About EthicsPortal #

Last updated: 2026-09-24.

EthicsPortal is EU whistleblower compliance infrastructure that operates the secure whistleblowing channel required by Directive 2019/1937 — for organizations that cross the 50-worker threshold, and for regulated entities that carry the same obligation irrespective of headcount.

What EthicsPortal does #

Anonymous and confidential intake #

Employees submit reports from any browser, with no account, app, or company network. Identity disclosure is optional, reporter IP addresses are not stored, and file metadata (EXIF, GPS, author) is stripped before storage. The result is a channel people will actually use, which is the condition the Directive’s internal-first design depends on.

Deadline tracking #

Every report starts the Directive’s two clocks automatically: 7 days to acknowledge receipt, 3 months to provide substantive feedback. Overdue cases are flagged in the dashboard and handlers are notified as deadlines approach, so the dates that carry sanctions are not tracked in a spreadsheet.

Secure two-way communication #

Reporters return with a case reference and a 6-digit passcode of their own choosing to read handler messages and reply. Handler identities are never shown, so follow-up questions can be asked and answered without either side losing protection.

Case management and audit trail #

Handlers triage, assign, prioritize, and close cases in one view, and can log reports received by phone, email, or in person so every channel lands in the same case list. Every action is written to an append-only audit trail that cannot be modified after the fact.

Export and retention #

Any case exports to PDF with its full message history, timeline, and audit trail, for counsel, auditors, or a supervisory authority. Retention is configurable at 12, 24, 36, 48, or 60 months after closure, after which records are deleted automatically.

Identity and access integration #

SAML 2.0 single sign-on and SCIM 2.0 provisioning connect the channel to Okta, Microsoft Entra ID, or any standards-compliant provider. Handlers are provisioned from the directory and deprovisioned the moment they leave, which closes their access to reports without a manual step.

What makes EthicsPortal different #

The price is published #

EthicsPortal costs €41.67/month billed annually (€500/year), or €60/month month-to-month, with every feature included and no per-employee fees. None of NAVEX, EQS Integrity Line, SpeakUp, Whispli, or FaceUp publishes a price; each quotes through a sales process. See pricing and the comparisons .

Deployment is self-service #

An organization configures its whistleblowing channel and receives a live URL and QR code in the same session, without an implementation project. The enterprise platforms in this category route deployment through a sales engagement first, which is a difference in procurement time rather than in product quality.

Report data stays in the EU #

Core report data — application, database, and file storage — runs on Hetzner in Nuremberg, Germany, and transactional email through Mailjet in France. The whistleblowing channel and handler portal do not load Cloudflare. NAVEX is US-based and its EU hosting position is not publicly documented; see the subprocessor list for the full chain.

Procurement evidence is published, including the gaps #

The ISO/IEC 27001:2022 self-assessment covers Clauses 4–10 and all 93 Annex A controls, alongside an ISO 37002 alignment map , a pre-filled CAIQ , a DORA third-party map , a DPA , an SLA , and a risk register . Where a control is not in place, the same pages say so and date it, rather than leaving a reviewer to find out at questionnaire stage. The open items are listed on trust .

Report content is never processed by AI #

No report content, reporter identity, handler message, attachment, or audit entry is transmitted to any large language model, generative AI service, or AI-based classifier. This is contractual, not a setting — DPA §6.10 — and introducing it would be a material change requiring notice under the sub-processor clause.

Who EthicsPortal is for #

The 50-worker threshold in Art. 8(3) is the best-known trigger, not the only one. Art. 8(4) disapplies it for entities within the scope of the Union acts in Parts I.B and II of the Annex, and several member states extend the obligation to public entities of any size.

• Financial services firms , e-money and payment institutions , insurers, and AML-obliged entities — including those well under 50 workers, which carry the obligation irrespective of headcount under Art. 8(4) , often alongside DORA and sectoral reporting duties
• Public sector bodies and municipalities , where several transpositions cover public entities regardless of size and Art. 8(9) allows only small municipalities to share a channel
• EU companies of 50–249 workers that crossed the Art. 8(3) threshold and have no channel yet
• EU companies of 250+ workers replacing an email inbox or a shared mailbox used as a channel
• Manufacturing groups with multi-site, multi-language workforces
• EU subsidiaries of non-EU parents that need an EU-operated channel of their own
• Compliance consultancies and external DPOs operating channels on behalf of client organizations

The organization behind EthicsPortal #

EthicsPortal is a trade name used by Yaroslav Shmarov, a sole proprietor (jednoosobowa działalność gospodarcza) registered in Warsaw, Poland, who is the authorized signatory for commercial agreements, DPAs, and security questionnaires.

Continuity is addressed rather than assumed: organization administrators can export their cases at any time without operator involvement, and the business continuity plan states the operational dependencies, activation triggers, recovery objectives, and the current operator-incapacity limitations.

The service exists because the obligation arrives long before a compliance department does — at 50 workers for most employers, and at any headcount for a supervised financial entity. The available options were an enterprise GRC suite priced and sold for a compliance department, or a shared mailbox that satisfies the letter of an obligation and none of its purpose. EthicsPortal was built for the organizations in between: a channel that meets each article of the Directive, priced and deployed like software rather than like a consulting engagement.

• Founder: Yaroslav Shmarov — LinkedIn
• Company: LinkedIn · GitHub
• Contracting party, registry evidence, and procurement materials: trust

EthicsPortal operates a whistleblowing channel of its own, on its own product, under Directive 2019/1937: secure.ethicsportal.eu/p/R8HXGNHO .

How EthicsPortal works with customers #

Onboarding #

Create the organization account, set the name, logo, report categories, and retention period, and the whistleblowing channel is assigned its URL and QR code as soon as configuration is saved. Configuration takes minutes and the organization does it itself: there is no implementation project to schedule and no professional-services engagement to buy. See how EthicsPortal works for the full deployment workflow.

Who you work with #

Questions about the DPA, liability position, or a security questionnaire reach the authorized signatory directly — they are answered by someone who can sign the answer, not by a ticket queue that escalates toward one. Separate addresses exist for the matters that need them: privacy@ethicsportal.eu for GDPR and data protection, security@ethicsportal.eu for disclosures, legal@ethicsportal.eu for the DPA, accessibility@ethicsportal.eu for conformance questions.

Response times #

Email is answered within one business day under normal conditions. Personal data breach notification to the controller is made without undue delay after becoming aware, as Art. 33(2) GDPR requires of a processor (DPA §6.6 ). Availability measurement and exclusions are in the SLA ; recovery objectives are RPO 24 hours and RTO 4 hours.

Transparency during operation #

Live availability is published at secure.ethicsportal.eu/up , security incidents at incidents , and sub-processor changes are notified at least 30 days before they take effect, with a right to object and terminate (DPA §6.4 ).

Key facts #

Frequently asked questions #

Who operates EthicsPortal? #

EthicsPortal is a trade name used by Yaroslav Shmarov, a sole proprietor registered in Warsaw, Poland (NIP 5272755790). The same person is the authorized signatory for commercial agreements, DPAs, and security questionnaires. Registry evidence is published on the trust page and supplied on request during procurement.

Where is report data stored? #

Core report data — the application, database, and file storage — is hosted on Hetzner infrastructure in Nuremberg, Germany. Transactional email runs through Mailjet in France. The marketing site is delivered via Cloudflare; the whistleblowing channel and handler portal are not.

What does EthicsPortal cost? #

€41.67/month billed annually (€500/year), or €60/month month-to-month. Every feature is included and there are no per-employee fees, so the price does not change as headcount does. See pricing .

What security and compliance evidence does EthicsPortal publish? #

A full ISO/IEC 27001:2022 self-assessment covering Clauses 4–10 and all 93 Annex A controls as a Statement of Applicability, an ISO 37002 alignment map , a pre-filled CAIQ , a DORA third-party map , named policy documents, and a risk register . These are self-assessments against the control sets an external audit would evaluate, not accredited certification. Current certification status and open items are stated on trust .

Can an organization outside the EU use EthicsPortal? #

The entity operating the whistleblowing channel must be registered in the EU. Where a group has an EU entity, that entity can operate one channel and open it to staff in any country, with every report reaching the same case list. A compliance report cites the national law of the operating EU entity.

How long does deployment take? #

The whistleblowing channel is live as soon as configuration is saved — name, logo, categories, and retention period. Distribution is the remaining work: the channel comes with a shareable link and a QR code for handbooks, onboarding packs, and notice boards.

Does EthicsPortal use AI on report content? #

No. Report content, reporter identity, handler messages, attachments, and audit entries are never transmitted to a large language model, generative AI service, or AI-based classifier, and the service performs no AI categorisation, triage, summarisation, translation, or suggested replies on personal data. The commitment is contractual under DPA §6.10 .

How do I get procurement documents? #

The Terms, DPA, SLA, subprocessor list, security documentation, and self-assessments are published openly and require no request. Registry evidence, a countersigned DPA, and remaining procurement materials are available on request during review — see trust .

Deploy your whistleblowing channel →

Last updated: September 30, 2026