Ashio whistleblowing software

Oct 11, 2026

Whistleblowing Software Requirements Checklist: 12 Questions to Ask Any Vendor

Whistleblowing Software Requirements Checklist: 12 Questions to Ask Any Vendor

Buying whistleblowing software is one of the few compliance purchases where the wrong choice is not just expensive โ€” it is a regulatory finding. Use this whistleblowing software requirements checklist to filter vendors before you book a demo: twelve questions covering legal scope, anonymity, audit evidence, deadlines, hosting, roles, and contract terms, each tied to a specific obligation under Directive (EU) 2019/1937 and a concrete proof point you can ask a salesperson to show.

Table of contents

Key takeaways

  • The mandatory EU deadlines โ€” seven days to acknowledge receipt and three months to give feedback โ€” are fixed by Article 9 of Directive 2019/1937, and any vendor that cannot show how their system enforces them is non-compliant on paper.
  • Anonymity is a design choice, not a marketing line: ask whether the reporter's IP is logged, whether cookies are set on the intake page, and whether encryption keys live on the server or only in the browser.
  • Audit-ready logging means an activity record that is tamper-evident, exportable, and survives a regulator's visit without manual reconstruction.
  • Hosting and certification evidence should be a single document: ISO 27001 certificate, data-residency statement, and the encryption architecture in plain English, signed and dated within the last twelve months.
  • The procurement questions โ€” pricing per user vs. flat, contract length, data portability at exit โ€” are where most buyers lose leverage if they are not raised before the first quote.

What 'good' whistleblowing software must do under EU Directive 2019/1937

Good whistleblowing software operationalises Directive (EU) 2019/1937 end to end: it offers a confidential channel for written, verbal and in-person reports, protects the reporter's identity, applies the seven-day acknowledgement and three-month feedback deadlines from Article 9, and produces an audit trail a regulator can read on the spot.

Directive 2019/1937, in force since December 2021 and binding on legal entities with 50 or more employees since December 2023, sets four obligations a tool must support mechanically rather than through policy:

  • Receive reports through three channels โ€” written, verbal and in-person โ€” without forcing the reporter to identify themselves.
  • Keep the reporter's identity confidential, including any information from which the identity can be inferred directly or indirectly.
  • Acknowledge receipt within seven calendar days of the report.
  • Give feedback on the follow-up within three months of the acknowledgement.

Anything that cannot enforce those four rules inside the platform is asking the compliance officer to enforce them by hand, which is exactly how findings happen. The European Commission's guidance and the practice of national supervisory authorities treat each obligation as testable: a regulator will ask for the timestamp on the acknowledgement, the channel used, and the log of who accessed the case.

Read every vendor pitch by mapping each claim back to one obligation above and asking, for each, "show me where this is enforced in the system, not in your policy." Compliance officers responsible for the rollout can work through the same obligations against the role-specific guidance for compliance officers, which translates each Article 9 requirement into a feature checklist.

Is the intake truly anonymous? Questions to ask any vendor

Anonymity is where vendor marketing and vendor engineering diverge most often, and the questions you ask about the intake decide whether your channel survives a regulator's probe. Treat every answer that does not name a mechanism โ€” IP handling, cookie behaviour, key custody โ€” as a red flag.

What happens to the reporter's IP address on the report page?

The strongest answer is that no IP is logged at the application layer, and that the hosting provider's network logs are disabled or minimised for the intake endpoint. If the vendor says "we anonymise IPs at the load balancer," ask for the retention window and the specific configuration; "anonymised" without a number is a claim, not a control.

Are any cookies, trackers or fingerprinting scripts running on the report page?

The intake page should set no cookies, run no analytics, and use no fingerprinting. Anything else means the reporter leaves a trace a motivated adversary can correlate. Ask the vendor to load the page in a private browser, then open DevTools: the only third-party request should be to the vendor's own domain.

Can a reporter submit without creating an account?

Account creation ties the report to an email address and a login timestamp. The compliant pattern is a one-shot link generated for each report that lives only in the URL bar and on the reporter's device.

Can a reporter respond to follow-up questions while remaining anonymous?

Two-way communication must use that same one-shot link, not a named inbox or shared mailbox. The mechanism is usually a per-report encryption key the system generates and hands back to the reporter after submission; the vendor should be able to draw the data flow.

Is the verbal channel processed before or after the audio leaves the reporter's device?

If the reporter can dictate a report, the audio must be transcribed on the device and only the text sent. A vendor that records and transcribes server-side has built an audio fingerprint of every voice reporter.

The point of these questions is to expose which vendors have built for anonymity and which have retrofitted a marketing page onto a ticketing tool. HR leaders who run the channel day-to-day will recognise these checks from the intake-interview perspective covered in the HR leader guide.

How is the case file and audit log built?

The case file and the activity log are the artefacts a regulator will actually read, and they are where the cheapest tools fail first. The audit log must be tamper-evident, exportable in a standard format, and complete enough to reconstruct who knew what, and when, without manual notes.

What is logged, and is the log append-only?

Every state change โ€” report received, acknowledgement sent, case assigned, status updated, file attached, report closed โ€” should produce a log entry that case workers cannot edit or delete. If the log lives in the same database as the case data, ask how the vendor prevents a privileged user from rewriting history.

Can the log be exported in a standard, regulator-friendly format?

A regulator will not read a PDF screenshot. The export must be machine-readable โ€” CSV, JSON, or a signed PDF with an embedded timestamp โ€” and must include the actor, the action, the timestamp in UTC, and the case reference.

How long is the log retained, and who can delete it?

Retention must match the record-keeping obligation in the national transposition of the Directive. Deletion rights should be restricted to a documented role, and every deletion itself should be logged.

Does the system store the report body, or only references to it?

If the body is encrypted with a key only the case worker holds, the vendor's server cannot read it โ€” the strongest possible answer to a data-minimisation question. A plaintext body on the server is a finding waiting to happen.

A workable test: open three cases, run them through every status, then ask the vendor for a single export a non-technical auditor can follow from receipt to closure without a walk-through. If the answer requires a slide deck, the log is not built for audit.

What hosting, encryption and data-residency evidence will you accept?

Hosting and encryption are where vendor answers get vaguest, because the controls are technical and the salesperson usually has only the marketing summary. Push for documents: a current ISO 27001 certificate, a data-residency attestation from the hosting provider, and a one-page encryption architecture signed by an engineer.

Where does the data sit, and is the hosting provider certified?

The strongest answer is ISO 27001-certified hosting in a jurisdiction with strong data-protection law. Swiss and EU data centres are common answers for European buyers; outside those, ask the vendor to walk through the legal basis for any transfer.

Is encryption end-to-end, and who holds the keys?

End-to-end encryption means the keys live with the reporter and the case worker, not on the server. If the vendor can decrypt a report on demand, the architecture is not end-to-end, regardless of what the brochure says. Ask which symmetric algorithm is used (AES-256-GCM is the current standard) and how keys are wrapped per recipient.

What is the encryption architecture and who wrote it?

A one-pager describing the key flow โ€” generated in the browser, wrapped for each recipient, stored only as ciphertext โ€” shows the engineering has been done. A brochure indicates it has not.

Is there a zero-access guarantee, and is it contractual?

A zero-access architecture means the vendor cannot read report bodies. Strong vendors put that in the contract, not just the security page. A verbal guarantee should be written into the procurement document before signing.

Can the vendor show an independent penetration test from the last twelve months?

A pentest report dated within the year, covering the intake flow, the authentication flow, and the case-management API, is the minimum. Older reports, or reports scoped only to the marketing site, do not count.

How does the vendor handle the 7-day acknowledgement and 3-month feedback deadlines?

The deadlines are the most-cited numbers in any whistleblowing audit, and the only safe way to manage them is inside the software. Hard-coded timers that warn at day five and escalate at day seven are the baseline; manual tracking is not.

Are the deadlines automatic, with reminders and escalation?

The system should generate the acknowledgement deadline the moment the report lands, send a reminder to the assigned case worker, and escalate if the deadline passes without action. Anything that requires the case worker to copy a date into a calendar is fragile.

Does the system record the actual acknowledgement timestamp?

A regulator will not accept "we usually acknowledge within a day." The system must record when the acknowledgement was sent, by whom, and on which channel.

Can feedback be partial, and is the three-month clock pauseable?

Article 9 allows the feedback period to be extended where necessary, provided the reporter is informed. Ask whether the platform can record an extension, the reason for it, and the new deadline, without losing the original three-month target in the export.

Does the system distinguish between acknowledgement and feedback?

Many tools conflate the two. The Directive treats them separately: acknowledgement is a receipt confirmation, feedback is a substantive update on the follow-up. The platform must let you mark and timestamp each independently.

The fastest way to test this is to ask the vendor to demo a case that arrived yesterday and walk through what the case worker sees today: a notification, a countdown, a status, and an export showing both timestamps.

Roles, separation of duties and four-eyes control โ€” what to verify

Whistleblowing tools must enforce who can see a case, who can act on it, and who can close it, because conflict-of-interest cases โ€” a report naming the compliance officer, for instance โ€” will happen. The right model is role-based access, separation between administrative settings and casework, and a four-eyes rule for status changes that affect the reporter.

Can admin settings be kept separate from casework?

The platform should let you grant a colleague the right to manage users and policies without granting access to report bodies. If every admin can read every report, the tool is admin-shaped, not compliance-shaped.

Is there a four-eyes rule for closing a case?

Closing a report โ€” or reclassifying its status โ€” should require a second approver. This is the only way to evidence that a closure was reviewed.

Can you reassign a case when the reporter names the assigned case worker?

The system must let a supervisor reroute a case to a different handler in one step, with the reassignment itself logged. Manual workaround emails are the audit failure mode.

Are roles and permissions documented and exportable?

A regulator will ask who had access to a specific case at a specific time. The answer must come from the system, not from a screenshot of a settings page.

Pricing, contract length and data portability: the procurement questions

Procurement questions are where buyers lose leverage, because they get asked late, after the demo is done. Move them to the second call, before any technical commitment, and write the answers into the contract.

Is the price flat or per user?

Per-user pricing penalises the exact behaviour you want โ€” inviting more colleagues into the channel. A flat price with unlimited internal users aligns the tool with the obligation.

What is the contract length, and what happens to your data if you leave?

Annual contracts are common; multi-year lock-ins are not necessary. The exit clause must cover data export in a usable, documented format โ€” JSON for the case data, CSV for the log โ€” and a defined window after termination during which the data remains accessible.

Is there a free trial, and what does it include?

A trial should expose the deadlines, the role separation, and the export โ€” the three areas where the cheapest tools fall down. If the trial gates those behind a sales call, the tool is being demoed, not tested.

What is the SLA, and is it contractual?

Uptime, support response, and the security-incident notification window should be in writing, with remedies attached. Verbal SLAs are not SLAs.

For a concrete pricing model and a flat-fee comparison, the pricing page sets out how the plan is structured, what is included, and what to expect on a quote from any vendor in this category.

Whistleblowing software requirements checklist: the 12-point scorecard

Whistleblowing software requirements checklist: the 12-point scorecard The scorecard below is the document to send to every salesperson on your shortlist. Each row pairs an obligation with a question and an acceptable evidence type, and is the practical form of the whistleblowing software evaluation criteria a compliance team needs before a demo.

  1. Channel coverage. Can the system receive written, verbal and in-person reports without forcing identification? Evidence: a demo of all three flows, with the verbal flow running on a mobile device.
  2. Confidentiality by design. Is the reporter's identity protected from any non-owner role? Evidence: a permission matrix showing who can read report bodies.
  3. No IP logging on the intake page. Are IP addresses stripped or never recorded at the application layer? Evidence: a network capture of the intake page in a private browser.
  4. No cookies or trackers on the report page. Is the page free of analytics, fingerprinting and third-party scripts? Evidence: DevTools screenshot of the network panel during submission.
  5. One-shot reporter link. Can a reporter return to a case without an account, using a private URL? Evidence: a live demo of two-way communication through that link.
  6. End-to-end encryption. Are report bodies encrypted with keys the vendor cannot read? Evidence: a signed architecture document naming the algorithm and key flow.
  7. Automatic deadlines. Are the seven-day acknowledgement and three-month feedback clocks generated from the platform, with reminders and escalation? Evidence: a screenshot of the case-worker's dashboard at day five.
  8. Immutable activity log. Is every status change, access and export recorded in an append-only log? Evidence: a CSV export from a demo case showing actor, action and UTC timestamp.
  9. Standard export format. Can the log and case data be exported in a regulator-friendly, machine-readable format? Evidence: a sample export file.
  10. ISO 27001 hosting in a defined jurisdiction. Where does the data sit, and is the hosting provider certified? Evidence: a current ISO 27001 certificate and a data-residency attestation from the hosting provider.
  11. Role separation and four-eyes control. Can administrative settings be kept apart from casework, and does case closure require a second approver? Evidence: a permissions matrix and a closure workflow demo.
  12. Flat pricing, portable data, documented SLA. Is pricing flat with unlimited internal users, is data export part of the exit clause, and is the SLA in the contract? Evidence: the contract itself, with the relevant clauses highlighted.

Copy this list into your RFP template, replace "evidence" with the vendor's reply, and score each row 0โ€“2. Any vendor scoring under twelve is missing an obligation you cannot patch with policy.

Frequently asked questions

What is the most common reason a whistleblowing tool fails an audit?

The most common failure is the inability to evidence the seven-day acknowledgement and three-month feedback deadlines from the platform itself: the timestamps are missing, the reminders were manual, or the clock was reset after a status change. The fix is to require automatic deadline tracking with exportable timestamps in the RFP.

Do small companies really need a full whistleblowing platform, or is a shared mailbox enough?

A shared mailbox fails the Directive on three counts: it does not reliably protect identity, it does not generate the acknowledgement and feedback timestamps a regulator expects, and it offers no audit trail. The European Commission's guidance and national supervisory authorities have been consistent on this; a purpose-built channel is the only safe default.

What is the difference between anonymity and confidentiality in a whistleblowing channel?

Anonymity means the reporter's identity is not known to the organisation, even in principle; confidentiality means the identity is known but restricted to authorised handlers. Both satisfy the Directive, but anonymity is harder to engineer and requires the strongest intake controls.

How long must whistleblowing records be retained?

The Directive does not set a single retention period; the period is set by national transposition and by the organisation's record-of-processing rules. The safer default is to retain case data only as long as the case is active and the follow-up is documented, then delete it on a documented schedule.

Should whistleblowing software be per-user or flat-priced?

Flat pricing with unlimited internal users aligns the tool with the obligation: the more colleagues who can receive and triage, the safer the channel. Per-user pricing creates the wrong incentive and is worth pushing back on in the procurement phase.

Sources