Whistleblowing Portals
Visslan
Provenance unknown Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Visslan AB · www.visslan.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Visslan at a glance
- Vendor
- Visslan AB
- Headquarters
- Not stated on the vendor’s pages as of 3 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 3 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 3 Nov 2026
- Panel verdict
- The AI panel rates Visslan 1/5, the mean of 6 judges. Visslan is a whistleblowing portal from Visslan AB, a Swedish company with org.nr 559327-2999 at Norrgatan 10, 43241 Varberg. how scores are made
- As of
- Vendor pages captured 3 Nov 2026; evaluated by the panel 4 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Visslan is a whistleblowing portal from Visslan AB, a Swedish company with org.nr 559327-2999 at Norrgatan 10, 43241 Varberg. Its strongest criterion is reporting channels at 4, range 4 to 4: the vendor states that reporter identities are secured and a two-way follow-up conversation is possible, with supporting files supplied securely at the handler's request; we found no public information on languages, phone or voice intake, or accessibility. Its weakest are multi-entity scale, scored 0 to 0, and pricing transparency, scored 0 to 1, where the only public terms are a 14-day free trial and a free consultation. The judges split on compliance alignment, scores 0 and 2: those at 2 credited its presentation as a whistleblowing system within the obligation domain; those at 0 found no public information naming the EU whistleblowing directive or any national transposition. Case management ranges 0 to 3, clustering at 2; security assurance sits at 2, a promise without documented architecture; sovereignty ranges 1 to 2, with the Swedish contracting entity proven and hosting, subprocessors and a data processing agreement unstated.
Speaks for it
- Anonymous reporting with a two-way follow-up conversation is stated on the vendor's own pages.
- Supporting files can be supplied securely when the person handling the report requests them.
- The contracting entity is a documented Swedish company: Visslan AB, org.nr 559327-2999, Norrgatan 10, 43241 Varberg.
- A 14-day free trial and a free consultation are offered.
- The vendor states the system can be up and running in under 120 minutes.
Held against it
- We found no public information on tier prices, billing period, employee bands, add-ons or setup fees.
- We found no public information on per-entity channels, group-level oversight or ombudsman access.
- Security assurance scored 2 — a confidentiality promise with no public information on encryption, penetration tests or certifications.
- We found no public information naming the EU whistleblowing directive or any national transposition.
- We found no public information on deadline tracking, handler roles and permissions, retention or deletion.
Best for
- You need a single-company whistleblowing channel with anonymous two-way dialogue and secure file upload.
- You want to evaluate before committing and are comfortable getting pricing through a consultation after the 14-day free trial.
- You prefer an EU-based contracting entity and will ask the vendor about hosting location, subprocessors and the data processing agreement during procurement.
Avoid if
- You need a group rollout with separate channels per legal entity — multi-entity scale scored 0 to 0.
- You must compute your invoice from published prices — pricing transparency scored 0 to 1, with only a free trial and consultation public.
- You need written mapping of product features to the EU whistleblowing directive or a named national transposition — compliance alignment split 0 and 2.
- You need documented encryption, certifications or penetration-test results — security assurance scored 2 on a confidentiality promise alone.
The scores
| Criterion | Panel median |
|---|---|
| Reporting channels & reporter experience | 2 of 5 |
| Case management & deadline discipline | 1 of 5 |
| Legal compliance alignment | 1 of 5 |
| Security & anonymity assurance | 1 of 5 |
| European sovereignty | 1 of 5 |
| Pricing transparency | 0.5 of 5 |
Reporting channels & reporter experience
Show reasoningHide reasoning
How this is scored
The intake side: how a reporter actually submits — web form, anonymous dialogue, phone or voice message, languages, accessibility — and whether anonymity survives first contact.
0 — Not a reporting channel; a general contact or survey form with no anonymous route and no way to reach the reporter afterwards.
3 — A web form that accepts anonymous reports, with a case number or access code the reporter can use to check the report later.
5 — Anonymous two-way dialogue through a protected mailbox or access code, the reporting page in several languages, and use on mobile devices without an app or account.
8 — Several channels (web, voice message or phone hotline, in-person meeting requests, QR or intranet entry points), broad language coverage with translation of messages, accessibility addressed, and voice distortion or another anonymity measure for spoken reports.
10 — Intake engineered around the frightened reporter: every channel usable anonymously, dozens of languages, WCAG conformance stated, no app or account required, and the vendor documents how the reporter's identity is kept out of the channel itself.
The Compliance Officer
Anonymous reporting is stated, with the reporter's identity secured and a two-way follow-up conversation possible, and supporting files can be supplied securely at the handler's request. We found no public information on language coverage, mobile use without an app, voice or phone channels, or accessibility measures, so this sits between a basic anonymous web intake and a multi-channel setup. 2
The Reporter's Advocate
The vendor promises the software 'säkrar visselblåsarnas identiteter och möjliggör en tvåvägs uppföljningskonversation' — anonymous identities with a two-way follow-up conversation, which is the lifeline a frightened reporter actually needs. What we do not see is how the reporter returns to that conversation: no access code or case number is documented, and we found no public information on languages, mobile use, or any phone or voice channel. 2
The SME Operator
The vendor's page states the software secures reporter identities and enables a two-way follow-up conversation, which is anonymous dialogue with the reporter. We found no public information on languages, mobile use, or additional channels such as phone or voice. 2
The Group Counsel
The vendor's own words commit to a system that secures reporter identities and carries a two-way follow-up conversation, with supporting files supplied securely at the handler's request — an anonymous dialogue rather than a one-way form. We found no public information on language coverage, phone or voice intake, accessibility, or mobile use without an app or account, so I cannot place the reporter experience above that. 2
The Security Auditor
The vendor states that reporter identities are secured and that a two-way follow-up conversation with the reporter is possible, plus secure upload of supporting files — an anonymous dialogue, not a one-way form. We found no public information on channel types beyond that, languages, accessibility, or voice intake. 2
The Skeptic
The captured page states the software "secures reporter identities and enables a two-way follow-up conversation" — anonymous two-way dialogue is the one thing actually documented. We found no public information on additional intake channels such as phone or voice, language coverage, accessibility, or how the channel itself keeps the reporter's identity out of the system. 2
Case management & deadline discipline
n/r
Show reasoningHide reasoning
How this is scored
The case worker's side: triage, the statutory deadlines (7-day acknowledgement, 3-month feedback), roles for case handlers, documentation of each case, and retention and deletion.
0 — No case handling; reports are forwarded by email and handled outside the product.
3 — Reports collected in a case list with status, notes and messages to the reporter.
5 — Reminders or deadline tracking for the 7-day acknowledgement and 3-month feedback, case handlers assigned with roles and permissions, and notes, documents and the full dialogue kept per case.
8 — Statutory deadlines tracked automatically with escalation, conflict-of-interest handling that excludes implicated case handlers, a tamper-evident case history, retention and deletion periods applied per case, and caseload statistics or management reports.
10 — A case system an external investigator can rely on: configurable investigation workflows, a complete audit trail of every access and change, deletion automated to the statutory retention periods with evidence, and statistics prepared for the annual report or the regulator.
The Compliance Officer
The pages show that a named person handles each report and can request supporting files, with the follow-up dialogue kept going inside the product. We found no public information on acknowledgement or feedback deadline tracking, handler roles and permissions, conflict-of-interest handling, retention and deletion, or case statistics — the statutory clocks I answer for are not documented here. 2
The Reporter's Advocate not rated — no public information
We found no public information on case management — nothing on the 7-day acknowledgement or 3-month feedback deadlines, case handler roles, retention or deletion appears on the captured pages. 1 2
The SME Operator
The captured page shows reports are handled inside the product, with the handler able to request supporting files and converse with the reporter. We found no public information on case lists, status tracking, the statutory acknowledgement or feedback deadlines, or handler roles and permissions. 2
The Group Counsel
The pages show a handler inside the system who can request supporting files from the reporter through the protected dialogue, which is in-product handling with reporter communication. We found no public information on deadline tracking for the acknowledgement and feedback periods, handler roles and permissions, tamper-evident case history, or retention and deletion — for a group rollout that is the part I would insist on seeing documented. 2
The Security Auditor
The captured pages show a two-way follow-up conversation and a report handler who can request supporting files, so some handling sits inside the product. We found no public information on case statuses, notes, deadline tracking for the acknowledgement and feedback periods, retention, or deletion. 2
The Skeptic
The only case-handling detail captured is that the person handling a report can request supporting files from the reporter within the system, alongside the two-way conversation. We found no public information on deadline reminders for the 7-day acknowledgement or 3-month feedback, handler roles and permissions, case history, retention or statistics — "market-leading" is asserted, not documented. 2
Legal compliance alignment
n/r
n/r
n/r
Show reasoningHide reasoning
How this is scored
How specifically the product implements EU Directive 2019/1937 and its national transpositions (HinSchG et al.): which statutory duties it maps to features, which countries it names, and how it keeps up when the law changes.
0 — Generic feedback or survey software with no reference to the whistleblowing obligations.
3 — The directive or HinSchG named on the vendor's pages, with the product presented as a way to meet the duty to provide an internal reporting channel.
5 — The statutory duties described as product features for at least one named national law — confidentiality, the acknowledgement and feedback deadlines, documentation of reports, and deletion after the retention period.
8 — Several national transpositions supported with their differing details, templates or process guidance (reporting policy, employee information) provided, and legal review by named counsel or a documented process.
10 — The product is a legal instrument: per-country rule sets kept current with a stated update process, documented legal review, and guidance for edge cases (group-wide channels, external ombudsman set-ups, works council involvement under the BetrVG) published.
The Compliance Officer not rated — no public information
We found no public information tying the product to the EU whistleblowing directive or any national transposition: the captured pages present it as whistleblowing software securing reporter identities, with no named law, statutory duty, or deletion obligation mapped to a feature. I read both captured pages and cannot score legal alignment on this material. 1 2
The Reporter's Advocate
The pages present the product squarely as whistleblower software — 'marknadens ledande visselblåsarsystem' — securing reporter identities, so it is not generic feedback tooling. But we found no public information naming EU Directive 2019/1937 or any national transposition such as HinSchG, nor any mapping of statutory duties to product features. 1 2
The SME Operator not rated — no public information
We found no public information naming the EU whistleblowing directive or any national law the product implements — neither the homepage nor the captured blog page makes any mapping between a statutory duty and a product feature. 1 2
The Group Counsel
This is marketed as a leading whistleblowing system, so it sits inside the obligation domain, but the captured pages name no law — neither the directive nor any national transposition — and describe no statutory duty as a product feature. We found no public information on per-country rule sets, templates for reporting policies, or legal review, which is precisely what a group operating across a dozen countries needs in writing. 1 2
The Security Auditor
The pages present Visslan as a whistleblowing system for internal reporting, which is more than generic feedback software, but we found no public information naming the EU Directive or any national transposition, or mapping statutory duties to product features. 1 2
The Skeptic not rated — no public information
We found no public information tying the product to the EU whistleblowing directive or any named national transposition: the captured pages name no statute, statutory deadline, documentation duty or deletion rule, and no legal counsel or update process is identified. Both the vendor homepage and the anonymous-reporting article were read and neither goes beyond marketing the product as a whistleblowing system. 1 2
Security & anonymity assurance
Show reasoningHide reasoning
How this is scored
Whether the confidentiality promise is engineered and evidenced: encryption, IP and metadata handling, penetration tests, certifications of the vendor and its hosting.
0 — Reports are not protected as confidential data; the product makes no security or confidentiality commitment for them.
3 — Encrypted transmission and storage of reports stated, and a commitment that reports are confidential.
5 — Encryption of report content described with some technical detail (end-to-end or at rest with key handling), a statement that IP addresses or metadata are not logged, and an ISO 27001 certificate for the vendor or its named hosting provider.
8 — A certified ISMS covering the product itself, regular third-party penetration tests stated, the encryption architecture documented, metadata minimisation explained, and a security contact or disclosure policy published.
10 — Assurance a hostile auditor accepts: current certificates with their scope published, recurring pentest summaries public, the cryptographic architecture documented, and anonymity analysed against the operator itself — the vendor explains why it cannot unmask a reporter.
The Compliance Officer
The vendor commits that the software "secures reporter identities" and that files are provided "in a secure way" — a confidentiality commitment, but a bare one. We found no public information on encryption architecture, IP or metadata handling, penetration tests, or certifications of the vendor or its hosting. 2
The Reporter's Advocate
There is a confidentiality commitment in the vendor's own words — reporter identities are secured and supporting files are provided 'på ett säkert sätt' — which is a promise, not an architecture. We found no public information on encryption, IP or metadata handling, penetration tests, or certifications. 2
The SME Operator
The vendor states it secures whistleblower identities and lets files be provided securely, which is a confidentiality commitment for reports. We found no public information on encryption, penetration testing, certifications, or handling of IP addresses and metadata. 2
The Group Counsel
The vendor commits to securing whistleblower identities and to secure provision of supporting files, which is a confidentiality promise covering the reports themselves. We found no public information on encryption architecture, IP or metadata handling, penetration testing, certifications, or hosting security, so from where I sit the promise is unaudited. 2
The Security Auditor
What is documented is adjectives: the software "secures whistleblower identities" and files are provided "in a secure way" — a promise with no architecture behind it. We found no public information on encryption, IP or metadata handling, penetration tests, or certifications of the vendor or its hosting. 2
The Skeptic
The vendor's word is "secure" — reporter identities are "secured" and files are provided "in a secure way" — but we found no public information on encryption, certificates, penetration tests, or metadata and IP handling behind that promise. A confidentiality claim with no engineering detail or third-party evidence is precisely what a hostile auditor will refuse at face value. 2
Group & multi-entity capability
n/r
n/r
n/r
n/r
n/r
n/r
Show reasoningHide reasoning
How this is scored
Whether one contract can serve a corporate group: separate channels per legal entity, central oversight, ombudsman access, white-labelling.
0 — Built for a single organisation only; a group needs one separate contract and instance per company.
3 — Several reporting channels or companies managed under one account.
5 — Separate channels per legal entity with their own case handlers, a group-level overview, and branding per channel; access for an external ombudsperson or counsel possible.
8 — A multi-tenant group structure: per-entity channels, languages and branding, delegated administration per subsidiary, external ombudsman roles, and group reporting that respects entity boundaries.
10 — Group compliance as architecture: hundreds of entities managed centrally, per-country legal rules assigned per entity, white-label reporting pages, and access separation strong enough to satisfy each subsidiary's works council — all documented.
The Compliance Officer not rated — no public information
We found no public information on serving several legal entities under one contract, group-level oversight, per-entity branding, or ombudsman access. The captured pages describe a single whistleblowing system up and running in under 120 minutes and give no material on group structures, so this criterion is unevidenced to me. 1 2
The Reporter's Advocate not rated — no public information
We found no public information on group or multi-entity capability — nothing on separate channels per legal entity, group-level oversight, or ombudsman access appears on the captured pages. 1 2
The SME Operator not rated — no public information
We found no public information on running several companies or channels under one account — nothing in the captured pages mentions per-entity channels, group-level oversight, branding per channel, or external ombudsman access. 1 2
The Group Counsel not rated — no public information
We found no public information on group or multi-entity capability — nothing on separate channels per legal entity, delegated administration per subsidiary, external ombudsman access, or group reporting that respects entity boundaries. The captured pages speak only of a whistleblowing system that can be running in under 120 minutes, anonymous reporting with two-way follow-up, and a free trial. 1 2
The Security Auditor not rated — no public information
We found no public information on group or multi-entity capability: nothing on per-entity channels, central oversight, external ombudsman access, or white-labelling on either captured page. 1 2
The Skeptic not rated — no public information
We found no public information on group or multi-entity capability: neither captured page mentions per-entity channels, group oversight, ombudsman or counsel access, white-labelling or delegated administration. A group buyer has nothing here to evaluate. 1 2
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where reports about people actually live and under whose law: contracting entity and parent company, hosting location, subprocessors (hosting, phone or voice provider, translation, email), and the data processing agreement. In this category the data is by definition the most sensitive a company holds. Independently sourced by the sovereignty pipeline; describe what is proven, and treat what is not stated as unknown rather than non-EU.
0 — Proven non-EU end to end: non-EU entity and non-EU hosting with no EU option, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist; hosting location and subprocessors are not stated, or EU hosting is offered only on request or on top tiers.
5 — EU hosting stated as the default, a data processing agreement and a subprocessor list published; a parent company or a subprocessor may sit outside the EU.
8 — EU entity, EU hosting in named data centres, a subprocessor list with no non-EU processor touching report content, and the DPA and TOMs published.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors for report content and metadata, an on-premises or sovereign-cloud option, and the whole chain documented publicly.
The Compliance Officer
The contracting entity is proven European: Visslan AB with registered address Norrgatan 10 in Varberg and org number 559327-2999. We found no public information on hosting location, subprocessors, or a data processing agreement, so those dimensions remain unknown to me rather than non-European. 2
The Reporter's Advocate
One dimension is proven: the contracting entity is Visslan AB, Norrgatan 10, Varberg, org.nr 559327-2999 — a Swedish, therefore EU, company. Hosting location, subprocessors and any data processing agreement are unknown, with no facts on record in either direction. 2
The SME Operator
The contracting entity is proven to be Swedish: Visslan AB, Norrgatan 10, Varberg, org. nr. 559327-2999, which is an EU entity. Hosting location, subprocessors and a data processing agreement are not stated on the captured pages, so where the reports live remains unknown. 2
The Group Counsel
The contracting entity is proven European: Visslan AB, Norrgatan 10 in Varberg, with Swedish organisation number 559327-2999. Everything downstream of the contract — hosting location, subprocessors, and the data processing agreement — is unknown to me from these pages, and I treat it as unknown rather than assume it sits outside the EU. 2
The Security Auditor
The contracting entity is proven Swedish — Visslan AB, Norrgatan 10, 43241 Varberg, org.nr 559327-2999 — which puts the legal relationship inside the EU. We found no public information on hosting location, subprocessors, or a data processing agreement, so where reports actually live is unknown. 2
The Skeptic
One link of the chain is proven: Visslan AB is a Swedish company with organisation number 559327-2999 and an address in Varberg, so the contracting entity sits in the EU. Everything downstream — hosting location, subprocessors, a data processing agreement — is unstated on the captured pages, and unstated means unknown, not non-European; the documented chain ends one link deep. 2
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether an obligated company can compute the real invoice — per entity, per employee band, per year — from public pages alone: tier prices, billing period, employee bands, add-ons (phone intake, languages, entities) and setup fees.
0 — No public prices at all; every tier is a sales conversation.
3 — A public "from" price or one priced tier; the other tiers, employee bands or add-ons are not public.
5 — Public per-tier prices with the billing period (monthly or annual) stated and the main inclusions or employee band of each tier listed.
8 — Every tier priced publicly with employee-band boundaries, entity rules, add-ons (phone intake, languages, extra entities) and setup fees stated, and VAT treatment given; only genuine corporate-group contracts are custom.
10 — Complete price computability: every tier, band, add-on and renewal rule public, so the invoice for a 60-employee company and a 5-entity group is a two-minute exercise.
The Compliance Officer
The captured pages advertise a 14-day free trial and a free consultation, but we found no public information on tier prices, billing period, employee bands, add-ons, or setup fees. An obligated company cannot begin to compute its invoice from this material. 2
The Reporter's Advocate
The only public pricing facts are a 14-day free trial and an offer of a free consultation. We found no public information on tier prices, billing period, employee bands, add-ons or setup fees, so a buyer's real invoice can only come out of a sales conversation. 2
The SME Operator
No tier price appears anywhere we read — the only pricing-related facts are a 14-day free trial and an invitation to contact the vendor for a free consultation. An invoice cannot be computed from public pages; it starts with a sales conversation. 2
The Group Counsel
The only pricing facts on the captured pages are a 14-day free trial and an invitation to a free consultation. We found no public information on tier prices, billing period, employee bands, entity rules, add-ons or setup fees, so no invoice — not for one company, let alone a multi-entity group — can be computed from what is published. 1 2
The Security Auditor
The only pricing facts on the pages are free offers: a 14-day free trial and a free consultation. We found no public information on tier prices, billing period, employee bands, add-ons, or setup fees, so no invoice can be computed from these pages. 2
The Skeptic
The only commercial terms made public are a 14-day free trial and a free consultation. We found no public information on tier prices, billing period, employee bands, add-ons or setup fees, so an obligated company cannot compute even a rough invoice from these pages. 2
Questions about Visslan
Is Visslan European?
Not determined: the vendor’s pages as captured do not say where Visslan is based.
Where does Visslan store data?
Not stated on the vendor’s pages as of 3 Nov 2026.
Does Visslan have a free plan?
Not stated on the vendor’s pages as of 3 Nov 2026.
What are the best alternatives to Visslan?
As of 4 Nov 2026, the panel rates preeco | hinweisgeberschutz (3.5/5), Ethicontrol (3/5) and LegalTegrity (3/5) highest among the other 39 Whistleblowing Portals products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is preeco | hinweisgeberschutz (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Visslan alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 3 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We could not confirm any compliance information on the vendor’s own pages as captured, so this page shows none rather than a statement we cannot stand behind. Know more? Tell us
- 12 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
Sources (2)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page www.visslan.com Checked 3 Nov 2026 Details →
- 2 Reporting channels & reporter experience — found from sitemap www.visslan.com Checked 3 Nov 2026 Details →