Self-hosted whistleblowing software for the EU Directive (no per-year SaaS bill)

The EU Whistleblowing Directive (2019/1937) requires organisations with 50 or more employees to run a secure internal reporting channel — one that protects the reporter's identity and lets them follow up. It is not optional, and for the sensitive data involved, where that channel runs matters as much as that it runs.

What the category costs

The vendors in this space — FaceUp, NavEx, and most enterprise GRC suites — are quote-gated: their pricing pages say "Get a Quote" or "Book a Demo", never a number. Whistlelink is one of the few with visible pricing, and it is a recurring annual fee. Either way you are renting a channel for a legal duty, and handing the most sensitive reports your organisation will ever receive to a third party's cloud.

The buy-once option — and why self-hosting fits this one especially

Confida is a self-hosted, genuinely anonymous whistleblowing channel you buy once. A reporter files a case with no name, email, phone, or IP collected — follow-up is by case code plus a passphrase kept only as a one-way hash — and a handler communicates back through a two-way thread on the case, with the reporter still anonymous.

Self-hosting is a stronger fit here than almost anywhere else in the catalog: the whole point of a whistleblowing channel is that reports stay confidential and out of the wrong hands. Running it on your own server means the sensitive reports never sit in a vendor's database at all — you control the box, the backups, and the access.

• One payment, no per-report or per-year meter for a channel you are legally required to keep running.
• Anonymous by construction — no identity fields exist to leak, and the passphrase hash is never shown or exported.
• Your data, your server — the strongest possible answer to "who can see these reports?"

The honest limit

Confida is the reporting channel and case thread — it is not a full GRC suite with policy management, DPIAs, breach workflows, or staff-training records. If you need those, the enterprise suites bundle them (and charge for them). If you need the Directive's core requirement — a secure, anonymous, followed-up channel — Confida is that, owned, for one price. Its own product page lists exactly what it does and does not do before you buy.

Every vendor figure in this category also lives in the Price Observatory — verified, dated, and source-linked, free to cite — and the calculator turns those figures into your own three-year number in ten seconds.