Whistleblower Software by Formalize vs Whistlelink

Whistleblower Software by Formalize

Anonymous and confidential reporting with two-way follow-up dialog is first-class, and 80+ system languages plus an audited WCAG 2.1 AA rating beat the mid anchor comfortably. What holds it below 8: no evidence anywhere of phone/voice intake, hotline, or alternative entry channels for the frightened reporter.

Whistlelink

Multiple channels are real: written and oral intake, QR/short-link entry, a 24/7 hotline add-on with voice distortion, 50+ languages with auto-translation, WCAG, mobile, and no install — plus a documented code-based anonymity mechanism with two-way anonymous dialog. It only misses the 10-anchor bar because nothing documents how the reporter's identity is kept out of the channel itself (no IP/metadata statement).

Whistleblower Software by Formalize

Case-level and category-level access control, a 4-eye principle and pseudonymization for multi-handler cases show genuine role separation — better than the all-or-nothing anchor at 3. But 'advanced case management' is a plan bullet with nothing behind it in this sheet: no statutory clocks, no deadline reminders for the 7-day/3-month duties, no tamper-evident history, no caseload reporting, and deadlines are precisely what I answer for.

Whistlelink

The pieces exist — per-report acknowledgment, case management, secure evidence uploads, action/data logs, strict access control, auto-deletion, and monthly monitoring reports on higher tiers — but nowhere does the evidence evidence automated statutory clocks (a 3-month feedback deadline with reminders), conflict-of-interest exclusion of implicated handlers, or a tamper-evident history. As the person who answers for missed clocks, I cannot tell whether the 3-month duty is the system's job or still mine; that keeps it below the 5 anchor.

Whistleblower Software by Formalize

The EU Directive 2019/1937 is named, alongside SOX 301, UK FCA and Loi Sapin II, but it is a list on a security page — no acknowledgment or feedback clocks as features, no retention implementation for case data, no transposition-specific rules, no named counsel. The mapping to actual duties is left as the customer's problem, which is exactly the anchor at 3.

Whistlelink

The directive, GDPR, HinSchG and 'national laws' are all invoked, and two duties are implemented as features (per-report acknowledgment, automated deletion), with an external intake/receiver service offered. But the mapping stays marketing-level: no per-transposition rule sets, no feedback-clock feature, no legal review or update process documented — the differing national details appear to remain the customer's problem.

Whistleblower Software by Formalize

Current ISO 27001:2022 (Intertek, Nov 2024), annual ISAE 3000 Type 2, back-to-back Truesec pentests and ENS High, plus E2EE where the vendor states its own staff cannot read case data — that is real, attested assurance. It misses 8 because there is no metadata minimization story (IP retained up to 14 months), no published security contact or disclosure policy, no cryptographic architecture, and no 'how would you unmask a reporter' analysis.

Whistlelink

A company-level ISO 27001 certificate, attested external penetration tests, encryption in transit and at rest, MFA and redundancy are more than adjectives — but the anonymity engineering is where it thins out: no end-to-end architecture documentation, no statement on IP or metadata logging, no security contact or disclosure policy. For whistleblowing data, silence on metadata is precisely the question a hostile auditor will ask.

Whistleblower Software by Formalize

Unlimited channels, users and languages with case-level access separation and a claimed 5,000,000+ employee footprint gesture at scale, but nothing evidences per-legal-entity channel structure, a group-level consolidated view, external counsel/ombudsman access, delegated administration, or per-entity branding. A corporate group here buys promises, not architecture.

Whistlelink

Multiple industry/region-specific portals, Flex/Premium customization (logos, questionnaires, texts), extra admin users and third-party intake forwarding suggest N channels under one account — but there is no evidence of separated case access per legal entity, a consolidated group view, delegated administration or ombudsman roles. For a corporate group this reads as rubric level 3: several portals, no entity separation I could defend to a subsidiary.

Whistleblower Software by Formalize

Danish controller (Formalize ApS, Aarhus), all data and backups on AWS in Frankfurt, intra-group transfers confined to Denmark, Spain and Italy, and Schrems II acknowledged — that clears the mid anchor. Below 8 because the subprocessor list is only available on request, Google Analytics and other US-reach services appear in the chain, no public DPA/TOMs are evidenced, and the host itself (AWS) sits within US CLOUD Act reach.

Whistlelink

Hosting exclusivity is actually strong: all whistleblower-related data stays within the EEA on Sweden-hosted servers with no processing outside the EU, and the vendor is a Swedish AB. But the transparency around the chain is absent — no DPA, no subprocessor list, and ownership/jurisdiction explicitly unconfirmed in the computed attributes — which is exactly the documentation I need for the most sensitive data we hold.

Whistleblower Software by Formalize

For my 600 employees the invoice is a two-minute exercise: 500-999 band at €349/€529 per month, billed annually in EUR, with a 14-day trial and clean band boundaries on two named tiers. Held below 8 because VAT treatment is unstated, setup fees are never mentioned, the multi-entity rule is unspecified, and 1,000+ employees drops to 'contact sales'.

Whistlelink

A pricing page exists and names plans (Flex, Premium) plus a hotline add-on and tier differences (customization, languages, admin users), but the evidence contains not one figure — no prices, employee bands, VAT treatment or setup fees anywhere in evidence. An obligated company could not compute its invoice from what is published here; this is essentially the 0-anchor situation with a bit of structure.