hintcatcher

The Compliance Officer

Anonymity is guaranteed 'technically and organizationally' and the reporting office runs in 2 to unlimited languages depending on plan, which beats rubric level 3's 'few languages'. But there is no evidence of a secured mailbox for follow-up dialog with an anonymous reporter, no voice or phone intake, and nothing on accessibility — I cannot run a Meldestelle that cannot ask the reporter a second question. 1 2

Report an error

The Reporter's Advocate

Anonymity is engineered, not decorative — "even we cannot view them" with X25519/XSalsa20/Poly1305 and anonymity "ensured technically and organizationally" — and languages scale to unlimited on Premium. But the evidence never shows a two-way dialog: no protected mailbox, no follow-up mechanism, no voice or phone intake for reporters, nothing on mobile or accessibility, so I cannot confirm the conversation survives first contact. 1 2

Report an error

The SME Operator

Anonymity is promised twice — "Whistleblowers remain completely anonymous" and "technically and organizationally ensured" — and language counts per plan (2/5/unlimited) are refreshingly concrete. But the evidence is silent on any two-way dialog or protected mailbox for follow-up questions, and there is no phone/voice intake, mobile or accessibility evidence anywhere, so I can't rate above the anonymous-form-plus-languages level. 1 2

Report an error

The Group Counsel

Anonymity is engineered, not just promised — X25519/XSalsa20/Poly1305 with 'even we cannot view them' — and the reporting office runs in 2/5/unlimited languages by plan, which is more than a bare form. But the evidence is silent on a secured follow-up dialog for reporters, on any voice/phone or QR intake, and on accessibility — and missing evidence is information: I cannot confirm the two-way dialogue the 3-month feedback duty requires. 1 2

Report an error

The Security Auditor

Anonymous intake is asserted and there's a per-plan language matrix (2 on LITE, unlimited on PREMIUM), but the evidence shows zero evidence of a two-way anonymous dialog or protected follow-up mailbox, and no voice, QR, accessibility or mobile claims — the dialogue appears to end at the form. 1 2

Report an error

The Skeptic

Anonymity is asserted twice and languages scale to 'Unlimited' on PREMIUM, but the evidence shows no secured follow-up dialog, no voice intake, no QR or mobile story — for all the evidence shows, a reporter drops a form and prays. 'Whistleblowers remain completely anonymous' is marketing until the vendor documents how identity stays out of the channel itself. 1 2

Report an error

The Compliance Officer

Individual authorizations, an integrated audit log for all processing steps, a statistics dashboard and a flexible retention policy with deletion log clear rubric level 3. But the evidence is entirely silent on the one thing I answer for: no automated 7-day acknowledgment clock, no 3-month feedback deadline, no conflict-of-interest exclusion — I will not assume deadline machinery that is not documented. 1 2

Report an error

The Reporter's Advocate

An audit log "for all processing steps," a deletion log, individual authorizations and a statistics dashboard put this above a spreadsheet-plus-status-fields setup. But the statutory clocks — 7-day acknowledgment, 3-month feedback — appear nowhere, and neither does conflict-of-interest exclusion or case notes/attachments; deadlines look like the case worker's problem. 1 2

Report an error

The SME Operator

"Integrated audit log for all processing steps", "individual authorizations" and flexible retention with a deletion log are real bones, better than a status field and a spreadsheet. But the statutory clocks — 7-day acknowledgment, 3-month feedback — are nowhere in the evidence, no reminders, no conflict-of-interest handling, which means I'd be running the legal deadlines myself; that's exactly the work I'm paying to avoid. 1 2

Report an error

The Group Counsel

There is an integrated audit log for all processing steps, individual authorizations per caseworker (2/5/8 by plan), a flexible retention policy with a deletion log, and a statistics dashboard with Excel export — real bones. But nowhere does the evidence evidence statutory deadline clocks (7-day acknowledgment, 3-month feedback), conflict-of-interest exclusion, or tamper-evidence, so the case worker side stays below the '5' anchor for me. 1 2

Report an error

The Security Auditor

An audit log covering all processing steps, individual authorizations and a retention policy with deletion log lift it above a status list, but the evidence is entirely silent on statutory deadline clocks, conflict-of-interest exclusion and tamper-evidence — the 7-day/3-month discipline the law demands is nowhere evidenced. 1 2

Report an error

The Skeptic

Individual authorizations and an audit log 'for all processing steps' beat the spreadsheet tier, plus a statistics dashboard and a retention policy with deletion log — but the statutory clocks (7-day acknowledgment, 3-month feedback) are nowhere in the evidence, and 'flexible retention' smells like the customer's problem. An 'integrated audit log' is a claim, not demonstrated tamper-evidence. 1 2

Report an error

The Compliance Officer

Directive 2019/1937 and the HinSchG are explicitly named and the deletion log is a real retention feature, so this is more than vague name-dropping. But rubric level 5 hinges on the statutory duties implemented as product features — acknowledgment and feedback clocks — and none appear; beyond Germany there is no guidance, no named counsel, no evidence of updates when the law moves. 1 2

Report an error

The Reporter's Advocate

The Directive, the HinSchG and GDPR are named, and retention is actually implemented as a product feature ("flexible retention policy with deletion log"), which is more than marketing ink. What is missing is the machinery: no acknowledgment or feedback clock features, no documentation duties, no legal review or counsel named — the mapping stays vague where it counts. 1 2

Report an error

The SME Operator

HinSchG, the EU Directive and GDPR are named and retention/deletion plus an audit log exist as product features, which is more than marketing ink. But rubric level 5 requires the acknowledgment and feedback clocks implemented for at least one national law — Germany's own — and the evidence shows no deadline features, no legal templates, no named counsel or review; a German vendor should be showing that homework. 1 2

Report an error

The Group Counsel

The EU Directive 2019/1937, the HinSchG and GDPR are named, and GDPR duties appear as actual features (retention with deletion log, audit log, GDPR-compliant system and hoster) — slightly more than marketing invocation. But the whistleblowing-specific clocks, legal templates, named counsel and per-country rule sets that a twelve-country group needs are entirely absent from the evidence; only one national transposition is even mentioned. 1 2

Report an error

The Security Auditor

The Directive 2019/1937 and HinSchG are invoked by name plus a 'flexible' retention policy, but no duty is mapped to a feature: no acknowledgment or feedback clocks, no legal templates, no named counsel or review — this is marketing invocation, not implementation. 1 2

Report an error

The Skeptic

Directive 2019/1937 and HinSchG are name-dropped with zero mapping to product features — no acknowledgment clock, no feedback deadline, no documentation duty implemented anywhere in the evidence. Classic brochure-tier compliance: the law is in the marketing, the deadline work is in your inbox. 1

Report an error

The Compliance Officer

X25519/XSalsa20/Poly1305 with 'even we cannot view them' is genuine end-to-end engineering, and the hoster carries ISO/IEC 27001 — two of rubric level 5's three legs. But the certificate covers the hoster not the product, there is no no-IP-logging statement, no pentest attestation, and total silence on metadata handling, so a hostile auditor would stop asking questions here. 2

Report an error

The Reporter's Advocate

The cryptography is unusually concrete — named primitives, end-to-end encryption where the vendor claims it cannot read the content, logical isolation, an ISO 27001 certified hoster. But the certificate covers the hoster, not the vendor or product; there is no pentest evidence, and total silence on IP and metadata logging, which is precisely how a reporter gets unmasked. 2

Report an error

The SME Operator

The hoster holds ISO/IEC 27001, and the end-to-end encryption is documented with actual algorithms — X25519, XSalsa20, Poly1305 — plus "even we cannot view them", which is more than adjectives. But there are no penetration tests, no vendor-side ISMS, and total silence on IP and metadata logging, so the "how would you unmask a reporter?" question has no documented answer; that keeps it at the middle anchor, not above. 2

Report an error

The Group Counsel

The cryptographic story is unusually concrete: named primitives (X25519, XSalsa20, Poly1305), 'even we cannot view them', logical isolation of customer data, data invisible to customer administrators, and an ISO/IEC 27001 certified hoster with redundancy and separate-region backups. But the certificate covers the hoster, not the product or vendor ISMS; there is no pentest attestation, no metadata/IP-logging statement, and no security contact or disclosure policy in the registry. 1 2

Report an error

The Security Auditor

Genuine technical detail on the E2E claim (X25519/XSalsa20/Poly1305, 'even we cannot view them') is the best thing here, but the ISO/IEC 27001 certificate covers the hoster, not the vendor or product scope, and there is no pentest, no certificate with visible scope, and silence on IP logging and metadata — 'anonymity ensured technically and organizationally' is adjective security I cannot audit. 2 1

Report an error

The Skeptic

The crypto story is unusually specific — X25519/XSalsa20/Poly1305, 'even we cannot view them' — and the ISO/IEC 27001 is real but belongs to the *hoster*, not the vendor, which is the classic certification-borrowing move. No pentest, no security contact or disclosure policy, and total silence on IP/metadata logging, so 'completely anonymous' remains an adjective rather than an analysed architecture. 1 2

Report an error

The Compliance Officer

The only group-adjacent evidence is a multi-tenant PARTNER plan priced 'on inquiry' and aimed at law firms, external DPOs and ombudsmen rather than corporate groups. No per-entity channels, no group-level overview, no branding or delegated administration is documented — 'individual authorizations' is the faintest hint of access separation, so a multi-entity structure is unproven. 1 2

Report an error

The Reporter's Advocate

"Multi-tenant solution — price on inquiry" and partner conditions for ombudsmen and law firms exist, and individual authorizations are offered. But there is no evidence of per-entity channels, per-entity case separation, group-level overview or delegated administration — a corporate group has to take the vendor's word for architecture the evidence never describes. 1 2

Report an error

The SME Operator

There is a "PARTNER Multi-tenant solution — Price on inquiry" aimed at law firms and ombudsmen, so multiple organizations on one product is at least claimed. But nothing evidences per-entity channels, separated case access per legal entity, a consolidated group view, or branding — and the caseworker caps of 2/5/8 look tight for a group; for my single 60-employee entity that's fine, but scored against the anchors this is a gesture, not group architecture. 1

Report an error

The Group Counsel

The only multi-entity signal is a PARTNER plan, 'Multi-tenant solution, Price on inquiry', aimed at law firms, external DPOs and ombudsmen reselling to their clients — an ombudsman scenario, not a corporate group. Nothing evidences per-legal-entity channels, separated case access per subsidiary, delegated administration, or a consolidated group view; for my 25 entities this reads as one channel multiplied by 25 contracts, exactly what I reject. 1 2

Report an error

The Security Auditor

The only multi-entity evidence is the unpriced PARTNER 'multi-tenant solution' aimed at law firms and ombudsmen — nothing on per-entity channels, separated case access, delegated administration or group-level oversight; a corporate group has nothing here it can verify or buy. 1

Report an error

The Skeptic

One 'multi-tenant solution' priced 'on inquiry' for PARTNER and per-user authorizations are the entire group story on paper — no per-entity channels, no consolidated group view, no entity-boundary enforcement anywhere. The partner program for ombudsmen and law firms is a go-to-market channel, not group architecture. 1 2

Report an error

The Compliance Officer

A German GmbH with a Handelsregister entry (Ulm HRB 739026) hosting case data on German servers with an ISO 27001-certified hoster genuinely avoids rubric level 5's non-European jurisdictional reach. But there is no public DPA, no subprocessor list, no named data centers, and backups sit in an undisclosed 'separate geographical region' — short of rubric level 8's documentation bar. 2 3

Report an error

The Reporter's Advocate

The imprint is refreshingly concrete: product kitchen GmbH, Göppingen, Handelsregister Ulm HRB 739026, German VAT ID, "we are a German supplier" and "case data hosted on secure servers in Germany" — EU entity and EU default hosting, not an opt-in region. It stays below the next anchor because no DPA, no subprocessor list and no ownership disclosure are evidenced, so the chain behind "Germany" is unexamined. 2 3

Report an error

The SME Operator

German GmbH with a Handelsregister entry in Ulm, case data on servers in Germany, GDPR compliance claimed for system and hoster — the fundamentals are genuinely European, which matters for the most sensitive data I hold. But no published DPA, no subprocessor list, and backups "in separate geographical region" that isn't named — I can't verify that region is inside the EU, so this sits between rubric level 3's undocumented subprocessors and rubric level 5's published paperwork. 2 3

Report an error

The Group Counsel

The vendor is a German GmbH (Handelsregister Ulm HRB 739026, Göppingen) and 'case data hosted on secure servers in Germany' with a GDPR-compliant, ISO 27001-certified hoster and E2E encryption that keeps content out of the hoster's reach — the jurisdictional core is right. But no DPA or TOMs are published in the evidence, there is no subprocessor list at all, the data centers are unnamed, and backups sit in an unspecified 'separate geographical region', which keeps this below the published-chain anchor. 2 3

Report an error

The Security Auditor

Whatever the computed attributes say, the imprint and security page put a German GmbH in the Ulm register hosting case data on servers in Germany — but the hoster and its certified data centers are unnamed, the backup region is unspecified, and there is no published DPA, subprocessor list or TOMs, so the chain is plausibly European but undocumented. 2 3

Report an error

The Skeptic

A German GmbH with Handelsregister number and VAT ID, 'German supplier', case data 'hosted on secure servers in Germany' — solid as far as it goes. But no published DPA, no subprocessor list, and backups sit in an unnamed 'separate geographical region', which could be a second jurisdiction nobody vetted. 2 3

Report an error

The Compliance Officer

Every standard tier carries a real number (39/59/99 € net per month) with VAT treatment stated, no setup fee, a 1-month term with 14-day notice, and pricing explicitly independent of headcount — for my 600 employees the invoice is PREMIUM at 99 € net, a two-minute exercise. The only unpriced item is the multi-tenant PARTNER plan, which is precisely the group capability, so it cannot reach rubric level 8. 1

Report an error

The Reporter's Advocate

For an ordinary company the invoice is a two-minute exercise: €39/€59/€99 net per month, no setup fee, 1-month term with 14-day notice, explicitly independent of employee count, languages and caseworkers priced per tier. It falls short of full computability because entity rules per plan are never stated and the multi-tenant PARTNER tier is "price on inquiry," so a group cannot do the maths from public pages. 1

Report an error

The SME Operator

This is the evidence I wish every vendor published: LITE €39 / PLUS €59 / PREMIUM €99 net per month with VAT treatment stated, no setup fee, 1-month term with 14-day notice, unlimited whistleblowers, and pricing explicitly independent of employee count — my 60-person invoice is a two-minute exercise and nothing will surprise the year-end review. The only unpriced item is the multi-tenant PARTNER tier at "on inquiry", which is precisely the genuine corporate/custom carve-out rubric level 8 permits; nothing an ordinary obligated SME needs hides in an add-on. 1

Report an error

The Group Counsel

The core tiers are cleanly public — 39/59/99 € net monthly, VAT treatment stated, no setup fee, 1-month term with 14-day notice, and pricing independent of employee headcount, which removes the band-maths games. The gap that matters to a group buyer: entity rules are unstated and the multi-tenant PARTNER plan is 'price on inquiry', so the capability a 5-entity group would actually need is the one thing I cannot compute. 1

Report an error

The Security Auditor

Three tiers with real net monthly figures, no setup fee, 1-month term and employee-count independence make a single company's invoice a two-minute exercise — but the multi-tenant PARTNER plan is price-on-inquiry and the evidence says nothing about per-entity costs, so a group cannot compute anything. 1

Report an error

The Skeptic

€39/€59/€99 net monthly, no setup fee, 1-month term with 14-day notice, employee-count-independent, payment methods and per-plan caseworker/language quotas all public — a single obligated company can compute its invoice in two minutes. The only hole is multi-entity: PARTNER 'multi-tenant' is 'price on inquiry', so a corporate group cannot. 1

Report an error