# Vispato — Whistleblowing Portals

Vispato by Vispato GmbH holds a panel rating of 1.5/5 from 6 AI judges (category median 2/5), as of 2026-10-15. Provenance: EU-Made; sovereignty: not determined.

- Vendor: Vispato GmbH (https://www.vispato.com)
- Category: [Whistleblowing Portals](https://whats-best.ai/software/whistleblowing.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/whistleblowing/vispato
- Alternatives: https://whats-best.ai/software/whistleblowing/vispato/alternatives ([markdown](https://whats-best.ai/software/whistleblowing/vispato/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-15 · oldest source captured 2026-10-13

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Vispato GmbH
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 13 Oct 2026

## The panel's verdict

Vispato is a German whistleblowing system from Vispato GmbH of Düsseldorf, acquired in April 2025 by HRworks GmbH of Freiburg, with support handled by HR WORKS. Its strongest area is case management, scoring 4-5: cases run end to end with communication, documentation and deadline tracking on one platform, backed by role-based permissions, need-to-know access, logged inputs and logins, and trend reporting. Its weakest is compliance alignment, 2 with no spread: the captured pages name no statute — neither the EU Whistleblower Directive nor a German transposition — leaving the legal mapping to the buyer. Judges genuinely split elsewhere. Sovereignty spans 2-4, split between crediting the acquirer's statement that all data is safe in the European Union and weighing that the vendor's own captured pages leave residency unconfirmed, with no public information on a data processing agreement or subprocessor list. Reporting channels, security assurance and multi-entity scale each spread 3-4, splitting over how far an anonymity promise, asserted encryption and portals-plus-permissions carry without documented mechanisms, certificates or group structure. We found no public information on pricing.

**Speaks for it:**
- Cases are handled end to end with communication, documentation and deadline tracking on one platform
- Role-based permissions, need-to-know access and logged inputs and logins are stated on the captured pages
- End-to-end encryption, encryption on all servers, two-factor authentication, regular backups and regular security tests are asserted
- One or more submission portals are provided, with standard or custom categories and the customer's choice of how many contact persons, under a promise of highest anonymity for reporters
- Reports, settings and user accounts are stated to remain fully preserved, with the system continuing without interruption through the acquisition

**Held against it:**
- The captured pages name no statute — neither the EU Whistleblower Directive nor a German transposition — leaving the mapping from feature to legal duty to the buyer (compliance alignment scored 2 with no spread)
- We found no public information on automated statutory clocks, exclusion of implicated case handlers, tamper-evident case history, or per-case retention and deletion rules
- We found no public information on ISO 27001 or equivalent certification, third-party penetration-test attestations, or how IP addresses and metadata are handled
- We found no public information on per-entity case separation, a consolidated group view, or external ombudsman and counsel access
- The EU data statement sits on the acquiring company's security page rather than the vendor's own, and we found no public information on a data processing agreement or subprocessor list

**Best for:**
- You are a single-entity, German-speaking organization that wants cases handled end to end — communication, documentation and deadline tracking on one platform — and can supply the statutory mapping through your own counsel
- You want to collect reports from all or selected stakeholders through one or more submission portals, with your own categories and your own choice of contact persons
- You place weight on the acquiring company's statement that all data is safe in the European Union and will ask the vendor for a data processing agreement and subprocessor list before signing

**Avoid if:**
- You need statutory acknowledgment and feedback clocks wired to the EU Whistleblower Directive or a German transposition — compliance alignment scored 2 with no spread and the deadline feature is described generically
- Your group spans several legal entities and needs per-entity case separation and a consolidated group view — multi-entity scale spread 3-4 and we found no public information on either capability
- Your reporters must be reachable for follow-up questions through a protected anonymous channel — reporting channels spread 3-4 and we found no public information on a two-way anonymous mailbox, phone intake or language coverage

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The Compliance Officer | The Reporter's Advocate | The SME Operator | The Group Counsel | The Security Auditor | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Reporting channels & reporter experience | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 2/5 |
| Case management & deadline discipline | 2/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 | 2.5/5 |
| Legal compliance alignment | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 | 1/5 |
| Security & anonymity assurance | 2/5 | 2/5 | 2/5 | 1.5/5 | 1.5/5 | 2/5 |
| Group & multi-entity capability | 1.5/5 | 2/5 | 1.5/5 | 1.5/5 | 2/5 | 2/5 |
| European sovereignty | 2/5 | 1.5/5 | 1/5 | 2/5 | 2/5 | 1.5/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **1.5/5** | **1.5/5** | **1.5/5** | **1.5/5** | **2/5** | **2/5** |

### The judges

- **The Compliance Officer** (v1.0): Runs the internal reporting office of a 600-employee company and answers for every missed statutory clock. Optimizes for case discipline: automated acknowledgment and feedback deadlines, role separation, documentation that survives a regulator. Rejects inbox-with-a-form products that make the deadlines her problem.
- **The Reporter's Advocate** (v1.0): Judges from the frightened side of the form. Optimizes for anonymity that survives contact, a two-way dialog without an account, languages the workforce actually speaks, and channels that work on a night-shift phone. Rejects login walls, app installs and anything that makes reporting feel like a deposition.
- **The SME Operator** (v1.2): Runs a 60-employee company that the law obligated, not convinced. Optimizes for compliance set up in an afternoon at a price the year-end review will not question, with the legal duties handled by the product. Rejects per-report fees, setup charges and anything that needs a compliance department to operate.
- **The Group Counsel** (v1.0): Rolls one system out to 25 subsidiaries in a dozen countries. Optimizes for per-entity channels with real access separation, per-country legal rule sets, external ombudsman roles and group reporting that respects entity boundaries. Rejects one-channel products multiplied by twenty-five contracts.
- **The Security Auditor** (v1.0): Pentests the anonymity promise for a living. Optimizes for evidenced security: current certificates with visible scope, published pentests, documented end-to-end encryption, metadata minimization, and hosting outside hostile jurisdictional reach. Rejects adjective security and "military-grade" anything.
- **The Skeptic** (v1.2): Assumes "audit-proof" and "100% anonymous" are marketing until the evidence says otherwise. Hunts certification claims without certificates, anonymity claims next to analytics scripts, per-report pricing traps and legal-update promises with no named lawyer. Exists to keep the rest of the bench honest.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- AVV tom available: yes [S2]
- Bitkom audit: vollständige DSGVO-Konformität · Bitkom Consult [S2]
- Dataguard partnership: DataGuard · Datenschutzexpertise [S2]
- Dora addendum: DORA-Ergänzungsvereinbarung · yes [S2]
- Employee training: yes [S2]
- Encryption GDPR: yes · Deutschland/EU · yes [S1]
- ISO 27001: DIN ISO/IEC 27001 [S2]

**Hosting**
- EU server location: Alle Daten sind sicher in der Europäischen Union. [S2]

**Legal**
- Entity: HRworks GmbH [S1]
- Entity: HRworks GmbH [S2]
- German jurisdiction: Deutschland · yes [S2]
- Merger: Die Vispato GmbH wurde mit der HRworks GmbH verschmolzen. [S1]

**Product**
- Anonymity: yes [S1]
- Audit logging: Protokollierte Eingaben und Anmeldungen [S2]
- Case management: yes · yes · yes [S1]
- Categories: yes · yes [S1]
- Data leak prevention: yes · yes · yes [S1]
- Data preserved: yes [S1]
- Encryption all servers: yes [S2]
- Need to know access: yes [S2]
- Overview: whistleblowing system for receiving reports from all or selected stakeholders [S1]
- Portals: yes [S1]
- Privacy mode service requests: yes [S2]
- Regular backups: yes [S2]
- Regular security tests: yes [S2]
- Reporting: yes [S1]
- Role based permissions: yes [S2]
- System continuity: yes [S1]
- Two factor auth: yes [S2]
- Whistleblowing software: yes [S2]

**Support**
- Channel: https://www.hrworks.de/dienstleistungen/support/ · HR WORKS [S1]

## Questions

### Is Vispato European?

Yes. whats-best.ai classifies Vispato as EU-Made.

### Where does Vispato store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does Vispato have a free plan?

Not stated on the vendor’s pages as of 13 Oct 2026.

### What are the best alternatives to Vispato?

As of 21 Oct 2026, the panel rates [preeco | hinweisgeberschutz (3.5/5)](https://whats-best.ai/software/whistleblowing/preeco-hinweisgeber), [EQS Integrity Line (3.5/5)](https://whats-best.ai/software/whistleblowing/eqs-integrity-line) and [Safecall (3.5/5)](https://whats-best.ai/software/whistleblowing/safecall) highest among the other 36 Whistleblowing Portals products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [preeco | hinweisgeberschutz](https://whats-best.ai/software/whistleblowing/preeco-hinweisgeber) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Vispato alternatives](https://whats-best.ai/software/whistleblowing/vispato/alternatives).

## What this page leaves out

- We found no public information on pricing on the pages we read (vispato.com, hrworks.de/unternehmen/sicherheit-bei-hr-works). If the vendor publishes it somewhere else, send us the page.
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://www.vispato.com/ (checked 2026-10-13)
- [S2] Security / trust page: https://www.hrworks.de/unternehmen/sicherheit-bei-hr-works/ (checked 2026-10-13)

---

Cite as: whats-best.ai, "Vispato — Whistleblowing Portals", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/whistleblowing/vispato

Corrections: https://whats-best.ai/correct/519?target=page