What whistleblowing software is and how companies use it in 2026
Whistleblowing software is a safe reporting channel joined to a case system, and companies use it in 2026 to meet the EU Whistleblower Directive. Staff file a report through a web form. The report arrives encrypted and opens as a case, and every action on that case is logged. The law sets the deadlines for an answer, and the software tracks them.
What whistleblowing software does
Whistleblowing software does three jobs in one place. It takes a report in, holds that report in an encrypted case file, and records each person who opens or changes the file. The intake half is a form staff can fill in without giving a name. The case half is a panel where the handlers a company names can sort, look into, answer and close each case. The audit trail runs under both. It stamps every read and every edit with an account and a time. Those three parts are what makes a channel a compliance channel and not a shared mailbox.
That gap is bigger than it sounds. A mailbox cannot prove when a reply went out. Nor can it stop the wrong colleague from reading a name, or show an inspector who saw what. WeMoral is secure whistleblowing software, a subscription service that runs all three parts from one panel. Encryption covers a report in transit and again at rest. Frankfurt, Germany is where the case data lives, and it stays inside the EU. Access is set by role. A company picks which handlers may read a case, answer it or close it, and which of them may see the fields that hold personal data.
The channel suits any EU employer that wants the duty covered without adding to the working week. A single compliance officer can operate the channel end to end. A full compliance team can share the same channel through role-based permissions, limits on who sees personal data, and email alerts to the handlers on duty. PRO covers five panel users, and Enterprise lifts the cap. The handlers judge each case, and the software keeps the record.
Which employers have to run a whistleblowing channel in the EU
Employers with 50 or more staff have to run a whistleblowing channel in the EU. Bigger ones have had to for longer. Directive (EU) 2019/1937 set the first floor at 250 staff, in force since December 2021. The 50 to 249 band came in from December 2023. All 27 member states have since put the Directive into national law. The duty an employer really carries comes from that national text. So the detail differs from one country to the next.
Two deadlines run through every version of it. A report has to be acknowledged within 7 days, and the reporter has to get feedback within 3 months. Holding those two clocks is the plainest reason to buy software instead of improvising. A dated case record shows an inspector when the acknowledgement went out. It also shows what the reporter was told. National law decides whether an employer must take reports with no name attached. So the channel has to handle both routes, and let the employer pick.
Which countries outside the EU require a whistleblowing channel
Countries outside the EU require a whistleblowing channel too, though each frames the duty its own way. Japan is the closest match. Its Whistleblower Protection Act has covered reporters since 2006. Since 2022, an employer with more than 300 workers must run an internal reporting system. From 1 December 2026, punishing someone for a report becomes a crime there.
The United Kingdom took another route. The Public Interest Disclosure Act 1998 came into force on 2 July 1999 and protects almost every worker from the first day on the job. It guards the reporter rather than ordering a channel. Tribunal compensation for a dismissal after a protected disclosure carries no upper limit, which is a strong reason to run a channel anyway.
The United States has no single whistleblower statute at all. Protection is spread across the Whistleblower Protection Act of 1989, Section 806 of the Sarbanes-Oxley Act of 2002 and Section 922 of the Dodd-Frank Act of 2010. The last of those created the SEC reward programme, which pays a whistleblower 10% to 30% of the money collected once sanctions top $1 million. A worker with that option will use it if the employer offers no route of its own. The same software serves all four regimes, because every one of them needs a private intake route and a dated record of what was done.
How employees reach the reporting channel
Employees reach the reporting channel by three routes, and one employer can open all three. One route is a branded web link staff can save and share. The same form also sits inside the intranet, next to the payslip and the holiday booker. A printed QR code on a poster in a corridor, a canteen or a depot reaches the part of a workforce that never sits at a desk. All three feed one case pool, so the record stays in one place however the report came in.
Filing takes minutes. There is nothing for the reporter to install and no account to set up. A reporter can type what happened, record a voice message in the form, or attach files, photos and video as proof. A spoken route is a legal duty in several member states, and a recorder in the browser covers it with no phone line to staff. An antivirus scan runs over every upload before it lands in the case file. Hidden metadata comes off each file first, so a photo does not carry the spot it was taken in.
The moment the form is sent, the reporter gets a password-protected link and a one-time case code. Each is shown a single time, so both have to be written down. That pair is how a reporter comes back later. They read the handler's reply, answer a follow-up and add a document, and stay anonymous the whole way. The two-way thread is encrypted at both ends of the workflow. Contact runs through that thread alone, which keeps personal email addresses and phone numbers out of it.
Which languages a reporting channel has to speak
The languages a reporting channel has to speak are the ones staff use at home. The one the head office writes its policies in is not enough. A worker setting out a harassment case or a safety breach reaches for a first language. A form in the wrong one loses the detail that makes a report worth looking into. Reporter and handler also need to choose on their own. A case filed in Portuguese may well be read by a handler working in Polish. WeMoral runs 25 languages on both sides of the channel, with no extra licensing. An employer can switch on the full set or only the part its sites need.
| Bulgarian | Croatian | Czech | Danish | Dutch |
| English | Estonian | Finnish | French | German |
| Greek | Hungarian | Irish | Italian | Latvian |
| Lithuanian | Maltese | Norwegian | Polish | Portuguese |
| Romanian | Slovak | Slovenian | Spanish | Swedish |
That list is the 24 official languages of the European Union, plus Norwegian. Wording a customer writes itself follows the same set. A renamed field or an added question carries its own text in each language a company turns on. So a custom form is not stuck in the language it was built in.
What whistleblowing software costs
Whistleblowing software costs either a flat monthly fee or a deal struck on a call. Which one you get follows whether a vendor shows a rate at all. WeMoral PRO is €79 a month, net, and paying by the year takes 20% off. The free trial runs 30 days and carries the full PRO feature set. So a company can run real reports through the channel before any money moves. Enterprise is quoted on request. It adds unlimited panel users, unlimited forms, the reporting page on a corporate domain, single sign-on and several company accounts in one console.
The PRO fee already carries the parts the law leans on: unlimited reports, the audit log, the corrective-actions registry, two-factor sign-in, the antivirus scan and the custom terms and privacy text. Branding the page with a logo and a colour set costs the same. Updates cost nothing extra. The larger suites in this category are usually priced after a sales call. A figure a buyer can read before making contact helps when a shortlist is drawn up.
The category comes down to four parts. An employer in scope of the Directive needs a form staff trust, a case file only named handlers can open, a log that holds up in an audit, and a price a finance team can plan against. In 2026 those four parts arrive as a monthly subscription.