Whistleblower Software by Formalize vs Whistlelink

Whistleblower Software by Formalize

The anonymous two-way dialog is first-class — E2EE means not even the vendor can read case data, 80+ languages dwarf the usual offering, and WCAG 2.1 AA was actually audited by TÜV. But the evidence shows not one non-web intake channel: no hotline, no voice message, no QR entry for the night-shift worker with only a phone, and the one metadata statement I can find retains IPs up to 14 months rather than promising the reporter's trail is invisible.

Whistlelink

Engineered for the frightened reporter: no personal data asked at intake, a case code for the anonymous two-way dialog, 50+ languages with automatic translation, mobile/QR entry, and voice recordings distorted so the voice itself cannot identify the speaker. Only the 24/7 hotline being a paid add-on with its live-call anonymity asserted rather than documented keeps me one notch from the top.

Whistleblower Software by Formalize

Case-level and category-level access, the 4-eye principle, and anonymize/pseudonymize for multi-handler cases are real separation. But the evidence is completely silent on the statutory clocks — no 7-day acknowledgment tracking, no 3-month feedback reminders, no tamper-evident history, no per-case retention — and 'Advanced case management' is a marketing word with nothing behind it here.

Whistlelink

Case management with receipt confirmation per report, external review-and-forward intake, action/data logs and MFA exists — but the evidence is silent on automated statutory clocks (especially the 3-month feedback a reporter is owed), conflict-of-interest exclusion and tamper-evidence of case history. Monitoring reports are monthly and tier-gated, so caseload reporting is limited; the absence of deadline discipline decides this.

Whistleblower Software by Formalize

A law list on the security page invokes the Directive, SOX 301, FCA, the German Code and Sapin II, and the marketing promises EU whistleblowing compliance — that is naming, not implementing. Nothing evidences deadline automation, documentation duties, retention periods per law, per-country rule sets, or any named counsel; the legal homework looks like the customer's problem.

Whistlelink

The duties appear as features, not slogans: oral and written channels, acknowledgment for every report, auto-deletion per GDPR timelines, and the HinSchG thresholds (>50 employees, >10,000-inhabitant municipalities) correctly quoted. But the mapping ends at a blanket 'fully compliant with GDPR, EU directive and national laws' — no per-country rule sets, no named legal review, no deadline automation.

Whistleblower Software by Formalize

The assurance stack is real and dated — ISO/IEC 27001:2022 by Intertek, annual ISAE 3000 Type 2, ENS High, recurring Truesec pentests in 2023 and 2024 — and the claim that only the key holder can view case data is the right shape for operator-proof anonymity. But metadata minimization is unexplained, there is no security contact or disclosure policy, and the only IP statement I can find keeps IPs up to 14 months; nobody here answers 'how would you unmask a reporter?'

Whistlelink

ISO 27001 for the named company and external penetration tests are attested, with encryption in transit and at rest, redundancy and MFA — above the adjectives floor. But there is no end-to-end claim, no disclosure policy, and total silence on IP and metadata logging: for a reporter on a company phone, nothing here answers 'how would you unmask me?', and the anonymity mechanism (code, no personal data) is documented but never analysed against the operator itself.

Whistleblower Software by Formalize

'Unlimited channels' with case-level access control gives a one-account-many-channels shape with genuine access granularity, and the vendor claims 5M+ employees covered. But nothing evidences per-entity channel separation, group-level oversight, external ombudsman roles, delegated administration or white-labeling — the group architecture this criterion asks about is simply not on the evidence.

Whistlelink

Industry- or region-specific portals, logo/questionnaire/text customization on Flex and Premium, extra admin users, and an external third-party intake service exist. Nothing evidences separated case access per legal entity, a group-level consolidated view, or delegated administration — a group of N subsidiaries would be buying on faith.

Whistleblower Software by Formalize

The confirmed parts are good: a Danish controller, Formalize ApS in Aarhus, all data and backups in AWS Frankfurt with EEA-only intra-group transfers. But the subprocessor list is available only on request rather than published, AWS Frankfurt sits under a US parent's CLOUD Act reach, and the evidence itself flags residency, ownership and subprocessor exposure as unverified — 'unknown' is not where the most sensitive data a company holds should live.

Whistlelink

Sweden-hosted servers with an explicit 'no personal data processed or hosted outside the EU', operated by a named Swedish AB — the data about people stays in Europe. But no published DPA, no subprocessor list and no named data centers appear anywhere: the chain is asserted in prose, not documented, so the assurance stops at the vendor's word.

Whistleblower Software by Formalize

Both tiers carry real per-band numbers up to 999 employees with 'billed annually' stated, so a mid-sized obligated company can roughly compute the invoice. But VAT treatment, setup fees and any entity or add-on pricing are absent, the 1000+ band is a sales conversation, and the generic 'unlimited channels' does not tell me what a second legal entity costs.

Whistlelink

A public pricing page names the tiers (Flex, Premium), an 'all functions included' claim and the add-ons — 24/7 hotline, external intake — but not a single price, employee band, VAT treatment or setup fee is evidenced. No obligated company can compute its invoice from what is published, and one cannot even confirm an entry price exists.