# Ethicontrol — Whistleblowing Portals

Ethicontrol by Ethicontrol holds a panel rating of 3/5 from 6 AI judges (category median 2/5), as of 2026-10-15. Provenance: provenance unknown; sovereignty: not determined.

- Vendor: Ethicontrol (https://ethicontrol.com)
- Category: [Whistleblowing Portals](https://whats-best.ai/software/whistleblowing.md)
- Provenance (editorial classification): provenance unknown
- Canonical page: https://whats-best.ai/software/whistleblowing/ethicontrol
- Alternatives: https://whats-best.ai/software/whistleblowing/ethicontrol/alternatives ([markdown](https://whats-best.ai/software/whistleblowing/ethicontrol/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-15 · oldest source captured 2026-10-13

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Ethicontrol
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 13 Oct 2026
- Starting price: “Whistleblowing platform from 89 EUR per month” (vendor’s words) [S1]

## The panel's verdict

Ethicontrol is strongest at intake: reporting channels scores cluster at 8, crediting a 24/7 toll-free line, a script-free portal reachable over Tor, anonymous two-way dialogue via secret code and Feedback Room, and metadata stripped from uploads; case management clusters at 7 for no-access-by-default roles and escalation bypassing implicated responders. Weakest are pricing transparency at 2-3 — beyond 'from 89 EUR / month' entry prices for the toll-free line and ethics helpdesk, the Starter, Advanced and Pro plans carry no public prices — and sovereignty at 2-4, where the captured pages give different figures for data location ('Data stored within the EU in certified data centers' on one, servers in the EU, US, UAE, KSA, India and Tanzania on another) and we found no public information on the vendor's legal entity, ownership, a data processing agreement or subprocessors. The splits are matters of weight: the two-point spreads on sovereignty and multi-entity scale 6-8 weigh multi-portal, multi-tenant structure against undocumented delegated administration and ombudsman roles. Security assurance 4-5 and compliance alignment 5-6 sit between: engineered anonymity, unnamed certification, directive clocks without transposition detail.

**Speaks for it:**
- Reporting channels scores sit at 8, on a 24/7 toll-free line with native speakers, a script-free portal, Tor access, and anonymous two-way dialogue via a secret code and the Feedback Room.
- Reporter anonymity is engineered and documented — no tracking cookies, IP addresses or digital footprints about reporters, metadata cleaned from uploaded files, and intake channels isolated in a demilitarised zone.
- Case management scores sit at 7, with role-based access that defaults to no access, a filterable audit log, and escalation that bypasses implicated responders.
- Multi-entity scale scores 6-8 on multiple portals for groups not under a single brand, multi-tenant storage, and access split by region, division and organisational hierarchy.
- The EU Directive clocks — acknowledgement within 7 days, feedback within 3 months, a 6-month extension — are implemented as product features with overdue reminders.

**Held against it:**
- Beyond 'from 89 EUR / month' for the ethics helpdesk and toll-free line, the Starter, Advanced and Pro plans carry no public prices, employee bands, setup fees or VAT terms, so an invoice cannot be computed from public pages.
- The captured pages give different figures for data location — 'Data stored within the EU in certified data centers' on one, servers in the EU, US, UAE, KSA, India and Tanzania on another.
- We found no public information on the vendor's legal entity, ownership, a data processing agreement or a subprocessor list.
- The certification claim stops at 'certified info-security and privacy management', naming no standard, issuer or scope, and we found no public information on penetration tests or a security contact.
- We found no public information on per-case retention rules or automated deletion after the retention period.

**Best for:**
- You need intake built for a frightened reporter — anonymous two-way dialogue via a secret code, a script-free portal, Tor access and metadata cleaning are all documented.
- Your group runs companies under several brands — multiple portals with their own subdomains, multi-tenant storage and hierarchy-split access are evidenced, and multi-entity scale scores 6-8.
- You fell under the EU Directive's obligations (over 250 employees since 31/12/2021, over 50 since 17/12/2023) and want the 7-day acknowledgement, 3-month feedback and 6-month extension clocks wired into the tool.
- You want the most sensitive reports on your own infrastructure — an on-premise option, and dedicated-server configuration on request, are both offered.

**Avoid if:**
- You must compute a real invoice before a sales conversation — ask the vendor: the public pages we read do not show it
- You must pin down where reports legally sit before signing — the captured pages give different figures for data location, and we found no public data processing agreement or subprocessor list to resolve them.
- A hostile external audit is imminent and you need named certification or penetration-test evidence in hand — the public claim stays generic, and we found no public information on either.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The Compliance Officer | The Reporter's Advocate | The SME Operator | The Group Counsel | The Security Auditor | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Reporting channels & reporter experience | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 |
| Case management & deadline discipline | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Legal compliance alignment | 3/5 | 3/5 | 3/5 | 3/5 | 2.5/5 | 3/5 |
| Security & anonymity assurance | 2/5 | 2.5/5 | 2/5 | 2.5/5 | 2/5 | 2/5 |
| Group & multi-entity capability | 3/5 | 3/5 | 3/5 | 4/5 | 3.5/5 | 3.5/5 |
| European sovereignty | 1/5 | 1/5 | 1.5/5 | 2/5 | 1.5/5 | 1/5 |
| Pricing transparency | 1.5/5 | 1.5/5 | 1.5/5 | 1/5 | 1.5/5 | 1/5 |
| **Weighted verdict** | **3/5** | **3/5** | **3/5** | **3.5/5** | **2.5/5** | **2.5/5** |

### The judges

- **The Compliance Officer** (v1.0): Runs the internal reporting office of a 600-employee company and answers for every missed statutory clock. Optimizes for case discipline: automated acknowledgment and feedback deadlines, role separation, documentation that survives a regulator. Rejects inbox-with-a-form products that make the deadlines her problem.
- **The Reporter's Advocate** (v1.0): Judges from the frightened side of the form. Optimizes for anonymity that survives contact, a two-way dialog without an account, languages the workforce actually speaks, and channels that work on a night-shift phone. Rejects login walls, app installs and anything that makes reporting feel like a deposition.
- **The SME Operator** (v1.2): Runs a 60-employee company that the law obligated, not convinced. Optimizes for compliance set up in an afternoon at a price the year-end review will not question, with the legal duties handled by the product. Rejects per-report fees, setup charges and anything that needs a compliance department to operate.
- **The Group Counsel** (v1.0): Rolls one system out to 25 subsidiaries in a dozen countries. Optimizes for per-entity channels with real access separation, per-country legal rule sets, external ombudsman roles and group reporting that respects entity boundaries. Rejects one-channel products multiplied by twenty-five contracts.
- **The Security Auditor** (v1.0): Pentests the anonymity promise for a living. Optimizes for evidenced security: current certificates with visible scope, published pentests, documented end-to-end encryption, metadata minimization, and hosting outside hostile jurisdictional reach. Rejects adjective security and "military-grade" anything.
- **The Skeptic** (v1.2): Assumes "audit-proof" and "100% anonymous" are marketing until the evidence says otherwise. Hunts certification claims without certificates, anonymity claims next to analytics scripts, per-report pricing traps and legal-update promises with no named lawyer. Exists to keep the rest of the bench honest.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Encryption at rest: OS and database level · yes [S4]
- Encryption in transit: yes [S4]
- EU whistleblowing directive: yes [S1]
- GDPR: yes [S1]
- GDPR: yes [S2]
- GDPR: yes [S6]
- ISO 27001: yes [S2]
- ISO 27001: Information security · ISO 27001 · yes [S6]
- ISO 27001: ISO 27001 · yes [S7]
- ISO 27001: yes [S8]
- Iso27701: yes [S2]
- Iso27701: Privacy management · ISO 27701 · yes [S6]
- Iso27701: ISO 27701 · yes [S7]
- Iso27701: yes [S8]
- ISO 27001: yes [S1]
- ISO 27701: yes [S1]
- ISO 37001: yes [S1]
- MFA: yes · yes [S4]
- Nda: yes [S1]
- Nda client wording: yes [S8]
- Sapin pidia: yes [S1]
- Scale: 37 · 354000 [S1]
- SSO: yes · MS Azure AD · Okta · Ping [S4]
- SSO 2FA: yes · yes [S1]
- US doj: yes [S1]
- Waf: yes [S4]

**Hosting**
- Data center locations: EU · US · UAE · KSA · India · Tanzania [S4]
- EU data centers: yes · yes [S7]
- On premise option: yes [S8]
- Residency: EU [S1]

**Integrations**
- Pricing page check: compliance matrix available [S1]

**Legal**
- Copyright entities: Ethicontrol OU · Ethicontrol LLC [S7]
- Entities: Ethicontrol, OU · Ethicontrol LLC [S6]
- Entities: Ethicontrol, OU · Ethicontrol LLC [S4]
- Entity: Ethicontrol, OU · Ethicontrol LLC [S1]
- Entity: Ethicontrol, OU and Ethicontrol LLC [S8]
- Nda client wording: yes [S6]

**Pricing**
- No hidden costs: yes [S1]
- Pay model: Pay for features, not for users [S1]
- Start price: 89 [S8]
- Starting price: starting price per month · 89 · EUR [S1]
- Starting price: 89 [S7]
- Test access: 6 [S1]
- Unlimited: Unlimited reports, users, employees, cases, procedures, automations [S1]
- Unlimited users price: 89 · yes [S4]
- Upgrade downgrade: yes [S1]

**Product**
- Access rights: yes [S1]
- Access rights split: yes [S8]
- Access split by org: region · division · organizational hierarchy [S4]
- Acknowledgement followup: Timely feedback, trackability, follow-ups, acknowledgement of receipt and progress reporting [S6]
- Additional org levels: yes [S4]
- Analytics: predefined reports: time to respond, substantiation rate, investigation duration [S1]
- Analytics location: Groups report located under Analytics in main navigation [S10]
- Analytics reporting: yes [S6]
- Anonymity position: The company states the only guarantee of the informant's safety is total anonymity [S9]
- Anonymous reporting: yes [S6]
- Anonymous separate: separate [S3]
- Anonymous two way: yes [S1]
- Anonymous two way communication: yes [S8]
- Architecture separation: Reporting channels physically separated from case management; intake portal and web room in DMZ [S2]
- Audit log: yes [S1]
- Audit log: yes [S4]
- Automations: yes [S1]
- Automations: yes [S8]
- Benchmark comparison: yes [S8]
- Business rules engine: yes [S4]
- Call from web: yes [S2]
- Case activity log: yes [S4]
- Case connections: yes · yes [S4]
- Case delegation: yes [S1]
- Case facts: yes [S4]
- Case materials: yes [S1]
- Case materials: yes [S4]
- Case table limit: highest priority · 10 · yes [S5]
- Case team access: yes [S4]
- Categorisation triage: yes [S8]
- Certified infosec: yes [S7]
- Channel dependent availability: yes [S3]
- Chatbots: yes [S2]
- Client key encryption option: yes [S8]
- Compliance matrix frameworks: EU Directive · ISO 37002 · U.S. FCPA · USDoJ Evaluation · ISO 37001 · In-house solution [S6]
- Compliance standards: ISO 37001 · ISO 37002 · GDPR · EU Whistleblowing Directive [S8]
- Confidentiality: whistleblower identity kept confidential regardless of reporting channel [S7]
- Configurable reports: yes [S1]
- Consultant chat: yes [S2]
- Custom intake fields: yes [S2]
- Customizable intake: yes [S8]
- Deadline extensions: 6 [S7]
- Dedicated server option: yes [S2]
- Dedicated subdomain: company.ethics.help · speakup.click · ethicontrol.com · whistleblowing.click · aml.tips [S2]
- Default roles: Admin · Supervisor · Lead investigator · Team member · yes [S4]
- Delegation deadlines: yes [S8]
- Demo: yes [S1]
- Disciplinary actions: yes [S4]
- Dossier profiles: yes [S4]
- Employee thresholds: 2023-12-17 · 2021-12-31 · yes [S7]
- Escalation: yes [S1]
- Escalation: yes [S2]
- Escalation bypass: yes [S8]
- Executive reporting: yes [S8]
- Export: PDF · PNG/vector · CSV · XLS [S1]
- Facts verification: yes [S8]
- Feedback room: yes [S8]
- Feedback templates: yes [S1]
- File upload: yes [S2]
- Framework compliance: FCPA · UKBA · SAPIN II · PIDA · ISO 37001 · ISO 37002 · ESG [S7]
- Groups report chart types: Histogram · Pie chart [S10]
- Groups report components: primary grouping selector · chart display options · optional second grouping for stacked bars · reporting period and filters · case-count chart · detailed table · Dynamics chart [S10]
- Groups report config dependent: Available grouping values depend on organisation configuration [S10]
- Groups report detail table: yes [S10]
- Groups report dynamics chart: yes [S10]
- Groups report dynamics intervals: Years · Months · Days [S10]
- Groups report dynamics types: Curve · Histogram [S10]
- Groups report filters: Category · Unit · Assigned user · Channel · Priority · Region · Segment · Procedure · Event date / Actual incident date · Resolution date [S10]
- Groups report period options: custom range · Today · Yesterday · Week · Last week · Month · Last month · Year · Last year [S10]
- Groups report permission dependent: Access to Groups report depends on user permissions [S10]
- Groups report primary dimensions: Categories · Case class · Units · Channels · Assigned · Segments · Disciplinary actions · Statuses · Regions · Procedures · Priorities · Open / Closed · Organisational level 1 · Organisational level 2 [S10]
- Groups report purpose: Analytics report to compare case statistics across dimensions of case-management data [S10]
- Groups report secondary grouping: Channels · Statuses · Priorities · Without stacked bars [S10]
- Helpdesk price: EUR · 89 [S2]
- Instant reports: yes [S8]
- Intake case sync: yes [S2]
- Intake channels: web portal, chatbot, live chat, smart answering machine [S1]
- Intake channels: 10 [S7]
- Intake channels: Specialised contact center, toll-free numbers, multilingual web portal, chatbots, live chat, and other modern channels [S8]
- Intake data minimisation: Message pushed to case management and deleted from reporting channels on receipt [S2]
- Intake languages: 60 · yes [S7]
- Internal notes search: yes [S8]
- Internal reporting channels: Multichannel reporting channels including hotline, online form, personal meeting [S6]
- Investigation documentation: yes [S6]
- Involved parties: reporter · initiator · case manager · team members · non-team members task executors · suspects · witnesses · wrongdoers [S4]
- Jurisdiction workflows: yes [S2]
- Languages: 60+ [S1]
- Languages supported: English · Polski · Ukrainian · Spanish [S8]
- Lead investigator assignment: yes [S4]
- Live demo: yes [S7]
- Machine translation: yes [S2]
- Management decision: yes [S4]
- Manual translation: yes [S2]
- Metadata cleaning: yes [S2]
- Multi tenant storage: yes [S2]
- Multichannel reporting: yes · yes · yes · yes [S7]
- Multiple portals: yes [S2]
- Notifications: yes [S1]
- Notifications alerts: yes [S8]
- Notifications via verified contact: email · phone · yes [S3]
- Onboarding time: 72 [S1]
- Outsourced processing: yes [S7]
- Pdf export: yes · yes [S4]
- Personnel training: yes [S6]
- Portal branding: yes [S2]
- Procedures: yes [S4]
- Procedures: yes [S8]
- Profiles connections: yes [S8]
- Rbac access: yes · no access unless granted [S4]
- Remediation plan: yes [S4]
- Report integrity: Original reported message cannot be changed on either side [S2]
- Reporter email alerts: yes [S2]
- Reporter identity protection: No tracking cookies, IP addresses or digital footprints collected about reporters [S2]
- Reporter password: yes [S2]
- Reporter profile linking: yes [S3]
- Reporter web room: yes [S2]
- Reporter web room: yes [S4]
- Retaliation protection: yes [S6]
- Script free portal: yes [S2]
- Search scope: cases · facts · tasks · case materials · suspect index [S4]
- Single or multiscreen form: yes [S2]
- Sop templates: yes [S4]
- SSO 2FA: yes · yes [S6]
- Star features plans: Advanced · Pro [S2]
- Task workflow: yes [S4]
- Tasks: yes [S1]
- Tasks sections: Investigation tasks · Disciplinary actions · Remediation actions [S4]
- Team conclusions: yes [S4]
- Team messages: yes [S4]
- Templates provided: yes [S1]
- Templates translation: yes [S4]
- Terminology adaptation: yes [S2]
- Third party reporting: yes [S6]
- Three steps: Choose your plan · Test and adjust · Promote and use [S7]
- Toll free line price: EUR · 89 [S2]
- Top management access: yes [S6]
- Tor access: yes [S2]
- Trackability deadlines: 3 · 7 [S7]
- Triage prioritisation: yes [S6]
- Triggered fields: yes [S2]
- Trust center: yes [S1]
- Turnkey process: yes [S7]
- Unified event registry: yes [S8]
- Unified feedback room: yes [S3]
- Unit based assignment: yes [S2]
- Unit hierarchy: yes [S2]
- Unlimited usage: Unlimited users, cases, procedures, automations [S8]
- User activity reports: yes [S8]

**Support**
- All users: 24/7 · Help portal · in-app support widget · yes [S4]
- Enterprise channels: phone · MS Teams · WhatsApp [S4]
- Languages: English · Polski · Українська · Español [S6]
- Live training: yes [S1]
- Premium: premium · phone · video [S1]
- Promo campaign: yes [S1]
- Success calls: yes [S1]

4 more facts on the canonical page: https://whats-best.ai/software/whistleblowing/ethicontrol

## Questions

### Is Ethicontrol European?

Not determined: the vendor’s pages as captured do not say where Ethicontrol is based.

### Where does Ethicontrol store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does Ethicontrol have a free plan?

Not stated on the vendor’s pages as of 13 Oct 2026.

### What are the best alternatives to Ethicontrol?

As of 21 Oct 2026, the panel rates [preeco | hinweisgeberschutz (3.5/5)](https://whats-best.ai/software/whistleblowing/preeco-hinweisgeber), [EQS Integrity Line (3.5/5)](https://whats-best.ai/software/whistleblowing/eqs-integrity-line) and [Safecall (3.5/5)](https://whats-best.ai/software/whistleblowing/safecall) highest among the other 36 Whistleblowing Portals products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [preeco | hinweisgeberschutz](https://whats-best.ai/software/whistleblowing/preeco-hinweisgeber) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Ethicontrol alternatives](https://whats-best.ai/software/whistleblowing/ethicontrol/alternatives).

## What this page leaves out

- 6 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor page: https://ethicontrol.com (checked 2026-10-13)
- [S2] Reporting channels & reporter experience — found from sitemap: https://ethicontrol.com/en/features/internal-reporting-channels (checked 2026-10-13)
- [S3] Reporting channels & reporter experience — found from sitemap: https://help.ethicontrol.com/en/support/solutions/articles/24000106298-how-to-log-in-to-the-feedback-room-using-email-or-phone (checked 2026-10-13)
- [S4] Case management & deadline discipline — found from sitemap: https://ethicontrol.com/en/features/case-management (checked 2026-10-13)
- [S5] Case management & deadline discipline — found from sitemap: https://help.ethicontrol.com/en/support/solutions/articles/24000077740-case-sorting (checked 2026-10-13)
- [S6] Legal compliance alignment — found from sitemap: https://ethicontrol.com/en/compliance-matrix (checked 2026-10-13)
- [S7] Legal compliance alignment — found from sitemap: https://ethicontrol.com/en/eu-whistleblowing-directive-platform (checked 2026-10-13)
- [S8] Security & anonymity assurance — found from sitemap: https://ethicontrol.com/en/painless-security-platform (checked 2026-10-13)
- [S9] Security & anonymity assurance — found from sitemap: https://help.ethicontrol.com/en/support/solutions/articles/24000014535-what-are-the-security-guarantees-for-the-informant-how-to-protect-yourself-from-harassment- (checked 2026-10-13)
- [S10] Group & multi-entity capability — found from sitemap: https://help.ethicontrol.com/en/support/solutions/articles/24000106750-how-to-use-the-groups-report (checked 2026-10-13)

---

Cite as: whats-best.ai, "Ethicontrol — Whistleblowing Portals", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/whistleblowing/ethicontrol

Corrections: https://whats-best.ai/correct/841?target=page