Internal reporting channels
Organizations with 50+ employees must establish secure, confidential internal reporting channels for whistleblowers to report breaches of EU law.
EU Directive 2019/1937 aligned
Whistleblowing software built for Directive (EU) 2019/1937
Ashio is the reporting channel an EU whistleblowing programme actually runs on: anonymous intake with no IP addresses and no cookies, an owner and a status for every case, the 7-day acknowledgment and 3-month feedback tracked, and an audit trail you can hand to an auditor. One flat price for the whole organisation, live in about ten minutes.
Last reviewed: November 2, 2026
Key obligations
What the software has to do
Those six are the Directive's own obligations, not a wish list. Software that misses one turns a legal duty into a policy with no evidence behind it.
Acknowledgment within 7 days
Reports must be acknowledged to the whistleblower within 7 days of receipt — no exceptions. Ashio tracks that deadline and can send the acknowledgement automatically.
Follow-up within 3 months
Organizations must provide feedback to the whistleblower on the follow-up to their report within three months of acknowledgment.
Protection against retaliation
Whistleblowers are protected from dismissal, demotion, and other forms of retaliation. The burden of proof lies with the employer in retaliation cases.
Data confidentiality and GDPR compliance
Personal data must be processed in accordance with GDPR. The identity of the whistleblower must be kept confidential throughout the process.
Record keeping
Organizations must maintain comprehensive records of all reports received and actions taken, with strict access controls.
Pricing
What does compliant whistleblowing software typically cost?
Lean self-service tools for compliant whistleblowing start at roughly €20–30 a month and are often limited by employee count, while enterprise suites cost several hundred or more. Ashio is €23–29/month flat for the whole organisation, whatever the headcount.
What's included
- Anonymous intake workflows
- Secure two-way communication with whistleblowers
- Verbal intake via speech-to-text
- Structured case management
- Deadline monitoring
- Unlimited team members
- Notification management
- Audit-ready logging
- Adjustable branding
- Multi-language (18 languages)
FAQ
Questions buyers ask
Do all companies need to comply?+
Legal entities with 50+ employees in the EU must comply. Some sectors (financial services, aviation, maritime) must comply regardless of size. Companies with fewer than 50 employees are exempt unless they operate in a regulated sector.
How long does it take to get the channel live?+
About ten minutes. Name the organisation, add the people who may read reports, and share the report link. There is no onboarding project and no call to book: the trial channel is live before you speak to anyone.
Is anonymous reporting required?+
The directive mandates confidential reporting, not anonymous. However, it encourages accepting anonymous reports. Ashio supports both.
Which whistleblower systems are certified for EU Directive compliance?+
None — there is no certification scheme for Directive (EU) 2019/1937, and no vendor can be “certified compliant” with it. What you can verify instead: (1) anonymous reports without IP or cookie tracking, (2) an instrumented 7-day acknowledgment, (3) feedback and two-way dialogue within 3 months, (4) an immutable log of every status change, (5) guaranteed confidentiality of the reporter's identity, (6) protection from retaliation. The certificates you will actually see — ISO 27001 for hosting and information security, ISO 37301 for compliance management — cover those areas, not the Directive itself. Also ask where the data is hosted and who the processor is: those are verifiable facts, unlike a compliance label.
EU directives covered
Related compliance guides.
Explore Ashio's coverage of each EU regulation.
Ready to meet your obligations?
Set up secure, compliant reporting channels in minutes with Ashio.