Whistleblowing Portals
First Whistle
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by WeKomply · www.firstwhistle.fi
Report an error on this page Is this your product? →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
First Whistle, a whistleblowing portal now under Denmark-based WeKomply after stints at Juuriharski Consulting Group Oy and Falcony Oy (sold February 2026), scores low and narrow across the bench. It is strongest at reporting channels & reporter experience — a flat 4 — resting on the confirmed fact that reporters can stay anonymous while two-way communication stays open. It is weakest at group & multi-entity capability and security & anonymity assurance: nothing in the record evidences per-entity channels, group oversight, certificates, pentests, encryption or logging, leaving security as a GDPR-conformance sentence plus hosting on the provider's own servers. Case management is confirmed only as statistics on report frequency and type, so statutory clocks and audit trails go unevidenced, and legal compliance alignment hangs on a generic multi-jurisdiction claim that never names a directive. The genuine split is sovereignty: judges weigh confirmed hosting on Juuriharja's servers and a Finnish-to-Danish ownership chain against the evidence's "no sovereignty attributes on record" — no DPA, subprocessor list or named data centers — and scatter across that range. Captured pricing pages confirmed no price facts; those scores are not counted.
Speaks for it
- Anonymity with ongoing two-way communication to the reporter is confirmed, the basis for the flat 4 on reporting channels & reporter experience
- The service resides entirely on provider Juuriharja's servers, separate from the customer intranet
- Aggregate statistics on report frequency and type are confirmed, to help organisations identify potential gaps in codes of conduct
- Provenance is recorded as EU made, with the ownership chain ending at Denmark-based WeKomply
Held against it
- Only report statistics are confirmed on the case side — no statutory clocks, role separation or audit trail appear anywhere (case management & deadline discipline 1–2)
- Security assurance is a GDPR-conformance sentence with no certificate, pentest, encryption or logging claim in the record (security & anonymity assurance 1–2)
- Nothing evidences multi-entity use — no per-entity channels, separated case access or group oversight (group & multi-entity capability 0–1)
- Compliance support is a generic multi-jurisdiction claim that names no directive, deadline or retention duty
- The evidence lists "no sovereignty attributes on record" — no DPA, subprocessor list or named data centers — under a product sold twice
Best for
- You need an EU-provenance intake point where anonymous reporters can keep up a two-way dialog — the one capability the bench scored at 4
- You are a single organisation that wants the channel hosted on the provider's own servers, outside your intranet
- You already run deadline tracking, case handling and group administration elsewhere and only need the reporting intake
Avoid if
- You need statutory 7-day acknowledgment or 3-month feedback clocks built in — the evidence evidences no deadline tracking, role separation or audit trail
- Your team administers multiple entities and expects per-entity channels, separated case access or a consolidated group view
- You require documented security — certificates, pentests, encryption or logging statements — before trusting a channel with whistleblower data
- You need a published DPA, subprocessor list or named data centers; the evidence records none of these
The scores
Reporting channels & reporter experience
Show reasoningHide reasoning
How this is scored
The intake side: how a reporter actually submits — web form, anonymous dialog, phone/voice, languages, accessibility — and whether anonymity survives first contact.
0 — A web form that is an email in disguise: no anonymous route, no way to reach the reporter afterwards.
3 — An anonymous form exists but the dialogue ends there — no secured mailbox for follow-up questions, few languages, desktop-only.
5 — Anonymous two-way dialog via a protected mailbox, a usable set of languages, mobile-friendly; voice or phone intake missing or an add-on.
8 — Multiple channels (web, voice message or hotline, QR entry points), broad language coverage with translation support, accessibility considered, and the anonymous dialog is first-class rather than bolted on.
10 — Intake engineered around the frightened reporter: every channel anonymous-capable, dozens of languages, WCAG-conscious, no app install or account required, and the vendor documents how the reporter's identity is kept out of the channel itself.
The Compliance Officer
Anonymous reporting with two-way communication is confirmed, so the dialogue doesn't die at first contact — that much I'll grant. But the evidence says nothing about languages, mobile, voice/phone intake, or how the channel keeps the reporter's identity out of the metadata, and for a Finnish-origin product pointed at 600 employees I need more than one sentence before I trust the intake. 1
The Reporter's Advocate
Anonymity with ongoing dialog is confirmed verbatim — 'the option of anonymity while enabling communication' — which is what keeps a frightened reporter talking past first contact. But the evidence is silent on languages, mobile-friendliness, phone/voice intake and how identity stays out of the channel, and for the night-shift worker on a phone, silence is not reassurance. 1
The SME Operator
Anonymous reporting with two-way communication back to the reporter is confirmed, which clears the legal floor — but the evidence is silent on languages, phone or voice intake, mobile usability and accessibility, so I cannot tell whether my whole workforce can actually use it. That lands between a dead-end form and a proper dialog, at 4. 1
The Group Counsel
Anonymous reporting with two-way communication to the reporter is explicitly confirmed, which beats a dead-end anonymous form, but the evidence says nothing about languages, phone intake, mobile access or accessibility — unusable as a sole channel across a dozen countries. 1
The Security Auditor
Anonymity with two-way communication back to the reporter is claimed, which clears the dead-end-form floor, but nothing evidences channel breadth, languages, mobile-friendliness, or how the reporter's identity is kept out of the channel. One sentence of marketing is not an intake architecture. 1
The Skeptic
One sentence claims anonymity plus the ability to communicate with the reporter, and that is the entire story: no protected-mailbox mechanism described, not a word on languages, mobile, accessibility, or any channel beyond the implied web form. The dialog claim gets it off 3; the complete absence of engineering detail keeps it well off 5. 1
Case management & deadline discipline
Show reasoningHide reasoning
How this is scored
The case worker's side: triage, statutory deadlines (7-day acknowledgment, 3-month feedback), role separation, audit-proof documentation.
0 — Reports land in an inbox; deadlines, roles and history live in a spreadsheet next door.
3 — A case list with status fields, but deadlines are manual, permissions are all-or-nothing, and the record of who did what is thin.
5 — Deadline tracking with reminders for the statutory clocks, case notes and attachments, basic role separation between case handlers; reporting on the caseload is limited.
8 — Automated statutory clocks, conflict-of-interest handling (excluding implicated case handlers), complete tamper-evident case history, retention and deletion rules applied per case, and management reporting.
10 — A case system an external investigator can rely on: enforced workflows, full audit trail, legally aware retention/deletion automation, evidence handling, and statistics that survive a regulator's questions.
The Compliance Officer
The only case-side fact is that the product collects report statistics; there is no evidence of statutory deadline tracking, role separation, conflict handling, or a tamper-evident history. I answer for every missed 7-day and 3-month clock — on this evidence the clocks are my problem, not the system's, which is exactly what I refuse to buy. 1
The Reporter's Advocate
The only case-side fact on record is aggregate statistics on the frequency and type of reports; not one word on the 7-day or 3-month clocks, role separation, or a tamper-evident history. The deadlines and the audit trail evidently still live in the spreadsheet next door. 1
The SME Operator
The only case-side fact is that it 'collects statistics on the frequency and type of reports'; the 7-day acknowledgment, 3-month feedback clock, case notes, role separation and audit trail are entirely unevidenced. I'd be running the statutory deadlines myself, which is exactly the work I pay a product to handle. 1
The Group Counsel
The only case-side capability on record is statistics on report frequency and type; there is no evidence of case lists, statutory clocks, role separation or audit history, so the 7-day and 3-month deadlines would live in a spreadsheet next door. 1
The Security Auditor
The only case-side fact is that statistics on report frequency and type are collected; no statutory clocks, role separation, audit trail, or retention rules appear anywhere. I cannot even confirm reports land in anything better than an inbox. 1
The Skeptic
The only case-side fact is that it 'collects statistics on the frequency and type of reports' — a categorization counter is not case management. The 7-day/3-month clocks, role separation, audit trail and retention rules are entirely unmentioned, so they don't exist. 1
Legal compliance alignment
Show reasoningHide reasoning
How this is scored
How specifically the product implements EU Directive 2019/1937 and national transpositions (HinSchG et al.) — not whether the marketing mentions them.
0 — Generic feedback software wearing a whistleblowing label; no reference to the legal obligations it claims to satisfy.
3 — The directive is invoked in marketing but the mapping is vague; deadline rules, documentation duties and retention periods are the customer's problem.
5 — The statutory duties are implemented as product features — acknowledgment and feedback clocks, documentation, deletion after the retention period — for at least one national law, with guidance for the rest.
8 — Multiple national transpositions supported with their differing details, legal templates and process guidance maintained by named counsel or documented review, and updates when the law moves.
10 — The product is a legal instrument: per-country rule sets kept current, documented legal review, guidance for edge cases (group-wide channels, external ombudsman setups), and the vendor shows its homework in public.
The Compliance Officer
The homepage asserts adherence to 'legal requirements on whistleblowing in different national jurisdictions' plus GDPR — an invocation, not a mapping. No named transposition, no acknowledgment/feedback clocks, no retention or documentation duties anywhere in the evidence, so the legal homework lands on my desk. 1
The Reporter's Advocate
The entire legal claim is 'adhere to legal requirements on whistleblowing in different national jurisdictions' plus a GDPR conformance sentence — marketing that never names Directive 2019/1937, a statutory deadline, a retention period, or reviewing counsel. It's vaguer even than a directive invoked-but-unmapped: a label, not implementation. 1
The SME Operator
It claims to 'adhere to legal requirements on whistleblowing in different national jurisdictions' without ever naming Directive 2019/1937 or a national transposition, and no deadline, documentation or retention feature is evidenced. Marketing-level compliance, not implemented duties — the obligations remain my problem. 1
The Group Counsel
A generic claim to support 'legal requirements on whistleblowing in different national jurisdictions' plus a GDPR conformance statement names no directive or transposition and implements no duty — no acknowledgment clock, no feedback deadline, no retention rules. 1
The Security Auditor
'Enables you to adhere to legal requirements on whistleblowing in different national jurisdictions' names no directive, no transposition, no deadline or deletion feature — the EU Whistleblower Directive is never even mentioned by name. This is the vague-invocation anchor with the marketing turned up, not an implementation. 1
The Skeptic
'Enables you to adhere to legal requirements on whistleblowing in different national jurisdictions' is compliance as a slogan — the directive is never even named, let alone HinSchG, acknowledgment deadlines, or retention periods. This is below the vague-mapping anchor because there is no mapping at all, just GDPR name-dropping. 1
Security & anonymity assurance
Show reasoningHide reasoning
How this is scored
Whether the confidentiality promise is engineered and evidenced: encryption, metadata handling, penetration tests, certifications.
0 — Security is a paragraph of adjectives; no certificates, no test reports, no statement on metadata.
3 — TLS and encryption at rest asserted, but nothing audited: no ISO 27001 or equivalent, no published pentest, silence on IP and metadata logging.
5 — A current ISO 27001 (or equivalent) certificate for vendor or hosting, end-to-end encryption of report content claimed with some technical detail, an explicit no-IP-logging statement.
8 — Certified ISMS covering the product, regular third-party penetration tests attested, documented end-to-end encryption architecture, metadata minimization explained, security contact and disclosure policy published.
10 — Assurance a hostile auditor accepts: current certificates with visible scope, recurring pentest summaries public, cryptographic architecture documented, anonymity analysed against the operator itself — the vendor can answer "how would you unmask a reporter?" with "we cannot, and here is why".
The Compliance Officer
The entire security posture in evidence is a GDPR-conformance sentence and the note that the service sits on the provider's own servers outside our intranet. No certificate, no pentest, no encryption architecture, no statement on IP or metadata logging — for the most sensitive data we hold, that is adjectives, not assurance. 1
The Reporter's Advocate
What exists is a GDPR adjective-paragraph plus one genuinely useful architectural fact — reports reside entirely on provider Juuriharja's servers, outside the customer's intranet, so client-side admins aren't in the path. No certificate, no pentest, no encryption architecture, and total silence on IP and metadata logging, which is precisely what unmasks a reporter. 1
The SME Operator
The entire security story is an adjective-heavy GDPR claim ('the strictest such regulation in the world') plus the fact that it sits on the provider's own servers — no certificate, no pentest, no encryption detail, nothing on IP or metadata logging. That would not survive a single serious question. 1
The Group Counsel
Security is a paragraph of adjectives: no ISO 27001 or equivalent, no pentest, no encryption architecture, and total silence on IP and metadata logging; the only engineered claim is that reports sit on the provider's own servers separate from the customer intranet. 1
The Security Auditor
Zero certificates, zero pentests, zero statements on encryption, IP logging or metadata — the entire posture is 'GDPR compliant... the strictest such regulation in the world', which is adjective security in its purest form. The anonymity promise shows no engineering behind it; as far as this sheet goes, it is unverified, and 'we cannot unmask a reporter' has never been demonstrated. 1
The Skeptic
A GDPR-conformity adjective and the note that the service resides on Juuriharja's own servers, separate from the customer intranet — no ISO 27001, no pentest, and strikingly not even a TLS or encryption-at-rest claim, let alone a statement on IP or metadata logging. 'Strictest regulation in the world' is a paragraph of adjectives until the certificates show up. 1
Group & multi-entity capability
Show reasoningHide reasoning
How this is scored
Whether one contract can serve a corporate group: separate channels per legal entity, central oversight, ombudsman access, white-labeling.
0 — One company, one channel; a group buys and administers N separate instances.
3 — Multiple channels under one account, but no separation of case access per entity and no consolidated view.
5 — Per-entity channels with separated case handlers and a group-level overview; branding per entity is basic; external counsel access possible.
8 — Real multi-tenant group structure: per-entity channels, languages and branding, delegated administration, external ombudsman roles, group reporting that respects entity boundaries.
10 — Group compliance as architecture: hundreds of entities manageable centrally, per-country legal rule assignment per entity, white-label reporting pages, and access separation strong enough to satisfy each subsidiary's works council.
The Compliance Officer
Nothing in any homepage capture evidences per-entity channels, separated case access, group-level oversight, delegated administration or ombudsman roles. I must score the absence: one channel, one instance, and a corporate group administers N of them. 1 2 2
The Reporter's Advocate
The evidence records nothing about per-entity channels, separated case access, or group oversight — the nearest fact is a generic multi-jurisdiction compliance claim. Absence of evidence here means I must assume the group buys and administers N separate instances. 1
The SME Operator
Nothing in the evidence evidences more than one channel or entity — no per-entity separation, no group view, no delegated administration. As a single 60-person company I don't need it, but I score what is evidenced, and the evidence is silent. 1
The Group Counsel
Every fact on the evidence describes a single organisation — statistics 'within the organisation', one contact email — with nothing on per-entity channels, separated case access, delegated administration, ombudsman roles or group reporting; I would be signing twenty-five contracts, which I refuse. 1
The Security Auditor
The evidence is silent on multi-entity anything — no per-entity channels, delegated administration, consolidated group view, or ombudsman access; an unevidenced capability is an absent capability. One contract, one channel, as far as any evidence goes. 1
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where reports about people actually live and under whose law — entity, hosting, subprocessors, DPA. In this category the data is by definition the most sensitive a company holds.
0 — Non-EU entity, non-EU-default hosting, no public DPA or subprocessor list — for whistleblowing data.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad or undocumented.
5 — EU hosting is the default, DPA and subprocessor list published; the vendor or a critical subprocessor is still within non-European jurisdictional reach.
8 — EU entity, EU hosting with named data centers, published subprocessor list free of content-touching non-EU processors, DPA and TOMs public.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors for report content and metadata, on-premises or sovereign-cloud options, and the whole chain documented publicly.
The Compliance Officer
Hosting resides on Juuriharja's own servers and the ownership chain runs Finnish to Finnish to WeKomply (DK), so EU jurisdiction looks plausible — but there is no DPA on record, no subprocessor list, no named data centers, and the provenance itself warns to verify domain and ownership because the product has changed hands twice and lives on two domains. For whistleblowing data, undocumented subprocessor exposure is where I stop being generous. 1 2
The Reporter's Advocate
Reports sit entirely on Finnish provider Juuriharja's servers and the provenance chain is Finnish-to-Danish, all EU — but the evidence itself declares 'no sovereignty attributes on record': no published DPA, no subprocessor list, no named data centers. Clean-looking location, undocumented chain. 1
The SME Operator
Hosting on Finnish provider Juuriharja's servers is EU-local and separate from my intranet, which is a real plus — but the evidence records no sovereignty attributes, no published DPA, no subprocessor list and no named data centers, and the product has been sold twice (Juuriharja to Falcony to Danish WeKomply). European enough on paper, undocumented where it counts. 1
The Group Counsel
Hosting on the provider's own servers decoupled from our intranet is mildly reassuring and the lineage is Finnish, but no DPA, no subprocessor list, no named data centers and no sovereignty attributes on record — and a mid-acquisition ownership chain (Falcony to Via Equity-backed WeKomply) that nobody has documented. 1
The Security Auditor
Hosting sits on Juuriharja's own servers, separated from customer intranets, and the vendor chain reads Finnish/Danish, but 'no sovereignty attributes on record' means no published DPA, no subprocessor list, no named data centers. For the most sensitive data a company holds that is undocumented custody, and a product sold twice inside a year raises chain-of-custody questions of its own. 1
The Skeptic
Finnish hosting on Juuriharja's servers and a Finnish-to-Danish ownership chain are decent instincts, but the evidence itself declares 'no sovereignty attributes on record': no DPA, no subprocessor list, no named data centers, and domain ownership explicitly flagged for verification after two acquisitions. EU-by-default hosting with zero published accountability chain doesn't clear 3. 1
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether an obligated company can compute the real invoice — per entity, per employee band, per year — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — An entry price exists, but the tiers most obligated companies need are unpriced, or the maths is obscured by employee bands, per-report fees or mandatory setup charges.
5 — Most tiers carry real numbers with billing period and VAT treatment stated, but at least one commonly needed capability — extra entities, extra languages, phone intake — hides in an unpriced add-on.
8 — Every tier priced publicly with employee-band boundaries, entity rules and setup fees stated; only genuine corporate-group contracts are custom.
10 — Complete price computability: every tier, band, add-on and renewal rule public, so the invoice for a 60-employee company and a 5-entity group is a two-minute exercise.
The Compliance Officer
Pricing pages were captured yet not a single price, tier, employee band or billing term made it into the confirmed facts. An obligated 600-employee company cannot compute its invoice from this evidence, and I score by what's missing. 3 3
The Reporter's Advocate
Pricing pages exist in the registry yet not a single price, employee band, entity rule, billing period or VAT treatment made it into evidence. An obligated company cannot compute any invoice from this sheet, and I won't credit a page I cannot read. 3 3
The SME Operator
Pricing pages appear in the registry but not a single price, employee band, billing period or setup-fee term is confirmed as fact — and they sit on firstwhistle.com while the vendor page is.fi with an explicit ownership-verification warning. I cannot compute my invoice from this sheet, and that is disqualifying for my year-end review. 3 3
The Group Counsel
The pricing page was captured four times over a month and not a single price fact survived into the record — no tier, band, entity rule or VAT treatment — so no obligated company, let alone a 5-entity group, can compute an invoice from public pages. 3 3
The Security Auditor
Pricing pages were captured three times and produced not one confirmed price, band boundary, or billing term. From the evidence alone, no obligated company can compute an invoice — every tier might as well be a sales conversation. 3 3 3
The Skeptic
The registry contains three captures of a pricing page and not one price, tier, employee band, setup fee or VAT rule made it into evidence — and those pages sit on firstwhistle.com while every confirmed fact comes from firstwhistle.fi, a domain split the evidence itself tells me to verify before trusting. No obligated company can compute an invoice from this. 1 3 3
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined | — | uncited Report an error |
| Subprocessors | Not determined | — | uncited Report an error |
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 23 Aug 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (firstwhistle.fi, firstwhistle.com, firstwhistle.com/pricing). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (3)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Product homepage (verify domain) www.firstwhistle.fi Checked 15 Sep 2026 Details →
- 2 Product homepage firstwhistle.com Checked 15 Sep 2026 +3 earlier captures: 11 Sep 2026, 23 Aug 2026, 23 Aug 2026 Details →
- 3 Pricing page firstwhistle.com Checked 15 Sep 2026 +3 earlier captures: 11 Sep 2026, 23 Aug 2026, 23 Aug 2026 Details →