Whistleblowing Portals
FaceUp
EU-Made Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 2 of 4 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by FaceUp Technology s.r.o. · www.faceup.com
Report an error on this page Is this your product? →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
FaceUp, a Czech whistleblowing portal vendor, is strongest at reporter-facing intake and weakest at legal implementation. Reporting channels & reporter experience scores 8: web, mobile and hotline channels, two-way anonymous follow-up, 113 languages, and documented identity protection — IP addresses not stored, metadata removed, voice messages anonymized. Legal compliance alignment lands at 1-2, with GDPR, CCPA and CPRA the only laws named anywhere in the evidence and EU Directive 2019/1937 absent. Case management & deadline discipline scores 4: the 7-day acknowledgment and 3-month feedback clocks, conflict-of-interest exclusion and per-case retention are unevidenced; the one retention rule is a 30-day cap on hotline recordings. Group & multi-entity capability rests on a single Enterprise bullet. Security & anonymity assurance spans 5-7 — judges credit claimed ISO 27001:2022 and SOC 2 certification with E2EE but weigh missing certificate scopes, public pentest reports and disclosure policy differently. Sovereignty covers a Czech s.r.o. for rest-of-world processing, a US Inc. for US data, EU/US/UAE/Australia storage regions, and OpenAI generating hotline transcripts.
Speaks for it
- Web, mobile and hotline reporting channels with two-way anonymous follow-up and 113 languages
- Channel-level identity protection is documented: IP addresses not stored, metadata removed, voice messages anonymized
- ISO 27001:2022 and SOC 2 certification claimed, with end-to-end encryption in standard or symmetrical modes
- DPA available with the subprocessor list published at Annex B
- AI-powered features, automatic translation and voice transcription are processed in the EU
Held against it
- EU Directive 2019/1937 and every national transposition go unmentioned; only GDPR, CCPA and CPRA are named
- No evidence of statutory deadline clocks, conflict-of-interest exclusion or per-case retention — the sole retention rule is 30 days for hotline recordings
- Hotline transcripts flow through OpenAI, a US processor touching report content, despite the security page's 'no third-party access' claim
- Multi-entity support is a single Enterprise bullet (with unlimited administrators) — no per-entity case separation or group oversight is evidenced
- Certificate scopes, public pentest reports and a security disclosure policy are absent
Best for
- You need anonymous intake across web, mobile and hotline in 113 languages and your team runs the statutory deadlines itself
- You operate a single-entity company and don't need group-level architecture
- You are a school — the vendor advertises Special Pricing for Schools
Avoid if
- You need the portal to implement EU Directive 2019/1937 duties — acknowledgment and feedback clocks, documentation and retention rules
- You must keep report content free of US-reachable processors — OpenAI generates hotline transcripts and FaceUp Technology Inc. handles US data processing
- You are rolling out across subsidiaries and need per-entity case separation and group-level oversight
- You require attested security — certificate scopes, public pentest reports and a security disclosure policy
The scores
Reporting channels & reporter experience
Show reasoningHide reasoning
How this is scored
The intake side: how a reporter actually submits — web form, anonymous dialog, phone/voice, languages, accessibility — and whether anonymity survives first contact.
0 — A web form that is an email in disguise: no anonymous route, no way to reach the reporter afterwards.
3 — An anonymous form exists but the dialogue ends there — no secured mailbox for follow-up questions, few languages, desktop-only.
5 — Anonymous two-way dialog via a protected mailbox, a usable set of languages, mobile-friendly; voice or phone intake missing or an add-on.
8 — Multiple channels (web, voice message or hotline, QR entry points), broad language coverage with translation support, accessibility considered, and the anonymous dialog is first-class rather than bolted on.
10 — Intake engineered around the frightened reporter: every channel anonymous-capable, dozens of languages, WCAG-conscious, no app install or account required, and the vendor documents how the reporter's identity is kept out of the channel itself.
The Compliance Officer
Web, mobile and hotline intake with metadata removed, no IP storage, anonymized voice messages and two-way anonymous follow-up across 113 languages is a real anonymous intake, not a form bolt-on. It stops short of the top anchor because the evidence says nothing on accessibility/WCAG or QR entry, and I want the no-tracing claim documented against the operator itself, not just asserted. 1 2 3
The Reporter's Advocate
Web, mobile and a real hotline, two-way anonymous follow-up, 113 languages with automatic translation — and the vendor actually documents how identity stays out of the channel: no IP stored, metadata removed, voice messages anonymized. Docked because the evidence is silent on accessibility/WCAG, shows no QR entry points, and never confirms a reporter can file without an account or app install. 1 2 3 4
The SME Operator
Web, mobile and hotline intake with two-way anonymous follow-up, 113 languages, and a concrete identity promise — metadata removed, IPs not stored, no sender tracing, voice messages anonymized. Only accessibility (WCAG) and QR entry points go unmentioned, which keeps it at rubric level 8 rather than higher. 1 2 3
The Group Counsel
Web, mobile app and an AI hotline with two-way anonymous follow-up across 113 languages, plus an explicit identity-protection claim (IP not stored, metadata removed, voice messages anonymized) — that is first-class anonymity, not a bolted-on form. Accessibility and a no-install guarantee are never evidenced, which keeps it off the top anchor. 1 2 3
The Security Auditor
Web, mobile and hotline channels with 113 languages and first-class two-way anonymous follow-up, plus documented channel-level identity protection (no IP storage, metadata removed, voice anonymized). Docked below 10 because accessibility/WCAG, QR entry points, and no-app-install reporting are entirely unevidenced. 1 2 3
The Skeptic
Web, mobile and hotline channels with two-way anonymous follow-up and 113 languages is genuinely strong intake, and the vendor does document how identity is kept out of the channel (IP not stored, metadata removed, voice messages anonymized). But not one word on accessibility/WCAG or QR entry points, so I can't go past the 8 anchor — 'no app install required' is also unverified when a mobile app is the marketed channel. 1 2 3 4
Case management & deadline discipline
Show reasoningHide reasoning
How this is scored
The case worker's side: triage, statutory deadlines (7-day acknowledgment, 3-month feedback), role separation, audit-proof documentation.
0 — Reports land in an inbox; deadlines, roles and history live in a spreadsheet next door.
3 — A case list with status fields, but deadlines are manual, permissions are all-or-nothing, and the record of who did what is thin.
5 — Deadline tracking with reminders for the statutory clocks, case notes and attachments, basic role separation between case handlers; reporting on the caseload is limited.
8 — Automated statutory clocks, conflict-of-interest handling (excluding implicated case handlers), complete tamper-evident case history, retention and deletion rules applied per case, and management reporting.
10 — A case system an external investigator can rely on: enforced workflows, full audit trail, legally aware retention/deletion automation, evidence handling, and statistics that survive a regulator's questions.
The Compliance Officer
Case management with audit trail, multi-workflow handling and dashboards is claimed on the plan pages, which clears the 'inbox with a form' bar. But nowhere does the evidence evidence the 7-day acknowledgment or 3-month feedback clocks, conflict-of-interest exclusion of implicated handlers, or per-case retention rules — the statutory deadlines would be my problem in a spreadsheet next door, and that is exactly what I reject. 2
The Reporter's Advocate
Case management with an audit trail, workflows and dashboards exists — but the statutory clocks my frightened reporter is owed (7-day acknowledgment, 3-month feedback), reminders, conflict-of-interest exclusion and per-case retention are entirely unevidenced. Missing evidence is information: deadlines appear to be nobody's feature here. 2
The SME Operator
Case management with audit trail, multiple workflows and analytics is evidenced, but not one word on the 7-day acknowledgment or 3-month feedback clocks, handler role separation, conflict-of-interest exclusion, or per-case retention. I'd be running the statutory deadlines myself — exactly the work I bought the product to avoid. 2
The Group Counsel
There is case management with an audit trail, workflows, dashboards and tiered permissions, but not one word on the statutory clocks — no 7-day acknowledgment, no 3-month feedback deadline, no conflict-of-interest exclusion of implicated handlers, and the only retention rule I can find is a 30-day cap on hotline voice recordings. For a group under a dozen transposition regimes, deadline discipline is the product; here it is invisible. 2 4
The Security Auditor
Audit trail, multi-workflow case management and analytics exist, but there is zero evidence of statutory deadline clocks, conflict-of-interest exclusion of implicated handlers, or per-case retention rules — the 30-day voice-recording deletion is data hygiene, not deadline discipline. Missing evidence on the statutory clocks is decisive for a whistleblowing product. 2 4
The Skeptic
'Case management with audit trail' and 'advanced reporting and analytics' are feature-blob words — the evidence contains nothing on statutory clocks, conflict-of-interest exclusion, or per-case retention, and the only retention rule found is a 30-day delete on hotline recordings. For a whistleblowing product, total silence on the 7-day/3-month deadlines is information, not an oversight. 2 4
Legal compliance alignment
Show reasoningHide reasoning
How this is scored
How specifically the product implements EU Directive 2019/1937 and national transpositions (HinSchG et al.) — not whether the marketing mentions them.
0 — Generic feedback software wearing a whistleblowing label; no reference to the legal obligations it claims to satisfy.
3 — The directive is invoked in marketing but the mapping is vague; deadline rules, documentation duties and retention periods are the customer's problem.
5 — The statutory duties are implemented as product features — acknowledgment and feedback clocks, documentation, deletion after the retention period — for at least one national law, with guidance for the rest.
8 — Multiple national transpositions supported with their differing details, legal templates and process guidance maintained by named counsel or documented review, and updates when the law moves.
10 — The product is a legal instrument: per-country rule sets kept current, documented legal review, guidance for edge cases (group-wide channels, external ombudsman setups), and the vendor shows its homework in public.
The Compliance Officer
The only statutes the evidence names are GDPR and the California privacy laws in the privacy policy — not one mention of EU Directive 2019/1937, HinSchG, or any national transposition, and no deadline or documentation duty implemented as a feature. A whistleblowing portal with zero evidenced whistleblowing-law mapping is generic feedback software wearing the label; missing evidence here is the finding. 3 4
The Reporter's Advocate
Every legal fact on this sheet is privacy law — GDPR, CCPA/CPRA response windows, a Czech supervisory authority — and not one word on Directive 2019/1937 or HinSchG deadlines, documentation duties or whistleblower retention periods. That is generic feedback software wearing a whistleblowing label, as far as this sheet shows. 3 4
The SME Operator
The only laws actually named are GDPR and California's CCPA/CPRA — that's privacy hygiene, not whistleblowing duty. No reference to Directive 2019/1937 or any national transposition, no acknowledgment/feedback clocks, no legal templates or counsel review; the legal obligations remain my problem. 3 4
The Group Counsel
GDPR and CCPA/CPRA hygiene is documented, but Directive 2019/1937 and every national transposition are entirely absent from the captured evidence — no acknowledgment or feedback clocks as features, no legal templates, no named counsel. A whistleblowing portal that never names the whistleblowing law is a compliance risk, not a compliance instrument. 3 4
The Security Auditor
The only laws implemented or even named are GDPR and California's CCPA/CPRA; EU Directive 2019/1937 and any national transposition (HinSchG etc.) appear nowhere in the captured evidence, and no acknowledgment/feedback clock features or legal review are documented. This is generic privacy compliance wearing a whistleblowing label. 3 4
The Skeptic
The only laws FaceUp names in the entire sheet are GDPR, CCPA and CPRA — the privacy policy is visibly written for California, while EU Directive 2019/1937 and any national transposition appear nowhere in the captured facts. No deadline features, no legal templates, no named counsel; this is a compliance-adjacent anonymous form service, not an implementation of the whistleblowing law. 4 2
Security & anonymity assurance
Show reasoningHide reasoning
How this is scored
Whether the confidentiality promise is engineered and evidenced: encryption, metadata handling, penetration tests, certifications.
0 — Security is a paragraph of adjectives; no certificates, no test reports, no statement on metadata.
3 — TLS and encryption at rest asserted, but nothing audited: no ISO 27001 or equivalent, no published pentest, silence on IP and metadata logging.
5 — A current ISO 27001 (or equivalent) certificate for vendor or hosting, end-to-end encryption of report content claimed with some technical detail, an explicit no-IP-logging statement.
8 — Certified ISMS covering the product, regular third-party penetration tests attested, documented end-to-end encryption architecture, metadata minimization explained, security contact and disclosure policy published.
10 — Assurance a hostile auditor accepts: current certificates with visible scope, recurring pentest summaries public, cryptographic architecture documented, anonymity analysed against the operator itself — the vendor can answer "how would you unmask a reporter?" with "we cannot, and here is why".
The Compliance Officer
ISO 27001:2022 and SOC 2 certification claimed, regular penetration testing and continuous code testing asserted, end-to-end encryption offered, and — to their credit — an explicit no-IP-logging, metadata-removed, no-tracking statement that goes beyond adjectives. But no certificate scope, no public pentest reports, and the encryption detail is one line about 'standard vs symmetrical', so a hostile auditor has little paper to hold. 1 3 4
The Reporter's Advocate
ISO 27001:2022 and SOC 2 are named, regular pentesting and continuous code testing are claimed, E2EE comes with a little technical detail, and the explicit no-IP-logging plus metadata-removal statement is the part I care about. But no pentest summaries are public, no disclosure policy is evidenced, and 'no one can trace the sender' is asserted without the cryptographic architecture to make a hostile auditor — or a frightened reporter — believe it. 2 3 4
The SME Operator
ISO 27001:2022 plus SOC 2, regular penetration testing and continuous code security testing claimed, end-to-end encryption with a stated choice of standard or symmetrical, and an explicit no-IP-logging, no-tracking statement. Missing only published pentest attestations, certificate scope and a security disclosure policy to reach rubric level 8. 1 3 4
The Group Counsel
ISO 27001:2022 and SOC 2 are claimed, end-to-end encryption offered with a choice of modes, and the no-IP-logging/metadata-removal statement is exactly what I want to hear. But certificate scopes are invisible, penetration testing is asserted rather than attested publicly, there is no security contact or disclosure policy, and hotline call audio flows to OpenAI — a content-touching exposure the anonymity story never addresses. 1 3 4
The Security Auditor
ISO 27001:2022 and SOC 2 are claimed with standards named, E2EE is offered with a stated symmetrical option, and there's an explicit no-IP-logging and metadata-removal statement — real substance, not pure adjectives. But neither certificate shows scope, 'regular penetration testing' names no tester, date or report, the E2EE architecture is undocumented, and no security contact or disclosure policy exists; attestation is exactly what's missing. 1 3 4
The Skeptic
ISO 27001:2022, SOC 2, 'regular penetration testing', E2EE and an explicit no-IP-logging statement are all claimed — that clears the 5 anchor, but 'SOC 2 certified' with no type or report, no certificate scope, no public pentest summaries, and no security contact or disclosure policy keeps it from 8. The 'choice between standard and symmetrical encryption' reads like E2EE is optional, which nobody explains. 3 4
Group & multi-entity capability
Show reasoningHide reasoning
How this is scored
Whether one contract can serve a corporate group: separate channels per legal entity, central oversight, ombudsman access, white-labeling.
0 — One company, one channel; a group buys and administers N separate instances.
3 — Multiple channels under one account, but no separation of case access per entity and no consolidated view.
5 — Per-entity channels with separated case handlers and a group-level overview; branding per entity is basic; external counsel access possible.
8 — Real multi-tenant group structure: per-entity channels, languages and branding, delegated administration, external ombudsman roles, group reporting that respects entity boundaries.
10 — Group compliance as architecture: hundreds of entities manageable centrally, per-country legal rule assignment per entity, white-label reporting pages, and access separation strong enough to satisfy each subsidiary's works council.
The Compliance Officer
The Enterprise plan lists 'Support for multi-entity and multi-country setups' as a single line item, with unlimited forms and channels on Professional — multiple channels under one account, in effect. Nothing evidences per-entity separation of case access, delegated administration, external ombudsman roles, or a consolidated group view that respects entity boundaries, which is what my group contract would actually turn on. 2
The Reporter's Advocate
The Enterprise tier claims 'support for multi-entity and multi-country setups' with unlimited admins and advanced permission management, but the evidence is silent on per-entity case separation, group-level oversight, ombudsman access and white-labeling. A claim without architecture; a works council would have nothing to examine. 2
The SME Operator
One line — 'Support for multi-entity and multi-country setups' on the Enterprise tier with unlimited admins and advanced permissions — is the entire evidence. Nothing on per-entity case separation, group-level reporting, ombudsman access or per-entity branding; adequate for my single 60-person company, unverifiable for a group. 2
The Group Counsel
My core criterion rests on a single Enterprise bullet — "Support for multi-entity and multi-country setups" — with unlimited administrators and permission management; nothing on per-entity access separation, delegated administration, external ombudsman roles, or group reporting that respects entity boundaries. One marketing line cannot carry a 25-subsidiary rollout, and I would need contractual proof before believing it. 2
The Security Auditor
A single enterprise bullet — 'support for multi-entity and multi-country setups' with unlimited administrators and advanced permission management — is the entire evidence base, with regional entities implied by the split s.r.o./Inc. processing structure. Nothing on per-entity branding, external counsel/ombudsman roles, delegated administration, or group-level reporting that respects entity boundaries. 2 4
The Skeptic
The entire multi-entity evidence is one Enterprise bullet — 'Support for multi-entity and multi-country setups' — with zero detail on separated case access per entity, group-level oversight, delegated administration or ombudsman roles. A marketing line locked to the top tier is a claim, not architecture. 2
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where reports about people actually live and under whose law — entity, hosting, subprocessors, DPA. In this category the data is by definition the most sensitive a company holds.
0 — Non-EU entity, non-EU-default hosting, no public DPA or subprocessor list — for whistleblowing data.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad or undocumented.
5 — EU hosting is the default, DPA and subprocessor list published; the vendor or a critical subprocessor is still within non-European jurisdictional reach.
8 — EU entity, EU hosting with named data centers, published subprocessor list free of content-touching non-EU processors, DPA and TOMs public.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors for report content and metadata, on-premises or sovereign-cloud options, and the whole chain documented publicly.
The Compliance Officer
A Czech s.r.o. processes non-US data, the AI/translation/email features are 'Processed in EU', and a DPA with a published subprocessor list exist — that is the skeleton of rubric level 5. But hosting region is a customer pick among EU, US, UAE and Australia, a US Inc. applies to US processing, and hotline voice transcripts run through OpenAI — a US-reachable processor touching report content, which alone caps this below the 'free of content-touching non-EU processors' bar. 2 3 4
The Reporter's Advocate
A Czech entity processes rest-of-world data and the DPA and subprocessor list are public, which is better than silence — but EU hosting is one selectable region among EU/US/UAE/Australia, never evidenced as the default, AWS sits under US reach, and hotline calls are transcribed by OpenAI, a US processor touching report content. For the most sensitive data a company holds, that chain is not clean. 2 3 4
The SME Operator
Czech vendor with an EU storage region, published DPA and subprocessor list — but the customer 'chooses' EU among US, UAE and Australia regions (default unconfirmed), a US sister entity handles US processing, AWS sits under US reach, and OpenAI generates hotline transcripts. Content-touching non-EU processors and unnamed data centers keep it at rubric level 5. 3 4
The Group Counsel
A Czech entity with DPA and a published subprocessor list, EU as one of the hosting regions and EU-processed AI features is a real start. But EU default hosting is never confirmed against the EU/US/UAE/Australia menu, a US entity handles US data processing, and OpenAI transcribes hotline calls — content-touching US CLOUD Act reach exactly where the data is most sensitive; the evidence's own sovereignty attributes are all unconfirmed. 2 3 4
The Security Auditor
A Czech s.r.o. handles rest-of-world processing and the subprocessor list is published in DPA Annex B, but hotline transcripts flow through OpenAI — a US, CLOUD-Act-reachable processor touching report content — and storage regions span EU, US, UAE and Australia with no stated EU default. Report metadata and content have a documented path to non-European jurisdiction; no on-prem or sovereign-cloud option anywhere. 3 4
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether an obligated company can compute the real invoice — per entity, per employee band, per year — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — An entry price exists, but the tiers most obligated companies need are unpriced, or the maths is obscured by employee bands, per-report fees or mandatory setup charges.
5 — Most tiers carry real numbers with billing period and VAT treatment stated, but at least one commonly needed capability — extra entities, extra languages, phone intake — hides in an unpriced add-on.
8 — Every tier priced publicly with employee-band boundaries, entity rules and setup fees stated; only genuine corporate-group contracts are custom.
10 — Complete price computability: every tier, band, add-on and renewal rule public, so the invoice for a 60-employee company and a 5-entity group is a two-minute exercise.
The Compliance Officer
The captured pricing page yields plan names, admin counts (5/10/unlimited) and feature lists — and not one euro, no employee bands, no billing period, no VAT treatment, no setup fees. For an obligated company wanting to compute a real invoice from public pages, this is still a sales conversation. 2
The Reporter's Advocate
A pricing page exists with tier names and admin limits, yet not a single number survived capture — no prices, no employee bands, no billing period, no VAT treatment — and extras like hosting in other countries are 'available for an additional fee' that is never quantified. An obligated company cannot compute any invoice from this sheet. 2 3
The SME Operator
The pricing page yields tier names, admin counts and feature lists — and not a single figure: no prices, no billing period, no VAT treatment, no employee-band rules. I cannot compute a year-one invoice for 60 employees from public pages, and Enterprise is clearly a sales conversation, which I refuse to start. 2
The Group Counsel
The pricing page publishes tier names and administrator limits (5/10/unlimited) but not a single currency figure, billing period, VAT treatment or entity rule — and Enterprise, the only tier that mentions multi-entity setups, is plainly a sales conversation. I cannot price one subsidiary from this, let alone twenty-five. 2
The Security Auditor
Tier names, admin limits and a schools-discount teaser are public, but not a single price figure, employee band, billing period or VAT treatment is captured, and other-country hosting carries an unspecified 'additional fee'. An obligated company cannot compute even a rough invoice from these pages. 2 3
The Skeptic
The pricing page was captured and it yielded tier names and admin counts — not a single currency figure, no employee bands, no billing period, no VAT, plus an unpriced 'additional fee' for non-listed hosting countries and 'Special Pricing for Schools' with no numbers. No public prices at all means every tier is a sales conversation, which is the 0-1 anchor. 2 3
European sovereignty — proven facts
2 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Incorporated in US ⚠ unverified | 0/3 pts | 4 Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | EU optional ⚠ unverified | 1/3 pts | 4 Report an error |
| Subprocessors | Not determined ⚠ unverified | — | uncited Report an error |
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 16 Sep 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity. The vendor is a dual-entity structure: a second entity, FaceUp Technology s.r.o. (registered address Jiráskova 222/18, 602 00 Brno - střed), handles processing for the rest of the world, but the page names no country or register for it.
- Weak sourcing — Data residency. No default region is stated, and regardless of the selected region some features run centrally — the live hotline is processed in the US.
- Weak sourcing — Subprocessors. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 24 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 8 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 8 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (14)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.faceup.com Checked 16 Sep 2026 Details →
- 2 Pricing page www.faceup.com Checked 16 Sep 2026 Details →
- 3 Security page www.faceup.com Checked 16 Sep 2026 Details →
- 4 Privacy policy www.faceup.com Checked 16 Sep 2026 Details →
- 5 Whistleblowing product page www.faceup.com Checked 16 Sep 2026 Details →
- 6 Data processing agreement (dpa) www.faceup.com Checked 30 Sep 2026 Details →
- 7 Reporting channels & reporter experience — found from sitemap support.faceup.com Checked 1 Oct 2026 Details →
- 8 Reporting channels & reporter experience — found from sitemap support.faceup.com Checked 1 Oct 2026 Details →
- 9 Case management & deadline discipline — found from sitemap www.faceup.com Checked 1 Oct 2026 Details →
- 10 Case management & deadline discipline — found from sitemap support.faceup.com Checked 1 Oct 2026 Details →
- 11 Legal compliance alignment — found from sitemap www.faceup.com Checked 1 Oct 2026 Details →
- 12 Legal compliance alignment — found from sitemap support.faceup.com Checked 1 Oct 2026 Details →
- 13 Security & anonymity assurance — found from sitemap support.faceup.com Checked 1 Oct 2026 Details →
- 14 Security & anonymity assurance — found from sitemap support.faceup.com Checked 1 Oct 2026 Details →