Self-hosted whistleblowing software for the EU Directive (no per-year SaaS bill)
The EU Whistleblowing Directive requires a secure reporting channel — and the SaaS options are quote-gated enterprise. Here is a self-hosted, anonymous channel you own outright.
The EU Whistleblowing Directive (2019/1937), through each Member State's transposition, obliges organisations with 50 or more workers to run a secure internal reporting channel — one that protects the reporter's identity and lets them follow up. It is not optional, and for the sensitive data involved, where that channel runs matters as much as that it runs.
What the category costs
The vendors in this space — FaceUp and NavEx, along with most enterprise GRC suites — are quote-gated. Read again on 5 September 2026, FaceUp's pricing page carries "Get a Quote" against every plan and no figure anywhere; NavEx publishes no price either, and the route its own site sends you down is named request-pricing.
Whistlelink is one of the few that prints a table. On 5 September 2026 it read in full:
| Employees | Monthly price |
|---|---|
| 0–49 | EUR 79 |
| 50–149 | EUR 99 |
| 150–249 | EUR 149 |
| 250–499 | EUR 199 |
| 500–999 | EUR 299 |
| 1000+ | Contact us |
Read the band before you read the price. The Directive's internal-channel duty starts at 50 workers, so for most organisations the lowest band they can actually sit in is the second — EUR 99 a month, not the EUR 79 the headline invites you to quote. One exception is worth knowing before you assume the cheap row is out of reach: Article 8(4) disapplies that threshold for entities covered by the Union acts listed in Parts I.B and II of the Directive's Annex — financial services and anti-money-laundering among them — so a twenty-person firm in one of those sectors carries the duty anyway, and the EUR 79 band is honestly its own. (Directive (EU) 2019/1937 at EUR-Lex, read 5 September 2026.) The company states it is "offered as an annual subscription", "invoiced annually at the beginning of your contract" and paid by bank transfer, and it offers a "30-day free trial with full access to all features" before any of that starts. Those figures were first read 5 July 2026, re-read 31 August, and read again 5 September 2026 without a change on any of the three occasions.
Either way you are renting a channel for a legal duty, and handing the most sensitive reports your organisation will ever receive to a third party's cloud.
The buy-once option — and why self-hosting fits this one especially
Confida is a self-hosted, genuinely anonymous whistleblowing channel you buy once — $119 — and one of the six registers in the Compliance Suite; the demo is open without a sign-up. A reporter files a case with no name, email, phone, or IP collected — follow-up is by case code plus a passphrase kept only as a one-way hash — and a handler communicates back through a two-way thread on the case, with the reporter still anonymous.
Try the Confida demo ↗Live, on sample data, no sign-up.
Self-hosting is a stronger fit here than almost anywhere else in the catalog: the whole point of a whistleblowing channel is that reports stay confidential and out of the wrong hands. Running it on your own server means the sensitive reports never sit in a vendor's database at all — you control the box, the backups, and the access.
- One payment, no per-report or per-year meter for a channel the Directive requires in-scope entities to keep running.
- Anonymous by construction — no identity fields exist to leak, and the passphrase hash is never shown or exported.
- Your data, your server — the strongest possible answer to "who can see these reports?"
The honest limit
Confida is the reporting channel and case thread — it is not a full GRC suite with policy management, DPIAs, breach workflows, or staff-training records. If you need those, the enterprise suites bundle them (and charge for them). If you need the Directive's core requirement — a secure, confidential, followed-up channel — and want anonymity on top of it, Confida is that, owned, for one price. Its own product page lists exactly what it does and does not do before you buy. Is a shared email inbox enough for the Directive? answers the question most organisations start with, and the best self-hosted whistleblowing tools in 2026 is the field guide.
Every vendor figure in this category also lives in the Price Observatory — verified, dated, and source-linked, free to cite — and the calculator turns those figures into your own three-year number in ten seconds.
Nothing here is legal advice. The Directive's text is at EUR-Lex and your national transposition governs — check both with your adviser.