Encrypted in the reporter's browser
Report bodies and attachments are encrypted before they leave the reporter's device. The server stores ciphertext it cannot read, and the report page collects no IP address.
For startups
Whistleblowing software for startups, live before the questionnaire arrives.
The directive applies at 50 employees and investors ask sooner. Publish an end-to-end encrypted channel in 10 minutes, without a compliance hire or a consultant.
Last reviewed: November 6, 2026
50
Employees at which the EU directive expects an internal reporting channel
17 Dec 2023
Date the deadline passed for companies with 50 to 249 employees
10 min
From sign-up to a published, encrypted report form
€23/mo
Ashio annual plan, transparent pricing
Why now
The obligation arrives before the compliance team does.
Regulatory requirements begin at 50 employees. Procurement questionnaires arrive much earlier. Neither waits for a company to hire its first compliance officer. Ashio gives founders a practical way to get ahead of both: a ready-to-publish compliance channel they can set up and manage themselves. One flat price, one page of settings, and no implementation project.
What applies
Three rules a small company actually runs into.
None of this needs a consultant to read. It needs a channel that exists, and a record of how each case was handled.
EU Whistleblowing Directive 2019/1937
Private companies with 50 or more employees must offer a confidential internal channel, acknowledge a report within seven days and give feedback within three months. Financial and insurance firms are covered at any size.
Customer and investor due diligence
Enterprise buyers and funds ask how staff can report misconduct before they sign. A working channel answers that with a link instead of a policy document and a promise.
National implementation
Each member state transposed the directive with its own thresholds and deadlines, and some go further than the minimum. The guide lists what applies per country.
Why Ashio
Built for a team where the same person also runs payroll.
No implementation call, no per-seat invoice, no second console to learn.
Published in 10 minutes
Name the organization, choose the languages and publish the form. Theme, anonymity option and policy text are settings, not a project.
One flat price per organization
Priced per organization rather than per seat, so a second case handler costs nothing extra. The 14-day trial needs no card.
Before you launch
Three decisions the channel does not make for you.
Publishing takes ten minutes. These three take an hour each, and they are the parts an auditor asks about.
- 1
Who reads it, and who answers
Pick the person who handles cases and give them their own encryption code, never a shared login: the timeline records which account opened a case and when. Then decide who answers the reporter, because the seven-day acknowledgment and the three-month feedback start at submission, not when you notice it.
- 2
How you tell people it exists
Employees, and the freelancers, contractors and partner firms who work for you: the directive protects all of them as reporters, so the link goes to everyone who might need it. A line in the onboarding pack or an all-hands mention is enough once it exists.
- 3
How long you keep a closed case
Choose the retention window in the settings: one, three or five years after closure, and the same figure appears in the notice reporters read. Nothing expires a case for you, so put the deletion in a calendar with a name against it.
Pricing
What a reporting channel costs a startup
Lean self-service tools for compliant whistleblowing start at roughly €20–30 a month and are often limited by employee count, while enterprise suites cost several hundred or more. Ashio is €23–29/month flat for the whole organization, whatever the headcount.
FAQ
Questions founders ask us.
We are under 50 people. Do we need a channel?+
Not under the directive, which applies at 50 employees and to financial firms at any size, but customers and investors ask earlier. Most startups publish one before the threshold.
Can we run it without a consultant?+
Yes. Name the organization, publish the form and invite a case handler in 10 minutes. The policy text is already translated and there is no onboarding call.
Who can read a report?+
Only the case handlers you invite, inside your organization. Reports are encrypted so the server holds ciphertext only, and each handler unlocks with their own encryption code.
Where is the data stored?+
On servers in Switzerland, covered by an adequacy decision, and the sub-processor list names every party involved. Report bodies are ciphertext before they reach the server.
What happens when we pass 50 employees?+
Nothing in the setup. The timestamped record, the retention setting and the access controls an audit asks about are already there. You add case handlers as the team grows.
Related
Continue exploring.
Publish the channel while the team is still small.
Live in 10 minutes. €23/month annual. ISO 27001 hosted. Built for startups.