Whistleblowing Portals
EthicsGlobal
Provenance unknown Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: not determined
by EthicsGlobal · www.ethicglobal.com
Report an error on this page Is this your product? →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
EthicsGlobal is listed in the Whistleblowing Portals category, but the captured page does not show a whistleblowing product: it describes "pre-opening IT project management, LV infrastructure design, and systems integration", and the only intake anywhere is an email contact form whose required field reads "Enter your email here*". The computed scores show a minimum of 0 and a maximum of 0 on each of the seven criteria, and the flagged splits record none — the rationales converge rather than split. The bench found no strength on any criterion: on reporting channels the sole captured intake collects an email address; on case management, compliance alignment, security assurance and multi-entity scale we found no public information — no statutory deadline tracking, no reference to EU Directive 2019/1937 or any national transposition, no certifications or encryption statements, no group structures; sovereignty carries no attributes on record, with ETHIC Global, LLC the only entity named. No public prices appear, which is normal in this market and not counted in the verdicts. On this record, every question an obligated employer has is a sales conversation.
Speaks for it
- An email contact form is available as a first point of contact
- The operating entity is identified on the page as ETHIC Global, LLC
- The page states its actual service offering concretely: pre-opening IT project management, LV infrastructure design, and systems integration
Held against it
- The only captured intake is an email contact form whose required field reads 'Enter your email here*'
- The captured page describes pre-opening IT project management, LV infrastructure design and systems integration rather than any reporting workflow
- We found no public information on case handling — statutory deadline tracking, role separation, or audit history
- We found no public information referencing EU Directive 2019/1937 or any national transposition
- No sovereignty attributes are on record, with no public hosting location, data processing agreement, or subprocessor list
Best for
- You need pre-opening IT project management, LV infrastructure design, or systems integration — the services the captured page actually describes
- You are content to source pricing, security and compliance details through direct vendor conversation rather than public pages
- You want a named legal counterparty from the first contact; the page identifies ETHIC Global, LLC
Avoid if
- Your reporters need anonymity at intake — the only captured intake is an email contact form requiring an email address
- You must run statutory acknowledgment and feedback deadlines inside the product — the captured page describes IT project management and systems integration rather than any case system
- You need a vendor whose pages evidence whistleblowing functionality; the captured page evidences IT services instead
- You must establish hosting jurisdiction and data processing terms for whistleblowing data — ask the vendor: the public pages we read do not show it
The scores
Too little public evidence to rate — fewer than 1 captured source or 3 proven facts — so no star rating is shown. The panel's reasoning is below.
Reporting channels & reporter experience
Show reasoningHide reasoning
How this is scored
The intake side: how a reporter actually submits — web form, anonymous dialog, phone/voice, languages, accessibility — and whether anonymity survives first contact.
0 — A web form that is an email in disguise: no anonymous route, no way to reach the reporter afterwards.
3 — An anonymous form exists but the dialogue ends there — no secured mailbox for follow-up questions, few languages, desktop-only.
5 — Anonymous two-way dialog via a protected mailbox, a usable set of languages, mobile-friendly; voice or phone intake missing or an add-on.
8 — Multiple channels (web, voice message or hotline, QR entry points), broad language coverage with translation support, accessibility considered, and the anonymous dialog is first-class rather than bolted on.
10 — Intake engineered around the frightened reporter: every channel anonymous-capable, dozens of languages, WCAG-conscious, no app install or account required, and the vendor documents how the reporter's identity is kept out of the channel itself.
The Compliance Officer
The only intake-adjacent item on the captured page is an email contact form that asks the sender to supply their address, while the page's own service description covers IT project management and systems integration rather than reporter intake. We found no public information on an anonymous route, a protected follow-up mailbox, languages, or phone entry — from my desk this is the inbox-with-a-form situation I refuse to run. 1
The Reporter's Advocate
The only intake on the captured page is an email contact form demanding "Enter your email here*" — a form that is an email in disguise, with no anonymous route and no secured dialog for follow-up questions. I found no public information on phone or voice intake, languages, or how a frightened reporter's identity would be kept out of the channel. 1
The SME Operator
The captured vendor page describes pre-opening IT project management, LV infrastructure design and systems integration, and we found no public information on any whistleblower intake channel — no anonymous form, follow-up mailbox, phone route or language coverage. For an obligated company like mine there is nothing here a reporter could even submit through. 1
The Group Counsel
The only contact mechanism the captured page shows is the vendor's own email contact form; I found no public information on any reporting channel — anonymous or named, web or phone — or on any two-way dialog with a reporter. For a group roll-out I have no intake mechanism to point a frightened employee at. 1
The Security Auditor
The only intake surface in the captured material is a contact form whose required field is 'Enter your email here*', so a reporter's identity enters the channel at first contact. We found no public information on anonymous submission routes, secured follow-up dialogue, languages, or voice intake. 1
The Skeptic
The only intake evidenced anywhere is a contact form that demands an email address — the collected page reads 'Enter your email here*' — which is a web form that is an email in disguise. We found no public information on any anonymous route, protected two-way dialog, hotline, languages, or accessibility. 1
Case management & deadline discipline
Show reasoningHide reasoning
How this is scored
The case worker's side: triage, statutory deadlines (7-day acknowledgment, 3-month feedback), role separation, audit-proof documentation.
0 — Reports land in an inbox; deadlines, roles and history live in a spreadsheet next door.
3 — A case list with status fields, but deadlines are manual, permissions are all-or-nothing, and the record of who did what is thin.
5 — Deadline tracking with reminders for the statutory clocks, case notes and attachments, basic role separation between case handlers; reporting on the caseload is limited.
8 — Automated statutory clocks, conflict-of-interest handling (excluding implicated case handlers), complete tamper-evident case history, retention and deletion rules applied per case, and management reporting.
10 — A case system an external investigator can rely on: enforced workflows, full audit trail, legally aware retention/deletion automation, evidence handling, and statistics that survive a regulator's questions.
The Compliance Officer
We found no public information on a case list, statutory clocks, reminders, role separation, or any record of who did what — the captured page describes no case-worker side at all. If the 7-day and 3-month clocks live nowhere, they become my personal liability, and nothing here moves them off my desk. 1
The Reporter's Advocate
I found no public information on any case list, statutory deadline tracking, role separation, or tamper-evident case history — nothing a case worker could triage with. The captured page instead markets pre-opening IT project management and systems integration services. 1
The SME Operator
We found no public information on case lists, statutory clocks such as the 7-day acknowledgment or 3-month feedback deadline, role separation or audit history. The captured page evidences no case system of any kind, so I cannot verify the legal duties would be handled by the product rather than by me. 1
The Group Counsel
I found no public information on case handling of any kind — no statutory clocks, role separation, tamper-evident history or caseload reporting. The captured description of the offering is pre-opening IT project management, low-voltage infrastructure design and systems integration, which gives me nothing to administer a single case with, let alone a group's. 1
The Security Auditor
We found no public information on case lists, statutory deadline tracking, role separation, or audit-proof case history. The captured page describes pre-opening IT project management and systems integration services rather than any reporting workflow. 1
The Skeptic
We found no public information on case handling — no statutory deadlines, no role separation, no audit trail, no retention rules. The captured page instead advertises 'pre-opening IT project management, LV infrastructure design, and systems integration', which a case worker cannot map onto caseload or clocks. 1
Legal compliance alignment
Show reasoningHide reasoning
How this is scored
How specifically the product implements EU Directive 2019/1937 and national transpositions (HinSchG et al.) — not whether the marketing mentions them.
0 — Generic feedback software wearing a whistleblowing label; no reference to the legal obligations it claims to satisfy.
3 — The directive is invoked in marketing but the mapping is vague; deadline rules, documentation duties and retention periods are the customer's problem.
5 — The statutory duties are implemented as product features — acknowledgment and feedback clocks, documentation, deletion after the retention period — for at least one national law, with guidance for the rest.
8 — Multiple national transpositions supported with their differing details, legal templates and process guidance maintained by named counsel or documented review, and updates when the law moves.
10 — The product is a legal instrument: per-country rule sets kept current, documented legal review, guidance for edge cases (group-wide channels, external ombudsman setups), and the vendor shows its homework in public.
The Compliance Officer
The captured page makes no reference to EU Directive 2019/1937 or any national transposition, and we found no public information on acknowledgment or feedback clocks, documentation duties, or retention periods as product features. An obligated employer has nothing here to measure legal implementation against. 1
The Reporter's Advocate
I found no public information referencing the EU whistleblowing directive or any national transposition, and no acknowledgment or feedback clocks, documentation duties, or retention rules shown as product features. The category label is the only place the whistleblowing purpose appears. 1
The SME Operator
We found no reference to EU Directive 2019/1937 or any national transposition such as the HinSchG on the captured page; the only services described are IT project management, LV infrastructure design and systems integration. There is nothing to map my company's whistleblowing obligations onto. 1
The Group Counsel
I found no public reference to the EU whistleblower directive, any national transposition, acknowledgment or feedback deadlines, or retention duties. The captured page describes IT project management and infrastructure services, so I have no basis to treat this as a legal instrument implementing even one jurisdiction's whistleblowing law. 1
The Security Auditor
We found no public information referencing EU Directive 2019/1937, national transpositions, acknowledgment or feedback deadlines, documentation duties, or retention periods. No legal obligation of any kind appears in the captured material. 1
The Skeptic
The captured page never invokes the EU whistleblowing directive or any national transposition, and I found no public information on acknowledgment or feedback deadlines, documentation duties, or deletion periods. A category placement is not legal implementation. 1
Security & anonymity assurance
Show reasoningHide reasoning
How this is scored
Whether the confidentiality promise is engineered and evidenced: encryption, metadata handling, penetration tests, certifications.
0 — Security is a paragraph of adjectives; no certificates, no test reports, no statement on metadata.
3 — TLS and encryption at rest asserted, but nothing audited: no ISO 27001 or equivalent, no published pentest, silence on IP and metadata logging.
5 — A current ISO 27001 (or equivalent) certificate for vendor or hosting, end-to-end encryption of report content claimed with some technical detail, an explicit no-IP-logging statement.
8 — Certified ISMS covering the product, regular third-party penetration tests attested, documented end-to-end encryption architecture, metadata minimization explained, security contact and disclosure policy published.
10 — Assurance a hostile auditor accepts: current certificates with visible scope, recurring pentest summaries public, cryptographic architecture documented, anonymity analysed against the operator itself — the vendor can answer "how would you unmask a reporter?" with "we cannot, and here is why".
The Compliance Officer
We found no public information on ISO 27001 or equivalent certification, penetration tests, encryption of report content, or how IP and metadata are handled. For the most sensitive data a company holds, we cannot even see a paragraph of assurance claims to test. 1
The Reporter's Advocate
I found no public information on encryption, certificates, penetration tests, or what happens to a reporter's IP and metadata — not even adjectives about security appear on the captured page. For data this sensitive, that silence is the deciding fact. 1
The SME Operator
We found no public information on ISO 27001 or equivalent certification, penetration tests, encryption architecture, or handling of IP addresses and metadata. The only product detail captured is an email contact form, which is no assurance basis for the most sensitive data a company holds. 1
The Group Counsel
I found no public information on certifications, penetration tests, encryption of report content, or handling of IP and metadata. I have nothing to put in front of an auditor or a works council showing how reporter confidentiality is engineered. 1
The Security Auditor
We found no public information on certificates, penetration tests, encryption of report content, or metadata and IP handling — the captured page carries no security statement at all, not even an adjective one. For a channel whose entire promise is confidentiality, that is the bottom of the scale as I score it. 1
The Skeptic
No certificates, no penetration test summaries, no encryption claims, no statement on metadata or IP logging — we found no public information on any of it. There is no confidentiality promise on the record to even begin testing, which for whistleblowing data is the whole question. 1
Group & multi-entity capability
Show reasoningHide reasoning
How this is scored
Whether one contract can serve a corporate group: separate channels per legal entity, central oversight, ombudsman access, white-labeling.
0 — One company, one channel; a group buys and administers N separate instances.
3 — Multiple channels under one account, but no separation of case access per entity and no consolidated view.
5 — Per-entity channels with separated case handlers and a group-level overview; branding per entity is basic; external counsel access possible.
8 — Real multi-tenant group structure: per-entity channels, languages and branding, delegated administration, external ombudsman roles, group reporting that respects entity boundaries.
10 — Group compliance as architecture: hundreds of entities manageable centrally, per-country legal rule assignment per entity, white-label reporting pages, and access separation strong enough to satisfy each subsidiary's works council.
The Compliance Officer
We found no public information on per-entity channels, separated case access, group-level oversight, ombudsman or counsel access, or per-entity branding. A 600-employee operation running several legal entities has nothing documented here to build group structure on. 1
The Reporter's Advocate
I found no public information on per-entity channels, delegated administration, consolidated group oversight, or ombudsman access. Nothing on the captured page indicates one contract could serve more than a single entity. 1
The SME Operator
We found no public information on multiple channels under one contract, per-entity case separation, delegated administration or external ombudsman access. Nothing captured evidences any group capability, which matters even to a single-site company like mine that reports into a wider group. 1
The Group Counsel
I found no public information on per-entity channels, separated case access per subsidiary, delegated administration, external ombudsman roles, or a consolidated group view. Nothing published supports covering twenty-five subsidiaries in a dozen countries under one structure. 1
The Security Auditor
We found no public information on separate channels per legal entity, separated case-handler access, group-level oversight, ombudsman access, or white-labeling. Nothing in the captured material shows a product structure that could serve a corporate group. 1
The Skeptic
We found no public information on per-entity channels, group oversight, delegated administration, branding, or ombudsman access. With a single corporate page and an email contact form as the only intake, a corporate group has nothing here to evaluate against one-contract service. 1
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where reports about people actually live and under whose law — entity, hosting, subprocessors, DPA. In this category the data is by definition the most sensitive a company holds.
0 — Non-EU entity, non-EU-default hosting, no public DPA or subprocessor list — for whistleblowing data.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad or undocumented.
5 — EU hosting is the default, DPA and subprocessor list published; the vendor or a critical subprocessor is still within non-European jurisdictional reach.
8 — EU entity, EU hosting with named data centers, published subprocessor list free of content-touching non-EU processors, DPA and TOMs public.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors for report content and metadata, on-premises or sovereign-cloud options, and the whole chain documented publicly.
The Compliance Officer
The recorded legal entity is ETHIC Global, LLC, the sovereignty record is empty, and we found no public information on hosting location, data processing terms, or subprocessors. For whistleblowing data I treat a fully undocumented data chain as the lowest level of confidence. 1
The Reporter's Advocate
The only governance fact captured is the entity name ETHIC Global, LLC, and I found no public information on hosting location, data protection terms, or subprocessors. Where the most sensitive reports a company holds would live, and under whose law, is entirely unevidenced. 1
The SME Operator
No sovereignty attributes are on record, and we found no published DPA, subprocessor list or hosting information; the operating entity is stated as "ETHIC Global, LLC" with no EU establishment documented anywhere captured. For whistleblowing data I have no way to verify where reports about people would live or under whose law. 1
The Group Counsel
I found no public information on hosting location, a data processing agreement, a subprocessor list, or where report data would reside, and the only entity reference on the captured page is an LLC designation. For the most sensitive data we hold, I cannot establish from public pages that anything sits under European jurisdiction or protection. 1
The Security Auditor
No sovereignty attributes are on record: the captured page names an LLC entity, and we found no public information on hosting locations, a data-processing agreement, or a subprocessor list. For the most sensitive data a company holds, I can credit nothing on jurisdiction that is not documented. 1
The Skeptic
No sovereignty attributes are on record: we found no public information on hosting location, data processing agreement, subprocessor list, or jurisdiction — only the entity name 'ETHIC Global, LLC'. For the most sensitive data a company holds, an empty file is itself the answer an auditor will act on. 1
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether an obligated company can compute the real invoice — per entity, per employee band, per year — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — An entry price exists, but the tiers most obligated companies need are unpriced, or the maths is obscured by employee bands, per-report fees or mandatory setup charges.
5 — Most tiers carry real numbers with billing period and VAT treatment stated, but at least one commonly needed capability — extra entities, extra languages, phone intake — hides in an unpriced add-on.
8 — Every tier priced publicly with employee-band boundaries, entity rules and setup fees stated; only genuine corporate-group contracts are custom.
10 — Complete price computability: every tier, band, add-on and renewal rule public, so the invoice for a 60-employee company and a 5-entity group is a two-minute exercise.
The Compliance Officer
We found no public prices on the captured page — no tiers, employee bands, entity rules, or setup fees of any kind. An obligated company cannot compute even a rough invoice from what is public; every question would have to be a sales conversation. 1
The Reporter's Advocate
No price appears anywhere on the captured page — no tiers, no employee bands, no billing period, no setup fees — so an obligated company cannot compute even a first invoice from public pages. I found no public pricing information at all. 1
The SME Operator
We found no public pricing of any kind — no tiers, no employee bands, no prices, only an email contact form marked "Enter your email here*". I cannot begin to compute what a 60-employee obligated company would pay, so a sales conversation is the only path. 1
The Group Counsel
I found no public prices at all — no tiers, employee bands, billing periods, VAT treatment or setup fees. The invoice for a single obligated entity or a multi-entity group would be a sales conversation from start to finish. 1
The Security Auditor
We found no public prices at all — no tiers, employee bands, billing periods, or setup fees appear in the captured material. An obligated company would have no basis to compute an invoice from the public pages. 1
The Skeptic
We found no public prices at all — no tiers, no employee bands, no setup fees, no billing or VAT treatment. An obligated company cannot compute even a rough invoice from what has been captured, so every number is a sales conversation. 1
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Sep 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (ethicglobal.com). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
- We found no public information on compliance on the pages we read (ethicglobal.com). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
Sources (1)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page www.ethicglobal.com Checked 29 Sep 2026 Details →