Whistleblower Software by Formalize vs Whistlelink

Whistleblower Software by Formalize

Anonymous/confidential intake with two-way follow-up is claimed, and 80+ system languages plus a TÜV-audited WCAG 2.1 AA certificate are real paper — but there is no voice, phone or QR intake channel anywhere in the evidence, and the only IP statement on file retains IP addresses up to 14 months with nothing documenting that the reporting channel itself is log-free. Good dialog; unproven channel anonymity.

Whistlelink

Web intake with guided forms, QR/shortlink entry, voice messages with voice distortion plus a 24/7 hotline add-on, 50+ languages with auto-translation, WCAG and mobile access, and a code-based anonymous two-way dialog with no personal data requested. It falls short of a 10 because the phone channel is a paid add-on and the vendor documents only the code mechanism — nothing on how the reporter's identity stays out of channel metadata.

Whistleblower Software by Formalize

Case-level and category-level access control and a 4-eye principle are genuinely granular permissions, better than all-or-nothing — but 'Advanced case management' is a label, not a feature list: no statutory 7-day/3-month clocks, no conflict-of-interest exclusion of implicated handlers, no tamper-evident history, no retention automation and no caseload reporting appear anywhere in evidence.

Whistlelink

"Fall-Management" is a label: I can confirm per-report acknowledgement, action/data logs, "strict user access control" and GDPR-timeline auto-deletion, but not one word on the statutory 7-day/3-month clocks, conflict-of-interest exclusion, case-handler role separation, or tamper-evidence. The deadline discipline a regulator asks about is simply not evidenced, so this sits below the anchor that requires clock tracking.

Whistleblower Software by Formalize

The security page name-drops the directive — mistyped as '2019/19378' — alongside SOX 301, FCA, the German Corporate Governance Code and Loi Sapin II, which is law-collecting, not implementation; no acknowledgment/feedback deadline features, no national transposition details (HinSchG, Danish act), no named counsel and no legal-update commitment exist in the evidence. 'Helps comply with EU whistleblowing laws' is exactly the vague mapping rubric level 3 describes.

Whistlelink

"Fully compliant with GDPR, the EU Whistleblower Directive and national laws" is marketing until mapped; the duties I can actually see implemented are the acknowledgement and GDPR auto-deletion, while HinSchG is a single German-market name-drop. No feedback clock, no legal templates, no named counsel, no per-country rule sets — above a bare badge, below feature-level statutory implementation.

Whistleblower Software by Formalize

Unusually real certification trail — ISO/IEC 27001:2022 by Intertek, annual ISAE 3000 Type 2 by Beierholm, Truesec pentests in 2023 and 2024, E2EE with a key-holder claim — but no pentest summaries are published, there is no security contact or disclosure policy, no metadata-minimization statement, and a 14-month IP retention clause sits next to the anonymity pitch, with SMS offered as the example MFA. Certified, yes; auditor-hostile, no.

Whistlelink

ISO 27001 is asserted at company level with a vague "Informationssicherheit" scope and "Externe Penetrationstests" is one unaudited line — no dates, no reports. Encryption in transit and at rest is stated, but there is no certificate scope, no end-to-end architecture, and total silence on IP and metadata logging, so the anonymity promise rests on trust rather than evidence.

Whistleblower Software by Formalize

'Unlimited channels, users' plus case-level access separation buys multiple channels with fine-grained permissions, but nothing evidences per-legal-entity channel structure, a consolidated group view, delegated administration, external ombudsman roles or per-entity branding. A group can technically share one account; whether that satisfies each subsidiary's separation demands is undemonstrated.

Whistlelink

"Branchen- oder regionsspezifische Portale" and tier-gated extra admin users hint at scale, but there is nothing on per-entity case access separation, a consolidated group view, delegated administration, or ombudsman/external-counsel roles. For a corporate group the multi-entity question is unanswered, which is itself the answer.

Whistleblower Software by Formalize

Danish controller, all data and backups on AWS in Frankfurt with the region named, EEA-only intra-group transfers — but AWS is a US-parent critical processor, the subprocessor list is request-only rather than published (with Google Analytics sitting in the disclosed categories), and no DPA or TOMs appear in the evidence. That is the anchor-5 profile exactly: EU hosting default with non-EU jurisdictional reach on the critical processor.

Whistlelink

A Swedish AB with Sweden-hosted servers and an explicit "no personal data processed or hosted outside the EU" claim is the right baseline — better than EU-on-request. But no published DPA, no subprocessor list and no named data centers mean the EEA-only claim is unverifiable while the processing chain stays undocumented; with the most sensitive data a company holds, undocumented is unscored.

Whistleblower Software by Formalize

Two plans carry real numbers with explicit employee-band boundaries and an asterisked 'billed annually' disclosure — the monthly-figure-for-annual-commitment optics are at least admitted. But VAT treatment is silent, setup fees are silent, everything above 999 employees is 'Contact sales', and per-entity terms rest on nothing more than a homepage 'unlimited channels' claim.

Whistlelink

A pricing page exists and plan differences are described in prose — customization, languages, admin users, monitoring reports — yet the captured evidence contains not a single number: no tier prices, no employee bands, no billing period or VAT treatment, and the hotline add-on is unpriced. No obligated company can compute an invoice from this; that is a pricing page in name only.