Open source whistleblowing software compared

Four open source projects, side by side. Every fact comes from the project's own site or repository, as of 2026-09. Where a source says nothing, the cell says not stated.

Facts side by side

As of 2026-09 OpenWhistle GlobaLeaks SecureDrop Hush Line
Licence GPL-3.0 [1] AGPL-3.0 [2] AGPL-3.0 [3] AGPL-3.0 [4]
Stack Python, FastAPI, PostgreSQL, Redis Python (Twisted), Angular, SQLite Python Python
Hosting Self-hosted: Docker Compose or Helm Self-hosted on Debian or Ubuntu, package or Docker Self-hosted on dedicated physical servers; virtualisation not supported Managed service at tips.hushline.app; self-hosting not stated
Built for Companies and public bodies under EU Directive 2019/1937 and HinSchG Media, activists, public agencies, corporations Media organisations and NGOs Journalists, lawyers, employers and boards, educators, organisers
HinSchG 7-day / 3-month deadlines Built in, per case, with opt-in reminders Not stated; per-report reminders and expiration dates Not stated Not stated
Case management Statuses, assignment, notes, linked cases, audit log Custom statuses and sub-statuses, labels, audit log Not stated Message status management
Several organisations, one installation Yes, a reporting link per organisation Yes, multiple sites Not stated Not stated
Tor onion service Optional; you run the Tor daemon Set up automatically (v3) Yes Yes
Interface languages 4 70+, including right-to-left 22 Not stated
Staff two-factor login TOTP, mandatory TOTP (RFC 6238) Two-factor code Optional TOTP
Published security audits None yet Six firms, reports published Five audits, 2013–2018, reports published Not stated
Since 2026 (first release 0.1.0) 2011; used by more than 30,000 organisations, per its site 2013; a project of Freedom of the Press Foundation 2023; Science & Design, Inc.
Latest release 2.1.1 (2026-10-03) 5.0.99 (2026-07-26) 2.16.1 (2026-07-08) 0.7.25 (2026-09-24)

Which one fits

GlobaLeaks is the mature reference among open source whistleblowing platforms. The other three answer narrower questions.

PickWhen
GlobaLeaks You need many languages or right-to-left scripts, a questionnaire builder, or several channels per site. You want years of track record and published audits, or a managed service instead of your own server.
OpenWhistle You are a German employer or authority and want the HinSchG case workflow built in: both deadlines per case, reminders, audit log, 3-year deletion. You already run Docker Compose or Kubernetes with PostgreSQL.
SecureDrop You are a newsroom or NGO receiving documents from sources, and can run dedicated hardware with an air-gapped viewing station.
Hush Line You are a person or small team who wants an encrypted tip line without running a server.

Managed GlobaLeaks

Some companies run GlobaLeaks for you. One example is opensource-hinweisgeberportal.de by splice digital GmbH [5].

  • The software is GlobaLeaks; the provider operates the server.
  • Hosting is in German data centres, on request on dedicated hardware.
  • Packages come with a 30-day money-back guarantee; the home page names no price.

The trade is the same for any managed service: someone else runs the server and processes the reports for you.

Sources

All read on 2026-09-27. A correction is welcome as an issue on GitHub.

  1. OpenWhistle: Documentation, Changelog, github.com/openwhistle/OpenWhistle.
  2. GlobaLeaks: globaleaks.org (organisations, languages, audits); features.rst (stack, sites, statuses, Tor, TOTP); recipient guide (reminders, expiration); releases.
  3. SecureDrop: securedrop.org (purpose, languages); hardware guide; What is SecureDrop? (audits); github.com/freedomofpress/securedrop (licence, stack, releases).
  4. Hush Line: hushline.app (audience, hosting, onion); github.com/scidsg/hushline (licence, stack, TOTP, releases).
  5. splice digital GmbH: opensource-hinweisgeberportal.de.