Internal reporting channels
Organizations with 50+ employees must establish secure, confidential internal reporting channels for whistleblowers to report breaches of EU law.
EU Directive 2019/1937 aligned
Whistleblowing software built for Directive (EU) 2019/1937
Ashio is the reporting channel an EU whistleblowing program actually runs on: anonymous intake with no IP addresses and no cookies, an owner and a status for every case, the 7-day acknowledgment and 3-month feedback tracked, and an audit trail you can hand to an auditor. One flat price for the whole organization, live in about ten minutes.
Last reviewed: November 2, 2026
How the channel works, end to end
Four steps, from the moment someone decides to report to the file an auditor reads. Nothing to install, no IT project.
- 1
A report is filed
The reporter opens the company link and writes or records a voice message. No account, no email address, no IP address, no cookie, so nothing links the report to a person.
- 2
It is acknowledged
The platform acknowledges on submission when automatic acknowledgment is switched on; otherwise a handler acknowledges in the case file. The date is recorded either way and the seven-day clock starts.
- 3
The two exchange messages
The reporter comes back with the reference from the submission screen, reads the follow-up questions and answers them. The thread stays with the case instead of living in a mailbox.
- 4
The case closes with evidence
Owner, status, actions and decisions are timestamped on the case. The three-month feedback deadline is tracked, and the audit trail exports as the record an auditor or employee representation asks for.
Key obligations
What the software has to do
Those six are the Directive's own obligations, not a wish list. Software that misses one turns a legal duty into a policy with no evidence behind it.
Acknowledgment within 7 days
Reports must be acknowledged to the whistleblower within 7 days of receipt — no exceptions. Ashio tracks that deadline and can send the acknowledgement automatically.
Follow-up within 3 months
Organizations must provide feedback to the whistleblower on the follow-up to their report within three months of acknowledgment.
Protection against retaliation
Whistleblowers are protected from dismissal, demotion, and other forms of retaliation. The burden of proof lies with the employer in retaliation cases.
Data confidentiality and GDPR compliance
Personal data must be processed in accordance with GDPR. The identity of the whistleblower must be kept confidential throughout the process.
Record keeping
Organizations must maintain comprehensive records of all reports received and actions taken, with strict access controls.
What to check before you buy whistleblowing software
Six questions separate a real reporting channel from a form that only looks like one.
- 1
Can a report be filed without an account, and without leaving an IP address, cookies or a device fingerprint?
- 2
Does the software track the 7-day acknowledgment and the 3-month feedback with a deadline per case, or is that only in a policy?
- 3
Does every action land in an audit trail you can export, or is the history a mailbox?
- 4
Can suppliers and contractors report too, in their own language, without a login?
- 5
Is the price flat per organization, or does the bill grow with headcount and per report?
- 6
Who can read a report: a named case team with roles, or anyone with the shared inbox password?
Pricing
What does compliant whistleblowing software typically cost?
Lean self-service tools for compliant whistleblowing start at roughly €20–30 a month and are often limited by employee count, while enterprise suites cost several hundred or more. Ashio is €23–29/month flat for the whole organization, whatever the headcount.
What's included
- Anonymous intake workflows
- Secure two-way communication with whistleblowers
- Verbal intake via speech-to-text
- Structured case management
- Deadline monitoring
- Unlimited team members
- Notification management
- Audit-ready logging
- Adjustable branding
- Multi-language (18 languages)
- Attachments, encrypted and cleaned
- Two-factor authentication and single sign-on
What the market charges
Four billing models are sold in this market. Only the first stays predictable as headcount grows, which is why two quotes that look similar can differ by a factor of five.
Flat per organization
One invoice for the whole company, predictable from the first month whatever the headcount.
Per seat
Grows with headcount, and the people who may report are the number you cannot cap.
Per case
Grows with report volume, so the price rises when the channel is actually working.
Quote only
A number after a discovery call, which turns the budget into a negotiation.
Which ISO standard applies to whistleblowing software?
Three standards come up in every software evaluation and each answers a different question. None of them certifies the software itself.
- ISO 37002
- Guidance for a whistleblowing management system: how a report is received, assessed, investigated and closed. It is guidance, not a certifiable standard, so a badge saying ISO 37002 certified means nothing. What a buyer should ask instead: does the tool timestamp each of those steps?
- ISO 27001
- Information security management, and it applies to whoever holds the data. The question is not which logo a vendor shows but where the reports actually sit: Ashio is hosted in ISO 27001-certified data centers in Austria.
- ISO 9001
- Quality management. It says nothing about data protection, anonymity or reporting duties, and it appears in comparisons because it is easy to obtain, not because the Directive asks for it.
Where the reports live
servers in Austria certified to ISO 27001, inside the EEA, so no transfer outside the EU arises. Reports are encrypted in transit and at rest, the form records no IP address and sets no cookie, and the interface ships in 18 languages.
Does it fit your size?
The duty starts at 50 employees, the work does not. What changes with size is who receives a report and how many people need access.
Fewer than 50 employees
Private companies are outside the duty at this size, except in financial services, insurance and money-laundering prevention; public bodies are in scope at any size. A voluntary channel runs on one handler and one flat price.
50 to 249 employees
Here the duty applies: an internal channel, the seven-day acknowledgment and the three-month feedback. Usually two or three handlers with separate access, and a named backup for absences.
250 employees and more
Several teams, access split by entity, employee representation involved and reporting to the board. Same platform and more roles, and the audit trail becomes the monthly reporting source.
FAQ
Questions buyers ask
How long does it take to get the channel live?+
About ten minutes. Name the organization, add the people who may read reports, and share the report link. There is no onboarding project and no call to book: the trial channel is live before you speak to anyone.
Does it acknowledge a report automatically, inside the seven-day deadline?+
Yes, if the organization switches it on. Ashio acknowledges a report as soon as it is submitted, writes the date into the case file and starts the seven-day clock the Directive sets for acknowledging a report. Automatic acknowledgment is opt-in per company, so a case handler can also acknowledge by hand. Both paths are logged with their date and neither can be edited afterwards.
Does it fit a company with 20 to 50 employees?+
That is the size it was built for. A company in that range usually receives zero to two reports a year, so the platform has to be ready without anyone running it: no installation, a case file for every report, and deadlines tracked whether or not anyone remembers them. Larger organizations use the same platform with several handlers and separate teams, and one flat price covers the whole organization.
Which whistleblower systems are certified for EU Directive compliance?+
None — there is no certification scheme for Directive (EU) 2019/1937, and no vendor can be “certified compliant” with it. What you can verify instead: (1) anonymous reports without IP or cookie tracking, (2) an instrumented 7-day acknowledgment, (3) feedback and two-way dialogue within 3 months, (4) an immutable log of every status change, (5) guaranteed confidentiality of the reporter's identity, (6) protection from retaliation. The certificates you will actually see — ISO 27001 for hosting and information security, ISO 37301 for compliance management — cover those areas, not the Directive itself. Also ask where the data is hosted and who the processor is: those are verifiable facts, unlike a compliance label.
From the blog
Longer reads on choosing, moving and auditing a channel.
EU directives covered
Related compliance guides.
Explore Ashio's coverage of each EU regulation.
EU Whistleblowing Directive
The obligations, the deadlines and the national law behind each of them.
Read moreISO 37002:2021
How Ashio aligns with the global whistleblowing standard.
Read moreAnonymous reporting software
No IP, no cookies, no fingerprinting. End-to-end encrypted.
Read moreWhistleblowing software for every industry
Ready to meet your obligations?
Set up secure, compliant reporting channels in minutes with Ashio.