Whistleblowing Portals
Reveal
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Whistleblower Security Inc. · www.whistleblowersecurity.com
Report an error on this page Is this your product? →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
WhistleBlower Security, a Case IQ company since 2005, earns its best marks on reporting channels, where scores cluster at 7-8: live-answer toll-free hotlines 24/7/365 in English, French and Spanish with interpretation into 150 further languages, a web portal with three anonymity levels, and anonymous two-way messaging. Apart from pricing, its lowest scores land in compliance alignment, at 1-2, where the captured compliance language goes no further than a dashboard that helps you "stay compliant with regulations", and in sovereignty, at 0-1, where the pages state report data is hosted in Canadian Azure data centres — primary and geo-replicated secondary — with agents in Canada, and we found no public information on an EU hosting option, a data processing agreement or a subprocessor list. Case management spreads 4-6, security assurance sits flat at 4, and multi-entity scale runs 3-4: real permissions, routing, audit log, one-click reports and entity-aware subsidiary intake, but we found no public information on statutory deadline clocks, per-case retention or separated case access per entity. Its only pricing statement is an "all-inclusive service … at a price you can afford".
Speaks for it
- Live-answer toll-free hotlines 24/7/365 in English, French and Spanish, with interpretation into 150 further languages
- Three anonymity levels, the strictest holding no contact data, with anonymous two-way messaging as a core channel
- Real case-handling machinery: configurable user permissions, a restricted-manager role, investigator assignment, audit log, task management and one-click investigation reports
- Subsidiary intake shaped to corporate structure, letting reporters select which legal entity or division a report concerns, driving routing and portal dropdowns
- Stated ISO 27001 certification with an implemented ISMS, plus TLS in transit and AES-256 transparent data encryption at rest
Held against it
- The captured compliance language stays generic ("stay compliant with regulations"); we found no public information mapping the product to EU Directive 2019/1937 or any national transposition
- Report data is hosted in Canadian Azure data centres with agents in Canada, and we found no public information on an EU hosting option, a data processing agreement or a subprocessor list
- We found no public information on statutory acknowledgment or feedback clocks, conflict-of-interest exclusion of implicated handlers, or per-case retention and deletion
- The strictly anonymous reporter must log in manually every 24-48 hours and, on losing the password, must create a new case
- We found no public information on the ISO 27001 certificate's scope or validity dates, on penetration tests, or on end-to-end encryption of report content
Best for
- You need around-the-clock, multilingual intake — live answer in three languages with interpretation into 150 more, for a polyglot or night-shift workforce
- You want engineered anonymity — the stricter levels document that the organization cannot see the reporter's name or email, with two-way anonymous dialogue
- You run a group of brands or subsidiaries and need reporters to designate which legal entity a report concerns
Avoid if
- You are an EU-obligated company and need the product to carry statutory duties — the captured pages offer only generic compliance language, so the legal mapping would be your own work
- Your procurement requires EU data residency or a published DPA and subprocessor list — the captured pages state Canadian Azure hosting and Canadian agents
- Your reporters will rely on the strictly anonymous mode and may lose their password — the help pages state the dialogue cannot be recovered and a new case must be created
The scores
Reporting channels & reporter experience
Show reasoningHide reasoning
How this is scored
The intake side: how a reporter actually submits — web form, anonymous dialog, phone/voice, languages, accessibility — and whether anonymity survives first contact.
0 — A web form that is an email in disguise: no anonymous route, no way to reach the reporter afterwards.
3 — An anonymous form exists but the dialogue ends there — no secured mailbox for follow-up questions, few languages, desktop-only.
5 — Anonymous two-way dialog via a protected mailbox, a usable set of languages, mobile-friendly; voice or phone intake missing or an add-on.
8 — Multiple channels (web, voice message or hotline, QR entry points), broad language coverage with translation support, accessibility considered, and the anonymous dialog is first-class rather than bolted on.
10 — Intake engineered around the frightened reporter: every channel anonymous-capable, dozens of languages, WCAG-conscious, no app install or account required, and the vendor documents how the reporter's identity is kept out of the channel itself.
The Compliance Officer
A live-answer hotline staffed around the clock in three languages with interpretation for 150 more, plus web intake with a genuinely engineered anonymity model: strictly anonymous reporters keep a username-only dialog they must check in on manually, and at the middle level the organization is told it will not see the reporter's name or email. Two-way anonymous dialog is core, not bolted on. I found no public information on accessibility or QR-style entry points, which is the one gap keeping this a step below the top of the scale. 1 3 4 6
The Reporter's Advocate
Live-answer toll-free hotlines around the clock in English, French and Spanish with interpretation into 150 more languages, plus web intake with three documented anonymity levels and anonymous two-way messaging — the night-shift phone and the polyglot workforce are genuinely served. The strictest anonymous reporter, though, must remember a username and password, log in again within every 24–48 hour window to see replies, and cannot recover a lost password without starting a whole new case — a wall exactly where the frightened are weakest. We found no public information on accessibility measures or QR-style entry points. 1 3 4 6
The SME Operator
A live-answer toll-free hotline staffed 24/7/365 in English, French and Spanish with interpretation into 150 further languages, plus a web portal with three documented anonymity levels including one where the organization never sees the reporter's name or email — that is intake a frightened reporter can genuinely use. The strictly anonymous mode is austere (manual login every 24–48 hours, lost password means starting a new case), and we found no public information on accessibility standards or QR entry points. 1 3 4 5
The Group Counsel
Live-answer toll-free hotlines in English, French and Spanish with interpretation into 150 further languages, a web reporting system with mobile support, and three documented anonymity levels including a strictly anonymous mode with no password reset — intake here is engineered, not bolted on. I found no public information on accessibility standards or QR-style entry points, which keeps it below the top band. 1 3 4 5 6
The Security Auditor
Live-answered toll-free hotlines in English, French and Spanish with interpretation into 150 further languages, a 24/7/365 web reporting system, two-way anonymous messaging, and a genuinely graded three-level anonymity scheme — the strictest mode holds no contact data and disables password resets — make the anonymous dialog first-class rather than bolted on. I found no public information on accessibility standards, QR or alternate entry points, or how a reporter's identity is kept out of the human-answered voice channel, and the strictest mode makes the reporter check in every 24–48 hours to hear back. 1 3 4 5 6
The Skeptic
Live-answer hotlines 24/7/365 in English, French and Spanish with interpretation into 150 further languages, plus a web intake with three documented anonymity levels and anonymous two-way messaging, is genuinely engineered intake — and the vendor documents how contact details stay out of the organization's view. The weak point is the strictly anonymous reporter, who must log in manually every 24–48 hours and, on losing a password, loses the dialogue and must file a new case. We found no public information on accessibility standards, QR entry, or a reporter-facing mobile experience. 1 3 4 6
Case management & deadline discipline
Show reasoningHide reasoning
How this is scored
The case worker's side: triage, statutory deadlines (7-day acknowledgment, 3-month feedback), role separation, audit-proof documentation.
0 — Reports land in an inbox; deadlines, roles and history live in a spreadsheet next door.
3 — A case list with status fields, but deadlines are manual, permissions are all-or-nothing, and the record of who did what is thin.
5 — Deadline tracking with reminders for the statutory clocks, case notes and attachments, basic role separation between case handlers; reporting on the caseload is limited.
8 — Automated statutory clocks, conflict-of-interest handling (excluding implicated case handlers), complete tamper-evident case history, retention and deletion rules applied per case, and management reporting.
10 — A case system an external investigator can rely on: enforced workflows, full audit trail, legally aware retention/deletion automation, evidence handling, and statistics that survive a regulator's questions.
The Compliance Officer
The case worker side is a real system: configurable user permissions, restricted manager and investigator assignment, case routing, an audit log, task management, and reporting that goes well beyond a status list. But I found no public information on statutory deadline tracking — no acknowledgment or feedback clocks, no per-case retention or deletion rules, no conflict-of-interest exclusion — and those are exactly the pieces I answer for. On everything shown, the legal clocks would be my problem, not the system's. 5 6 7
The Reporter's Advocate
There is real investigative machinery here — configurable permissions, restricted managers, assigned investigators, an audit log, task management, related-case detection and one-click investigation reports. But we found no public information on statutory deadline tracking, acknowledgment or feedback clocks, retention and deletion per case, or excluding an implicated handler from their own case — the discipline a regulator will actually ask about. 5 6 7
The SME Operator
The feature list is real — configurable user permissions, a restricted-manager role, audit log, case routing, prioritization and escalation, task management, and one-click investigation reports. But we found no public information on automated statutory clocks such as the 7-day acknowledgment or 3-month feedback, on conflict-of-interest exclusion of implicated handlers, or on retention and deletion rules per case, which is precisely the legal burden I need the product to carry rather than my office. 5 6
The Group Counsel
The feature list shows a real case system — audit log, configurable user permissions, restricted manager roles, case routing, task management, one-click investigation reports and hotspot analytics. I found no public information on statutory acknowledgment or feedback clocks, conflict-of-interest exclusion of implicated handlers, or per-case retention and deletion automation, which is the decisive gap for my group rollout. 5 6 7
The Security Auditor
Configurable permissions, restricted-manager roles, investigator assignment, an audit log, task management and layered analytics with drill-down reporting give the case worker real machinery. I found no public information on statutory deadline clocks (acknowledgment or feedback), conflict-of-interest exclusion of implicated handlers, automated retention or deletion, or tamper-evidence of the case history — the parts of this criterion an EU obligation turns on. 5 6
The Skeptic
The documented feature list includes configurable user permissions, a restricted-manager role, investigator assignment, task management and an audit log, backed by case analytics and one-click investigation reports — real structure, not a shared inbox. I found no public information on statutory deadline clocks and reminders, conflict-of-interest exclusion of implicated handlers, or per-case retention and deletion rules; for a European case worker those duties are the test. 5 6
Legal compliance alignment
Show reasoningHide reasoning
How this is scored
How specifically the product implements EU Directive 2019/1937 and national transpositions (HinSchG et al.) — not whether the marketing mentions them.
0 — Generic feedback software wearing a whistleblowing label; no reference to the legal obligations it claims to satisfy.
3 — The directive is invoked in marketing but the mapping is vague; deadline rules, documentation duties and retention periods are the customer's problem.
5 — The statutory duties are implemented as product features — acknowledgment and feedback clocks, documentation, deletion after the retention period — for at least one national law, with guidance for the rest.
8 — Multiple national transpositions supported with their differing details, legal templates and process guidance maintained by named counsel or documented review, and updates when the law moves.
10 — The product is a legal instrument: per-country rule sets kept current, documented legal review, guidance for edge cases (group-wide channels, external ombudsman setups), and the vendor shows its homework in public.
The Compliance Officer
I found no reference to any statute in the captured pages — not the EU whistleblower directive, not a single national transposition — only marketing language about staying compliant with regulations. The service is built around a North American ethics-hotline model with Canadian agents. As an obligated European company I cannot map even one statutory duty to a product feature from this material. 1 4 5
The Reporter's Advocate
The only legal gesture on the captured pages is that the dashboard helps you stay compliant with regulations; we found no public information on the EU whistleblowing directive, any national transposition, statutory deadlines, documentation duties or retention periods. This reads as generic ethics software, not an implemented legal mapping. 1 5
The SME Operator
The only compliance language we found is a generic "stay compliant with regulations" beside the case management dashboard, and we found no public information mapping the product to the EU whistleblowing directive or its national transpositions — no named statutes, no deadline rules, no legal templates, no counsel. For a company obligated by statute, every duty lands back on my desk. 5
The Group Counsel
The captured pages go no further than a generic promise that the dashboard helps you "stay compliant with regulations"; I found no public information on EU Directive 2019/1937 or any national transposition, and no public information on legal templates or review by named counsel. For a dozen-country rollout this is marketing, not implementation. 1 5
The Security Auditor
The word compliance appears in product names, but I found no public information mapping the product to the EU whistleblowing directive or any national transposition — no deadline rules, documentation duties, retention periods, legal templates or named counsel. The captured pages name regulation only generically ("stay compliant with regulations"), so the legal mapping would be the customer's own work from end to end. 5 6 7
The Skeptic
We found no public information on EU Directive 2019/1937 or any national transposition — the closest the captured pages come is a generic dashboard that helps you "stay compliant with regulations". No named statute, no legal templates, no named counsel, no update commitment: "Compliance Case Management System" is a label until the vendor shows its legal homework. 5 7
Security & anonymity assurance
Show reasoningHide reasoning
How this is scored
Whether the confidentiality promise is engineered and evidenced: encryption, metadata handling, penetration tests, certifications.
0 — Security is a paragraph of adjectives; no certificates, no test reports, no statement on metadata.
3 — TLS and encryption at rest asserted, but nothing audited: no ISO 27001 or equivalent, no published pentest, silence on IP and metadata logging.
5 — A current ISO 27001 (or equivalent) certificate for vendor or hosting, end-to-end encryption of report content claimed with some technical detail, an explicit no-IP-logging statement.
8 — Certified ISMS covering the product, regular third-party penetration tests attested, documented end-to-end encryption architecture, metadata minimization explained, security contact and disclosure policy published.
10 — Assurance a hostile auditor accepts: current certificates with visible scope, recurring pentest summaries public, cryptographic architecture documented, anonymity analysed against the operator itself — the vendor can answer "how would you unmask a reporter?" with "we cannot, and here is why".
The Compliance Officer
ISO 27001 certification with a documented ISMS, Azure hosting under SOC 2 Type II attestations, TLS in transit and AES-256 transparent data encryption with the database even named — that is engineered, not adjectives. But I found no public information on penetration tests, on IP or metadata logging, or on end-to-end encryption of report content, and no security contact or disclosure policy. The confidentiality promise rests on certificates and encryption, not on audited anonymity. 5 7
The Reporter's Advocate
An ISO 27001 certificate for the vendor and Azure hosting covered by SOC 2 Type II are published, and the encryption story is refreshingly concrete: TLS in transit and AES-256 transparent data encryption in an MS SQL Azure database. That is database-level encryption rather than end-to-end protection of report content, and we found no public information on penetration tests, IP or metadata logging, or a disclosure policy. The three anonymity levels are explained clearly to reporters, but we found no public information on any analysis of whether the operator itself could unmask one. 3 5 7
The SME Operator
A stated ISO 27001 certification with an implemented ISMS, plus TLS and AES-256 transparent data encryption on a named Azure database, lifts this above security adjectives. But we found no public information on penetration tests, on end-to-end encryption of report content, or on any statement covering IP and metadata logging — the anonymity promise rests on the certificate alone. 5 7
The Group Counsel
ISO 27001 certification for the vendor and SOC 2 Type II attestation for the Azure hosting are published, and encryption is described with technical detail (TLS in transit, AES-256 transparent data encryption at rest). I found no public information on end-to-end encryption of report content, penetration testing, IP or metadata logging, or a security disclosure policy — and with live human agents answering the hotline by design, who can read report content deserves an answer I did not find. 4 5 7
The Security Auditor
The certifications page asserts ISO 27001 certification and an implemented ISMS, and the infrastructure detail — TLS in transit, AES-256 transparent data encryption in an MS SQL Azure database — is real technical language, though I see no certificate scope, certifying body or validity dates, and the SOC 2 and ISO coverage shown belongs to the Azure hosting, not to this product. I found no public information on penetration tests, end-to-end encryption of report content, IP or metadata logging, or a security contact and disclosure policy; "unquestionable security" on the services page is an adjective I score at zero. 5 7
The Skeptic
"WhistleBlower Security is ISO 27001 certified" is one sentence on the certifications page, and we found no public information on the certificate's scope, issue date or the document itself; the encryption detail is real — TLS in transit and AES-256 transparent data encryption on Azure SQL at rest. That is transport-and-storage protection rather than end-to-end encryption of report content, and we found no public information on penetration tests, IP or metadata logging, or a security contact and disclosure policy. 5 7
Group & multi-entity capability
Show reasoningHide reasoning
How this is scored
Whether one contract can serve a corporate group: separate channels per legal entity, central oversight, ombudsman access, white-labeling.
0 — One company, one channel; a group buys and administers N separate instances.
3 — Multiple channels under one account, but no separation of case access per entity and no consolidated view.
5 — Per-entity channels with separated case handlers and a group-level overview; branding per entity is basic; external counsel access possible.
8 — Real multi-tenant group structure: per-entity channels, languages and branding, delegated administration, external ombudsman roles, group reporting that respects entity boundaries.
10 — Group compliance as architecture: hundreds of entities manageable centrally, per-country legal rule assignment per entity, white-label reporting pages, and access separation strong enough to satisfy each subsidiary's works council.
The Compliance Officer
A subsidiaries configuration lets the reporter choose which legal entity or division a report concerns and feeds report routing, and user permissions are configurable per handler. But I found no public information on entity-separated case access, a group-level consolidated view that respects entity boundaries, delegated administration per entity, or external ombudsman and counsel access. The group capability shown here reads as intake routing rather than multi-tenant architecture. 6 8
The Reporter's Advocate
The setup guidance shows real group awareness: subsidiaries as legal entities or divisions, reporters asked which entity they are reporting about, and routing, dropdowns and naming aligned to the corporate structure and brand. But we found no public information on separated case access per entity, delegated administration, external ombudsman access or a consolidated group view — intake-level entity selection is not the handler separation a subsidiary's works council would demand. 6 8
The SME Operator
The setup sheet lets subsidiaries be listed so reporters select which legal entity or division a report concerns, with report routing following that structure. We found no public information on separated case-handler access per entity, a consolidated group-level view, per-entity branding, delegated administration, or external ombudsman access. 8
The Group Counsel
The setup workbook shows genuine multi-entity intent: subsidiaries configured per legal entity or division, report routing and portal dropdowns shaped to corporate structure, custom hotline numbers, localized scripts, and key contacts who need not be platform users. I found no public information on separated case access per entity, delegated administration, external ombudsman roles, or group reporting that respects entity boundaries — without those, twenty-five subsidiaries would share one lens rather than twenty-five. 5 6 8
The Security Auditor
A subsidiaries configuration lets reporters designate which legal entity a report concerns and drives portal dropdowns and report routing to match the corporate structure, backed by configurable permissions and routing rules. I found no public information on a consolidated group-level view, per-entity branding, delegated administration, or external ombudsman or counsel access. 6 8
The Skeptic
Subsidiaries are handled natively: the pre-launch setup guide configures portal dropdowns and report routing so reporters select the legal entity concerned, with custom hotline numbers and localized scripts per brand. We found no public information on entity-scoped separation of case access, delegated administration per subsidiary, a consolidated group view that respects entity boundaries, or an external ombudsman role. 4 6 8
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where reports about people actually live and under whose law — entity, hosting, subprocessors, DPA. In this category the data is by definition the most sensitive a company holds.
0 — Non-EU entity, non-EU-default hosting, no public DPA or subprocessor list — for whistleblowing data.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad or undocumented.
5 — EU hosting is the default, DPA and subprocessor list published; the vendor or a critical subprocessor is still within non-European jurisdictional reach.
8 — EU entity, EU hosting with named data centers, published subprocessor list free of content-touching non-EU processors, DPA and TOMs public.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors for report content and metadata, on-premises or sovereign-cloud options, and the whole chain documented publicly.
The Compliance Officer
Reports live by default in Canadian Azure data centres — primary and geo-replicated backup both in Canada — in a service run by a Case IQ company with agents in Canada. I found no public information on a European hosting option, a data processing agreement, or a subprocessor list. Nothing in this chain is European, and for the most sensitive data a company holds, that is disqualifying for me. 4 5 7
The Reporter's Advocate
By the vendor's own words, reports live in a primary Canadian Azure data centre geo-replicated to a secondary Canadian one, with all agents likewise in Canada — non-EU residency for the most sensitive data a European company holds, and we found no public information on any EU hosting option. We also found no public information on the vendor's legal-entity jurisdiction beyond its Case IQ parentage, on a data processing agreement, or on a subprocessor list. 4 5 7
The SME Operator
The captured pages state reports are hosted in a primary Canadian Azure data centre with a secondary in Canada, agents sit in Canada, and the vendor is a Case IQ company — nothing European appears anywhere in the chain. We found no public DPA, no subprocessor list, and no public information on an EU hosting option, so the most sensitive data my company holds would sit under Canadian and Microsoft reach. 4 5 7
The Group Counsel
All report data lives by default in a primary Canadian Azure data centre, geo-replicated to a secondary Canadian data centre, with agents also in Canada and Microsoft as the hosting provider — a non-EU chain for the most sensitive data a European group holds. I found no public information on EU hosting options, a published DPA, or a subprocessor list. 4 5 7
The Security Auditor
Every captured statement puts report content and its disaster-recovery replica in Canadian Azure data centres, run by a vendor whose agents are "right here in Canada" and whose parent is Case IQ — for a European buyer this is non-EU hosting and a non-EU vendor by default, on the most sensitive data a company holds. I found no public information on a published DPA, a subprocessor list, or any EU hosting option, which is the floor for this criterion. 4 5 7
The Skeptic
Every captured statement about where reports live points to Canada: a primary Canadian Azure data centre geo-replicated to a secondary one, agents "located right here in Canada", and a vendor under Case IQ ownership. For the most sensitive data a European company holds, that is non-EU hosting by default, and we found no public information on a data processing agreement, a subprocessor list, or any EU hosting option. 4 7
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether an obligated company can compute the real invoice — per entity, per employee band, per year — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — An entry price exists, but the tiers most obligated companies need are unpriced, or the maths is obscured by employee bands, per-report fees or mandatory setup charges.
5 — Most tiers carry real numbers with billing period and VAT treatment stated, but at least one commonly needed capability — extra entities, extra languages, phone intake — hides in an unpriced add-on.
8 — Every tier priced publicly with employee-band boundaries, entity rules and setup fees stated; only genuine corporate-group contracts are custom.
10 — Complete price computability: every tier, band, add-on and renewal rule public, so the invoice for a 60-employee company and a 5-entity group is a two-minute exercise.
The Compliance Officer
The only pricing statement captured is an all-inclusive service at 'a price you can afford' — an invitation to a sales conversation. I found no tier prices, employee bands, billing periods or renewal rules in the captured pages, so a 600-employee company cannot compute even a rough invoice from public material. 4
The Reporter's Advocate
The only pricing statement is an all-inclusive service at a price you can afford, and we found no public information on any figure, tier, employee band, billing period or setup fee. An obligated company cannot compute even a rough invoice from the public pages; every price is a sales conversation. 4
The SME Operator
The only pricing statement captured is "Our all-inclusive service has everything you need at a price you can afford" — not a number, not a tier, not a billing period or renewal rule. As an obligated 60-employee company I cannot compute even the first line of the invoice from public pages, and "all-inclusive" is meaningless without a figure to test it against. 4
The Group Counsel
The only pricing language captured is an "all-inclusive service" at "a price you can afford", with no figures stated on the captured pages; I found no public information on employee bands, entity charges, setup fees or billing period. An obligated company cannot compute any part of its invoice from these pages. 4
The Security Auditor
The only pricing statement captured is an "all-inclusive service" offered "at a price you can afford" — words rather than figures. I found no public information on tier prices, billing periods, VAT treatment, employee bands, per-entity fees or setup charges, so an obligated company cannot compute any part of an invoice from the public pages. 4
The Skeptic
The only pricing statement captured is an "all-inclusive service... at a price you can afford" — an adjective where a number should be. We found no public information on tiers, employee bands, billing period, VAT treatment, setup fees or renewal terms, so no obligated company can compute a real invoice from these pages. 4
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined | — | uncited Report an error |
| Subprocessors | Not determined ⚠ unverified | — | uncited Report an error |
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Sep 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Subprocessors. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 11 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (8)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page www.whistleblowersecurity.com Checked 29 Sep 2026 Details →
- 2 Privacy policy — found from the homepage www.whistleblowersecurity.com Checked 30 Sep 2026 Details →
- 3 Reporting channels & reporter experience — found from sitemap help.whistleblowersecurity.com Checked 1 Oct 2026 Details →
- 4 Reporting channels & reporter experience — found from sitemap www.whistleblowersecurity.com Checked 1 Oct 2026 Details →
- 5 Case management & deadline discipline — found from sitemap www.whistleblowersecurity.com Checked 1 Oct 2026 Details →
- 6 Case management & deadline discipline — found from sitemap www.whistleblowersecurity.com Checked 1 Oct 2026 Details →
- 7 Security & anonymity assurance — found from sitemap www.whistleblowersecurity.com Checked 1 Oct 2026 Details →
- 8 Group & multi-entity capability — found from sitemap help.whistleblowersecurity.com Checked 1 Oct 2026 Details →