Edition II, 2023
How best to meet the requirements for whistleblower protection? This question has been asked by our customers for a long time. Therefore, in 2022 we have already tested the applications available on the Polish market and published the results in the form of a ranking.
Maciej Kaczmarski - CEO ODO 24
We are pleased to present the results of the TOP 10 ranking of whistleblower applications that support proper implementation of whistleblower protection. For the study we invited the authors of all applications available on 15 August 2023. Our ranking primarily promotes safe platforms for whistleblowers to report legal violations. It is a useful resource for exploring applications that we can recommend with full confidence.
As declared last year, we continue to develop our ranking. We are delighted that more companies have joined this year, as our ambition is for the ranking to cover the full market offering and become the most trusted source of information in this area.
The ranking order was determined based on points earned for required criteria. In case of a tie, the order was decided by the total points for useful criteria. Due to the large number of criteria, for greater clarity we divided the set of 100 criteria into additional subcategories. Specific colours were assigned to the points for each criterion, according to the following scale:
| Application |  |  |  |  |  |  |  |  |  |  |
| Base points | 137 review | 137 review | 137 review | 137 review | 136 review | 136 review | 136 review | 135 review | 135 review | 135 review |
| Free application trial | Free trial | Free trial | Free trial | Free trial | Free trial | Free trial | Free trial | Free trial | Free trial | Free trial |
| Availability of whistleblower applications | ||||||||||
| Ability to provide required information | ||||||||||
| Response deadline reminders | ||||||||||
| Ability to send feedback | ||||||||||
| Support for multiple entities | ||||||||||
| Attaching scans, transcripts, recordings | ||||||||||
| Report register | ||||||||||
| Deletion of data after the retention period | ||||||||||
| Fulfilment of individuals' rights under the GDPR | ||||||||||
| Data processing agreement between Client and Provider | ||||||||||
| Data are not transferred outside the EEA | ||||||||||
| Provider supports DPIA execution | ||||||||||
| Provider is responsible for staff and subcontractors | ||||||||||
| Provider is responsible for hacking attacks | ||||||||||
| Provider is responsible for failures of its infrastructure | ||||||||||
| All subcontractors explicitly listed | ||||||||||
| Possibility to object to a change of subcontractor | ||||||||||
| Subcontractors are verified by the Provider | ||||||||||
| Ensuring anonymity – optional | ||||||||||
| Handling of reports by authorised persons | ||||||||||
| No linking of IP address to report content | ||||||||||
| Application security | ||||||||||
| Encryption / secure communication channel | ||||||||||
| Access control | ||||||||||
| Event logging | ||||||||||
| Intuitive interface, self-configuration | 2 points | 3 points | 3 points | 3 points | 2 points | 1 points | 3 points | 2 points | 2 points | 2 points |
| Additional features supporting follow-up actions | 3 points | 2 points | 5 points | 5 points | 2 points | 3 points | 1 points | 1 points | 1 points | 1 points |
As you can see in the table above, the TOP 10 of the ranking included applications that meet the vast majority of required criteria, to the highest or high degree. The last two criteria were subject to an individual and therefore by nature subjective assessment by ODO 24 experts. This assessment is however based on a reliable review of all applications. For distinction we present it in traditional scoring form.
| Application | | | | | | | | | | |
| Optional features | 91 | 86 | 85 | 80 | 92 | 85 | 83 | 69 | 59 | 36 |
| Reports via form and helpline | ||||||||||
| Provider liability insurance | ✕ | |||||||||
| Provider liability cap | ✕ | |||||||||
| Compliance with KNF guidelines | ✕ | ✕ | ✕ | ✕ | ✕ | |||||
| Document copy anonymization | ✕ | |||||||||
| Security management | ||||||||||
| ISO 27000 certificate | ✕ | ✕ | ✕ | |||||||
| Advanced encryption | ||||||||||
| Advanced access control | ||||||||||
| Extended interface | ||||||||||
| No integration with HR systems | ||||||||||
| Accessibility for people with disabilities | ✕ | |||||||||
| Management of breach reports | ||||||||||
| Mobile application | ✕ | ✕ |
Below is a list of companies that were invited to this year's edition of the whistleblower application ranking. More companies have registered and agreed to have their application assessed. We note that not all of the platforms listed below participated in the ranking. The list includes: Alertador, Amodit, Animativ, Anonimowy Sygnalista, CS-Sygnalista, Demaskator,* E-nform, EQS Integrity Line, e-SDS, e-Sygnalista, Ethicontrol, EY VCO, Genprox, GoWhistle, Gwizdek, HeroApp, Hintbox, Just Report, Linia Etyki, LogPlus, Notibox, Oxari, Panel Sygnalisty, Qualitime, Signalink, Sygnalista SygnaliściApp, Sygnalista.com, Sygnalisci.org, Sygnalista.net, Sygnalo, Syon, Sygnanet, WeMoral, Whiblo, Whistboard, Whistleblower Software, Whistlee, Whistlelink, Whistlesystem. We invite more companies!
* did not participate in the ranking
We have developed a set of 9 categories and 100 specific criteria based ona zero-one method, which made it possible to conduct a rigorous study. We divided these criteria into required (key) and useful (facilitations), and we assigned points according to weight from 1 to 3 points. Only two criteria (simplicity and intuitiveness of the interface and additional features supporting follow-up actions) were subject to individual assessment by ODO 24 experts, based on research conducted in stage I. For the remaining criteria, we relied on the explicit statements of the application authors.
Ranking position was determined by the total points for required criteria, and in case of a tie – by the total points for useful criteria. The maximum possible points were 140 and 96 respectively.
See more
Due to the large number of evaluation criteria, for greater clarity of the ranking we grouped criteria into subcategories. We also sought to ensure confidentiality of certain solutions used in the tested applications, for example in the "Data security" category. The list of useful criteria that facilitate use of applications – most of which fall under "Functionality" – speaks to the depth of our research.
Here are some of them: a mobile app version (Android / iOS / Huawei), phone or SMS reporting, reporting by e-mail, online chat (inside the application, with a live operator), custom naming of dedicated form links, export of application data in popular formats for migration to another application, customisation of the application's appearance for the client, extension of forms with additional fields for whistleblowers and administrators, conversion of documents to PDF, storage of additional documents in the application related to a report, visible only to the administrator, conversion of recorded calls to audio files (e.g. MP3/MP4), changing report statuses, priorities and categories, labelling (categorising) reports, notes and attachments by the whistleblowing coordinator, statistical and analytical reports on reports, automatic logging of operations performed, automatic assignment of reports to designated persons, creation of working teams – adding external users, revocation of permissions at any time, text recognition when attached documents are in graphic format (OCR – optical character recognition), multilingual interface, automatic confirmation of report receipt, predefined responses for whistleblowers (acknowledgement and feedback), PDF report summary with data anonymisation, ability to check whether a whistleblower (including anonymous) viewed report status, repository of system authorisations with confirmation of acceptance.
Whistleblower applications were reviewed by our experts in the field of personal data protection law, whistleblower protection and IT security in two stages. In the first stage, the review consisted of testing and analysing individual applications, both from the whistleblower reporting a breach and from administrators (coordinators, case managers, compliance officers, etc.) managing reports and the application itself. We were also interested in how follow-up actions after receiving a report are organised.
In the second stage, we asked application authors to complete a confidential detailed form containing 100 criteria subject to evaluation.
Please note that our whistleblower application ranking serves only as an auxiliary function when choosing an application, especially as point differences within the TOP 10 are minor. ODO 24 does not accept liability for business decisions made solely on the basis of an analysis of the results of our ranking.
Before you deploy a whistleblower application, update your security procedures. The law requires it.
As the application authors explain, Ethicontrol is a platform created by professionals who were dissatisfied with standard solutions and approaches to whistleblowers. The application allows not only receiving reports but also providing feedback, initiating and documenting explanatory proceedings, assigning responsible persons, escalating cases, generating reports, and analysing the effectiveness of the hotline and response team. The platform can simultaneously work with multiple portals or several business processes within a single client's operations.
Processing the personal data of whistleblowers and persons whose report relates to them involves a high level of risk. That is why it is worth preparing for implementation of whistleblower protection in line with GDPR requirements with due care for the personal data of persons submitting reports as well as persons who are the subject of a report.
SygnaApp is a fully compliant, secure and intuitive tool for receiving and handling whistleblower reports, also supporting explanatory proceedings. Thanks to extensive configuration options, it allows quick adaptation to the needs of any organisation. The application is designed for both internal and external reports. SygnaApp is used by companies of various sizes and public entities. The system supports capital groups and enables external entities to conduct explanatory proceedings.
EY Virtual Compliance Officer is a modular application enabling broader compliance activities. Despite extensive features, it is a simple and intuitive tool. According to the authors, the form is based on forensic best practices. In the most comprehensive package, there is an intelligent internal regulations repository module, as well as expert support in implementing procedures tailored to the client, evaluating reports, recommending follow-up actions, and conducting explanatory proceedings.
Whistlelink offers an online solution for reporting irregularities for small, medium and large companies and organisations, in full compliance with whistleblowing regulations. Whistlelink's ambition is to provide the most user-friendly irregularity reporting system in the world. Whistlelink is very easy to deploy and includes everything an organisation needs in this area. It is a global solution hosted in Sweden. No data is stored or processed outside the EU. The company holds ISO 27001 certification for information security management.
Hintbox is an intuitive system for whistleblowers that can be configured to your needs in less than 5 minutes. The system has ISO 27001 security certification and is GDPR compliant. Hintbox has gained the trust of many clients in Poland and Europe, is available in over 30 language versions, and can handle many types of reports. Thanks to end-to-end encryption, all data is stored securely. Even when submitting an anonymous report, the whistleblower remains in secure and confidential contact with the person managing reports.
EQS Integrity Line is an advanced application created to provide a secure and confidential platform for reporting incidents, complaints, abuses and other actions inconsistent with organisational ethics and principles. EQS Integrity Line has been on the European market for over 20 years. More than 2,500 companies use it, including the European Commission itself. The application enables reporting via various channels such as mobile app, website, e-mail and phone, giving employees and other stakeholders access anytime, anywhere.
Whiblo is a service that enables confidential written reporting of suspected illegal or unethical activities in an organisation. It allows an anonymous, encrypted dialogue between the whistleblower and the organisation after a report is submitted. The solution also supports report management through assignment to coordinators, status tracking, document storage, a report register and report generation. The application is compliant with regulations and ensures data security. It is a user-friendly system for any organisation.
The e-sygnalista.com platform is a Polish application also used in the USA, the UK and other European countries. Organisations can currently use it free of charge (the purchased annual licence period is counted from the entry into force of the act). The application was built on the experience of a team specialising in abuse risk analysis, investigative audit, anonymous reporting, and comprehensive explanatory proceedings. It works in a modern, anonymity-preserving way in the user's browser.
Statlook is a simple, intuitive and secure tool for reporting and handling irregularities in an organisation. It allows employees to confidentially or anonymously report workplace abuses. The system enables secure two-way communication between the whistleblower (including anonymous) and the person handling the report. The application can be an integral module of Statlook software, a standalone tool alongside that system, or completely independent. Statlook is software, not a SaaS service, ensuring compliance with Polish and European law.
e-SDS is an advanced tool for secure breach reporting, designed by Codefellow sp. z o.o. in close cooperation with Data Protection Advisory Group sp. z o.o. By combining modern technology with deep personal data protection expertise, the application ensures maximum information security. The platform operates on a SaaS model but also offers on-premises installation. Implemented security mechanisms meet the highest industry standards, guaranteeing reliability and protection of transmitted data.
