Whistleblowing Portals
Impactly Whistleblowing
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Impactly ApS · www.impactly.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Impactly Whistleblowing at a glance
- Vendor
- Impactly ApS
- Headquarters
- Not stated on the vendor’s pages as of 20 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 20 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 20 Oct 2026
- Panel verdict
- The AI panel rates Impactly Whistleblowing 0/5, the mean of 6 judges. Impactly ApS is listed under Whistleblowing Portals, but its single captured page (impactly.com, captured 20 Oct 2026) markets a different product: "the first operating system for family offices and foundations", built around data aggregation, collaboration and portfolio sharing. how scores are made
- As of
- Vendor pages captured 20 Oct 2026; evaluated by the panel 21 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Impactly ApS is listed under Whistleblowing Portals, but its single captured page (impactly.com, captured 20 Oct 2026) markets a different product: "the first operating system for family offices and foundations", built around data aggregation, collaboration and portfolio sharing. Judged against whistleblowing criteria, scores sit low throughout. Reporting channels, compliance alignment and pricing transparency topped out at 0; case management and multi-entity scale reached a maximum of 1; only security assurance and sovereignty peaked at 2, resting on one published sentence — "Maximum Security with encrypted, two-stage authentication" — and the vendor's Danish company form. Those same two criteria show the widest spread: some judges gave partial credit to the Danish incorporation and the authentication claim, others declined, though the flagged splits recorded none of substance. The aligned findings are stark — we found no public information on a reporter-facing submission route, no public information referencing EU Directive 2019/1937 or any national transposition, no case-handling detail, and no hosting, data processing agreement or subprocessor information. Pricing appears only as Enterprise-Level Support with white-glove setup.
Speaks for it
- Published security claim of encrypted, two-stage authentication, which lifted security assurance to its maximum of 2
- Danish-incorporated vendor (Impactly ApS), the only jurisdictional signal, credited in sovereignty scores up to 2
- Tailored permissions by role — staff, family members and advisors — described on the captured page
- Enterprise-Level Support with white-glove setup, issue escalation and feature updates, as published
- Claimed fully customizable platform, accessible via any device
Held against it
- The captured page markets an operating system for family offices and foundations, not evidenced whistleblowing functionality
- We found no public information on any reporter-facing submission route — no form, anonymous dialog, mailbox or hotline
- No public information referencing EU Directive 2019/1937 or any national transposition appears in the captured material
- Security rests on one published sentence, with no certificate, penetration test or statement on IP and metadata logging on record
- No sovereignty attributes are on record — no hosting location, data processing agreement or subprocessor list published
Best for
- You run a family office or foundation and want the aggregation, sharing and analytics platform this captured page markets
- You already operate a separate whistleblowing channel and would adopt Impactly only for its family-office functions
- You treat the vendor's Danish company form (Impactly ApS) as your jurisdictional signal and will verify hosting, processing agreements and subprocessors directly
- You accept the published two-stage authentication claim for login security and plan to demand certificates and penetration tests during procurement
Avoid if
- You are obligated under EU Directive 2019/1937 or a national transposition — compliance alignment topped out at 0 and the captured material names no legal duty
- You need an evidenced reporter intake — reporting channels scored 0 across the table and the captured page addresses family offices and foundations
- You must show a regulator audited security — ask the vendor: the public pages we read do not show it
- You need documented hosting, a data processing agreement and a subprocessor list before signing — the record carries no sovereignty attributes beyond Impactly ApS's Danish company form
The scores
| Criterion | Panel median |
|---|---|
| Reporting channels & reporter experience | 0 of 5 |
| Case management & deadline discipline | 0 of 5 |
| Legal compliance alignment | 0 of 5 |
| Security & anonymity assurance | 0.5 of 5 |
| Group & multi-entity capability | 0 of 5 |
| European sovereignty | 0.5 of 5 |
Reporting channels & reporter experience
Show reasoningHide reasoning
How this is scored
The intake side: how a reporter actually submits — web form, anonymous dialog, phone/voice, languages, accessibility — and whether anonymity survives first contact.
0 — A web form that is an email in disguise: no anonymous route, no way to reach the reporter afterwards.
3 — An anonymous form exists but the dialogue ends there — no secured mailbox for follow-up questions, few languages, desktop-only.
5 — Anonymous two-way dialog via a protected mailbox, a usable set of languages, mobile-friendly; voice or phone intake missing or an add-on.
8 — Multiple channels (web, voice message or hotline, QR entry points), broad language coverage with translation support, accessibility considered, and the anonymous dialog is first-class rather than bolted on.
10 — Intake engineered around the frightened reporter: every channel anonymous-capable, dozens of languages, WCAG-conscious, no app install or account required, and the vendor documents how the reporter's identity is kept out of the channel itself.
The Compliance Officer
The one captured page positions this as an operating system for family offices and foundations, and we found no public information on whistleblowing intake — no reporting form, anonymous dialog, follow-up mailbox, hotline, or language coverage. From my desk there is no evidenced route by which an employee could even submit a report. 1
The Reporter's Advocate
The captured page presents an operating system for family offices and foundations — data aggregation, co-funding, portfolio sharing — and we found no public information on any whistleblowing intake: no anonymous dialog, no protected mailbox for follow-up questions, no phone or voice channel, no language coverage. A frightened reporter looking for a way in at 3 a.m. on a night-shift phone finds nothing addressed to them at all. 1
The SME Operator
The captured pages position the product as an operating system for family offices and foundations, and I found no public information on any whistleblowing intake — a report form, an anonymous route, languages, a phone line, anything. A reporter at my sixty-person company has nothing on these pages showing how they would even submit. 1
The Group Counsel
The captured page positions the product as an operating system for family offices, and we found no public information on anonymous intake, protected two-way dialogue with reporters, language coverage, or voice channels. Nothing in the public evidence describes a reporter-facing experience at all. 1
The Security Auditor
The captured vendor page positions Impactly as a platform for family offices and foundations — data aggregation, portfolio sharing, syndication — and we found no public information on any whistleblowing intake: no anonymous form, no protected mailbox for follow-up dialog, no phone or voice channel. From what is published I cannot even evidence that a reporter-facing submission route exists, which sits at the bottom of this scale. 1
The Skeptic
The only captured page positions the product as an operating system for family offices and foundations covering equities, private investments, grants and projections, and we found no public information on any whistleblowing intake — no report form, no anonymous route, no language coverage. "Fully Customizable Platform... with accessibility via any device" is breadth marketing, not evidence of a reporter channel. 1
Case management & deadline discipline
Show reasoningHide reasoning
How this is scored
The case worker's side: triage, statutory deadlines (7-day acknowledgment, 3-month feedback), role separation, audit-proof documentation.
0 — Reports land in an inbox; deadlines, roles and history live in a spreadsheet next door.
3 — A case list with status fields, but deadlines are manual, permissions are all-or-nothing, and the record of who did what is thin.
5 — Deadline tracking with reminders for the statutory clocks, case notes and attachments, basic role separation between case handlers; reporting on the caseload is limited.
8 — Automated statutory clocks, conflict-of-interest handling (excluding implicated case handlers), complete tamper-evident case history, retention and deletion rules applied per case, and management reporting.
10 — A case system an external investigator can rely on: enforced workflows, full audit trail, legally aware retention/deletion automation, evidence handling, and statistics that survive a regulator's questions.
The Compliance Officer
We found no public information on case handling: no deadline tracking, statutory clocks, case notes, attachments, or a record of who did what. The tailored permissions mentioned cover staff, family members, and advisors sharing portfolios, which says nothing about separating an implicated handler from a case. 1
The Reporter's Advocate
We found no public information on case handling: nothing on statutory deadline clocks, conflict-of-interest exclusion of implicated handlers, case notes or an audit-proof history. The closest features are tailored permissions for staff, family members and advisors, and analytics described for performance, impact metrics and cash flow projections — investment functions, not case work. 1
The SME Operator
I found no public information on case handling, triage, or the statutory clocks for acknowledgment and feedback. The one adjacent fact is tailored permissions for staff, family members and advisors — a family-office role model rather than case-handler separation — so someone here would still be tracking every deadline by hand. 1
The Group Counsel
The page evidences tailored role permissions for staff, family members and advisors plus portfolio analytics, but we found no public information on case triage, statutory acknowledgement or feedback clocks, conflict-of-interest exclusion, or tamper-evident case history. Permission structure for an investment platform is not case handling. 1
The Security Auditor
We found no public information on statutory clocks, 7-day acknowledgments, 3-month feedback duties, case notes, attachments, tamper-evident history or caseworker role separation; the only role statement on record covers staff, family members and advisors on a wealth-management platform. Nothing published evidences a case system a whistleblower's report would actually land in. 1
The Skeptic
The captured facts name "Data Analytics & Reporting" for performance and cash flow projections and "Tailored Permissions" for staff, family members and advisors — investment-workflow items, not casework. We found no public information on statutory deadlines, case histories, retention, or separation of case handlers. 1
Legal compliance alignment
Show reasoningHide reasoning
How this is scored
How specifically the product implements EU Directive 2019/1937 and national transpositions (HinSchG et al.) — not whether the marketing mentions them.
0 — Generic feedback software wearing a whistleblowing label; no reference to the legal obligations it claims to satisfy.
3 — The directive is invoked in marketing but the mapping is vague; deadline rules, documentation duties and retention periods are the customer's problem.
5 — The statutory duties are implemented as product features — acknowledgment and feedback clocks, documentation, deletion after the retention period — for at least one national law, with guidance for the rest.
8 — Multiple national transpositions supported with their differing details, legal templates and process guidance maintained by named counsel or documented review, and updates when the law moves.
10 — The product is a legal instrument: per-country rule sets kept current, documented legal review, guidance for edge cases (group-wide channels, external ombudsman setups), and the vendor shows its homework in public.
The Compliance Officer
We found no public information on EU Directive 2019/1937 or any national transposition, nor on acknowledgment or feedback deadlines implemented as product features. The nearest claim is encrypted, two-stage authentication, which is a security statement rather than a legal mapping. 1
The Reporter's Advocate
We found no public information referencing EU Directive 2019/1937, national transpositions such as the HinSchG, the seven-day acknowledgment duty, the three-month feedback duty or retention periods. The captured page positions the product for family offices and foundations, so there is no legal mapping to evaluate beyond the category label itself. 1
The SME Operator
The pages make no mention of the EU whistleblowing directive or any national transposition — no acknowledgment clocks, no documentation duties, no retention periods. The law obligated me, not convinced me, and nothing here shows the product would carry a single legal duty on my behalf. 1
The Group Counsel
We found no public reference to the EU whistleblowing directive or any national transposition, and no acknowledgement clocks, documentation duties or retention rules appear in the captured material. The legal duties that drive my procurement decision are absent from the public record. 1
The Security Auditor
We found no public information referencing EU Directive 2019/1937, the German HinSchG, or any other national transposition, and no mapping of product features to acknowledgment, feedback, documentation or retention duties. Without a single legal obligation named, this reads as generic software with a whistleblowing category label. 1
The Skeptic
We found no public information referencing the EU whistleblowing directive, any national transposition, or any legal duty the product claims to satisfy; the captured page markets an investment operating system for family offices. A category label with no legal mapping behind it. 1
Security & anonymity assurance
Show reasoningHide reasoning
How this is scored
Whether the confidentiality promise is engineered and evidenced: encryption, metadata handling, penetration tests, certifications.
0 — Security is a paragraph of adjectives; no certificates, no test reports, no statement on metadata.
3 — TLS and encryption at rest asserted, but nothing audited: no ISO 27001 or equivalent, no published pentest, silence on IP and metadata logging.
5 — A current ISO 27001 (or equivalent) certificate for vendor or hosting, end-to-end encryption of report content claimed with some technical detail, an explicit no-IP-logging statement.
8 — Certified ISMS covering the product, regular third-party penetration tests attested, documented end-to-end encryption architecture, metadata minimization explained, security contact and disclosure policy published.
10 — Assurance a hostile auditor accepts: current certificates with visible scope, recurring pentest summaries public, cryptographic architecture documented, anonymity analysed against the operator itself — the vendor can answer "how would you unmask a reporter?" with "we cannot, and here is why".
The Compliance Officer
Security is asserted in a single sentence — maximum security with encrypted, two-stage authentication — and we found no public information on certificates, penetration tests, encryption architecture, or metadata and IP logging. Assertion without audit is exactly what I cannot take to a regulator when a reporter's anonymity is at stake. 1
The Reporter's Advocate
The only security statement is "Maximum Security with encrypted, two-stage authentication" — adjectives plus a bare encryption claim, with no certificate, no penetration test report, and no statement on IP or metadata logging. Two-stage authentication governs user accounts, not reporter anonymity, and we found no public information on whether the channel can keep a reporter's identity out of the system. 1
The SME Operator
Security amounts to one sentence — "Maximum Security with encrypted, two-stage authentication" — with no certificate, no penetration test report, and no statement on IP or metadata logging. Adjectives are not assurance for the most sensitive reports my company will ever hold. 1
The Group Counsel
Security appears as "Maximum Security with encrypted, two-stage authentication", giving an encryption claim and a login control, but we found no public information on ISO 27001 or equivalent certification, penetration tests, or handling of IP addresses and metadata. For the most sensitive data a company holds, unaudited adjectives carry little weight. 1
The Security Auditor
The only security statement on record is "Maximum Security with encrypted, two-stage authentication" — adjectives plus one claimed control — with no certificate, no published penetration test, no documented end-to-end encryption architecture, and no statement on IP or metadata logging on record. For a product whose entire promise is anonymity, nothing here is evidenced, and "Maximum Security" is precisely the kind of claim I refuse to take on faith. 1
The Skeptic
The security story on record is one sentence — "Maximum Security with encrypted, two-stage authentication" — with no certificate, no pentest, and no statement on IP or metadata. Two-stage authentication protects a login, not a reporter's anonymity, and we found no public information on either. 1
Group & multi-entity capability
Show reasoningHide reasoning
How this is scored
Whether one contract can serve a corporate group: separate channels per legal entity, central oversight, ombudsman access, white-labeling.
0 — One company, one channel; a group buys and administers N separate instances.
3 — Multiple channels under one account, but no separation of case access per entity and no consolidated view.
5 — Per-entity channels with separated case handlers and a group-level overview; branding per entity is basic; external counsel access possible.
8 — Real multi-tenant group structure: per-entity channels, languages and branding, delegated administration, external ombudsman roles, group reporting that respects entity boundaries.
10 — Group compliance as architecture: hundreds of entities manageable centrally, per-country legal rule assignment per entity, white-label reporting pages, and access separation strong enough to satisfy each subsidiary's works council.
The Compliance Officer
We found no public information on per-entity channels, case access separated per legal entity, ombudsman access, or a group-level overview. The discreet sharing with peers that is described concerns family offices exchanging projects and portfolios, not compliance structure across a corporate group's subsidiaries. 1
The Reporter's Advocate
We found no public information on per-entity channels, separated case access, delegated administration, ombudsman roles or group-level oversight. "Collaborate and discreetly share projects, companies, or portfolios with peers" describes investment syndication among family offices, which is a different thing from one contract serving a corporate group's reporting channels. 1
The SME Operator
I found no public information on separate channels per legal entity, per-entity case separation, or a consolidated group view; the captured pages describe discreetly sharing companies and portfolios with peers for co-funding and syndication, which is not a group compliance structure. At best this reads as one shared account without entity boundaries. 1
The Group Counsel
I need one system serving every subsidiary with real access separation, and we found no public information on per-entity channels, delegated administration, group-level reporting, or external ombudsman roles. The captured discreet sharing of projects, companies and portfolios concerns co-funding and syndication among family offices, a different problem from entity-boundary access control. 1
The Security Auditor
We found no public information on per-entity channels, delegated administration, external ombudsman or counsel access, or group-level reporting that respects entity boundaries. The "discreetly share projects, companies, or portfolios with peers" language describes investment collaboration, not a multi-tenant group whistleblowing structure. 1
The Skeptic
Collaborating and "discreetly shar[ing] projects, companies, or portfolios with peers" is investment syndication, not per-legal-entity whistleblowing channels. We found no public information on entity separation, group oversight, delegated administration, or ombudsman access. 1
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where reports about people actually live and under whose law — entity, hosting, subprocessors, DPA. In this category the data is by definition the most sensitive a company holds.
0 — Non-EU entity, non-EU-default hosting, no public DPA or subprocessor list — for whistleblowing data.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad or undocumented.
5 — EU hosting is the default, DPA and subprocessor list published; the vendor or a critical subprocessor is still within non-European jurisdictional reach.
8 — EU entity, EU hosting with named data centers, published subprocessor list free of content-touching non-EU processors, DPA and TOMs public.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors for report content and metadata, on-premises or sovereign-cloud options, and the whole chain documented publicly.
The Compliance Officer
No sovereignty attributes are on record: we found no public information on hosting location, named data centers, a published DPA, or subprocessors. For the most sensitive data a company holds, I cannot tell from public pages where report content would live or under whose law. 1
The Reporter's Advocate
The sovereignty record is empty: no hosting location, no published data processing agreement, no subprocessor list, no word on where reports and their metadata would live. Only the vendor's Danish corporate form, Impactly ApS, hints at a European entity; for the most sensitive data a company holds, silence this complete is not assurance. 1
The SME Operator
The vendor is Impactly ApS — a Danish company form — but I found no public information on where reports are hosted, a data processing agreement, or subprocessors, and no sovereignty attributes are on record. For data this sensitive I need to know where it lives and under whose law before I sign anything, and these pages do not say. 1
The Group Counsel
The vendor operates under a Danish company form, the only jurisdictional signal in the captured material; we found no public information on hosting locations, data centers, a published data processing agreement, or any subprocessor list. For whistleblowing data I require the whole chain documented, and none of it is on the public record. 1
The Security Auditor
We found no public information on where report data would be hosted, on any DPA or subprocessor list, on named data centers, or on TOMs — for the most sensitive data category a company holds. I cannot evidence even that an EU hosting default or a published DPA exists, so a buyer cannot place whistleblowing data under European jurisdiction based on anything captured here. 1
The Skeptic
The vendor name carries a Danish company form, but that is where jurisdictional evidence ends: no DPA, no hosting location, no subprocessor list appears in the captured material. For the most sensitive data a company holds, we found no public information on where reports would live or under whose law. 1
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether an obligated company can compute the real invoice — per entity, per employee band, per year — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — An entry price exists, but the tiers most obligated companies need are unpriced, or the maths is obscured by employee bands, per-report fees or mandatory setup charges.
5 — Most tiers carry real numbers with billing period and VAT treatment stated, but at least one commonly needed capability — extra entities, extra languages, phone intake — hides in an unpriced add-on.
8 — Every tier priced publicly with employee-band boundaries, entity rules and setup fees stated; only genuine corporate-group contracts are custom.
10 — Complete price computability: every tier, band, add-on and renewal rule public, so the invoice for a 60-employee company and a 5-entity group is a two-minute exercise.
The Compliance Officer
We found no public information on pricing — no tiers, employee-band boundaries, billing period, VAT treatment, or setup fees appear in the captured material. Enterprise-level support with white-glove setup is named as a feature, but nothing carries a number, so no invoice for any company size can be computed from these pages. 1
The Reporter's Advocate
We found no public information on pricing — no tier, employee band, billing period, VAT treatment or setup fee appears in the captured material. The only commercial signal is "Enterprise-Level Support with white-glove setup", which points to a sales conversation; an obligated company cannot begin to compute an invoice from public pages. 1
The SME Operator
The captured pages show no prices at all — no tiers, no employee bands, no billing period or VAT treatment — while "white-glove setup" and "enterprise-level support" appear without numbers attached. I cannot compute an invoice from public pages, and unpriced setup involvement is exactly the kind of charge my year-end review would question. 1
The Group Counsel
We found no public pricing at all: no tier prices, employee bands, setup fees or billing terms appear in the captured page, and "Enterprise-Level Support with white-glove setup" signals a sales conversation rather than a computable invoice. An obligated company cannot begin to budget from this. 1
The Security Auditor
We found no public information on prices: no tiers, no employee bands, no per-entity rules, no setup fees, no billing period or VAT treatment — only an "Enterprise-Level Support with white-glove setup" marketing line. An obligated company cannot compute any part of the invoice from what is published. 1
The Skeptic
We found no public pricing information — no tier, band, add-on or fee appears in the captured material. "Enterprise-Level Support with white-glove setup" reads as a sales conversation, and we found no public information on anything that would let an obligated company compute an invoice. 1
Questions about Impactly Whistleblowing
Is Impactly Whistleblowing European?
Not determined: the vendor’s pages as captured do not say where Impactly Whistleblowing is based.
Where does Impactly Whistleblowing store data?
Not stated on the vendor’s pages as of 20 Oct 2026.
Does Impactly Whistleblowing have a free plan?
Not stated on the vendor’s pages as of 20 Oct 2026.
What are the best alternatives to Impactly Whistleblowing?
As of 21 Oct 2026, the panel rates preeco | hinweisgeberschutz (3.5/5), EQS Integrity Line (3.5/5) and Safecall (3.5/5) highest among the other 36 Whistleblowing Portals products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is preeco | hinweisgeberschutz (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Impactly Whistleblowing alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 20 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (impactly.com). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
Sources (1)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page www.impactly.com Checked 20 Oct 2026 Details →