11 whistleblower hotline providers, compared

A company that runs the channel through which employees, suppliers and the public raise concerns about an organization, and passes what arrives to the people who investigate. Most started as telephone answering services and added web forms, apps and case management; a few started as software and added a phone line or an AI voice agent. The table above shows what each of the 11 providers publishes about its own service.

Providers publish anything from hours to months. FaceUp and Whistleblower Software describe self-serve setups of a few hours to a few days; SpeakUp's FAQ says most organizations go live within eight weeks; EQS gives a few business days for standard programs and eight to twelve weeks for multinational ones; NAVEX's telephony onboarding runs thirty to sixty days. Confide's standard setup is one business day, with enterprise rollouts at three to six weeks.

Requirements depend on your organization, sector and locations. The EU Whistleblowing Directive requires covered organizations to provide internal reporting channels. SOX section 301 requires complaint procedures for covered audit committees, and FAR 52.203-13 requires an internal reporting mechanism for covered contractors. The UK Public Interest Disclosure Act protects qualifying disclosures but does not impose a general duty on every employer to run a hotline. Check the rules and your reporting policy before choosing a channel.

It varies more than the listings suggest. Safecall, Ethico and Case IQ answer with their own staff; NAVEX runs its own contact centers with interpreting partners; FaceUp's live line runs through AnswerNet; SpeakUp and Whistlelink record a message instead of answering; several providers do not say. Ask who takes the call, where they sit, and whether the person who answers is the person who writes the report.

Of the 11 providers compared, Confide and Whistlelink have verified public purchase pricing. Confide starts at USD 2,000 a year by headcount, with unlimited users and cases. Whistlelink starts at USD 119 a month with annual billing and self-service activation after its trial. Other providers require a quote or confirmation of the complete purchase terms.

Pricing calculator →

ISO 27001 for the information security management system, a SOC 2 Type II or ISAE 3000 Type II report for the service itself, and GDPR terms if you have reporters in Europe. Check whether a certificate covers the provider or only the cloud it runs on, and where the data is hosted. Confide holds ISO 27001 and SOC 2, works under GDPR and hosts in Frankfurt.

You need a channel that people without a company device or a private space can use, and some laws expect oral reporting to be available. A phone line answered by a person is one way to meet that. Voice reporting in a browser is another: the reporter speaks from any phone, nobody hears the real voice, and the words reach you as they were said. If your policy promises a staffed line, keep one; if it promises a confidential way to speak, both qualify.

Not as separate companies. Expolink's website now redirects to NAVEX, and Lighthouse Services redirects to Mitratech, where the service continues under the Syntrio name. Lists that still name them as independent providers are out of date.

No. Protect is a UK charity that runs a free, confidential advice line for workers thinking about blowing the whistle, and offers employers benchmarking, consultancy and training. It does not run a reporting line on an employer's behalf.

Reporters speak inside the product from any browser or phone, in their own language. The recording is distorted and transcribed into the case, Echo asks the follow-up questions while they are still there, and anonymous reporters keep a key to read updates and answer later. The hotline page shows how a voice report arrives as a case.

Voice reporting →