Whistleblowing Portals
ACT4 Compliance (compliance2b)
EU-Made Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 3 of 4 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Compliance 2b GmbH · compliance2b.at
Report an error on this page Is this your product? →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
ACT4 Compliance is an Austrian whistleblowing portal from Compliance 2b GmbH, and the panel scores it strongest on reporting channels at 6-7 and compliance alignment at 6-7. Intake is built around the anonymous reporter — link or QR-code entry, retrieval via a randomly generated code, voice recordings at submission, and a written statement that no IP addresses or document metadata are stored — while the Austrian legal documentation is public and specific: the 50-employee trigger, the 7-day and 3-month clocks, protected persons, and six state-level public-sector laws. Pricing transparency is the weakest mark, sitting at 3: the only public figure is EUR 77,00 pro Monat for small companies, plus one-time implementation costs whose amount is not stated. Security assurance holds at 4, resting on the vendor's own encryption and anonymity statements, with no public information on a certificate, penetration test or disclosure policy. Case management at 4-5 and multi-entity scale at 4-5 deliver deadline tracking and per-entity separation, with no public information on a tamper-evident case history or group-level reporting; sovereignty spans 4-6 around storage in a named German Azure data center through US-headquartered Microsoft.
Speaks for it
- Anonymous intake is engineered for the reporter — link or QR-code entry, a randomly generated retrieval code with no credentials needed, voice recordings at submission, and a written statement that no IP addresses or document metadata are stored.
- Austrian legal documentation is public and specific — the HSchG's 50-employee trigger with its averaging rule, the 7-day and 3-month clocks, protected persons, and six state-level public-sector laws — backed by a downloadable the evidence, a 40-minute training video and a published book.
- Any number of clients run in parallel in closed-off areas, each user needs one set of credentials for all clients, external lawyers or insurers can be added to case handling in seconds, and an ombudsman service runs through partner GRC-Experts GmbH.
- Rollout is fast on paper — technical implementation of 1 day and a typical rollout within 2 weeks — with a manual, information material and onboarding training provided.
- The vendor states storage in a Microsoft Azure data center in Germany, with permanent deletion 30 days after contract end and a data protection officer appointed with published contact details.
Held against it
- Only one public price exists — EUR 77,00 pro Monat for small companies — and it comes with mandatory one-time implementation costs whose amount is not stated, with the price basis described as complexity, user count and customization.
- We found no public information on an ISO 27001 or equivalent certificate, third-party penetration tests, or a security contact and disclosure policy behind the encryption and anonymity claims.
- We found no public information on automated statutory clocks, conflict-of-interest exclusion of implicated handlers, tamper-evident case history, or caseload reporting in case management.
- We found no public information on a consolidated group-level view, per-entity branding, or delegated administration across entities.
- The residency statement sits in an FAQ rather than a data processing agreement, hosting runs through US-headquartered Microsoft, we found no public subprocessor list, and the privacy policy invokes standard contractual clauses for transfers to the USA.
Best for
- You are an Austrian company above the 50-employee trigger that must stand up an internal reporting channel quickly — technical implementation takes 1 day and a typical rollout 2 weeks.
- Your priority is protecting reporter identity — the pages state no IP addresses or document metadata are stored, and reporters return to the dialog via a randomly generated code.
- You run several organizations or join as external counsel — clients operate in closed-off separated areas and external specialists can be added to case handling in seconds.
- You are an Austrian public-sector body — the site documents six state-level laws and public-sector obligations reaching municipalities from 10,000 inhabitants.
Avoid if
- You must compute your full invoice from public pricing before a purchase decision — beyond the entry figure, the pages state that the price depends on complexity, user count and customization.
- You run a multi-country group needing per-country rule sets — the documented mapping is Austria's HSchG, and other countries appear only as a passing reference to comparable laws.
- Your procurement requires published security certifications or third-party penetration test results — the captured pages show only the vendor's own statements.
- You oversee many subsidiaries and need consolidated group-level reporting — the documented model is per-entity separation, and we found no public information on a group view.
The scores
Reporting channels & reporter experience
Show reasoningHide reasoning
How this is scored
The intake side: how a reporter actually submits — web form, anonymous dialog, phone/voice, languages, accessibility — and whether anonymity survives first contact.
0 — A web form that is an email in disguise: no anonymous route, no way to reach the reporter afterwards.
3 — An anonymous form exists but the dialogue ends there — no secured mailbox for follow-up questions, few languages, desktop-only.
5 — Anonymous two-way dialog via a protected mailbox, a usable set of languages, mobile-friendly; voice or phone intake missing or an add-on.
8 — Multiple channels (web, voice message or hotline, QR entry points), broad language coverage with translation support, accessibility considered, and the anonymous dialog is first-class rather than bolted on.
10 — Intake engineered around the frightened reporter: every channel anonymous-capable, dozens of languages, WCAG-conscious, no app install or account required, and the vendor documents how the reporter's identity is kept out of the channel itself.
The Compliance Officer
The reporter enters via link or QR code, can record a voice file directly at intake, and reopens the report with a randomly generated code for a two-way dialog — and the vendor states that neither IP addresses nor document metadata are stored, which is a documented answer to how identity stays out of the channel. Default languages are German and English with reporter pages extensible by arbitrary further languages. We found no public information on accessibility standards or a phone hotline. 5 2
The Reporter's Advocate
The frightened reporter is handled well: entry by link or QR code from any phone, a randomly generated code instead of an account to return to the dialog, voice recordings accepted at input, and a plain statement that neither IP addresses nor document metadata are stored. What holds it back is breadth — German and English are standard and further languages come by extension rather than built in — and we found no public information on accessibility. 2 5
The SME Operator
Anonymous intake is the core of the pitch — advertised as one hundred percent anonymous, no IP addresses or document metadata stored, and the reporter re-enters the dialog with a randomly generated code and no account. Link and QR-code entry, voice recordings at submission and phone or tablet access are documented; the default is German and English with pages said to be extensible to any number of languages, and we found no public information on accessibility standards or a live hotline. 2 5
The Group Counsel
Link and QR-code entry, voice recordings at input, and anonymous code-based retrieval with explicit statements that no IP addresses or document metadata are stored make anonymity first-class rather than bolted on. Language delivery is thin — German and English by default with extensibility only claimed — and we found no public information on phone intake or accessibility. 2 5
The Security Auditor
Intake is built around the anonymous reporter: entry by link or QR code, voice recordings at submission, and a two-way dialog through a randomly generated code with no credentials or install, backed by an explicit statement that no IP addresses or document metadata are stored. Default languages are German and English with claimed extensibility to any number, and we found no public information on translation support or accessibility. 2 5
The Skeptic
The anonymous dialog is engineered rather than bolted on: a randomly generated retrieval code with no credentials, a built-in communication function, QR entry, voice recordings at input, and a written statement that no IP addresses and no document metadata are stored. Default coverage is only German and English with a claim of unlimited extensibility but no evidence of translation support, and we found no public information on accessibility or a phone hotline. 2 5
Case management & deadline discipline
Show reasoningHide reasoning
How this is scored
The case worker's side: triage, statutory deadlines (7-day acknowledgment, 3-month feedback), role separation, audit-proof documentation.
0 — Reports land in an inbox; deadlines, roles and history live in a spreadsheet next door.
3 — A case list with status fields, but deadlines are manual, permissions are all-or-nothing, and the record of who did what is thin.
5 — Deadline tracking with reminders for the statutory clocks, case notes and attachments, basic role separation between case handlers; reporting on the caseload is limited.
8 — Automated statutory clocks, conflict-of-interest handling (excluding implicated case handlers), complete tamper-evident case history, retention and deletion rules applied per case, and management reporting.
10 — A case system an external investigator can rely on: enforced workflows, full audit trail, legally aware retention/deletion automation, evidence handling, and statistics that survive a regulator's questions.
The Compliance Officer
The case management tool is described as guided and central processing with checklists and deadline management, need-to-know restriction of data is called out as a feature, external lawyers and insurers can be added as case users, and e-mails can be imported as files — that meets deadline tracking with basic role separation. We found no public information on automated statutory clocks, conflict-of-interest exclusion of implicated handlers, tamper-evident case history, or caseload reporting, which is what I would answer for at audit time. 5
The Reporter's Advocate
The case tool offers guided, central processing with checklists and deadline management, need-to-know restriction of the data, external specialists added as users in seconds, and email import next to a built-in communication function — deadline tracking and basic role separation in substance. We found no public information on automated statutory clocks, conflict-of-interest exclusion, tamper-evident case history, or caseload reporting, which keeps this in the middle. 2 5
The SME Operator
The FAQ describes a case management tool with checklists and deadline management, need-to-know restriction of data, and external lawyers addable as case-management users in seconds — enough for one person here to run the statutory clocks. We found no public information on automated seven-day and three-month reminders, tamper-evident case histories, per-case retention rules, or caseload reporting for management. 5 9
The Group Counsel
A guided case tool with checklists and deadline management, need-to-know restrictions and external lawyers addable as users is a workable core, though we found no public information on automated statutory clocks, conflict-of-interest exclusion, tamper-evident case history or caseload statistics. That missing audit spine is what my subsidiaries' external investigators would rely on. 5
The Security Auditor
The case management tool offers guided central processing with checklists and deadline management, a need-to-know restriction on data, and external specialists addable as users, which covers the statutory clocks and basic role separation. We found no public information on tamper-evident case history, exclusion of implicated case handlers, per-case retention rules, or management reporting on the caseload. 5 9
The Skeptic
The FAQ shows a case management tool with checklists, deadline management, email import and clients kept in separated areas, which is more than a status list. We found no public information on automated statutory clocks with reminders, conflict-of-interest exclusion, a tamper-evident case history, caseload reporting or retention rules applied per case — the only deletion statement covers 30 days after contract termination. 5
Legal compliance alignment
Show reasoningHide reasoning
How this is scored
How specifically the product implements EU Directive 2019/1937 and national transpositions (HinSchG et al.) — not whether the marketing mentions them.
0 — Generic feedback software wearing a whistleblowing label; no reference to the legal obligations it claims to satisfy.
3 — The directive is invoked in marketing but the mapping is vague; deadline rules, documentation duties and retention periods are the customer's problem.
5 — The statutory duties are implemented as product features — acknowledgment and feedback clocks, documentation, deletion after the retention period — for at least one national law, with guidance for the rest.
8 — Multiple national transpositions supported with their differing details, legal templates and process guidance maintained by named counsel or documented review, and updates when the law moves.
10 — The product is a legal instrument: per-country rule sets kept current, documented legal review, guidance for edge cases (group-wide channels, external ombudsman setups), and the vendor shows its homework in public.
The Compliance Officer
The Austrian homework is public and specific: the 7-day and 3-month feedback clocks, the 50-employee threshold with averaging for fluctuating headcount, protected persons, the material scope, and even the provincial whistleblowing laws, backed by a downloadable the evidence, a 40-minute law explainer and a book — and the product's own deadline management ties those clocks into the workflow. Support for other transpositions stays at the level of comparable laws in other EU countries, and we found no public information on legal templates or documented review by named counsel. 9 7 5
The Reporter's Advocate
This vendor shows its Austrian homework in public: the whistleblower protection act's dates, the 50-employee trigger with its averaging rule, the 7-day and 3-month feedback duties, the protected-persons list, and even the state-level laws for public bodies, plus a book and a 40-minute training video. We found no public information on other national transpositions being implemented in the product, or on a named counsel or documented legal review behind it — other countries appear only as a gesture at comparable laws. 1 7 9
The SME Operator
For an Austrian company this is close to turnkey: the site documents the HSchG clocks of seven days and three months, the obligation kicking in at 50 employees, the protected persons and even the provincial public-sector laws, and the product carries deadline management and checklists to match, backed by a book, a 40-minute law explainer and a downloadable the evidence. The mapping stops at Austria's borders, and we found no public information on named counsel, a documented legal review process, or updates when the law moves. 1 5 7 9
The Group Counsel
The vendor shows real homework on Austria: the federal act, six state-level laws, the 50-employee trigger and its averaging rule, the 7-day and 3-month clocks, and protected-person lists all published openly. Beyond a passing mention of comparable laws in other EU countries we found no evidence of per-country rule sets, which is what a twelve-country group actually runs on. 1 5 7 9
The Security Auditor
The Austrian transposition is documented with real depth — HSchG scope, the 50-employee cutoff and its 2023 date, the 7-day and 3-month notification clocks, protected persons, and six state-level public-sector laws — plus a downloadable summary of the draft law, a training video and a published book. What we can see covers Austria only, and we found no public information on rule sets for other member states' transpositions, legal review by named counsel, or product updates when the law moves; the ISO 37002 mention is a consulting service, not product functionality. 1 7 9
The Skeptic
Real public homework on Austria: the 7-day and 3-month notification duties, the 50-employee threshold, six additional state laws for the public sector, a downloadable the evidence, a training video and an ombudsman partner for external intake. But the pages name no counsel behind the guidance, show no documented legal review, and other member states appear only as a passing reference to comparable laws. 1 7 9
Security & anonymity assurance
Show reasoningHide reasoning
How this is scored
Whether the confidentiality promise is engineered and evidenced: encryption, metadata handling, penetration tests, certifications.
0 — Security is a paragraph of adjectives; no certificates, no test reports, no statement on metadata.
3 — TLS and encryption at rest asserted, but nothing audited: no ISO 27001 or equivalent, no published pentest, silence on IP and metadata logging.
5 — A current ISO 27001 (or equivalent) certificate for vendor or hosting, end-to-end encryption of report content claimed with some technical detail, an explicit no-IP-logging statement.
8 — Certified ISMS covering the product, regular third-party penetration tests attested, documented end-to-end encryption architecture, metadata minimization explained, security contact and disclosure policy published.
10 — Assurance a hostile auditor accepts: current certificates with visible scope, recurring pentest summaries public, cryptographic architecture documented, anonymity analysed against the operator itself — the vendor can answer "how would you unmask a reporter?" with "we cannot, and here is why".
The Compliance Officer
End-to-end encryption is claimed with the mechanism that even the cloud provider has no access to the reports, and the FAQ explicitly states that no IP addresses and no document metadata are stored — a genuine metadata position I rarely see written down. We found no public information on ISO 27001 or an equivalent certification, penetration tests, or a published security contact and disclosure policy, so none of the confidentiality promise is independently audited. 2 5
The Reporter's Advocate
The anonymity promise has the right shape for my taste: reports are stored encrypted such that, in the vendor's words, the cloud provider has no access to the data, and the system stores no IP addresses or document metadata. Beyond those statements we found no public information on certifications such as ISO 27001, third-party penetration testing, or a published security contact and disclosure policy. 2 5
The SME Operator
End-to-end encryption is claimed with the explicit statement that even the cloud provider has no access to the reports, and the FAQ states no IP addresses or document metadata are stored — the anonymity statements are unusually concrete. We found no public information on an ISO 27001 or equivalent certificate, penetration tests, or a security disclosure policy, so nothing audited backs the promise. 2 5
The Group Counsel
End-to-end encryption with the stated position that even the cloud provider cannot access the reports, plus the explicit no-IP and no-metadata statements, is a coherent anonymity story. No certificate, penetration test or security disclosure policy appears on the captured pages, so a hostile auditor has only the vendor's own words. 2 5 6
The Security Auditor
The confidentiality promise rests on bare claims — "100 % Anonym" and "END-END Verschlüsselt" with no cryptographic detail — while the FAQ's explicit statement that no IP addresses or document metadata are stored is the only engineering-grade fact on the page. We found no public information on an ISO 27001 or equivalent certificate, third-party penetration tests, a security contact or disclosure policy, or an analysis of whether the operator itself could unmask a reporter. 1 2 5
The Skeptic
"100 % Anonym" and "END-END Verschlüsselt" read as homepage marketing; the one engineered commitment behind them is the FAQ statement that no IP addresses and no document metadata are stored and that the cloud provider cannot access the data. We found no public information on ISO 27001 or an equivalent certificate, penetration tests, a documented cryptographic architecture, or a security contact and disclosure policy. 2 5
Group & multi-entity capability
Show reasoningHide reasoning
How this is scored
Whether one contract can serve a corporate group: separate channels per legal entity, central oversight, ombudsman access, white-labeling.
0 — One company, one channel; a group buys and administers N separate instances.
3 — Multiple channels under one account, but no separation of case access per entity and no consolidated view.
5 — Per-entity channels with separated case handlers and a group-level overview; branding per entity is basic; external counsel access possible.
8 — Real multi-tenant group structure: per-entity channels, languages and branding, delegated administration, external ombudsman roles, group reporting that respects entity boundaries.
10 — Group compliance as architecture: hundreds of entities manageable centrally, per-country legal rule assignment per entity, white-label reporting pages, and access separation strong enough to satisfy each subsidiary's works council.
The Compliance Officer
Unlimited clients can be operated in parallel in separated areas, each user needs only one set of credentials for all their clients, external service providers can be added to case handling, and an ombudsman service partner takes over report processing on request — that is real entity separation rather than N parallel instances. We found no public information on a consolidated group-level view, per-entity branding or delegated administration. 5 1
The Reporter's Advocate
Any number of clients can run in parallel in enclosed, separate areas, each user reaches all their clients with a single set of credentials, and external lawyers or insurers can be added to case handling — per-entity separation of case access is real. We found no public information on a consolidated group view, per-entity branding and languages, or delegated administration, so this stays a mid-scale story. 1 5
The SME Operator
The FAQ confirms any number of clients can be operated in parallel in closed-off areas with one credential set per user, and external providers such as lawyers or insurers can be added as case-management users; an ombudsman service through their partner is also offered. We found no public information on per-entity branding, delegated administration, or a consolidated group-level view. 1 5
The Group Counsel
Unlimited parallel mandants in closed-off areas, one credential set per user across them, external service providers added in seconds, and a partner firm offering ombudsman case handling amount to genuine access separation. We found no public information on group-level consolidated reporting, per-entity branding or delegated administration — for my 25 subsidiaries the oversight layer is the missing piece. 1 5
The Security Auditor
Unlimited clients run in parallel in closed-off areas, each user holds one credential set across their clients, and external lawyers or insurers can be added to case management; an ombuds service exists as a partner offering. We found no public information on a group-level consolidated view, per-entity branding or white-labeling, delegated administration, or per-entity assignment of legal rules. 1 5
The Skeptic
Unlimited clients run in parallel in closed-off areas, one credential set per user across them, and external service providers such as lawyers can be added as case management users — genuine per-entity separation with counsel access. We found no public information on per-entity branding, delegated administration or a consolidated group-level report. 1 5
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where reports about people actually live and under whose law — entity, hosting, subprocessors, DPA. In this category the data is by definition the most sensitive a company holds.
0 — Non-EU entity, non-EU-default hosting, no public DPA or subprocessor list — for whistleblowing data.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad or undocumented.
5 — EU hosting is the default, DPA and subprocessor list published; the vendor or a critical subprocessor is still within non-European jurisdictional reach.
8 — EU entity, EU hosting with named data centers, published subprocessor list free of content-touching non-EU processors, DPA and TOMs public.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors for report content and metadata, on-premises or sovereign-cloud options, and the whole chain documented publicly.
The Compliance Officer
An Austrian entity with a Vienna seat, storage in a named Microsoft Azure data center in Germany, an appointed data protection officer with contact details, and permanent deletion 30 days after contract end give a European default posture. The hosting chain runs through US-headquartered Microsoft, the privacy policy invokes standard contractual clauses for third-country transfers notably to the USA, and we found no public information on a published data processing agreement or a subprocessor list. 4 5 6
The Reporter's Advocate
An Austrian company stores reports in a named data center in Germany, which is the right direction for the most sensitive data a company holds. But we found no public processing agreement or subprocessor list — the residency statement sits in an FAQ — the hosting processor is a US-headquartered company within CLOUD Act reach, and the privacy policy itself relies on standard contractual clauses for transfers to the USA. 4 5 6
The SME Operator
The vendor is an Austrian GmbH seated in Vienna with a data protection officer appointed, and states the data sits in the Microsoft Azure data center in Germany. The hosting runs through US-headquartered Microsoft within reach of the US CLOUD Act, the location statement sits in the FAQ rather than in a data processing agreement, and we found no public information on a published processor agreement or a subprocessor list beyond the case-handling partner. 1 4 5 6
The Group Counsel
An Austrian entity storing data in a named German datacenter is the right posture for whistleblowing data. The hosting processor is US-headquartered Microsoft with the contracting entity unnamed, and we found no published data processing agreement or subprocessor list — I want that chain documented before a group rollout. 4 5 6
The Security Auditor
An Austrian GmbH with a Vienna register entry stores reports in a named German Azure datacenter — right geography, but the infrastructure provider is US-headquartered Microsoft within CLOUD Act reach, and the location statement sits in an FAQ rather than a data processing agreement. The privacy policy describes standard contractual clauses for transfers to third countries including the USA, and we found no public data processing agreement, subprocessor list, or technical and organisational measures document. 4 5 6
The Skeptic
An Austrian GmbH stating storage in a German Azure data center is a reasonable start, but the host is US-headquartered Microsoft within CLOUD Act reach and the pages do not say which Microsoft contracting entity is used. The location statement sits in an FAQ rather than a published data processing agreement, we found no public subprocessor list or TOMs, and the privacy policy itself discusses Standard Contractual Clauses for transfers to the USA. 4 5 6
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether an obligated company can compute the real invoice — per entity, per employee band, per year — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — An entry price exists, but the tiers most obligated companies need are unpriced, or the maths is obscured by employee bands, per-report fees or mandatory setup charges.
5 — Most tiers carry real numbers with billing period and VAT treatment stated, but at least one commonly needed capability — extra entities, extra languages, phone intake — hides in an unpriced add-on.
8 — Every tier priced publicly with employee-band boundaries, entity rules and setup fees stated; only genuine corporate-group contracts are custom.
10 — Complete price computability: every tier, band, add-on and renewal rule public, so the invoice for a 60-employee company and a 5-entity group is a two-minute exercise.
The Compliance Officer
One public figure exists: for small companies the monthly costs begin at EUR 77,00 per month, plus one-time implementation costs, and the price basis is stated to depend on complexity, user count and customization. We found no public information on further tiers, employee-band boundaries, VAT treatment, or what the implementation costs amount to, so no obligated company could compute its invoice from these pages. 5
The Reporter's Advocate
An entry price is public — monthly costs for small companies begin at EUR 77,00 per month — but it arrives with mandatory, unpriced one-time implementation costs, and the vendor says the price depends on complexity, user count and customization. We found no public information on further tiers, employee bands, VAT treatment or renewal terms, so an obligated company cannot compute its real invoice from public pages. 5
The SME Operator
The only public figure is that monthly costs for small companies begin at EUR 77,00 pro Monat plus one-time implementation costs, with price otherwise said to depend on complexity, user count and customization. Everything my year-end review would need — the implementation charge, what sits above the entry level, entity or language add-ons, VAT treatment — is a sales conversation, so the invoice cannot be computed from public pages. 5
The Group Counsel
A single entry figure exists — monthly costs for small companies "beginnen bei EUR 77,00 pro Monat, zuzüglich einmaliger Implementierungskosten", with implementation cost stated to depend on complexity, user count and customization. There is no public pricing for additional entities, additional languages or higher tiers, so a 25-entity group cannot compute its invoice from these pages. 5
The Security Auditor
One figure is public — "EUR 77,00 pro Monat" for small companies — but it comes with one-time implementation costs whose amount is not stated and a price basis of complexity, user count and customization. We found no public information on tier structure, VAT treatment, per-entity or per-language pricing, or renewal terms, so computing a real invoice beyond the smallest deployment is a sales conversation. 5
The Skeptic
Exactly one number is public: "EUR 77,00 pro Monat" for small companies, "zuzüglich einmaliger Implementierungskosten" — and those mandatory implementation costs are unpriced. Everything beyond the entry point is said to depend on complexity, user count and customization, and we found no public information on tiers, employee bands, multi-entity rules or VAT treatment. 5
European sovereignty — proven facts
3 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Incorporated in AT | 3/3 pts | 4 Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | EU only ⚠ unverified | 3/3 pts | 5 Report an error |
| Subprocessors | US CLOUD Act reach ⚠ unverified | 0/2 pts | 5 Report an error |
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 11 Sep 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data residency. The location statement sits in the FAQ, not in a data processing agreement, and does not explicitly rule out other regions or transfers.
- Weak sourcing — Subprocessors. The hosting subprocessor is US-headquartered Microsoft (subject to the US CLOUD Act) even though the named data center is in Germany; the page does not say which Microsoft contracting entity is used.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 10 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
Sources (9)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage compliance2b.at Checked 15 Sep 2026 +1 earlier capture: 11 Sep 2026 Details →
- 2 Whistleblowing product page compliance2b.at Checked 15 Sep 2026 Details →
- 3 Consulting services page compliance2b.at Checked 15 Sep 2026 Details →
- 4 Imprint compliance2b.at Checked 15 Sep 2026 Details →
- 5 FAQ compliance2b.at Checked 15 Sep 2026 +1 earlier capture: 11 Sep 2026 Details →
- 6 Privacy policy compliance2b.at Checked 30 Sep 2026 Details →
- 7 Reporting channels & reporter experience — found from sitemap compliance2b.at Checked 1 Oct 2026 Details →
- 8 Legal compliance alignment — found from sitemap compliance2b.at Checked 1 Oct 2026 Details →
- 9 Legal compliance alignment — found from sitemap compliance2b.at Checked 1 Oct 2026 Details →