Whistleblowing Portals
SwissGRC Whistleblowing
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by SwissGRC AG · swissgrc.com
Report an error on this page Is this your product? →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
SwissGRC AG presents an integrated GRC platform covering risk, compliance, security and processes across twelve modules, and the bench's scores mirror that breadth: strong on vendor assurance, thin on anything specific to whistleblowing. Security assurance is the standout at a flat 4, resting on the vendor's claimed ISO 27001, 27017 and 27701 certifications, though we found no public information on the certificates' scope. Reporting channels, compliance alignment and multi-entity scale all sit at 0 to 1: we found no public information on how a reporter would submit anything, on statutory clocks, on any mapping to EU Directive 2019/1937 or the HinSchG, or on per-entity channels and separated case access for groups. Case management spreads 0 to 2 — the risk register's measures with owners and deadlines were read by some as a workflow skeleton, by others as risk bookkeeping. Sovereignty splits 2 to 4: the on-premise deployment option earns credit as a real lever, while we found no public information on a data processing agreement, subprocessor list or named data centers. We found no public prices; a free trial is offered.
Speaks for it
- Security assurance holds a flat 4, resting on the vendor's claimed ISO 27001, 27017 and 27701 certifications.
- Cloud or on-premise deployment is offered, with unlimited users per module.
- The vendor is a Swiss legal entity with Swiss-made positioning and regional server locations.
- The configurable, web-based platform tracks measures with owners and deadlines, which some judges read as a workable follow-up skeleton.
- A free trial is offered, and support typically responds within one working day.
Held against it
- We found no public information on reporter-facing intake, anonymous two-way dialog, phone entry or language coverage.
- We found no public information on statutory acknowledgment or feedback clocks, role separation or tamper-evident case history.
- We found no public information tying the product to EU Directive 2019/1937 or any national transposition such as the German HinSchG.
- We found no public information on a data processing agreement, a subprocessor list or named data centers.
- We found no public information on per-entity channels, separated case access per legal entity or delegated administration for groups.
Best for
- You must keep whistleblowing data on your own infrastructure — the on-premise deployment option is documented.
- Your procurement screens for certified vendors — the claimed ISO 27001, 27017 and 27701 certifications carry the bench's strongest scores.
- You want a broad GRC platform first and would add whistleblowing as one module, testing it through the free trial.
- You operate as a single legal entity, where the undocumented group structure matters less.
Avoid if
- You need to see the reporter's intake journey — anonymity, follow-up dialog, languages — before a sales call.
- You must have statutory duties such as acknowledgment and feedback deadlines handled by the product itself.
- You must demonstrate a mapping to EU Directive 2019/1937 or a national transposition out of the box.
- You are rolling out across a group of subsidiaries and need per-entity channels and separated case access.
The scores
Reporting channels & reporter experience
Show reasoningHide reasoning
How this is scored
The intake side: how a reporter actually submits — web form, anonymous dialog, phone/voice, languages, accessibility — and whether anonymity survives first contact.
0 — A web form that is an email in disguise: no anonymous route, no way to reach the reporter afterwards.
3 — An anonymous form exists but the dialogue ends there — no secured mailbox for follow-up questions, few languages, desktop-only.
5 — Anonymous two-way dialog via a protected mailbox, a usable set of languages, mobile-friendly; voice or phone intake missing or an add-on.
8 — Multiple channels (web, voice message or hotline, QR entry points), broad language coverage with translation support, accessibility considered, and the anonymous dialog is first-class rather than bolted on.
10 — Intake engineered around the frightened reporter: every channel anonymous-capable, dozens of languages, WCAG-conscious, no app install or account required, and the vendor documents how the reporter's identity is kept out of the channel itself.
The Compliance Officer
I found no public information on how a reporter would submit a report — no intake form, anonymous dialog, phone line, language coverage or accessibility is shown in the captured material. For the most sensitive intake a company runs, I score that silence at the floor: at best a form whose anonymity and follow-up path are undemonstrated. 1
The Reporter's Advocate
Everything captured concerns the GRC platform — risk registers, module lists, an AI assistant — and we found no public information on an intake channel, an anonymous two-way dialog, languages, or phone entry for a whistleblower. A web-based, configurable platform implies a browser can reach something, but nothing captured shows a reporter's anonymity surviving first contact, a secured follow-up dialog, or a channel that works on a night-shift phone. 1
The SME Operator
The captured page presents an integrated GRC platform with risk, compliance and process modules, and we found no public information on how a reporter actually submits a report, whether anonymity survives first contact, or which channels and languages are offered. For an obligated 60-person company, the entire intake side would have to be taken on faith before a sales call. 1
The Group Counsel
I found no public information on how a report is actually submitted — nothing on anonymous intake, a secured two-way mailbox, phone or voice channels, languages, or accessibility. For a group of twenty-five subsidiaries, an intake channel that is not documented is an intake channel I cannot buy. 1
The Security Auditor
The captured pages market an integrated GRC platform; we found no public information on an anonymous submission form, a two-way protected mailbox, voice intake, or language coverage for reporters. A buyer cannot judge from this capture whether a reporter's identity even survives first contact. 1
The Skeptic
We found no public information on how a reporter would actually submit anything — no anonymous intake, no protected two-way dialog, no phone or hotline entry, no languages, no accessibility statement. The captured page names twelve GRC modules and never names a whistleblowing module, so even the existence of a reporter-facing channel rests on nothing but the category label. 1
Case management & deadline discipline
Show reasoningHide reasoning
How this is scored
The case worker's side: triage, statutory deadlines (7-day acknowledgment, 3-month feedback), role separation, audit-proof documentation.
0 — Reports land in an inbox; deadlines, roles and history live in a spreadsheet next door.
3 — A case list with status fields, but deadlines are manual, permissions are all-or-nothing, and the record of who did what is thin.
5 — Deadline tracking with reminders for the statutory clocks, case notes and attachments, basic role separation between case handlers; reporting on the caseload is limited.
8 — Automated statutory clocks, conflict-of-interest handling (excluding implicated case handlers), complete tamper-evident case history, retention and deletion rules applied per case, and management reporting.
10 — A case system an external investigator can rely on: enforced workflows, full audit trail, legally aware retention/deletion automation, evidence handling, and statistics that survive a regulator's questions.
The Compliance Officer
Nothing in the captured pages evidences case handling for whistleblowing reports — no statutory acknowledgment or feedback clocks, no role separation, no audit trail. The only deadline feature visible belongs to risk measures with owners and deadlines in the risk register, which is not a case file that survives a regulator. 1
The Reporter's Advocate
The platform tracks measures with owners and deadlines and is configurable rather than programmed, which is a workflow skeleton a case process could be built on. But we found no public information on statutory acknowledgment and feedback clocks, conflict-of-interest handling for implicated handlers, tamper-evident case history, or retention and deletion per case — the parts that make a record an investigator can rely on. 1
The SME Operator
The risk machinery shows measures with owners and deadlines on a configurable, web-based platform with unlimited users per module, which hints at workable follow-up workflows. But we found no public information on statutory clocks, case-handler role separation, or an audit-proof case history for whistleblowing reports — and I specifically need the seven-day and three-month duties handled by the product, not by my office. 1
The Group Counsel
The only deadline machinery on the captured page attaches to risk measures — owners and deadlines in a central risk register — not to whistleblower case files; I found no public information on acknowledgment or feedback clocks, role separation between case handlers, conflict-of-interest exclusion, or a tamper-evident case history. Generic GRC tracking is not case management. 1
The Security Auditor
The closest evidence is generic: measures with owners and deadlines inside a central risk register, which is risk bookkeeping rather than whistleblower case handling. We found no public information on statutory acknowledgment or feedback clocks, role separation, or a tamper-evident case history. 1
The Skeptic
Nothing in the captured material describes case handling for reports: we found no public information on statutory acknowledgment or feedback clocks, role separation, conflict-of-interest handling, or tamper-evident case history. The only deadline feature on show is measures with owners and deadlines inside a risk register, which is risk work, not whistleblower case work. 1
Legal compliance alignment
Show reasoningHide reasoning
How this is scored
How specifically the product implements EU Directive 2019/1937 and national transpositions (HinSchG et al.) — not whether the marketing mentions them.
0 — Generic feedback software wearing a whistleblowing label; no reference to the legal obligations it claims to satisfy.
3 — The directive is invoked in marketing but the mapping is vague; deadline rules, documentation duties and retention periods are the customer's problem.
5 — The statutory duties are implemented as product features — acknowledgment and feedback clocks, documentation, deletion after the retention period — for at least one national law, with guidance for the rest.
8 — Multiple national transpositions supported with their differing details, legal templates and process guidance maintained by named counsel or documented review, and updates when the law moves.
10 — The product is a legal instrument: per-country rule sets kept current, documented legal review, guidance for edge cases (group-wide channels, external ombudsman setups), and the vendor shows its homework in public.
The Compliance Officer
The captured material names general compliance and data privacy modules on a configurable platform, but I found no public information connecting the product to the EU whistleblowing directive or any national transposition — no acknowledgment clock, feedback duty or retention rule appears as a feature. A GRC label is not a legal implementation. 1
The Reporter's Advocate
The module list offers generic compliance and data-protection modules and the vendor holds an ISO 27701 privacy certification, but the captured pages never name EU Directive 2019/1937, the HinSchG, or any whistleblowing duty. We found no public information on legal templates, per-country rule sets, or documented review by named counsel. A compliance suite that never mentions the law the report exists under is not alignment. 1
The SME Operator
A compliance module and a data privacy module appear in the module list, but we found no public information referencing EU Directive 2019/1937, the HinSchG, or any national transposition mapped to product features such as acknowledgment or feedback deadlines. As far as the captured page shows, this is generic GRC software rather than a legal instrument for whistleblowing duties. 1
The Group Counsel
A compliance module and a privacy module exist on the platform, but I found no public reference to EU Directive 2019/1937, the German HinSchG, or any other national transposition, and nothing on per-country rule sets or documented legal review. Marketing-adjacent compliance modules do not implement a whistleblower statute. 1
The Security Auditor
We found no public information referencing the EU whistleblowing directive or any national transposition such as the German HinSchG; the compliance story in the capture is a module name, a data protection module, and three ISO certificates. With no documented mapping of statutory duties to product features, an obligated company cannot verify the law is implemented here. 1
The Skeptic
We found no public information tying the product to EU Directive 2019/1937 or any national transposition — no clocks, no documentation duties, no retention rules, no legal templates, no named counsel. Generic compliance and data-privacy modules are named, but that is a GRC label, not a mapping to whistleblower law. 1
Security & anonymity assurance
Show reasoningHide reasoning
How this is scored
Whether the confidentiality promise is engineered and evidenced: encryption, metadata handling, penetration tests, certifications.
0 — Security is a paragraph of adjectives; no certificates, no test reports, no statement on metadata.
3 — TLS and encryption at rest asserted, but nothing audited: no ISO 27001 or equivalent, no published pentest, silence on IP and metadata logging.
5 — A current ISO 27001 (or equivalent) certificate for vendor or hosting, end-to-end encryption of report content claimed with some technical detail, an explicit no-IP-logging statement.
8 — Certified ISMS covering the product, regular third-party penetration tests attested, documented end-to-end encryption architecture, metadata minimization explained, security contact and disclosure policy published.
10 — Assurance a hostile auditor accepts: current certificates with visible scope, recurring pentest summaries public, cryptographic architecture documented, anonymity analysed against the operator itself — the vendor can answer "how would you unmask a reporter?" with "we cannot, and here is why".
The Compliance Officer
The vendor asserts triple ISO certification — 27001, 27017 and 27701 — which is more than a paragraph of adjectives, but I found no public information on certificate scope, penetration tests, encryption of report content, or IP and metadata logging. Certificates without scope or technical detail still leave the confidentiality promise unevidenced. 1
The Reporter's Advocate
Three ISO certificates are claimed — 27001, 27017 and 27701 — which is more assurance paperwork than most, and on-premise operation is offered as an alternative to cloud. But we found no public information on encryption of report content, penetration tests, IP and metadata logging, or the stated certificate scope covering this product. Certificates alone do not answer the only question that matters to a reporter: how their identity is kept out of the channel. 1
The SME Operator
Triple ISO certification (27001, 27017, 27701) is claimed, which is more than many competitors show, but we found no public information on encryption of report content, metadata or IP logging, penetration testing, or the certificates' scope. The confidentiality promise for reporters is asserted through certificates, not visibly engineered for the whistleblowing data itself. 1
The Group Counsel
Triple ISO certification (27001, 27017, 27701) evidences a certified information security management system rather than a paragraph of adjectives, which earns real credit. But the certificate scope is not shown, and I found no public information on penetration tests, end-to-end encryption of report content, or metadata and IP-logging handling — the pieces that make an anonymity promise auditable. 1
The Security Auditor
Three ISO certifications — 27001, 27017 and 27701 — are claimed for the vendor, which beats adjective security, but we found no public information on the certificates' scope, dates or issuing auditor, nor on penetration tests, a security contact or a disclosure policy. We also found no public information on end-to-end encryption of report content, metadata minimization, or IP logging — precisely the parts that decide whether anonymity is engineered or merely asserted. 1
The Skeptic
Triple ISO certification — 27001, 27017, 27701 — is claimed, which is more than bare adjectives, but the capture shows no certificate numbers, issuer, or scope, so until a certificate is visible I treat it as a claim. We found no public information on encryption of report content, IP or metadata logging, penetration tests, or how a reporter's identity would be kept out of the system. 1
Group & multi-entity capability
Show reasoningHide reasoning
How this is scored
Whether one contract can serve a corporate group: separate channels per legal entity, central oversight, ombudsman access, white-labeling.
0 — One company, one channel; a group buys and administers N separate instances.
3 — Multiple channels under one account, but no separation of case access per entity and no consolidated view.
5 — Per-entity channels with separated case handlers and a group-level overview; branding per entity is basic; external counsel access possible.
8 — Real multi-tenant group structure: per-entity channels, languages and branding, delegated administration, external ombudsman roles, group reporting that respects entity boundaries.
10 — Group compliance as architecture: hundreds of entities manageable centrally, per-country legal rule assignment per entity, white-label reporting pages, and access separation strong enough to satisfy each subsidiary's works council.
The Compliance Officer
I found no public information on channels per legal entity, separated case access per entity, group-level oversight or ombudsman and external counsel roles. Unlimited users per module speaks to seats, not to the group architecture a multi-entity deployment needs. 1
The Reporter's Advocate
Unlimited users per module on one integrated enterprise platform is evidenced, but we found no public information on separate channels per legal entity, separated case access per subsidiary, group-level oversight, per-entity branding, or ombudsman access. For a corporate group, nothing captured shows whether one contract yields one structure or N separate administrations. 1
The SME Operator
Unlimited users per module and a modular platform are stated, but we found no public information on separate channels per legal entity, separated case-handler access, group-level reporting, or external ombudsman roles. A single-company buyer like me is less affected, but a group cannot judge this capability from what is public. 1
The Group Counsel
The platform is presented as one configurable, web-based suite with unlimited users per module and regional server locations, but I found no public information on per-entity channels, separated case access per legal entity, delegated administration, external ombudsman roles, or group reporting that respects entity boundaries. That is the entire question for my rollout, and on this evidence it is unanswered. 1
The Security Auditor
The platform is configurable, web-based, licensed with unlimited users per module, and runs in cloud or on-premise, but we found no public information on separate channels per legal entity, delegated administration, external ombudsman access, or a group-level consolidated view. A corporate group has nothing in this capture to judge entity-level access separation. 1
The Skeptic
We found no public information on per-entity channels, separated case access per entity, delegated administration, ombudsman roles, or white-labeling. 'Unlimited users per module' speaks to seats, not legal entities, and nothing in the capture evidences any group structure at all. 1
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where reports about people actually live and under whose law — entity, hosting, subprocessors, DPA. In this category the data is by definition the most sensitive a company holds.
0 — Non-EU entity, non-EU-default hosting, no public DPA or subprocessor list — for whistleblowing data.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad or undocumented.
5 — EU hosting is the default, DPA and subprocessor list published; the vendor or a critical subprocessor is still within non-European jurisdictional reach.
8 — EU entity, EU hosting with named data centers, published subprocessor list free of content-touching non-EU processors, DPA and TOMs public.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors for report content and metadata, on-premises or sovereign-cloud options, and the whole chain documented publicly.
The Compliance Officer
A Swiss legal entity with Swiss-made positioning, an on-premise deployment option and asserted regional server locations give a European footing for report content. But I found no public information on named data centers, a data processing agreement, or the subprocessor list — and for this data category the chain has to be documented, not implied. 1
The Reporter's Advocate
A Swiss legal entity, a Swiss-made claim, regional server locations and an on-premise deployment option are real signals that the most sensitive data a company holds can stay in the customer's own environment. But we found no public information on a published data processing agreement, a subprocessor list, or named data centers for the cloud path. The on-premise route is the only documented escape from an undocumented chain. 1
The SME Operator
The vendor is a Swiss entity advertising Swiss-made software with regional server locations and a cloud or on-premise deployment choice, which keeps the data in Europe and offers an on-premise route. But we found no public information on a data processing agreement, a subprocessor list, or named data centers, so the chain of custody for the most sensitive reports is undocumented. 1
The Group Counsel
A Swiss legal entity, 'Swiss made' positioning, regional server locations and an on-premise deployment option place the data chain in Europe and outside US reach, which is a genuine start. But I found no public DPA, no subprocessor list and no named data centers, so for the most sensitive data a company holds the chain is asserted rather than documented. 1
The Security Auditor
The operator is a Swiss entity with "Swiss made" positioning, regional server locations and an on-premise option — a reasonable jurisdictional posture for the most sensitive data a company holds. But we found no public information naming the data centers, a published data processing agreement, or a subprocessor list, so the chain carrying report content and metadata is undocumented. 1
The Skeptic
The vendor is a Swiss company marketing 'Swiss made' with regional server locations and a choice of cloud or on-premise — the on-premise option is a genuine sovereignty lever. But 'regional server locations' names no data centers, and we found no public information on a DPA, a subprocessor list, or TOMs, so the jurisdictional chain is asserted, not documented. 1
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether an obligated company can compute the real invoice — per entity, per employee band, per year — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — An entry price exists, but the tiers most obligated companies need are unpriced, or the maths is obscured by employee bands, per-report fees or mandatory setup charges.
5 — Most tiers carry real numbers with billing period and VAT treatment stated, but at least one commonly needed capability — extra entities, extra languages, phone intake — hides in an unpriced add-on.
8 — Every tier priced publicly with employee-band boundaries, entity rules and setup fees stated; only genuine corporate-group contracts are custom.
10 — Complete price computability: every tier, band, add-on and renewal rule public, so the invoice for a 60-employee company and a 5-entity group is a two-minute exercise.
The Compliance Officer
No price is shown in the captured material — a customer quote praising transparent pricing and a free trial are not numbers. An obligated company cannot compute any part of its invoice, let alone a multi-module GRC bill, from what is public. 1
The Reporter's Advocate
The only pricing fact is a customer quote praising "transparenter Preisgestaltung" — with no actual prices stated on the captured page — alongside a free trial offer. No tier, employee band, entity rule or setup fee carries a number anywhere in the evidence. An obligated company cannot compute even a first estimate of the invoice from what is public. 1
The SME Operator
No actual prices appear anywhere; the only pricing statement is a customer quote praising 'transparenter Preisgestaltung', alongside a free trial. An obligated company cannot compute a yearly invoice from this — every tier starts as a sales conversation, which is exactly what my year-end review would question. 1
The Group Counsel
The captured page carries a customer quote praising 'transparenter Preisgestaltung'; no figures for any tier, module, employee band or setup charge appear on it — only an offer to test the software free of charge. No obligated company can compute even a starting invoice from public pages. 1
The Security Auditor
The only pricing evidence is a customer quote praising transparent pricing with no figures attached, alongside a free trial offer. We found no public prices, tiers, employee bands or setup fees, so no obligated company can compute an invoice from these pages. 1
The Skeptic
The only pricing reference in the capture is a customer quote praising 'transparenter Preisgestaltung' — praise is not a price, and this is exactly the move I exist to flag. We found no public numbers for any tier, module, band, entity rule, or setup fee; the only concrete offer is a free trial. 1
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | Not determined ⚠ unverified | — | uncited Report an error |
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 22 Sep 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data residency, Subprocessors, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (swissgrc.com, swissgrc.com/impressum, swissgrc.com/compliance-software, swissgrc.com/iso-27001-zertifiziert-warum-das-allein-heute-nicht-mehr-ausreicht, swissgrc.com/success_story/informationssicherheit-mit-system-helvetias-weg-zum-konzernweiten-isms). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
- 6 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (5)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page swissgrc.com Checked 22 Sep 2026 Details →
- 2 Imprint — found from the homepage swissgrc.com Checked 30 Sep 2026 Details →
- 3 Legal compliance alignment — found from sitemap swissgrc.com Checked 1 Oct 2026 Details →
- 4 Security & anonymity assurance — found from sitemap swissgrc.com Checked 1 Oct 2026 Details →
- 5 Group & multi-entity capability — found from sitemap swissgrc.com Checked 1 Oct 2026 Details →