope: Module of a broader compliance platform

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Enforced (quarantine)
DNSSEC: Signed

Capabilities

Anonymous reporting ✓
Multi-channel intake ✓
Public API ✗
Free trial ✗
Two-factor authentication ✓
Audit log —
EU Directive 2019/1937 (vendor claim) —

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

Cyber Essentials Plus (vendor site)
IASME cyber assurance
NHS Data Security and Protection Toolkit

National laws referenced

United Kingdom (public whistleblowing guidance referenced; no statute named on public pages)

Typical buyer

UK public sector bodies, NHS trusts, law firms, and employers wanting anonymous speak-up plus HR case management from a UK-hosted platform available on the G-Cloud framework.

Distinctive features

Truly anonymous two-way conversations documented on public pages
Combined anonymous speak-up and HR case management in one platform
UK (AWS) data storage is clearly disclosed
Listed on the UK G-Cloud framework with a published per-user price range
Cyber Essentials, IASME assurance, and NHS Data Security and Protection Toolkit referenced

Add-ons and conditions

Costs or terms not included in the headline price.

The vendor website is demo-led; the only published rate is the G-Cloud per-user range (GBP 0.06 to GBP 1.13 per user per month)
No free trial is offered per the G-Cloud listing
No ISO 27001 certification found; AWS provides hosting-level assurance only
Data is stored in the United Kingdom (non-EU); no EU data residency option was disclosed
No public API

Notable

Operated by WorkInConfidence Ltd, registered in England and Wales (company no. 08255296), with a registered office in East Grinstead and a stated client base of 100+ UK organisations and 200,000+ employees.
The platform spans anonymous speak-up, HR case management, employee surveys, discussion forums, and an external speak-up phone line; this profile focuses on the anonymous speak-up and whistleblowing case-management product.
Core differentiator is “truly anonymous, two-way conversations” where handlers can follow up with a reporter without the reporter’s identity being revealed unless they choose to disclose it.
The product is a web-based application accessible on any device with a browser, with multiple language options stated for international organisations.
Legal framing is UK-centric: public pages reference gov.uk whistleblowing guidance and do not name the Public Interest Disclosure Act 1998 or the EU Whistleblowing Directive 2019/1937.
The G-Cloud service definition states hosting on Amazon Web Services with data stored in the United Kingdom, encryption of personally identifiable data and dialogues at rest, and TLS 1.2 or above in transit.
Multi-factor authentication is offered as an optional client choice via mobile device; audit and system logs are retained for at least 12 months.
The vendor claims Cyber Essentials Plus and IASME cyber assurance on its website and references the NHS Data Security and Protection Toolkit; no ISO 27001 certification was found on public pages reviewed. The G-Cloud listing reviewed indicated Cyber Essentials but not Cyber Essentials Plus, so the certification level is stated inconsistently across public sources.
Pricing is demo-led on the vendor site; the only published figure is a per-user range of GBP 0.06 to GBP 1.13 per user per month in the G-Cloud service definition, which also states no free trial and no API.
End-of-contract data deletion is stated to occur within three months of termination, with an optional paid 12-month run-off period.

Frequently asked questions about WorkInConfidence

Answers derived from vendor-published materials dated on this page.

Is WorkInConfidence suitable for SMEs under 250 employees?

WorkInConfidence does not publish entry-tier pricing, so SME buyers need to request a quote to assess fit. Buying path: Sales contact required. UK public sector bodies, NHS trusts, law firms, and employers wanting anonymous speak-up plus HR case management from a UK-hosted platform available on the G-Cloud framework.

Which national whistleblower laws does WorkInConfidence explicitly reference?

WorkInConfidence explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: United Kingdom (public whistleblowing guidance referenced; no statute named on public pages). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does WorkInConfidence process whistleblower report content with AI?

Yes — WorkInConfidence processes report content with AI (typically for translation, summarisation, or classification). If your compliance posture requires keeping disclosures out of third-party LLMs or machine-translation services, confirm data-processing terms and vendor subprocessors before procurement. Homepage states AI-enhanced analysis and case management, offered on an opt-in basis.