EU Directive 2019/1937 & HinSchG

Free, open source
whistleblowing
software

OpenWhistle is free, open source whistleblower software: the self-hosted internal reporting channel that EU Directive 2019/1937 and Germany's HinSchG require.

Try the demo → Read the docs
Version 2.4.0 GPL-3.0 Python 3.14 Docker
Anonymity

Anonymity you can verify, not trust.

No IP address at any layer, report times as the day only, attachment metadata removed.

How to check it →
Reporting office

Built for the reporting office.

7-day and 3-month deadlines, four-eyes deletion, audit log, roles and locations.

The admin guide →
Control

Free and under your control.

Your server, your data, no licence fee, no vendor.

Install it →
How it Works

From report to closed case

Two lanes. Whistleblower: fill in the form, anonymous or confidential, with no account and no e-mail; note the case number and PIN, shown exactly once; check status and reply at /status. The form has six steps. Category and description are required. The page continues only after ticking that the case number and PIN are saved. Reporting office: log in with password, LDAP or OIDC, then always TOTP; acknowledge receipt within 7 days; review and give feedback within 3 months. The report goes from the form to the acknowledgement, the feedback back to the status page. Two lanes. Whistleblower: fill in the form, anonymous or confidential, with no account and no e-mail; note the case number and PIN, shown exactly once; check status and reply at /status. The form has six steps. Category and description are required. The page continues only after ticking that the case number and PIN are saved. Reporting office: log in with password, LDAP or OIDC, then always TOTP; acknowledge receipt within 7 days; review and give feedback within 3 months. The report goes from the form to the acknowledgement, the feedback back to the status page.
The three months for feedback run from the acknowledgement; a late acknowledgement never moves them later.
Features

What each side gets

For the whistleblower
Access Case number and a UUID4 PIN, shown once. No account, no email address.
Mode Anonymous, or confidential: name and contact encrypted, shown to the case handler only after an audited reason
Follow-up Read replies and send messages at /status with case number and PIN
For the reporting office
Case work Statuses, assignment, internal notes, linked cases, PDF export
Alerts Opt-in email and webhook digests and deadline reminders
For whoever runs it
Sign-in Password, LDAP or OIDC, then always TOTP. Enrolment is mandatory.
Encryption Each report has its own data key; the master key is never in the database
Languages 5 languages: English, German, French, Spanish, Brazilian Portuguese
OpenWhistle's reports dashboard: status and location filters, a search field, and the report table with case number, category, status, submitted day, assignee, 7-day SLA and 3-month SLA. OpenWhistle's reports dashboard: status and location filters, a search field, and the report table with case number, category, status, submitted day, assignee, 7-day SLA and 3-month SLA.
The dashboard: one row per case, with both deadlines.
Compliance

Compliance by jurisdiction

EU

EU Directive 2019/1937

Private employers with 50 or more workers, financial services firms at any size, and the public sector need an internal channel. Reports are acknowledged within 7 days and answered within 3 months.

Requirement by requirement →
DE

Germany: HinSchG

The Whistleblower Protection Act has applied since 2 July 2023. Running no internal channel can cost up to €20,000 (a summary, not legal advice).

Section by section →
ISO 37002

Further jurisdictions

The core follows ISO 37002; another law is a profile on top.

How the profiles work →
Verify it

Check it yourself

OpenWhistle has one maintainer and no external audit yet. Everything else you can check yourself: the code, the signed images, and the list of every request that leaves your server.

What to check Review the code
Demo or install

Try it, then run it yourself

The public demo signs you in with prefilled credentials and is wiped every 6 hours. Never enter a real report there.

Your own installation takes three commands and one edit of .env. The /setup wizard then creates the first account.

Open the demo → Installation guide →
bash — openwhistle setup
$ git clone https://github.com/openwhistle/OpenWhistle.git
$ cd OpenWhistle && cp .env.example .env
# .env: COMPOSE_FILE, SECRET_KEY, DATABASE_URL, REDIS_URL
$ docker compose up -d

# Then open https://localhost/setup with the token from the app log
FAQ

Frequently asked questions

Is OpenWhistle really free?
Yes. It is licensed under the GNU General Public License v3.0. There is no paid tier, no paid feature and no subscription. You pay only for the server you run it on.
Is OpenWhistle open source?
Yes, OpenWhistle is open source under the GNU General Public License v3.0. The full source code is public on GitHub. You may audit it, change it and use it commercially.
Can I host it myself?
Yes, and only that way: you run OpenWhistle on your own server with Docker Compose or Helm. The project offers no hosted service. Reports stay on that server, in the EU if you put it there.
Does it meet the HinSchG?
It builds in what software can: the 7-day acknowledgement (§17 Abs. 1 Nr. 1), the 3-month feedback (§17 Abs. 2), contact with the reporter (§17 Abs. 1 Nr. 3), identity confidentiality (§8), documentation and its deletion after 3 years (§11). The organisation still needs an impartial reporting office and an oral channel.
Is the whistleblower anonymous?
No IP address is stored at any layer. nginx clears the client-IP headers and writes no access log, the middleware drops the peer address, no table has an IP column, and a Redis session holds only a random token. The reporter's own device and network still matter: a private window or Tor Browser helps.
Can I use OpenWhistle for my company?
Yes. The GPL-3.0 permits commercial self-hosted use. One installation can serve several organisations, each with its own reporting link. It suits companies from 50 employees, public bodies and financial firms.
What are the technical requirements?
Docker 24 or newer, Docker Compose v2, 1 vCPU, 512 MB RAM (1 GB recommended), 5 GB disk, a domain and an HTTPS certificate. PostgreSQL 18 and Redis 8 are bundled in the Compose stack.
Is there commercial support available?
No, there is no paid support tier. Community support is on GitHub Issues, where bug reports, feature requests and contributions are welcome.
How does it compare with GlobaLeaks, SecureDrop or Hush Line?
GlobaLeaks is the mature general-purpose platform, SecureDrop serves newsrooms, and Hush Line is a hosted tip line. OpenWhistle is built around the HinSchG case workflow. The comparison lists the facts, each with its source.
Which languages does it support?
The interface is in English, German, French, Spanish and Brazilian Portuguese. It follows the browser's language until the reader picks one; that choice is kept in a cookie.