Dejan Jasnic · Co-founder & Compliance Lead, Trusty · 20+ years anti-fraud & compliance · ACFE Swiss Chapter Board
Whistleblowing software is the only one of the three options built to meet every requirement of EU whistleblowing law on its own. An email inbox and a phone hotline are both legitimate ways to receive reports, but each leaves gaps in confidentiality, access control, anonymity, deadlines or record keeping that you have to close with extra processes and manual work.
Under Directive (EU) 2019/1937, the EU Whistleblowing Directive, every private-sector employer with 50 or more workers must set up an internal reporting channel. For employers with 50 to 249 workers, that duty has applied since 17 December 2023. Public-sector bodies are covered too, and national law can extend the duty to smaller companies. The directive does not name a technology, so the choice of channel is yours, as long as it meets the safeguards in Article 9. This guide compares email, a hotline and dedicated software requirement by requirement.
one platform
Email and hotlines leave compliance gaps. Trusty gives you a secure reporting channel that meets every EU Directive requirement, ready in less than five minutes.
What is a whistleblowing system?
A whistleblowing system is the combination of channels, people and procedures an organisation uses to receive, assess, investigate and document reports of wrongdoing. The channel is only the entry point. Behind it you need designated case handlers, a written procedure, a way to stay in contact with the reporter and a secure record of every case.
The directive lets each organisation choose its channels. Its recitals give examples: written reports by post, a physical complaint box or an online platform, and oral reports by telephone hotline or another voice messaging system. On request, a reporter must also be able to meet someone in person within a reasonable time.
If you need a compliant channel quickly, Trusty’s whistleblowing software is live in minutes, from €49 a month.
What EU law requires from a whistleblowing system
EU law requires a whistleblowing system to be secure, confidential, impartially handled and documented, with fixed response deadlines. Articles 9, 16, 17 and 18 of the directive set seven tests that any channel has to pass:
1. Reporting route. People can report in writing, orally or both, and can request an in-person meeting (Article 9(2)).
2. Confidentiality. The identity of the reporter, and of anyone named in the report, is not disclosed beyond authorised staff without the reporter’s explicit consent (Article 16).
3. Restricted access. The channel is designed so that staff who are not authorised cannot access reports (Article 9(1)(a)).
4. Impartial handling. An impartial person or department follows up, stays in contact with the reporter and asks for more information where needed (Article 9(1)(c)).
5. 7-day acknowledgement. The reporter receives confirmation of receipt within seven days (Article 9(1)(b)).
6. 3-month feedback. The reporter is told what action is planned or has been taken within a reasonable time, no later than three months after the acknowledgement (Article 9(1)(f)).
7. Record keeping. Every report is recorded, kept confidential and stored no longer than necessary, and personal data that is clearly irrelevant is deleted without undue delay (Articles 17 and 18).
Two further duties apply whichever channel you choose. You must give clear, easily accessible information on how to report externally to the competent authorities (Article 9(1)(g)). And if a third party operates the channel for you, which the directive allows, the same safeguards apply to that provider (Article 8(5)).
National laws build on this baseline. Spain requires internal channels to accept and process anonymous reports, and failing to have a compliant internal system can cost a legal entity up to €1 million. Germany does not require channels to accept anonymous reports, but failing to set up an internal channel can lead to a fine of up to €20,000. If you employ people in more than one country, an anonymous route with two-way contact is the safe default.
Why an email address is rarely enough for whistleblowing
An email address can serve as a written reporting channel, but on its own it rarely meets the confidentiality and access requirements. The directive does not mention email specifically. What matters is that the channel is secure and that staff who are not authorised cannot reach the reports.
A standard mailbox struggles with that for five reasons:
• IT administrators can read it. Mail servers, backups and admin accounts give access to people who are not case handlers.
• The sender is identified. A work email address reveals the reporter, and a private one can still be traced.
• Messages go to the wrong people. Auto-complete, forwarding rules and shared inboxes can send a report to colleagues, or even to the person it concerns.
• Nothing tracks the deadlines. The seven-day and three-month clocks depend on someone remembering them.
• Records are scattered. Replies, forwards and attachments spread across inboxes, which makes a clean case file and GDPR-compliant deletion hard.
Email costs nothing to set up, which is why many small employers start there. If you keep it, limit the mailbox to named case handlers, keep it out of general admin access where you can, log every report and deadline in a separate case register, and write a procedure that explains how anonymous reporters can be contacted again.
A whistleblowing hotline covers only part of EU law
A whistleblowing hotline meets the oral reporting requirement, since the directive accepts reports by telephone or another voice messaging system. On its own, though, a phone line does not cover documentation, follow-up or deadline tracking.
A hotline has real strengths. Some people find it easier to explain a concern by speaking than by writing, a call needs no account or device login, and a trained operator can ask clarifying questions straight away.
Article 18 also sets specific record-keeping rules for oral reports:
• Consent to record. A call may be recorded only with the reporter’s consent, in a durable and retrievable form.
• Transcript or minutes. On a recorded line, you keep the recording or a complete and accurate transcript. On an unrecorded line, staff write accurate minutes of the call.
• Right to check. The reporter must be offered the chance to check, correct and agree the transcript or minutes by signing them.
• In-person meetings. The same consent and documentation rules apply when someone asks to report face to face.
The practical gaps are follow-up and anonymity. An anonymous caller cannot be contacted again unless you give them a way back in, and a recognisable voice can identify someone in a small team. Staffed lines also cost more as you add languages and opening hours, and outside those hours reports wait in a voicemail box that still has to be secured and logged.
What is whistleblowing software?
Whistleblowing software is a secure online platform where people submit reports and designated case handlers manage them from intake to closure. It combines the reporting form, two-way communication with the reporter, the case file, deadline tracking and the audit trail in one place. Because the platform sits outside the company’s email and file systems, only the case handlers you name can open reports.
How whistleblowing software meets the legal requirements
Whistleblowing software meets the legal requirements by building them into the workflow, so compliance does not depend on individual discipline. A good platform covers each test like this:
• Reporting route. A web form handles written reports, and voice messaging handles oral ones.
• Confidentiality and access. Reports sit outside the company mail system, and only named case handlers can open them.
• Anonymity with follow-up. The reporter gets an access code and returns to a private inbox to answer questions, without giving a name or email address.
• Deadlines. Each case shows its status and dates, so the seven-day and three-month limits are visible.
• Records. Every action is logged against the case, which gives you one file to show an authority or a court.
• Languages and entities. One platform can serve several countries, with a separate case team for each legal entity.
The trade-off is a subscription cost and a short setup. For most employers above the 50-worker threshold, that is less effort than building and maintaining the same safeguards around a mailbox or a phone line, and the case history gives you evidence of compliance if an authority asks.
Whistleblowing software vs. email vs. hotline: how they compare
Software passes all seven legal tests without extra processes, while email and a hotline each pass some and need workarounds for the rest.
Requirement | Email inbox | Phone hotline | Whistleblowing software |
|---|---|---|---|
Written reports | Yes | No | Yes |
Oral reports | No | Yes | Yes, with voice messaging |
Confidentiality of identity | Weak: sender address is visible | Partial: voice can identify | Yes |
Access limited to case handlers | Hard: IT admins can reach mailboxes | Depends on who answers | Yes, role-based |
Anonymous reporting with follow-up | No | No way to call back | Yes, through a private inbox |
7-day and 3-month deadlines | Tracked by hand | Tracked by hand | Visible on each case |
Record keeping | Scattered across inboxes | Needs consent, transcript and sign-off | One logged case file |
Several languages and entities | One mailbox per case team | Higher staffing cost | One platform |
Setup effort | Minutes, plus written procedures | Days to weeks | Minutes |
The three are not mutually exclusive. Many employers run software as the main channel and add a phone option for people who prefer to speak. If you combine channels, route every report into the same case file so deadlines and records stay in one place.
keep the proof
Replace email and hotline workarounds with one secure system. Trusty handles written and voice reports, anonymous follow-up, deadlines and audit records in one place. Or book a demo.
How to choose a whistleblowing system
Choose the whistleblowing system that passes the legal tests in every country where you employ 50 or more workers, then compare on effort and cost. Eight questions settle most decisions:
1. Can people report both in writing and by voice?
2. Can someone report anonymously and still answer follow-up questions?
3. Who, including IT staff, can technically access a report?
4. Does the system show the seven-day and three-month deadlines for each case?
5. Does it produce a complete, time-stamped record of every case?
6. Is the data hosted in the EU or EEA, and can you delete it on schedule?
7. Does it cover every language your workforce speaks?
8. Can each legal entity have its own case handlers and access rights?
A no to question 3 or 5 is a compliance gap everywhere in the EU, because access control and record keeping come from the directive itself. A no to question 2 is a gap in countries that require anonymous reporting, such as Spain. Questions 6 to 8 matter most for groups with staff in several countries.
Recommended whistleblowing software
Trusty is whistleblowing software built around the EU Whistleblowing Directive, and it sets up an internal reporting channel in less than five minutes. It answers yes to all eight questions above:
• Written and voice reports. An online form plus in-browser voice messages, with voice disguising so a speaker cannot be recognised.
• Anonymous two-way contact. Reporters return to a private inbox with an access code, so case handlers can ask questions without learning who they are.
• Controlled access. Role-based permissions, with separate case handling for each legal entity.
• Deadlines and records. A case dashboard, a qualified eIDAS timestamp on each report and a tamper-proof audit log.
• EU hosting. Data is hosted in ISO/IEC 27001 certified data centres in Germany.
• Ready to roll out. Compliance policy templates and employee training are included.
• Phone option. A hotline can be added for teams that want one.
Try Trusty free for 7 days at trusty.report, or book a short demo to see a report travel from submission to closed case.
Frequently asked questions about whistleblowing systems
No. EU law requires an internal reporting channel for employers with 50 or more workers, but it does not prescribe software. Software is simply the easiest way to meet the confidentiality, deadline and record-keeping rules together.
An email address can count as a written channel, but only if unauthorised staff, including IT administrators, cannot access the reports. A standard company mailbox usually fails that test without extra controls.
No. The directive lets employers offer written reporting, oral reporting or both. A hotline is one way to offer oral reporting, and voice messaging is another.
It depends on the country. The directive leaves the decision to member states, and Spain requires employers to accept anonymous reports. Anonymous whistleblowers who are later identified are protected everywhere in the EU.
Yes. The directive allows a channel to be operated by an external third party. The employer remains responsible for confidentiality, follow-up and deadlines.
A whistleblowing system is the whole process for receiving, handling and documenting reports. A hotline is one intake route within that system, limited to phone calls.
Setup takes minutes for the platform itself. With Trusty, an internal reporting channel is ready in less than five minutes, and you then add your case handlers, languages and policy.
Cost depends on the channel: email has no licence fee but needs manual processes, a staffed hotline grows with languages and hours, and software is a subscription. Trusty offers a 7-day free trial.
Sources
• Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law, EUR-Lex
• Trusty, product information
• Ley 2/2023 on the protection of persons who report regulatory breaches, Spain, BOE
• Hinweisgeberschutzgesetz (HinSchG), Germany
This article is general information, not legal advice.
with EU Directive & GDPR
Whistleblowing software made simple, built by compliance experts.