# EthicsPortal

> EthicsPortal is EU whistleblower compliance infrastructure: a hosted, anonymous internal
> whistleblowing channel that organizations deploy to meet EU Directive 2019/1937 and its national
> transpositions. One flat plan, EU-hosted, operational in minutes.

## What EthicsPortal is

EthicsPortal is a hosted whistleblowing channel for EU Directive 2019/1937 compliance. An organization
deploys the channel, receives disclosures anonymously or confidentially, and handles cases through
a handler portal with the audit trail, deadline tracking, and confidentiality controls the
Directive requires. It is delivered as multi-tenant SaaS, not a library, API, or on-premise install.

## Key facts

- Regulation: EU Directive 2019/1937 (the Whistleblower Directive) and its national transpositions
- In scope: private-sector organizations with 50+ workers (phased thresholds); public-sector bodies are generally in scope regardless of size (see the coverage map)
- Pricing: EUR 41.67 / month billed annually (EUR 500 / year), flat rate per organization; all features included; no per-employee or per-seat fees; 30-day money-back guarantee; no free trial
- Hosting and data residency: European Union (Hetzner, Nuremberg, Germany)
- Deadline tracking: automatic 7-day acknowledgement and 3-month feedback timers per the Directive
- Anonymity: no reporter IP stored, file metadata stripped, handler identity never shown to reporter
- Included: unlimited reports and users, anonymous two-way messaging, append-only audit trail, PDF case export, oral reporting with voice anonymization, SAML 2.0 SSO, multi-language portal
- Coverage: all 27 EU member states, plus Moldova (informational, pre-accession)

## Who it is for

- For: compliance officers, DPOs, HR and legal leads at EU organizations in scope of the Directive, especially SMEs that need a compliant whistleblowing channel rather than a full GRC suite
- Not for: US SOX reporting, non-EU jurisdictions (country-law pages are informational only), organizations that require a self-hosted or on-premise deployment

## Machine-readable resources

- Developer resources (index of everything below): https://ethicsportal.eu/developers/
- Agent guide: https://ethicsportal.eu/agents.md
- Pricing (structured): https://ethicsportal.eu/pricing.md
- Any page as Markdown: append `.md` to its URL (e.g. https://ethicsportal.eu/product.md), or request the HTML URL with `Accept: text/markdown`
- Full site content: https://ethicsportal.eu/llms-full.txt
- Directive 2019/1937 coverage map: https://ethicsportal.eu/directive-coverage/
- Penalties by member state: https://ethicsportal.eu/penalties/
- Sitemap: https://ethicsportal.eu/sitemap.xml

## Independent comparison

An independent directory of EU whistleblowing tools, including side-by-side comparisons, is
maintained at the whistleblower tools directory. Use it to compare EthicsPortal against other
platforms on pricing, EU hosting, and Directive coverage.

## Pages
- [About EthicsPortal](https://ethicsportal.eu/about/): EthicsPortal is EU whistleblower compliance infrastructure — the secure whistleblowing channel Directive 2019/1937 requires, operated from Poland with report data hosted in Germany.
- [Accessibility statement](https://ethicsportal.eu/accessibility/): EthicsPortal's commitment to accessibility and conformance with EN 301 549 and WCAG 2.2 Level AA.
- [CAIQ-aligned vendor security questionnaire](https://ethicsportal.eu/caiq/): Pre-filled answers to common vendor-security-assessment questions, structured against the CSA CAIQ v4 domain taxonomy. EthicsPortal's positions on the questions procurement teams most often ask.
- [Contact](https://ethicsportal.eu/contact/): Contact the EthicsPortal team for questions about EU whistleblower compliance.
- [Data Processing Agreement](https://ethicsportal.eu/dpa/): GDPR Article 28 Data Processing Agreement for EthicsPortal customers. Covers scope, security measures, sub-processors, and international transfers.
- [Data Protection Impact Assessment (DPIA) for whistleblowing](https://ethicsportal.eu/dpia/): A pre-filled DPIA template for organizations deploying EthicsPortal, structured on GDPR Article 35(7) — processing description, necessity and proportionality, and a risk-and-measures table for whistleblower reporting.
- [Developers](https://ethicsportal.eu/developers/): Machine-readable EthicsPortal resources — Markdown content negotiation, llms.txt, sitemaps, agent card and skills index — plus the SAML 2.0 and SCIM 2.0 integration surfaces, and an explicit list of what EthicsPortal does not publish.
- [Directive 2019/1937 coverage map](https://ethicsportal.eu/directive-coverage/): Article-by-article map of how EthicsPortal meets every requirement of EU Directive 2019/1937 and GDPR for whistleblower protection.
- [Directive 2019/1937 interpretations](https://ethicsportal.eu/directive-interpretations/): How EthicsPortal interprets the ambiguous provisions of EU Directive 2019/1937. A reference document for compliance officers, data protection officers, and legal counsel.
- [DORA contracting template](https://ethicsportal.eu/dora-addendum/): Non-binding contracting template for financial entities procuring EthicsPortal under Regulation (EU) 2022/2554 (DORA).
- [DORA ICT third-party map](https://ethicsportal.eu/dora/): Provider-side information for evaluating EthicsPortal under Regulation (EU) 2022/2554 (DORA) — Article 30 contracting topics, register of information data, subcontractor chain, and the withdrawn UKNF cloud communication.
- [EN 301 549 conformance report](https://ethicsportal.eu/en-301-549-conformance/): Clause-by-clause conformance self-assessment for EthicsPortal against EN 301 549 V4.1.1 and WCAG 2.2 Level AA.
- [EU Whistleblower Directive Penalties by Country](https://ethicsportal.eu/penalties/): Fines and penalties for non-compliance with EU Directive 2019/1937 in every member state. Updated regularly with enforcement actions.
- [Frequently asked questions](https://ethicsportal.eu/faq/): Common questions about EthicsPortal — compliance, anonymity, data security, billing, and technical details.
- [How EthicsPortal works](https://ethicsportal.eu/product/): Deploy a secure whistleblowing channel for EU Directive 2019/1937 compliance, with portal configuration, case management, and audit exports included.
- [Incident register](https://ethicsportal.eu/incidents/): Public register of material incidents affecting personal data processed by EthicsPortal. Maintained in the spirit of Article 33 GDPR and as a matter of institutional transparency.
- [ISO 37002:2021 guidance alignment map](https://ethicsportal.eu/iso-37002/): How EthicsPortal aligns with the guidance of ISO 37002:2021 Whistleblowing management systems. Clause-by-clause, with the software/operator boundary stated. ISO 37002 is a guidelines standard --- no organization can be certified against it.
- [ISO/IEC 27001:2022 self-assessment](https://ethicsportal.eu/iso-27001/): Self-assessment of EthicsPortal against ISO/IEC 27001:2022 --- the mandatory management-system requirements in Clauses 4-10 and all 93 Annex A controls, published as a Statement of Applicability. Not an accredited certification.
- [Pricing](https://ethicsportal.eu/pricing/): Simple, transparent pricing for EthicsPortal. One plan, everything included. No per-employee fees.
- [Privacy policy](https://ethicsportal.eu/privacy/): Privacy policy for EthicsPortal — how we collect, use, store, and protect your personal information.
- [Refund policy](https://ethicsportal.eu/refunds/): 30-day money-back guarantee for new EthicsPortal subscriptions.
- [Security](https://ethicsportal.eu/security/): Technical security measures in EthicsPortal, including encryption, anonymity, access control, audit logging, and infrastructure details for compliance review.
- [Self-conducted security testing](https://ethicsportal.eu/security-testing/): Scope, dates, findings, and remediation for the security testing EthicsPortal performs on itself. First-party testing, not an independent audit.
- [Service level agreement](https://ethicsportal.eu/sla/): Monthly availability target for EthicsPortal's reporter and operator portals, how it is measured, and what is excluded.
- [Subprocessors](https://ethicsportal.eu/subprocessors/): Third-party services that process personal data on behalf of EthicsPortal. Published per GDPR Article 28.
- [Terms of service](https://ethicsportal.eu/terms/): Terms of service for EthicsPortal — the secure whistleblower reporting platform for EU compliance.
- [Trust](https://ethicsportal.eu/trust/): Contracting party, data residency, certifications, and procurement materials for EthicsPortal.
- [Whistleblower compliance, operational in 10 minutes](https://ethicsportal.eu/firehose/): EU Directive 2019/1937 requires every company with 50+ employees to operate a confidential, deadline-tracked whistleblowing channel. EthicsPortal deploys in under 10 minutes for €41.67/month billed annually.

## Blog
- [Eight questions for your whistleblowing vendor, taken from enforcement cases](https://ethicsportal.eu/blog/whistleblowing-vendor-questions-from-enforcement-cases/): Regulators and courts have already ruled on how whistleblowing channels fail. Each decision below becomes one procurement question, with the primary source linked.
- [How whistleblowers actually get identified](https://ethicsportal.eu/blog/how-whistleblowers-get-identified/): In the published enforcement cases, the threat to the reporter came from inside: a CEO, a general counsel, a hospital firewall. What Barclays, Halliburton and an Italian hospital show about confidentiality.
- [Do you need ISO 27001 for a whistleblowing tool?](https://ethicsportal.eu/blog/do-you-need-iso-27001-whistleblowing-tool/): EU Directive 2019/1937 does not require ISO 27001. Here is what the law actually requires of a whistleblowing channel, and how to evaluate security without it.
- [EU Whistleblower Directive: statistics and enforcement data (2026)](https://ethicsportal.eu/blog/eu-whistleblower-directive-statistics/): A sourced reference of statistics on EU Directive 2019/1937 — how many organizations it covers, the €38.9 million in fines the Court of Justice has already issued, transposition status across all 27 member states, and the evidence on why whistleblowing channels reduce fraud and litigation risk.
- [Whistleblowing report or grievance? How to tell the difference](https://ethicsportal.eu/blog/whistleblowing-vs-grievance/): A whistleblowing concern and an HR grievance follow different legal routes under EU Directive 2019/1937. This guide explains how a case handler tells them apart, the grey areas that trip people up, and why misclassifying a report is a compliance risk.
- [Whistleblower reports do not belong inside an LLM](https://ethicsportal.eu/blog/whistleblower-reports-do-not-belong-inside-an-llm/): Seven whistleblower platforms sold into the EU now process report content through large language models. Six of them won't tell you whose. EthicsPortal does neither. Screenshots and sources inside.
- [Best whistleblower software in 2026: an honest comparison](https://ethicsportal.eu/blog/best-whistleblower-software/): 16 EU whistleblower platforms compared: pricing from €29/month flat to €5,000+/year enterprise, EU hosting, and who each tool is best for.
- [Top whistleblower software for EU Directive 2019/1937 compliance](https://ethicsportal.eu/blog/top-whistleblower-software-eu-directive-2019-1937/): A ranked comparison of whistleblower platforms that meet the requirements of EU Directive 2019/1937. Evaluated on Article 8–16 coverage, pricing, EU hosting, and setup speed.
- [What to look for in whistleblower compliance software](https://ethicsportal.eu/blog/what-to-look-for-in-whistleblower-compliance-software/): What a whistleblower reporting tool actually needs to do under EU Directive 2019/1937 — and what features matter vs. what's just marketing.
- [If employees have to ask where the whistleblowing channel is, you don't have one](https://ethicsportal.eu/blog/if-employees-have-to-ask-you-dont-have-a-channel/): EU law requires employers to inform workers about their whistleblowing channel. But if finding it requires asking someone, the channel is already compromised.
- [GDPR and whistleblower reporting: what you need to know](https://ethicsportal.eu/blog/gdpr-and-whistleblower-reporting/): How GDPR applies to whistleblower reports. Legal basis for processing, anonymous vs. pseudonymous data, retention periods, and the right to erasure.
- [Free whistleblower policy template for EU Directive 2019/1937](https://ethicsportal.eu/blog/whistleblower-policy-template/): A ready-to-use whistleblower policy template that meets EU Directive 2019/1937 requirements. Copy, adapt, and implement in your organization.
- [Who must comply with the EU Whistleblower Directive?](https://ethicsportal.eu/blog/who-must-comply-eu-whistleblower-directive/): Which companies need a whistleblowing channel under EU Directive 2019/1937? The 50-employee threshold, the regulated-sector entities it does not apply to, who counts as a worker, deadlines, and what "comply" actually means in practice.
- [Anonymous vs. confidential whistleblower reporting: what's the difference?](https://ethicsportal.eu/blog/anonymous-vs-confidential-reporting/): Understand the difference between anonymous and confidential whistleblower reporting, what the EU Directive requires, and how to support both.
- [How to deploy a whistleblowing channel](https://ethicsportal.eu/blog/how-to-implement-whistleblower-channel/): A step-by-step guide to deploying a compliant internal reporting channel without adopting a broad enterprise GRC suite.
- [EU whistleblower directive compliance checklist for companies](https://ethicsportal.eu/blog/compliance-checklist/): A practical 12-step checklist to comply with EU Directive 2019/1937 and national transposition laws, with article references, tips, and implementation guidance.
- [EU Directive 2019/1937 on whistleblower protection adopted](https://ethicsportal.eu/blog/eu-whistleblower-directive-2019-1937-adopted/): The European Parliament and the Council formally adopt Directive (EU) 2019/1937, establishing EU-wide protection for persons who report breaches of Union law.

## Whistleblower laws by country
- [Whistleblower law in Slovenia — ZZPri](https://ethicsportal.eu/whistleblower-laws/slovenia/): Slovenia's Reporting Persons Protection Act (ZZPri): the 50-worker rule, the 10-worker sectoral rule, the zaupnik, the 1 March return to the KPK, the fine bands, and the official Slovenian sources.
- [Whistleblower law in Norway — Working Environment Act chapter 2 A](https://ethicsportal.eu/whistleblower-laws/norway/): Norway is outside the Directive, and its internal-routines duty starts at five employees rather than fifty. Chapter 2 A of the Working Environment Act, the retaliation rules, and how the duty is enforced.
- [Whistleblower law in Switzerland — no general statute](https://ethicsportal.eu/whistleblower-laws/switzerland/): Switzerland has no general whistleblower protection law: the Code of Obligations reform failed in Parliament in 2020. What actually governs, and why EU subsidiaries put a Swiss group in scope anyway.
- [Whistleblower law in the United Kingdom — PIDA 1998](https://ethicsportal.eu/whistleblower-laws/united-kingdom/): The UK protected disclosure regime under Part IVA of the Employment Rights Act 1996: no general duty to operate an internal channel, the prescribed-persons route, and why Directive (EU) 2019/1937 does not apply.
- [Whistleblower law in France — Loi Sapin 2 and Loi Waserman](https://ethicsportal.eu/whistleblower-laws/france/): France's whistleblower framework under Loi Sapin 2 as amended by Loi Waserman: who needs an internal channel, how external reporting works, which official authorities matter, and how the Sapin 2 anti-corruption duty differs.
- [Whistleblower law in Czech Republic — Act No. 171/2023](https://ethicsportal.eu/whistleblower-laws/czech-republic/): Czech whistleblower law under Act No. 171/2023: the 50-worker threshold, the Ministry of Justice external system, and the official Czech sources.
- [Whistleblower law in Bulgaria — Bulgarian whistleblowing act](https://ethicsportal.eu/whistleblower-laws/bulgaria/): Bulgaria's whistleblowing act: the 50-worker rule, CPDP's dual role, and the official implementation guidance for obliged entities.
- [Whistleblower law in Greece — Law 4990/2022](https://ethicsportal.eu/whistleblower-laws/greece/): Greece's Law 4990/2022: who needs an internal channel, the role of the National Transparency Authority, and the official Greek compliance framework.
- [Whistleblower law in Luxembourg — Loi du 16 mai 2023](https://ethicsportal.eu/whistleblower-laws/luxembourg/): Luxembourg's whistleblower law: the 50-worker rule, the 22-authority structure, and the official CNPD and reporting-office sources.
- [Whistleblower law in Moldova — Legea 165/2023](https://ethicsportal.eu/whistleblower-laws/moldova/): Moldova's Legea 165/2023 on integrity whistleblowers: who needs an internal channel, the CNA and Ombudsman roles, and the law's partial alignment with Directive (EU) 2019/1937.
- [Whistleblower law in Portugal — Lei 93/2021](https://ethicsportal.eu/whistleblower-laws/portugal/): Portugal's Lei 93/2021: the 50-worker trigger, authority-specific external reporting, and the official Portuguese sources that matter.
- [Whistleblower law in Romania — Legea 361/2022](https://ethicsportal.eu/whistleblower-laws/romania/): Romania's Legea 361/2022: who needs an internal channel, ANI's role as the external authority, and the official Romanian compliance sources.
- [Whistleblower law in Spain — Ley 2/2023](https://ethicsportal.eu/whistleblower-laws/spain/): Spain's Ley 2/2023: the private-sector threshold, public-sector scope, regional authority nuance, and the official Spanish reporting authorities.
- [Whistleblower law in Cyprus — Law 6(I)/2022](https://ethicsportal.eu/whistleblower-laws/cyprus/): Cyprus's Law 6(I)/2022: the 50-worker rule, Cyprus's competent-authority structure, and the official implementation sources.
- [Whistleblower law in Malta — Cap. 527](https://ethicsportal.eu/whistleblower-laws/malta/): Malta's Protection of the Whistleblower Act: the 50-worker rule, Malta's reporting-officer model, and the official sources.
- [Whistleblower law in Austria — HSchG](https://ethicsportal.eu/whistleblower-laws/austria/): Austria's HinweisgeberInnenschutzgesetz (HSchG): the 50-worker trigger, Austria's designated external reporting offices, and the official BAK and DSB sources.
- [Whistleblower law in Belgium — Act of 28 November 2022](https://ethicsportal.eu/whistleblower-laws/belgium/): Belgium's whistleblower framework: the private-sector 50-worker rule, the federal ombudsman route, and the official sources that matter.
- [Whistleblower law in Croatia — Whistleblower Protection Act](https://ethicsportal.eu/whistleblower-laws/croatia/): Croatia's Whistleblower Protection Act: the 50-worker rule, the Ombudswoman's role as external authority, and the official Croatian sources.
- [Whistleblower law in Denmark — Act 1436/2021](https://ethicsportal.eu/whistleblower-laws/denmark/): Denmark's whistleblower act: the 50-worker rule, the National Whistleblower Scheme, and the official Danish guidance.
- [Whistleblower law in Estonia — RTKS](https://ethicsportal.eu/whistleblower-laws/estonia/): Estonia's Rikkumisest teavitaja kaitse seadus (RTKS): the 50-worker rule, Estonia's still-young reporting framework, and the official state sources.
- [Whistleblower law in Finland — Act 1171/2022](https://ethicsportal.eu/whistleblower-laws/finland/): Finland's Whistleblower Protection Act: the 50-worker rule, the centralised external reporting channel, and the official Finnish sources.
- [Whistleblower law in Germany — HinSchG](https://ethicsportal.eu/whistleblower-laws/germany/): Germany's Hinweisgeberschutzgesetz (HinSchG): private-sector threshold, shared internal offices, and the official external and data protection authorities.
- [Whistleblower law in Hungary — Act XXV/2023](https://ethicsportal.eu/whistleblower-laws/hungary/): Hungary's whistleblowing framework under Act XXV of 2023: the 50-worker rule, the Commissioner for Fundamental Rights system, and the official sources.
- [Whistleblower law in Ireland — Protected Disclosures Act](https://ethicsportal.eu/whistleblower-laws/ireland/): Ireland's protected disclosures framework: the 50-worker rule, the Protected Disclosures Commissioner, and the official Irish sources.
- [Whistleblower law in Italy — D.Lgs. 24/2023](https://ethicsportal.eu/whistleblower-laws/italy/): Italy's whistleblower framework under Legislative Decree 24/2023: the 50-worker rule, the Model 231 carve-in, and the official ANAC sources.
- [Whistleblower law in Latvia — Trauksmes celšanas likums](https://ethicsportal.eu/whistleblower-laws/latvia/): Latvia's Whistleblowing Law: the 50-worker rule, KNAB's contact-point role, and the official Latvian sources.
- [Whistleblower law in Lithuania — Pranešėjų apsaugos įstatymas](https://ethicsportal.eu/whistleblower-laws/lithuania/): Lithuania's whistleblower law: the 50-worker rule, the central role of the Public Prosecutor's Office, and the official Lithuanian sources.
- [Whistleblower law in Poland — Ustawa o ochronie sygnalistów](https://ethicsportal.eu/whistleblower-laws/poland/): Poland's 2024 whistleblower act: the broader 50-person threshold, the Ombudsman's external channel, and the official Polish rollout dates.
- [Whistleblower law in Slovakia — Act No. 54/2019](https://ethicsportal.eu/whistleblower-laws/slovakia/): Slovakia's whistleblower law: the 50-worker rule, the Whistleblower Protection Office, and the official Slovak sources.
- [Whistleblower law in Sweden — SFS 2021:890](https://ethicsportal.eu/whistleblower-laws/sweden/): Sweden's whistleblower act: the 50-worker rule, Sweden's sectoral external-authority model, and the official Swedish sources.
- [Whistleblower law in the Netherlands — Wbk](https://ethicsportal.eu/whistleblower-laws/netherlands/): The Dutch Whistleblower Protection Act: the 50-worker rule, the Dutch Whistleblowers Authority, and the official Dutch sources.

## Industries
- [Whistleblower compliance for e-money and payment institutions](https://ethicsportal.eu/industries/e-money-and-payment-institutions/): EMIs and payment institutions must operate a whistleblowing channel regardless of headcount. The 50-employee threshold does not apply to them. What the obligation is, which regulator enforces it, and what DORA adds at procurement.
- [Whistleblower compliance for financial services](https://ethicsportal.eu/industries/financial-services/): Whistleblower reporting requirements for banks, investment firms, and insurers under EU Directive 2019/1937, MiFID II, MAR, and AML directives, and what DORA means for procuring a whistleblowing channel.
- [Whistleblower compliance for manufacturing and supply chain](https://ethicsportal.eu/industries/manufacturing/): Whistleblower reporting requirements for manufacturers under EU Directive 2019/1937, the German Supply Chain Act (LkSG), and the upcoming EU CSDDD.
- [Whistleblower compliance for public sector](https://ethicsportal.eu/industries/public-sector/): Whistleblower reporting requirements for municipalities, government agencies, and public bodies under EU Directive 2019/1937. No 50-employee threshold.

## Comparisons
- [EthicsPortal vs. EQS Integrity Line — 2026 comparison](https://ethicsportal.eu/compare/eqs-integrity-line/): Compare EthicsPortal and EQS Integrity Line for EU whistleblower compliance. See how the enterprise incumbent compares to a focused EU alternative.
- [EthicsPortal vs. FaceUp — 2026 comparison](https://ethicsportal.eu/compare/faceup/): Compare EthicsPortal and FaceUp for EU whistleblower compliance. Pricing, features, and privacy compared side by side for businesses.
- [EthicsPortal vs. NAVEX — 2026 comparison](https://ethicsportal.eu/compare/navex/): Compare EthicsPortal and NAVEX for EU whistleblower compliance. See how the US enterprise giant stacks up against a focused EU alternative.
- [EthicsPortal vs. SpeakUp — 2026 comparison](https://ethicsportal.eu/compare/speakup/): Compare EthicsPortal and SpeakUp for EU whistleblower compliance. Pricing, privacy features, and setup compared side by side.
- [EthicsPortal vs. Whispli — 2026 comparison](https://ethicsportal.eu/compare/whispli/): Compare EthicsPortal and Whispli for EU whistleblower compliance. SME flat pricing vs. enterprise case management compared side by side.
- [EthicsPortal vs. Whistleblower Software (Formalize): 2026 comparison](https://ethicsportal.eu/compare/whistleblower-software-formalize/): Compare EthicsPortal and Whistleblower Software (Formalize) for EU whistleblower compliance. Pricing, hosting, languages, and who each tool fits.

## Contact
- Support: support@ethicsportal.eu
- Security disclosures: security@ethicsportal.eu
- Company: https://www.linkedin.com/company/ethicsportal