Transparency note
This article is written by the developers of OpenWhistle. It is therefore not neutral. We only cite facts the providers publish themselves, retrieved on 27 September 2026. We make no quality judgements about other products. Prices can change; the provider's linked page is authoritative.
Whether you buy software for the Whistleblower Protection Act (HinSchG) or run it yourself: seven criteria separate the providers. They are questions, not grades. The third column answers them for OpenWhistle.
How to compare providers
| Criterion | What you ask | OpenWhistle |
|---|---|---|
| Hosting location | In which country are the servers? Who processes the data on your behalf? | Your server; you choose the location |
| Encryption | Are reports and attachments encrypted at rest? Who holds the key? | a separate key per report; master key not in the database |
| Anonymity | Does the system store IP addresses? Are follow-up questions possible without an identity? | no IP storage; follow-up via case number and PIN |
| HinSchG deadlines | Does it track the 7 days and 3 months under § 17? | both counters per case, email reminder optional |
| Languages | In which languages can employees report? | 4: German, English, French, Portuguese (Brazil) |
| Pricing model | Licence, subscription or per user? What does operation cost? | €0 licence; you bear server and operation |
| Ombudsperson service | Does the provider supply an external ombudsperson (§ 14 Abs. 1 HinSchG)? | no, software only |
Where the data lives and what is encrypted is explained in Whistleblowing system with EU hosting and GDPR. The software itself is described in OpenWhistle whistleblowing software.
The options at a glance
| Product | Model | Licence | Hosting | Price according to provider | Languages |
|---|---|---|---|---|---|
| GlobaLeaks | Software | AGPL-3.0 | self-hosted | €0 licence | over 70 |
| OpenWhistle | Software | GPL-3.0 | self-hosted | €0 licence | 4 (interface) |
| Hinweisgeberportal OpenSource | managed GlobaLeaks | AGPL-3.0 (software) | data centres in Germany | from €39/month billed annually, €49 monthly, plus VAT | not stated |
| WhistlePort | SaaS | proprietary | Germany, ISO/IEC 27001 | €69/month plus VAT | 3 (report form) |
| EQS Integrity Line | SaaS | proprietary | external servers, ISO 27001 | not stated | over 80 |
Sources, all retrieved on 27 September 2026:
- GlobaLeaks: globaleaks.org (languages), GitHub repository (licence, releases).
- OpenWhistle: documentation and GitHub repository.
- Hinweisgeberportal OpenSource by splice digital GmbH, Hamburg: pricing page, “Company Bundle” plan.
- WhistlePort by VON RUEDEN Partnerschaft von Rechtsanwälten, Berlin: pricing page, platform licence.
- EQS Integrity Line by EQS Group: packages page; it states no price.
The BKMS System, also from EQS Group, is missing from this version. Its website was unreachable on the reference date.
GlobaLeaks: the mature reference
Anyone looking for an open-source whistleblowing system lands on GlobaLeaks first. The project has existed since 2011, OpenWhistle only since April 2026.
| Feature | GlobaLeaks | OpenWhistle |
|---|---|---|
| Since | 2011 | April 2026 (0.1.0) |
| Current release | 5.0.99, 26 July 2026 | 2.1.0, 27 September 2026 |
| Licence | AGPL-3.0 | GPL-3.0 |
| Programming language | Python, TypeScript | Python |
| Installation | Debian, Ubuntu; Docker | Docker Compose, Helm |
| Minimum RAM per docs | 1 GB | 512 MB |
| Tor | built in | optional onion address |
| Two-factor sign-in | supported | mandatory for every account |
| Multiple organisations | “Sites” | Multi-tenancy |
| Deadlines | reminders, expiry date per report | counters for 7 days and 3 months under § 17 HinSchG |
| Languages | over 70 | 4 |
Sources: GlobaLeaks documentation, in particular the requirements; for OpenWhistle the changelog.
Since 2011, six independent auditors have audited GlobaLeaks, among them Cure53 and Radically Open Security; the reports are published. The translations come from the Localization Lab community. The Digital Public Goods Alliance lists GlobaLeaks as a “Digital Public Good”. OpenWhistle has no external audit yet.
Run it yourself or have it run for you
Open source does not mean you have to run servers yourself. For GlobaLeaks there are managed offerings, such as Hinweisgeberportal OpenSource by splice digital GmbH. We know of no such offering for OpenWhistle.
| You have | Obvious model | Examples |
|---|---|---|
| your own IT or an IT service provider | self-hosted software | GlobaLeaks, OpenWhistle |
| no IT, but want open code | managed open source | Hinweisgeberportal OpenSource |
| no IT, budget for a service | SaaS | WhistlePort, EQS Integrity Line |
| nobody to staff the reporting office | external ombudsperson (§ 14 Abs. 1 HinSchG) | for example WhistlePort package 3: lawyers as external compliance managers |
What no system does for you
- The oral channel. Reports must also be possible by telephone (§ 16 Abs. 3 HinSchG).
- The people. Whoever handles reports must be independent and competent (§ 15).
- The follow-up. Examining, investigating and remedying stays with the employer (§ 14 Abs. 1, § 18).
- The contract. For every external service you need a data processing agreement under Art. 28 GDPR.
Try OpenWhistle without installing it
The live demo shows the reporting wizard and the admin area with sample data. It is reset every 6 hours.
Open the live demo →Conclusion
GlobaLeaks is the mature open-source reference, with over 70 languages. OpenWhistle is younger and explicitly tracks the deadlines of § 17 HinSchG. Neither costs a licence fee. The managed and commercial offerings cost money and take operation off your hands in return.
Try both open-source systems before you decide: the OpenWhistle demo and the GlobaLeaks demo.
More resources: Free whistleblowing system: what it really costs · HinSchG compliance guide · Step-by-step installation guide