Whistleblowing Portals
LegalTegrity
EU-Made Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 1 of 4 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by LegalTegrity GmbH · legaltegrity.com
Report an error on this page Is this your product? →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
LegalTegrity's whistleblowing system scores highest on reporting channels & reporter experience and case management & deadline discipline: online intake 24/7, telephone on working days, 40+ languages with built-in translation, an anonymous dialog with a personal PIN plus a 12-digit Case ID, and automated case workflow with deadline reminders and an audit-proof activity log with export. Its weakest criterion is group & multi-entity capability, flat at 4 — the vendor positions itself for medium-sized organisations, and no group-level consolidated view, delegated administration or per-entity branding is evidenced. Security & anonymity assurance credits explicit anonymity engineering — no IP logging, metadata removal, "not even LegalTegrity" access — but "pentested" carries no report or date, and the cited ISO 27001 belongs to the Open Telekom Cloud hosting. Legal compliance alignment implements one national law, HinSchG with AGG, GDPR and BSIG named, with no per-country rule sets. Sovereignty and pricing transparency show the widest spreads: judges weigh a Frankfurt-registered GmbH and Telekom-hosted data in Magdeburg/Biere against an unpublished DPA, no subprocessor list, ownership listed as unknown, and quote-only Enterprise above 1,000 employees.
Speaks for it
- Anonymous dialog with a personal PIN, 12-digit Case ID and real-time chat that judges called first-class rather than bolted on
- Online intake 24/7 plus telephone on working days, in 40+ languages with built-in translation
- Automated case workflow with checklists, intelligent deadline management with reminders, and an audit-proof activity log with export
- Anonymity hygiene is explicit in the evidence: no IP logging, removal of all metadata, a non-tracking session cookie, and 'not even LegalTegrity' access
- Public per-tier prices through Professional 1000 at 1.990 € per year, letting an SME compute its invoice
Held against it
- No group-level consolidated view, delegated administration or per-entity branding evidenced, and the vendor targets medium-sized organisations
- 'Pentested' carries no report, date or tester, and the only ISO 27001 belongs to the Open Telekom Cloud hosting, not the vendor's product
- No published DPA or subprocessor list appears, and the evidence lists ownership and subprocessor exposure as unknown
- Enterprise above 1,000 employees is price-on-request, the OmbuTegrity and training add-ons are unpriced, and VAT treatment sits behind an unresolved asterisk
- The evidence is silent on conflict-of-interest exclusion of implicated handlers and on per-case retention and deletion rules
Best for
- You are a German company newly under the HinSchG 50-employee obligation and want a computable invoice, with public prices from Essential at 588 € per year for < 50 employees to Professional 1000 at 1.990 € per year for < 1,000 employees
- You need a genuinely anonymous reporting dialog — PIN-based re-entry with a 12-digit Case ID, real-time chat, no IP logging — rather than a form on the intranet
- Your workforce is multilingual and needs intake in 40+ languages with built-in translation
- You require Germany-located hosting for whistleblowing data (Open Telekom Cloud, Magdeburg/Biere) and can accept unverified ownership and subprocessors pending review
Avoid if
- You run a corporate group needing consolidated views, delegated administration or per-entity branding — group & multi-entity capability is the table's only flat-4 criterion
- You need documented security artifacts — a pentest report, a product-scoped certificate, an encryption architecture — before storing sensitive reports
- You must serve multiple countries' whistleblowing transpositions; the product implements HinSchG only, and the 120-jurisdiction legal register is a separate product
- You require a published DPA and subprocessor list before signature; neither appears in the evidence, and the vendor's DCO product runs in the Microsoft Germany cloud (a US parent)
The scores
Reporting channels & reporter experience
Show reasoningHide reasoning
How this is scored
The intake side: how a reporter actually submits — web form, anonymous dialog, phone/voice, languages, accessibility — and whether anonymity survives first contact.
0 — A web form that is an email in disguise: no anonymous route, no way to reach the reporter afterwards.
3 — An anonymous form exists but the dialogue ends there — no secured mailbox for follow-up questions, few languages, desktop-only.
5 — Anonymous two-way dialog via a protected mailbox, a usable set of languages, mobile-friendly; voice or phone intake missing or an add-on.
8 — Multiple channels (web, voice message or hotline, QR entry points), broad language coverage with translation support, accessibility considered, and the anonymous dialog is first-class rather than bolted on.
10 — Intake engineered around the frightened reporter: every channel anonymous-capable, dozens of languages, WCAG-conscious, no app install or account required, and the vendor documents how the reporter's identity is kept out of the channel itself.
The Compliance Officer
Online intake 24/7 plus telephone on working days, 40+ languages with built-in translation, PIN-plus-12-digit-Case-ID locker with real-time anonymous chat, read-aloud and responsive design, and a documented claim that the channel is independent of the company's IT so the reporter cannot be traced. It sits at the 8 anchor; I hold it there rather than above because the phone route's anonymity handling is undocumented and phone stops on weekends — exactly when a frightened reporter calls. 1 2 3
The Reporter's Advocate
The anonymous dialog is first-class, not bolted on: reporter sets a PIN before submitting, re-enters a locker with a 12-digit case ID, and gets real-time anonymous chat, 40+ languages with built-in translation, responsive design and a read-aloud feature, with entry via a plain web link — no account, no install. It stops short of the top anchor because the phone channel only runs 'on working days' with no statement that it is anonymous-capable, and there is no QR entry or WCAG-consciousness documented — the night-shift phone finds nobody. 1 2 3
The SME Operator
Online 24/7 plus telephone included, 40+ languages with built-in translation, responsive design, read-aloud, and the anonymous dialog is the product's core: personal PIN, 12-digit Case ID and a two-sided locker for follow-up chat. Phone only on working days and no QR entry keep it off the top, but this is first-class, not bolted on. 1 2 3
The Group Counsel
Web 24/7 plus telephone intake (working days only), anonymous or open reporting with PIN and 12-digit case ID for re-entry, 40+ languages with built-in translation, responsive design and a read-aloud feature — anonymous dialog is genuinely first-class. Docked below 8 because phone is business-hours-only with no statement it is anonymity-capable, and accessibility rests on one read-aloud feature rather than documented WCAG-consciousness. 1 2 3
The Security Auditor
Web intake 24/7 plus telephone on working days, 40+ languages with built-in translation, responsive design, and a properly engineered anonymous dialog: reporter-chosen PIN plus 12-digit Case ID locker and real-time chat, with the vendor claiming the channel itself cannot trace the reporter. Held below 8 because phone intake is office-hours only, no QR entry points are evidenced, and accessibility amounts to one tier-gated read-aloud feature rather than documented WCAG consciousness. 1 2 3
The Skeptic
Web intake 24/7 with anonymous or open reporting, a PIN/12-digit Case ID locker making the two-way dialog first-class, 40+ languages with built-in translation, responsive design and phone intake on working days. But the phone channel's anonymity is never addressed, there is no QR entry point, no WCAG claim, and the read-aloud feature is gated to Professional 250 and up — so short of the anchor's 'every channel anonymous-capable'. 1 2 3
Case management & deadline discipline
Show reasoningHide reasoning
How this is scored
The case worker's side: triage, statutory deadlines (7-day acknowledgment, 3-month feedback), role separation, audit-proof documentation.
0 — Reports land in an inbox; deadlines, roles and history live in a spreadsheet next door.
3 — A case list with status fields, but deadlines are manual, permissions are all-or-nothing, and the record of who did what is thin.
5 — Deadline tracking with reminders for the statutory clocks, case notes and attachments, basic role separation between case handlers; reporting on the caseload is limited.
8 — Automated statutory clocks, conflict-of-interest handling (excluding implicated case handlers), complete tamper-evident case history, retention and deletion rules applied per case, and management reporting.
10 — A case system an external investigator can rely on: enforced workflows, full audit trail, legally aware retention/deletion automation, evidence handling, and statistics that survive a regulator's questions.
The Compliance Officer
Automated case workflow with checklists, intelligent deadline management with reminders, an audit-proof activity log with export, responsibilities assignable per subsidiary and category, and extensive reporting — that covers my statutory-clock and documentation worries. It falls short of 8 because the evidence is silent on conflict-of-interest exclusion of implicated handlers and on per-case retention/deletion automation, both of which I would demand before putting my neck on this system. 2 3
The Reporter's Advocate
Automated case management workflow with checklists, intelligent deadline management with reminders, an audit-proof activity log with export, and responsibilities assignable by business unit, subsidiary and report category — statutory clocks and role separation genuinely live in the product. But the evidence is silent on conflict-of-interest exclusion of implicated handlers and on per-case retention and deletion rules, which is what separates a usable tool from one an investigator can rely on. 1 2
The SME Operator
Automated workflow with checklists, intelligent deadline management with reminders, audit-proof activity log and responsibilities assignable by subsidiary and category — that covers the paperwork for my 60-person shop. But the evidence is silent on conflict-of-interest exclusion, per-case retention/deletion, and whether the deadline clock is actually wired to the 7-day/3-month HinSchG clocks rather than generic reminders. 1 2 3
The Group Counsel
Deadline management with reminders, automated checklist workflows, an audit-proof activity log and responsibilities assignable per subsidiary exceed rubric level 5's basic role separation. But no conflict-of-interest exclusion of implicated handlers, no per-case retention/deletion automation, and nothing tying the deadline feature explicitly to the 7-day/3-month statutory clocks. 1 2 3
The Security Auditor
Automated workflow with checklists, deadline management with reminder function, an audit-proof activity log with exports, and responsibilities assignable per business unit, subsidiary and report category — that clears rubric level 5. But the evidence is silent on conflict-of-interest exclusion of implicated handlers and on per-case retention and deletion rules, which are the parts a regulator or external investigator actually needs. 1 2
The Skeptic
Automated workflow with checklists, deadline management with reminders, unlimited case categories, and an 'audit-proof' activity log with export — but 'audit-proof' is asserted, not demonstrated: no tamper-evidence detail, no conflict-of-interest exclusion of implicated handlers, and no retention/deletion rules per case anywhere in the evidence. 2 3
Legal compliance alignment
Show reasoningHide reasoning
How this is scored
How specifically the product implements EU Directive 2019/1937 and national transpositions (HinSchG et al.) — not whether the marketing mentions them.
0 — Generic feedback software wearing a whistleblowing label; no reference to the legal obligations it claims to satisfy.
3 — The directive is invoked in marketing but the mapping is vague; deadline rules, documentation duties and retention periods are the customer's problem.
5 — The statutory duties are implemented as product features — acknowledgment and feedback clocks, documentation, deletion after the retention period — for at least one national law, with guidance for the rest.
8 — Multiple national transpositions supported with their differing details, legal templates and process guidance maintained by named counsel or documented review, and updates when the law moves.
10 — The product is a legal instrument: per-country rule sets kept current, documented legal review, guidance for edge cases (group-wide channels, external ombudsman setups), and the vendor shows its homework in public.
The Compliance Officer
This is a HinSchG instrument, not a directive name-drop: it claims to fulfil the Whistleblower Protection Act, documents case handling in a legally compliant manner, and even educates on the 50-employee threshold and the Money Laundering Act obligation. But it is Germany-only (AGG, BSIG are German statutes too) with no other transposition, no named counsel, no templates, and no deletion-after-retention feature — exactly the 5 anchor. 1 2 3
The Reporter's Advocate
This is real implementation of one national law, not marketing gloss: HinSchG, AGG, GDPR and BSIG are named, deadline reminders and audit-proof documentation are product features, and the vendor even publishes the 50-employee obligation threshold. No second transposition, no named counsel, no documented legal review of templates appears anywhere; the 120-jurisdiction legal register is a different product and cannot be credited to the whistleblowing system. 1 2 3
The SME Operator
HinSchG named and claimed fulfilled, AGG/BSIG/GDPR bundled, the 50-employee threshold and money-laundering obligations explained in plain terms, with deadline management and legally compliant case documentation as product features — that is one national law implemented, which is all I need. No named counsel, no per-country rule sets inside the whistleblowing product, and nothing on deletion after the retention period. 1 2 3
The Group Counsel
HinSchG is implemented, not just invoked — 'fulfils the requirements of the Whistleblower Protection Act' with legally compliant case documentation, plus AGG, GDPR and BSIG coverage. But the EU Directive 2019/1937 is never named, no per-country rule sets or documented legal review exist, and the 120-jurisdiction legal register is a separate product with no evidence it feeds the whistleblowing system — silent where my dozen national transpositions need answers. 1 3
The Security Auditor
HinSchG duties are implemented as product features — deadline clocks, case handling documented in a legally compliant manner, the 50-employee threshold and money-laundering obligations spelled out, plus AGG and BSIG — which is a solid one-national-law implementation. No per-country rule sets for the whistleblowing product, no named counsel or documented legal review, and no deletion-after-retention feature anywhere; the 120-jurisdiction legal register belongs to a different product. 1 2 3
The Skeptic
HinSchG, AGG, GDPR and BSIG are named, the 50-employee threshold is stated, and 'fulfils the requirements of the HinSchG' is claimed — yet the mapping stays marketing-level: no evidence the 7-day acknowledgment and 3-month feedback clocks are implemented, no retention feature, no named counsel or documented legal review, and EU Directive 2019/1937 itself is never cited. 1 2 3
Security & anonymity assurance
Show reasoningHide reasoning
How this is scored
Whether the confidentiality promise is engineered and evidenced: encryption, metadata handling, penetration tests, certifications.
0 — Security is a paragraph of adjectives; no certificates, no test reports, no statement on metadata.
3 — TLS and encryption at rest asserted, but nothing audited: no ISO 27001 or equivalent, no published pentest, silence on IP and metadata logging.
5 — A current ISO 27001 (or equivalent) certificate for vendor or hosting, end-to-end encryption of report content claimed with some technical detail, an explicit no-IP-logging statement.
8 — Certified ISMS covering the product, regular third-party penetration tests attested, documented end-to-end encryption architecture, metadata minimization explained, security contact and disclosure policy published.
10 — Assurance a hostile auditor accepts: current certificates with visible scope, recurring pentest summaries public, cryptographic architecture documented, anonymity analysed against the operator itself — the vendor can answer "how would you unmask a reporter?" with "we cannot, and here is why".
The Compliance Officer
The anonymity engineering is real and explicit: no IP logging, removal of all metadata, no tracking cookie, and a flat statement that not even LegalTegrity can access the content. But the assurance layer is adjectives — 'meets the requirements of various ISO certifications' is not a certificate, 'pentested' comes with no report or date, the ISO 27001 belongs to the hosting provider, and there is not one word about encryption of report content, so it sits between the 3 and 5 anchors. 1 2 3
The Reporter's Advocate
The anonymity engineering is the strongest part: explicit no-IP-logging, removal of all metadata, a session cookie with no personal data and no tracking, and 'no one else – not even LegalTegrity' plus independence from the company's IT so tracing is declared impossible. But assurance stops at adjectives: 'pentested' is one word with no tester, date or report, the ISO 27001 belongs to the Telekom hosting rather than the vendor, and there is no end-to-end encryption claim, no security contact and no disclosure policy in the evidence. 1 2 3
The SME Operator
'GDPR-compliant & pentested' with no date, no report and no recurring tests, and the ISO 27001 belongs to the Telekom cloud rather than the vendor's own product — encryption of report content is never claimed at all. Credit where due on anonymity engineering: explicit no-IP-logging, removal of all metadata, and 'No one else – not even LegalTegrity' answers the unmasking question in the right direction, just without certificates behind it. 1 2 3
The Group Counsel
Explicit no-IP-logging and full metadata removal, a vendor-cannot-access claim, and ISO 27001 hosting on the Telekom cloud give real anonymity engineering. But 'pentested' is a one-word, undated claim with no report or tester, no encryption-of-content architecture is described anywhere, and there is no product-scoped certificate, security contact or disclosure policy. 1 2 3
The Security Auditor
'GDPR-compliant & pentested' with no report, no date, no tester and no scope is precisely the adjective security I reject, and the only ISO 27001 in evidence belongs to the Open Telekom Cloud hosting, not to LegalTegrity's own product or ISMS — 'meets the requirements of various ISO certifications' is not a certificate. Credit where due: no IP logging, removal of all metadata and a non-tracking session cookie are explicit and specific, and 'not even LegalTegrity' access is claimed — but with no end-to-end encryption claim and no cryptographic architecture, that assertion is engineered nowhere in this sheet. 1 2 3
The Skeptic
'GDPR-compliant & pentested' and 'meets the requirements of various ISO certifications' are adjectives without artifacts: no certificate for the vendor, no pentest report or date, no encryption architecture described. The anonymity hygiene is genuinely better than average — no IP logging, metadata removal, non-tracking session cookie, 'not even LegalTegrity' access — but the only certified party is the Telekom host, not the product. 1 2 3
Group & multi-entity capability
Show reasoningHide reasoning
How this is scored
Whether one contract can serve a corporate group: separate channels per legal entity, central oversight, ombudsman access, white-labeling.
0 — One company, one channel; a group buys and administers N separate instances.
3 — Multiple channels under one account, but no separation of case access per entity and no consolidated view.
5 — Per-entity channels with separated case handlers and a group-level overview; branding per entity is basic; external counsel access possible.
8 — Real multi-tenant group structure: per-entity channels, languages and branding, delegated administration, external ombudsman roles, group reporting that respects entity boundaries.
10 — Group compliance as architecture: hundreds of entities manageable centrally, per-country legal rule assignment per entity, white-label reporting pages, and access separation strong enough to satisfy each subsidiary's works council.
The Compliance Officer
Multi-tenancy assigns responsibilities by business unit, subsidiary and report category, individual branding exists, and an external reporting office (ombudsman) can be attached as an add-on. But there is no evidence of a consolidated group-level view, per-entity branding or languages, or delegated administration, and the vendor explicitly positions itself for medium-sized organisations — above the 3 anchor, short of the 5. 2 5
The Reporter's Advocate
Multi-tenancy with responsibilities assignable by business unit, subsidiary and report category gives real per-entity case separation, and an external reporting office (OmbuTegrity) exists as an add-on. But no consolidated group view, delegated administration or per-entity branding is evidenced, and the vendor positions itself squarely for 'medium sized organisations' — a corporate group is not who this is built for. 1 2
The SME Operator
Multi-tenancy lets responsibilities be assigned by business unit, subsidiary and report category, and an external reporting office (OmbuTegrity) can be attached — that is real case-access separation. But per-entity channels, a group-level consolidated view and per-entity branding are nowhere evidenced, so a corporate group buys on faith. 1 2
The Group Counsel
Multi-tenancy with responsibilities assignable by business unit, subsidiary and report category is real case-access separation, and an external reporting office (OmbuTegrity) exists as an add-on. But there is no group-level consolidated view, no per-entity branding or delegated administration beyond tier-dependent admin counts, and the vendor explicitly targets medium-sized organisations — my 25-subsidiary rollout would hit an unpriced Enterprise wall with nothing showing the architecture scales. 5 1 2
The Security Auditor
Multi-tenancy with responsibilities assignable by business unit, subsidiary and report category, plus an external reporting office (OmbuTegrity) add-on, gets the per-entity case separation started. But the vendor positions itself for medium-sized organisations, and I find no group-level consolidated view, no delegated administration, no per-entity branding or per-country rule assignment — a corporate group cannot be run on this as evidenced. 5 1 2
The Skeptic
Multi-tenancy assigns responsibilities by business unit, subsidiary and report category, and an external reporting office (OmbuTegrity) is available as an add-on — but there is no group-level consolidated view, no delegated administration, no per-entity branding beyond generic 'individual branding', and nothing on separation strong enough for a works council. 1 2
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where reports about people actually live and under whose law — entity, hosting, subprocessors, DPA. In this category the data is by definition the most sensitive a company holds.
0 — Non-EU entity, non-EU-default hosting, no public DPA or subprocessor list — for whistleblowing data.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad or undocumented.
5 — EU hosting is the default, DPA and subprocessor list published; the vendor or a critical subprocessor is still within non-European jurisdictional reach.
8 — EU entity, EU hosting with named data centers, published subprocessor list free of content-touching non-EU processors, DPA and TOMs public.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors for report content and metadata, on-premises or sovereign-cloud options, and the whole chain documented publicly.
The Compliance Officer
The imprint confirms LegalTegrity GmbH, registered at Amtsgericht Frankfurt with a German VAT ID, and whistleblowing data sits in Deutsche Telekom's Open Telekom Cloud with named data centres in Magdeburg and Biere — the jurisdictional substance is genuinely German, better than the 5 anchor's tolerated non-EU reach. What caps it: no published DPA or subprocessor list for the most sensitive data a company holds, ownership unverified, and the vendor's other product line sits in the Microsoft Germany cloud, a US parent. 6 1 2 3
The Reporter's Advocate
A German GmbH with a verifiable Frankfurt imprint (HRB 117038) storing report content in Deutsche Telekom's Open Telekom Cloud with named data centres in Magdeburg and Biere is a genuinely European chain for the whistleblowing data. What's missing is the paperwork a hostile lawyer would ask for: no published DPA, no subprocessor list, no TOMs in the evidence, ownership unconfirmed — and their other product sits in the Microsoft Germany cloud, so EU-only cannot be assumed vendor-wide. 6 1 2 3
The SME Operator
German GmbH registered in Frankfurt with whistleblowing data in Deutsche Telekom's Magdeburg/Biere data centres — jurisdictionally the right neighbourhood for the most sensitive data I hold. But no published DPA, no subprocessor list, and ownership unverified on the vendor's own pages, so I cannot confirm the whole chain is clean, and the vendor's other product sits in the Microsoft Germany cloud of a US parent. 6 1 2
The Group Counsel
A German GmbH registered at Amtsgericht Frankfurt hosting the whistleblowing product in Telekom's Open Telekom Cloud with named data centres (Magdeburg/Biere) is the right geography for this data class. Held below 8 because no DPA, subprocessor list or TOMs are published, ownership is unconfirmed, and the vendor's DCO product runs on the Microsoft Germany cloud — the chain is undocumented precisely where I need it most. 6 1 2 3
The Security Auditor
The residency for whistleblowing reports is clean on its face: German GmbH with a Frankfurt imprint, hosted in Deutsche Telekom's Open Telekom Cloud with named data centres in Magdeburg and Biere. But there is no published DPA and no subprocessor list at all in the evidence, a HubSpot embed sits on the vendor's own web estate, and the sibling DCO product runs in Microsoft's Germany cloud — leaving US CLOUD Act exposure in the chain undocumented, which rubric level 8 will not tolerate. 6 5 1 2 3
The Skeptic
A German GmbH in Frankfurt with register court and VAT ID, and whistleblowing data hosted in Telekom's Open Telekom Cloud with named data centers (Magdeburg/Biere) — solid on entity and location. But no DPA and no subprocessor list appear anywhere in the evidence, and the vendor's DCO product runs in the Microsoft Germany cloud, a US parent, so the chain is not documented clean end to end. 6 1 2 3
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether an obligated company can compute the real invoice — per entity, per employee band, per year — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — An entry price exists, but the tiers most obligated companies need are unpriced, or the maths is obscured by employee bands, per-report fees or mandatory setup charges.
5 — Most tiers carry real numbers with billing period and VAT treatment stated, but at least one commonly needed capability — extra entities, extra languages, phone intake — hides in an unpriced add-on.
8 — Every tier priced publicly with employee-band boundaries, entity rules and setup fees stated; only genuine corporate-group contracts are custom.
10 — Complete price computability: every tier, band, add-on and renewal rule public, so the invoice for a 60-employee company and a 5-entity group is a two-minute exercise.
The Compliance Officer
I can compute my own invoice: Professional 1000 at 1,990 € per year for a 600-employee company, with band boundaries, admin-account counts and included telephone channel all stated, and setup included in Professional. It misses 7-8 because VAT treatment is never stated, the OmbuTegrity and training add-ons hide in unpriced extras, and Enterprise above 1,000 employees is price-on-request — and as a single 600-employee entity I still cannot price the ombudsman operation I might need. 1 2
The Reporter's Advocate
Three tiers carry real numbers with clean employee bands — 588 €/<50, 1.188 €/<250, 1.990 €/<1.000 — phone intake is included rather than an unpriced add-on, and setup is stated as included in Professional plans. But Enterprise above 1,000 employees is price-on-request, VAT treatment and per-entity costs are unstated, and the OmbuTegrity and training add-ons carry no numbers, so the real invoice for a group is not computable from public pages alone. 1 2
The SME Operator
Every tier up to 1,000 employees carries a public number with band boundaries — my 60-employee company is €1,188 a year on Professional 250, setup included, no per-report fees, no mandatory setup charge; the year-end review will not question that. Docked because the ombudsman-operation and training add-ons are unpriced, entity rules for groups are unstated, and VAT treatment hides behind an asterisk. 1 2
The Group Counsel
Three tiers carry real annual and monthly figures with employee-band boundaries and setup included from Professional, so an SME can compute its invoice. But the Enterprise tier (>1,000 employees), the ombudsman operation and training add-ons are unpriced, VAT treatment is unstated, and there is no per-entity pricing — the invoice for a 5-entity group is a sales conversation, not a two-minute exercise. 1 2
The Security Auditor
Three tiers carry real annual and monthly figures with employee-band boundaries (<50, <250, <1,000) and setup included from Professional upward, so a small company can compute its invoice. But VAT treatment is an unexplained asterisk, the OmbuTegrity external reporting office and training add-ons are unpriced, and Enterprise is quote-only — exactly the anchor-5 pattern of commonly needed capabilities hiding in unpriced extras. 1 2
The Skeptic
Three tiers carry real annual and monthly figures with employee bands up to 1,000, and admin-account counts per tier are stated. But VAT treatment is unstated (the asterisk on the monthly price is never resolved), the OmbuTegrity and training add-ons are unpriced, Enterprise above 1,000 employees is sales-only, and there is no per-entity pricing rule for groups. 1 2
European sovereignty — proven facts
1 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined ⚠ unverified | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | US CLOUD Act reach ⚠ unverified | 0/2 pts | 3 Report an error |
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 23 Aug 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Ownership, Data residency, Legal entity. Not confirmed on the vendor’s own pages as captured.
- Weak sourcing — Subprocessors. The ISMS product runs on Microsoft's Germany cloud, i.e. an EU contracting entity of US-parented Microsoft; the whistleblower system is hosted on Deutsche Telekom's Open Telekom Cloud (German provider), and no dedicated subprocessor list page was provided.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 75 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 47 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 14 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (10)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Product page incl. pricing/FAQ legaltegrity.com Checked 5 Oct 2026 +2 earlier captures: 11 Sep 2026, 23 Aug 2026 Details →
- 2 Pricing page legaltegrity.com Checked 5 Oct 2026 +2 earlier captures: 11 Sep 2026, 23 Aug 2026 Details →
- 3 Detailed FAQ legaltegrity.com Checked 5 Oct 2026 +2 earlier captures: 11 Sep 2026, 23 Aug 2026 Details →
- 4 About / team legaltegrity.com Checked 5 Oct 2026 +1 earlier capture: 15 Sep 2026 Details →
- 5 Contact legaltegrity.com Checked 5 Oct 2026 +2 earlier captures: 15 Sep 2026, 23 Aug 2026 Details →
- 6 Imprint legaltegrity.com Checked 5 Oct 2026 Details →
- 7 Security / trust page legaltegrity.com Checked 5 Oct 2026 Details →
- 8 Privacy policy legaltegrity.com Checked 5 Oct 2026 Details →
- 9 Reporting channels & reporter experience — found from sitemap legaltegrity.com Checked 5 Oct 2026 Details →
- 10 Reporting channels & reporter experience — found from sitemap legaltegrity.com Checked 5 Oct 2026 Details →