Whistleblowing Portals
Ethicontrol
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Ethicontrol · ethicontrol.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Ethicontrol at a glance
- Vendor
- Ethicontrol
- Headquarters
- Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 13 Oct 2026
- Starting price
- “Whistleblowing platform from 89 EUR per month” (vendor’s words) source, captured 13 Oct 2026
- Panel verdict
- The AI panel rates Ethicontrol 3/5, the mean of 6 judges. Ethicontrol is strongest at intake: reporting channels scores cluster at 8, crediting a 24/7 toll-free line, a script-free portal reachable over Tor, anonymous two-way dialogue via secret code and Feedback Room, and metadata stripped from uploads; case management clusters at 7 for no-access-by-default roles and escalation bypassing implicated responders. how scores are made
- As of
- Vendor pages captured 13 Oct 2026; evaluated by the panel 15 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Ethicontrol is strongest at intake: reporting channels scores cluster at 8, crediting a 24/7 toll-free line, a script-free portal reachable over Tor, anonymous two-way dialogue via secret code and Feedback Room, and metadata stripped from uploads; case management clusters at 7 for no-access-by-default roles and escalation bypassing implicated responders. Weakest are pricing transparency at 2-3 — beyond 'from 89 EUR / month' entry prices for the toll-free line and ethics helpdesk, the Starter, Advanced and Pro plans carry no public prices — and sovereignty at 2-4, where the captured pages give different figures for data location ('Data stored within the EU in certified data centers' on one, servers in the EU, US, UAE, KSA, India and Tanzania on another) and we found no public information on the vendor's legal entity, ownership, a data processing agreement or subprocessors. The splits are matters of weight: the two-point spreads on sovereignty and multi-entity scale 6-8 weigh multi-portal, multi-tenant structure against undocumented delegated administration and ombudsman roles. Security assurance 4-5 and compliance alignment 5-6 sit between: engineered anonymity, unnamed certification, directive clocks without transposition detail.
Speaks for it
- Reporting channels scores sit at 8, on a 24/7 toll-free line with native speakers, a script-free portal, Tor access, and anonymous two-way dialogue via a secret code and the Feedback Room.
- Reporter anonymity is engineered and documented — no tracking cookies, IP addresses or digital footprints about reporters, metadata cleaned from uploaded files, and intake channels isolated in a demilitarised zone.
- Case management scores sit at 7, with role-based access that defaults to no access, a filterable audit log, and escalation that bypasses implicated responders.
- Multi-entity scale scores 6-8 on multiple portals for groups not under a single brand, multi-tenant storage, and access split by region, division and organisational hierarchy.
- The EU Directive clocks — acknowledgement within 7 days, feedback within 3 months, a 6-month extension — are implemented as product features with overdue reminders.
Held against it
- Beyond 'from 89 EUR / month' for the ethics helpdesk and toll-free line, the Starter, Advanced and Pro plans carry no public prices, employee bands, setup fees or VAT terms, so an invoice cannot be computed from public pages.
- The captured pages give different figures for data location — 'Data stored within the EU in certified data centers' on one, servers in the EU, US, UAE, KSA, India and Tanzania on another.
- We found no public information on the vendor's legal entity, ownership, a data processing agreement or a subprocessor list.
- The certification claim stops at 'certified info-security and privacy management', naming no standard, issuer or scope, and we found no public information on penetration tests or a security contact.
- We found no public information on per-case retention rules or automated deletion after the retention period.
Best for
- You need intake built for a frightened reporter — anonymous two-way dialogue via a secret code, a script-free portal, Tor access and metadata cleaning are all documented.
- Your group runs companies under several brands — multiple portals with their own subdomains, multi-tenant storage and hierarchy-split access are evidenced, and multi-entity scale scores 6-8.
- You fell under the EU Directive's obligations (over 250 employees since 31/12/2021, over 50 since 17/12/2023) and want the 7-day acknowledgement, 3-month feedback and 6-month extension clocks wired into the tool.
- You want the most sensitive reports on your own infrastructure — an on-premise option, and dedicated-server configuration on request, are both offered.
Avoid if
- You must compute a real invoice before a sales conversation — ask the vendor: the public pages we read do not show it
- You must pin down where reports legally sit before signing — the captured pages give different figures for data location, and we found no public data processing agreement or subprocessor list to resolve them.
- A hostile external audit is imminent and you need named certification or penetration-test evidence in hand — the public claim stays generic, and we found no public information on either.
The scores
| Criterion | Panel median |
|---|---|
| Reporting channels & reporter experience | 4 of 5 |
| Case management & deadline discipline | 3.5 of 5 |
| Legal compliance alignment | 3 of 5 |
| Security & anonymity assurance | 2 of 5 |
| Group & multi-entity capability | 3.5 of 5 |
| European sovereignty | 1.5 of 5 |
| Pricing transparency | 1.5 of 5 |
Reporting channels & reporter experience
Show reasoningHide reasoning
How this is scored
The intake side: how a reporter actually submits — web form, anonymous dialog, phone/voice, languages, accessibility — and whether anonymity survives first contact.
0 — A web form that is an email in disguise: no anonymous route, no way to reach the reporter afterwards.
3 — An anonymous form exists but the dialogue ends there — no secured mailbox for follow-up questions, few languages, desktop-only.
5 — Anonymous two-way dialog via a protected mailbox, a usable set of languages, mobile-friendly; voice or phone intake missing or an add-on.
8 — Multiple channels (web, voice message or hotline, QR entry points), broad language coverage with translation support, accessibility considered, and the anonymous dialog is first-class rather than bolted on.
10 — Intake engineered around the frightened reporter: every channel anonymous-capable, dozens of languages, WCAG-conscious, no app install or account required, and the vendor documents how the reporter's identity is kept out of the channel itself.
The Compliance Officer
Intake is genuinely multi-channel — a 24/7 toll-free contact centre with native speakers, chatbots, live chat and browser calls alongside the web portal — and the anonymous dialog is first-class, with a secret code, a Feedback Room for follow-ups and a toll-free way back to the reporter. Language breadth is real (60+ intake languages with machine or manual translation) and the anonymity engineering is unusually documented: no tracking cookies or IP addresses on reporters, metadata cleaning of uploads, a script-free portal and Tor access. We found no public information on WCAG or other accessibility certification, which keeps this short of the top mark. 1 2 3 7 8
The Reporter's Advocate
This is intake built for the frightened reporter: a secret code opens an anonymous Feedback Room with two-way dialog at every stage, a 24/7 toll-free line with native speakers picks up the night-shift phone, and the portal is script-free, reachable over Tor, with no cookies, IP addresses or digital footprints collected and metadata scrubbed from uploads. My reservations are the language math and the accessibility silence — the hundred-plus web-form languages shrink to four on the entry plan, and I found no public information on accessibility standards or QR-code entry points. 1 2 7
The SME Operator
The intake side is genuinely multi-channel — a 24/7 toll-free line with native speakers, chatbots, browser-based calls, plus web, post and personal meeting — in more than 100 web-form languages with automatic and manual translation, and the anonymous dialogue via secret code and web Feedback Room is built in rather than bolted on. They also document keeping the reporter's identity out of the channel: no cookies or IP collection, metadata scrubbing from uploads, a script-free portal and Tor access. I found no public information on QR entry points or formal accessibility standards, which keeps this short of the top grade. 1 2 6 7 8
The Group Counsel
Multiple intake routes — web portal, browser-based calls, a 24/7 toll-free contact centre with native speakers, chatbots and live consultant chat — with anonymous two-way dialogue through a secret-code Feedback Room, sixty-plus intake languages with machine and manual translation, and anonymity engineered rather than bolted on: script-free portal, Tor access, metadata stripping on uploads and a stated policy of no tracking cookies, IP addresses or digital footprints. I found no public information on accessibility standards or QR-based entry points, which keeps this short of the top of the scale. 2 1 7 3 9
The Security Auditor
The intake side is engineered for the frightened reporter: anonymous two-way dialog via a secret code and the Feedback Room, a 24/7 toll-free line with native speakers, chatbots, browser calls without a phone, Tor access, a script-free portal that survives script blockers, and metadata stripped from uploaded files. Web form in more than 100 languages (4 with Starter, 10 with Advanced, unlimited with Pro) with machine and manual translation. We found no public information on accessibility standards or QR entry points, which keeps this below the top. 1 2 7 8
The Skeptic
The intake side is richly evidenced: anonymous two-way Feedback Room with a secret code, chatbots and messengers, browser-based toll-free calls, Tor access, a script-free portal that works with blockers, metadata cleaning on uploads, and a stated policy of collecting no cookies, IPs or digital footprints about reporters. What holds it back: language breadth is plan-gated (4 languages on Starter, 10 on Advanced), the native-speaker hotline is a paid add-on from 89 EUR / month, and we found no public information on WCAG or accessibility standards. 1 2 3 7
Case management & deadline discipline
Show reasoningHide reasoning
How this is scored
The case worker's side: triage, statutory deadlines (7-day acknowledgment, 3-month feedback), role separation, audit-proof documentation.
0 — Reports land in an inbox; deadlines, roles and history live in a spreadsheet next door.
3 — A case list with status fields, but deadlines are manual, permissions are all-or-nothing, and the record of who did what is thin.
5 — Deadline tracking with reminders for the statutory clocks, case notes and attachments, basic role separation between case handlers; reporting on the caseload is limited.
8 — Automated statutory clocks, conflict-of-interest handling (excluding implicated case handlers), complete tamper-evident case history, retention and deletion rules applied per case, and management reporting.
10 — A case system an external investigator can rely on: enforced workflows, full audit trail, legally aware retention/deletion automation, evidence handling, and statistics that survive a regulator's questions.
The Compliance Officer
The case side shows real discipline: role-based access defaulting to no access, a filterable audit log of every user action, escalation that bypasses implicated managers, automated response-time control with due dates and overdue reminders, and the 7-day acknowledgment and 3-month feedback clocks documented together with the 6-month extension. Management reporting is solid — time to respond, substantiation rate, investigation duration and a permission-aware group report across many dimensions. We found no public information on per-case retention and deletion automation, which is exactly what separates a strong case tool from one an external investigator can rely on. 1 2 4 7 8 10
The Reporter's Advocate
The statutory clocks are stated and wired in — seven-day acknowledgment, three-month feedback, six-month extension — with overdue reminders, automated delegation by category and procedure, an audit log that records everyone who ever touched a case, and escalation that bypasses implicated managers. What keeps me below the top of this range: I found no public information on retention and deletion rules applied per case, which an investigator facing a regulator will need. 2 4 7
The SME Operator
The statutory clocks — 7-day acknowledgement, 3-month feedback, 6-month extension — are implemented as product features with overdue reminders, role-based access that defaults to no access, an audit log of every action, and escalation that bypasses implicated managers, so the legal duties really are the product's job. Management reporting is extensive, from response times to substantiation rates to a permission-gated groups report. I found no public information on retention periods or automated deletion after them, which is exactly what a regulator would ask me about, so I stop one step below the top. 1 4 6 7 8 10
The Group Counsel
The case worker gets real discipline: role-based access with no-access-by-default, audit and case activity logs, escalation that bypasses implicated process owners to the Audit Committee, automatic triage with due dates driven by procedure rules, overdue reminders, and management analytics including response time and substantiation rate. The seven-day and three-month clocks plus a six-month extension are stated on the compliance pages, but I found no public information on retention or deletion rules applied per case, which is what an external investigator asks about first. 4 1 5 7 8 10
The Security Auditor
Role-based access with no access unless granted, a filterable audit log of all actions, automated delegation with due dates per procedure rules, and an escalation path that bypasses implicated responders — the conflict-of-interest handling a real investigator looks for. Automatic triage, task workflows with manager checklists, and substantiation-rate analytics give management reporting teeth. We found no public information on tamper-evident history, per-case retention rules, or automated deletion after the retention period. 4 5 8 10
The Skeptic
Automated due dates per procedure rules, overdue reminders, role-based access defaulting to no access, escalation that bypasses implicated process owners, a filterable audit log and management analytics are all evidenced. We found no public information on tamper-evident record keeping, per-case retention or deletion automation, which the top of this criterion expects. 1 4 5 7 8
Legal compliance alignment
Show reasoningHide reasoning
How this is scored
How specifically the product implements EU Directive 2019/1937 and national transpositions (HinSchG et al.) — not whether the marketing mentions them.
0 — Generic feedback software wearing a whistleblowing label; no reference to the legal obligations it claims to satisfy.
3 — The directive is invoked in marketing but the mapping is vague; deadline rules, documentation duties and retention periods are the customer's problem.
5 — The statutory duties are implemented as product features — acknowledgment and feedback clocks, documentation, deletion after the retention period — for at least one national law, with guidance for the rest.
8 — Multiple national transpositions supported with their differing details, legal templates and process guidance maintained by named counsel or documented review, and updates when the law moves.
10 — The product is a legal instrument: per-country rule sets kept current, documented legal review, guidance for edge cases (group-wide channels, external ombudsman setups), and the vendor shows its homework in public.
The Compliance Officer
The Directive duties are implemented as features rather than slogans — the 7-day and 3-month clocks with the 6-month extension, the 50/250-employee dates, subsidiaries anywhere regardless of ownership, jurisdiction-dependent form flows, and templates for whistleblowing policy and SOPs — and a published compliance matrix maps the platform against the EU Directive, ISO 37001/37002 and other regimes. However, we found no public information on named counsel, documented legal review, or how differing national transposition details are maintained when the law moves. 1 2 6 7
The Reporter's Advocate
The directive duties appear as product behaviour rather than decoration — the acknowledgment and feedback deadlines, the employee-count thresholds, forms that change with the reporter's jurisdiction, and ready templates for whistleblowing and investigation policies. But the mapping stops at framework names and one directive page; I found no public information on named counsel, documented legal review, or how the differing national transpositions are handled as rule sets. 2 6 7
The SME Operator
The directive's duties show up as features — acknowledgement and feedback deadlines, the 50/250-employee thresholds, multichannel requirements including post and answering machine, outsourced-processing guidance — and the web-form flow adapts to the reporter's jurisdiction, with SAPIN II and PIDA named alongside templates for whistleblowing policies, SOPs and training. The mapping stays at framework level though: I found no named counsel, no documented legal review, and no public information on retention or deletion duties, so this is features-plus-guidance rather than a legal instrument. 2 6 7
The Group Counsel
The EU Directive page shows homework — thresholds, seven-day acknowledgment, three-month feedback, a six-month extension, and the required channel mix including mailbox and answering machine — and the web form flow genuinely changes with the jurisdiction the reporter selects. But I found no public information on national transpositions such as the German HinSchG, per-country rule sets, or any named counsel or documented legal review behind the templates. 7 6 2 1
The Security Auditor
The directive's clocks are engaged concretely — acknowledgement within 7 days, feedback within 3 months, a 6-month extension — alongside the 250- and 50-employee obligation dates, a compliance matrix mapping the platform against ISO 37002 and others, and jurisdiction-dependent intake flows. We found no public information on per-country transposition detail such as Germany's HinSchG, named counsel, or documented legal review, which is what separates the strongest legal implementations. 1 2 6 7
The Skeptic
The statutory clocks (7-day acknowledgement, 3-month feedback, 6-month extension), employee thresholds and multichannel duties are mapped to product features, a compliance matrix compares the platform against the EU Directive, ISO 37002, FCPA and more, and the web form adapts to the reporter's jurisdiction. But we found no public information on named counsel, documented legal review, or updates when laws change, and deletion after the retention period is not evidenced. 2 6 7
Security & anonymity assurance
Show reasoningHide reasoning
How this is scored
Whether the confidentiality promise is engineered and evidenced: encryption, metadata handling, penetration tests, certifications.
0 — Security is a paragraph of adjectives; no certificates, no test reports, no statement on metadata.
3 — TLS and encryption at rest asserted, but nothing audited: no ISO 27001 or equivalent, no published pentest, silence on IP and metadata logging.
5 — A current ISO 27001 (or equivalent) certificate for vendor or hosting, end-to-end encryption of report content claimed with some technical detail, an explicit no-IP-logging statement.
8 — Certified ISMS covering the product, regular third-party penetration tests attested, documented end-to-end encryption architecture, metadata minimization explained, security contact and disclosure policy published.
10 — Assurance a hostile auditor accepts: current certificates with visible scope, recurring pentest summaries public, cryptographic architecture documented, anonymity analysed against the operator itself — the vendor can answer "how would you unmask a reporter?" with "we cannot, and here is why".
The Compliance Officer
The anonymity engineering is specific — an explicit statement of no tracking cookies, IP addresses or digital footprints on reporters, metadata cleaning of uploaded files, a script-free portal, Tor access, DMZ-separated intake, and a client-key database encryption option. But the certification claim is only "certified info-security and privacy management" with no named standard or scope, and we found no public information on penetration tests, security contacts or a disclosure policy; that will not survive a hostile auditor. 2 7 8 9
The Reporter's Advocate
The anonymity side is reasoned in public, which I prize: no cookies, IPs or digital footprints on reporters, metadata stripped from files, intake messages deleted from the channel on receipt, intake physically separated from case management in a demilitarised zone, and the vendor's stated position that total anonymity is the only safety guarantee. The audited side is thin — a certification is claimed without naming the standard, and I found no public information on penetration tests, certificate scope, or a security contact and disclosure policy. 2 7 8 9
The SME Operator
The anonymity engineering is public and concrete — no tracking cookies, IP addresses or digital footprints collected, metadata stripped from uploads, intake channels separated in a demilitarised zone, on-premise and dedicated-server options, client-key database encryption — and they point to certified info-security and privacy management plus a Trust-Center. But the certificate is unnamed, and I found no public information on penetration tests or a documented encryption architecture for report content, which is what an auditor would demand before signing off on the confidentiality promise. 1 2 8
The Group Counsel
Anonymity is engineered with unusual specificity — reporting channels physically separated from case management with the intake portal in a demilitarised zone, messages pushed to case management and deleted from intake on receipt, optional client-key encryption of the database, and on-premise or dedicated-server options. The certification claim stays generic as certified info-security and privacy management, and I found no public information on ISO 27001 scope, penetration tests, or a security contact and disclosure policy. 2 8 7 9
The Security Auditor
The anonymity engineering is real on paper: no tracking cookies, IP addresses or digital footprints collected about reporters, metadata cleaned from uploads, intake isolated in a demilitarised zone, Tor access, and an optional client-key encryption of the database. But the assurance layer thins fast — 'Certified info-security and privacy management' names no standard, issuer or scope, and we found no public information on penetration tests, a published certificate with visible scope, cryptographic architecture, or a security contact and disclosure policy. Unaudited adjective certification does not survive a hostile auditor, and no page answers how the operator itself could or could not unmask a reporter. 2 7 8 9
The Skeptic
Anonymity engineering is genuinely detailed — intake separated in a demilitarised zone from case management, an explicit statement that no tracking cookies, IP addresses or digital footprints about reporters are collected, metadata cleaning, and an option for client-held database encryption keys. But the claim of certified info-security and privacy management names no certificate, no scope, no penetration test and no security contact, and the bolded talk of total anonymity is not backed by audited assurance. 2 7 8 9
Group & multi-entity capability
Show reasoningHide reasoning
How this is scored
Whether one contract can serve a corporate group: separate channels per legal entity, central oversight, ombudsman access, white-labeling.
0 — One company, one channel; a group buys and administers N separate instances.
3 — Multiple channels under one account, but no separation of case access per entity and no consolidated view.
5 — Per-entity channels with separated case handlers and a group-level overview; branding per entity is basic; external counsel access possible.
8 — Real multi-tenant group structure: per-entity channels, languages and branding, delegated administration, external ombudsman roles, group reporting that respects entity boundaries.
10 — Group compliance as architecture: hundreds of entities manageable centrally, per-country legal rule assignment per entity, white-label reporting pages, and access separation strong enough to satisfy each subsidiary's works council.
The Compliance Officer
Groups are taken seriously: multi-tenant data storage, multiple portals for groups not under a single brand, hierarchy down to subregions, units and divisions, access split by region, division and organisational level, and group reporting that respects user permissions. We found no public information on delegated administration per entity or dedicated ombudsman roles, and per-entity branding is limited to logo and hero image. 2 4 8 10
The Reporter's Advocate
A group gets real structure: multiple portals for companies not under one brand, multi-tenant data storage for isolation, access split by region, division and organisational hierarchy, and a Groups analytics report that breaks down by organisational level and is permission-dependent. Branding per entity is a logo and hero image, and I found no public information on external ombudsman or outside-counsel access roles. 2 4 10
The SME Operator
Groups get multiple portals, multi-tenant storage, access rights split by region, division and hierarchy with default-deny permissions, additional hierarchy levels for complex structures, and a groups report that depends on user permissions — enough that a group could run entities with separated handlers and a consolidated view. I found no public information on external ombudsman or counsel roles, delegated administration, or white-label reporting pages, so it stops short of full group architecture. 2 4 10
The Group Counsel
This is close to the architecture a 25-subsidiary rollout needs: multiple portals with their own subdomains and branding for groups not under a single brand, multi-tenant storage for data isolation, access split by region, division and organizational hierarchy with no-access-by-default roles, additional hierarchy levels for complex structures, and a permission-gated Groups report sliceable by unit, region and organisational level. The thin spot for my purposes is ombudsman access: outsourced processing is offered, but I found no public information on dedicated external ombudsman roles or per-country legal rule assignment per entity. 2 4 8 10 7
The Security Auditor
Multi-tenant storage, multiple portals for groups not under a single brand, additional hierarchy levels down to subregions, units and divisions, and access split by region, division and organisational level — the entity separation is structural, not cosmetic. Group analytics group by organisational level with access dependent on user permissions. We found no public information on dedicated external ombudsman roles or delegated administration per entity. 2 4 6 10
The Skeptic
Multiple portals for groups, multi-tenant data storage, access split by region, division and hierarchy, additional organisational levels, and a permission-aware Groups report with entity-level dimensions are all evidenced. We found no public information on delegated administration per entity, external ombudsman or counsel roles, or white-labeling beyond logo and hero image. 2 4 10
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where reports about people actually live and under whose law — entity, hosting, subprocessors, DPA. In this category the data is by definition the most sensitive a company holds.
0 — Non-EU entity, non-EU-default hosting, no public DPA or subprocessor list — for whistleblowing data.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad or undocumented.
5 — EU hosting is the default, DPA and subprocessor list published; the vendor or a critical subprocessor is still within non-European jurisdictional reach.
8 — EU entity, EU hosting with named data centers, published subprocessor list free of content-touching non-EU processors, DPA and TOMs public.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors for report content and metadata, on-premises or sovereign-cloud options, and the whole chain documented publicly.
The Compliance Officer
EU storage in certified data centres is stated as the default, with on-premises and dedicated-server options available — but the same pages advertise servers in the US, UAE, Saudi Arabia, India and Tanzania. We found no public information on the vendor's legal jurisdiction or ownership, a data processing agreement, or any subprocessor list; for whistleblowing data that gap is what caps this rating. 1 4 7 8
The Reporter's Advocate
One page states data is stored within the EU in certified data centers and an on-premise option exists, while another lists servers in the US, UAE, KSA, India and Tanzania, and the captured pages give no basis to resolve the default. For the most sensitive data a company holds, I found no public information on the vendor's legal entity, ownership, data processing agreement or subprocessors. 1 4 8
The SME Operator
The captured pages give different figures for where reports live: one says data is stored within the EU in certified data centers, another lists servers in the EU, US, UAE, KSA, India and Tanzania. I found no public information on the vendor's legal entity, ownership, a data processing agreement or a subprocessor list, so for the most sensitive data a company holds the jurisdictional chain cannot be verified from public pages — an on-premise option exists, but as an exception rather than the documented rule. 1 4 7 8
The Group Counsel
EU storage in certified data centers is claimed as the default and an on-premise option exists, which matters for the most sensitive data a company holds. But the vendor's jurisdiction and ownership are not documented, I found no published DPA or subprocessor list, and the same captured pages state servers in the EU, US, UAE, KSA, India and Tanzania — so for whistleblowing data I cannot establish whose law the chain sits under. 4 1 7 8
The Security Auditor
The captured pages give different signals on residency: 'Data stored within the EU in certified data centers' on one page, and 'servers in EU countries, US, UAE, KSA, India and Tanzania' on another. We found no public information on the vendor's legal entity, ownership, a published DPA, or a subprocessor list — for whistleblowing data that is the entire sovereignty question. The on-premise option is the only jurisdictional escape evidenced. 1 4 7 8
The Skeptic
The captured pages give different signals: data storage within the EU in certified data centers and an on-premise option, alongside a server estate listed as EU, US, UAE, KSA, India and Tanzania. We found no public information on the vendor's legal entity jurisdiction, ownership, a published DPA, or a subprocessor list — for whistleblowing data, that silence is the finding. 2 4 7 8
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether an obligated company can compute the real invoice — per entity, per employee band, per year — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — An entry price exists, but the tiers most obligated companies need are unpriced, or the maths is obscured by employee bands, per-report fees or mandatory setup charges.
5 — Most tiers carry real numbers with billing period and VAT treatment stated, but at least one commonly needed capability — extra entities, extra languages, phone intake — hides in an unpriced add-on.
8 — Every tier priced publicly with employee-band boundaries, entity rules and setup fees stated; only genuine corporate-group contracts are custom.
10 — Complete price computability: every tier, band, add-on and renewal rule public, so the invoice for a 60-employee company and a 5-entity group is a two-minute exercise.
The Compliance Officer
Two entry prices are public — the global toll-free line and the ethics helpdesk each "from 89 EUR / month" — and plan boundaries are partially visible, with four web-form languages on Starter, ten on Advanced and unlimited on Pro. But we found no public prices for the plans themselves and no public information on employee-band boundaries, setup fees, billing period or VAT treatment, so an obligated company cannot compute a real invoice from public pages. 2
The Reporter's Advocate
Two entry figures are public — the ethics helpdesk from 89 EUR / month and the toll-free line from 89 EUR / month — and three plan names appear with feature markers. But no plan prices, employee-band boundaries, setup fees or VAT treatment are published, so an obligated company cannot compute a real invoice from the public pages. 2
The SME Operator
The only public figures I could find are 'from 89 EUR / month' for the toll-free line and the ethics helpdesk, while we found no public prices for the Starter, Advanced and Pro plans themselves, and no information on employee-band boundaries, setup fees or VAT treatment. Unlimited users, cases, procedures and automations is the simple base I want, and no per-report fees appear anywhere, but I still cannot compute the invoice for a 60-employee company from what is published — and the 'from' wording hides what the toll-free line would actually cost me. 2 8 1
The Group Counsel
Three plans exist by name — Starter, Advanced and Pro — with published differentiators such as four, ten or unlimited web-form languages, and the toll-free line and ethics helpdesk are each quoted from 89 EUR / month. But I found no public prices for the plans themselves and no employee bands, setup fees, entity rules or VAT treatment, so the real invoice for a five-entity group is a sales conversation. 2 7
The Security Auditor
Two public entry prices exist — 'Ethics helpdesk for anonymous reporters from 89 EUR / month' and 'Global toll-free line with native speakers from 89 EUR / month' — but the Starter, Advanced and Pro plans themselves carry no public prices, and we found no public information on employee-band boundaries, setup fees or billing terms. An obligated company cannot compute its invoice from the captured pages. 2 7
The Skeptic
Plan names (Starter, Advanced, Pro) and feature gating are public — language counts per plan, star features on Advanced and Pro — and the toll-free line and ethics helpdesk carry a public "from 89 EUR / month". But we found no public prices for the plans themselves and no employee-band boundaries, setup fees or VAT treatment, so an obligated company cannot compute its invoice from the pages we have. 2 8
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined | — | uncited Report an error |
| Subprocessors | Not determined | — | uncited Report an error |
Questions about Ethicontrol
Is Ethicontrol European?
Not determined: the vendor’s pages as captured do not say where Ethicontrol is based.
Where does Ethicontrol store data?
Not stated on the vendor’s pages as of 13 Oct 2026.
Does Ethicontrol have a free plan?
Not stated on the vendor’s pages as of 13 Oct 2026.
What are the best alternatives to Ethicontrol?
As of 21 Oct 2026, the panel rates preeco | hinweisgeberschutz (3.5/5), EQS Integrity Line (3.5/5) and Safecall (3.5/5) highest among the other 36 Whistleblowing Portals products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is preeco | hinweisgeberschutz (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Ethicontrol alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 13 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 6 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (10)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page ethicontrol.com Checked 13 Oct 2026 Details →
- 2 Reporting channels & reporter experience — found from sitemap ethicontrol.com Checked 13 Oct 2026 Details →
- 3 Reporting channels & reporter experience — found from sitemap help.ethicontrol.com Checked 13 Oct 2026 Details →
- 4 Case management & deadline discipline — found from sitemap ethicontrol.com Checked 13 Oct 2026 Details →
- 5 Case management & deadline discipline — found from sitemap help.ethicontrol.com Checked 13 Oct 2026 Details →
- 6 Legal compliance alignment — found from sitemap ethicontrol.com Checked 13 Oct 2026 Details →
- 7 Legal compliance alignment — found from sitemap ethicontrol.com Checked 13 Oct 2026 Details →
- 8 Security & anonymity assurance — found from sitemap ethicontrol.com Checked 13 Oct 2026 Details →
- 9 Security & anonymity assurance — found from sitemap help.ethicontrol.com Checked 13 Oct 2026 Details →
- 10 Group & multi-entity capability — found from sitemap help.ethicontrol.com Checked 13 Oct 2026 Details →