Whistleblower Software by Formalize vs Whistlelink

Whistleblower Software by Formalize

Anonymous and confidential reporting with two-way post-submission dialog is confirmed, and 80+ system languages plus an actually audited WCAG 2.1 AA (TÜV, Sep 2023) beat the median offering. But there is zero evidence of voice or hotline intake, QR entry, or any documented answer to how the reporter's identity stays out of the channel metadata — the anchor-8 channel diversity is simply absent.

Whistlelink

This is the strongest part of the product: written and oral channels with voice recording plus voice distortion for anonymity, QR entry, 50+ languages with auto-translation, WCAG, mobile-friendly, no install, and a documented code-based mechanism where no personal data is requested. It stops short of a 9-10 because the live 24/7 hotline's anonymity capability is not documented and nothing addresses whether the channel itself leaks metadata (IP logging) about the reporter.

Whistleblower Software by Formalize

Case-level and category-level access control plus handler-side anonymize/pseudonymize are real, checkable controls. But 'Advanced case management' is an adjective with nothing behind it, and the evidence is completely silent on statutory clocks, tamper-evident history, and per-case retention — silence on deadlines is the score.

Whistlelink

Case management exists with audit logs, strict access control, acknowledgements and GDPR-timeline auto-deletion, plus monitoring reports on higher tiers — that clears rubric level 3's 'thin record' floor. But there is zero evidence of automated statutory clocks (7-day/3-month reminders), conflict-of-interest exclusion of implicated handlers, tamper-evidence, or granular role separation, so it does not reach rubric level 5.

Whistleblower Software by Formalize

Five regimes are name-dropped — Directive 2019/1937, SOX 301, FCA, German Code, Loi Sapin II — with no mapping to product behavior beyond a 4-eye principle, and the citation itself is botched ('2019/19378'), which tells you the level of legal care. No acknowledgment or feedback clocks, no documented duty implementation anywhere; deadlines are the customer's problem.

Whistlelink

HinSchG is named and acknowledgement plus automated deletion exist as product features, which lifts it above pure marketing invocation — but 'fully compliant with GDPR, the directive and national laws' is adjective compliance. No evidence of feedback-deadline features, per-country rule sets, legal templates, or any documented legal review; the retention claim is tied to generic GDPR timelines, not whistleblower-specific periods.

Whistleblower Software by Formalize

The certificate wall is genuinely good: ISO 27001:2022 by Intertek (Nov 2024), annual ISAE 3000 Type 2 by Beierholm, pentests by Truesec in 2023 and 2024, plus a zero-knowledge E2EE claim that even vendor staff can't read case data. But scope of the ISO cert is unstated, the last pentest on record is over two years stale at capture, the privacy policy admits IP retention for 14 months with no no-IP-logging statement for the channel, and there is no cryptographic architecture document or security contact/disclosure policy — I cannot verify 'how would you unmask a reporter?' from this sheet.

Whistlelink

There is an ISO 27001 certificate — but scoped to the company, 'Informationssicherheit', with no visible product scope, certifying body, or validity dates — and a one-line 'external penetration tests' claim with no report, cadence, or summary. Encryption is in-transit and at-rest only; end-to-end encryption of report content is never claimed, and the evidence is completely silent on IP logging and metadata minimization — for an anonymity product, that silence decides the score below rubric level 5.

Whistleblower Software by Formalize

Unlimited channels combined with case-level and category-level access grants give real separation between handler populations, and SAML/SCIM ease provisioning. Nothing evidences a consolidated group view, per-entity branding, delegated administration, or ombudsman roles — a group would be buying the structure on trust, and the 5M-employee claim is coverage marketing, not group architecture.

Whistlelink

Industry/region-specific portals and per-brand customization on Flex/Premium suggest multiple channels, and external intake/receiver services exist — but that is exactly rubric level 3. Nothing on separation of case access per legal entity, delegated administration, group-level consolidated reporting, or ombudsman/external-counsel roles; for a corporate group, the evidence is simply not there.

Whistleblower Software by Formalize

The basics are clean: Danish controller in Aarhus, data and backups on AWS in Frankfurt with the region named, and intra-group transfers confined to Denmark, Spain and Italy. But the subprocessor list exists only on request — with Google Analytics and marketing automation named as categories and no statement of whether any touch the reporting path — and AWS itself sits under US CLOUD Act reach, so the chain is neither published nor jurisdictionally closed.

Whistlelink

The hosting claims are genuinely good and specific: servers in Sweden, all whistleblower-related data kept within the EEA, no personal data processed or hosted outside the EU, and the entity is a Swedish AB. But the paper chain is absent — no DPA published, no subprocessor list, no named data centers — so it cannot reach rubric level 5, which requires a published DPA and subprocessor transparency, and the sovereignty attributes themselves flag these as unconfirmed.

Whistleblower Software by Formalize

Two complete public tier tables with employee-band boundaries and annual billing stated let a 60-employee company compute its invoice in a minute, and 'unlimited cases, users, languages and channels' eliminates the usual per-entity and per-language add-on fog. VAT treatment and any setup fees are unstated and the 1000+ band is a sales conversation — deductions, not disqualifiers.

Whistlelink

A pricing page was captured and it enumerates tiers, add-ons and services — but not a single price figure survives into the evidence: no tier prices, no billing periods, no employee-band boundaries, and the Flex/Premium split plus the hotline add-on are unpriced. An obligated company cannot compute an invoice from what is evidenced here, which sits just above rubric level 0 only because a pricing page exists at all.