Trusty Whistleblowing: facts for vendor assessment
This page answers the questions a procurement, compliance, IT security or legal team asks before choosing a whistleblowing channel. Plain facts, no marketing, maintained by Trusty AG. Last reviewed: 15 October 2026.
Product page: Trusty Whistleblowing Software. Prices: Pricing. Contracts: Terms of Service, Whistleblowing Additional Terms, Price Document, Data Processing Agreement, DORA Addendum. Questions not answered here: book a walkthrough.
Product at a glance
| Item | Fact |
|---|---|
| Product | Trusty Whistleblowing: a public reporting website for whistleblowers, a pseudonymous inbox for two-way dialogue, and a case management suite for the handlers |
| Provider | Trusty AG, Hünenberg (canton of Zug), Switzerland, founded 2022 |
| Type | Software as a service, used in the browser, nothing to install, no app and no company email needed to report |
| Built for | Organisations with 50 or more employees that must run an internal reporting channel under the EU Whistleblower Directive 2019/1937 and its national laws, and any organisation that wants one |
| Standards | Developed to the requirements of ISO 37002 (whistleblowing management systems) and Directive (EU) 2019/1937 |
| Customers | More than 1,000 companies, from 50-employee firms to groups with 13,500+ employees |
| Plans | LITE, Standard, Advanced (self-serve, shared SaaS, live in minutes); Premium (individually deployed, quoted individually) |
| Set-up time | Minutes for the self-serve plans; Premium usually goes live within one month of signature |
| Trial | 7 days, all features unlocked (the plan toggle is preset to Advanced), card charged only after the trial, invoice available, cancel within the trial with no obligation |
| Pricing model | One flat price per organisation, unlimited employees, unlimited reports and storage, billed annually in advance, languages never charged extra |
| Hosting | Germany (EU) for LITE, Standard and Advanced. Switzerland, the United States or your own infrastructure with Premium |
Plans and features
| Feature | LITE | Standard | Advanced |
|---|---|---|---|
| Price (billed annually) | €49 per month, €588 per year | €69 per month, €828 per year | €99 per month, €1,188 per year |
| Admin users | 1 | 2 | Unlimited, roles Superuser, Admin, User, Limited User |
| Reporting languages | 1 | 2 | All supported languages |
| Secure reporting website, 24/7, mobile friendly, dedicated reporting URL | Yes | Yes | Yes |
| Anonymous or named reporting, switch from anonymous to named at any time | Yes | Yes | Yes |
| Configurable anonymity settings | No | No | Yes |
| Whistleblower inbox with secure two-way dialogue (random username and password, no personal data needed) | Yes | Yes | Yes |
| File attachments | Yes | Yes | Yes |
| Reporting form | Simple form | Structured, guided form | Structured, guided form, custom texts |
| “Ask a question” alongside reports | No | No | Yes |
| Voice message in the browser (oral reporting), transcript reviewed by the reporter, recording kept or deleted at the reporter’s choice | No | No | Yes |
| Supply-chain reporting (e.g. LkSG) | No | No | Yes |
| NIS2 cybersecurity vulnerability reporting channel | No | No | Yes |
| Branding | Predefined template | Predefined template | Own logo, colours, font, legal texts |
| Case handling | Basic: status, memo, dialogue | Standard: status, handling, follow-up | Standard plus workflows and automated reminders |
| Automatic receipt confirmation in the inbox (and by email if an address is given) | Yes | Yes | Yes |
| 90-day feedback countdown per case | Yes | Yes | Yes |
| Email notifications for new reports | No | Yes | Yes |
| Retention period management with deletion reminder | No (permanent case deletion available) | No | Yes |
| Granular access: visibility per category or case, limited users, technical admins without case access, conflict-of-interest exclusion | No | No | Yes |
| Related cases, templates, private notes, assignments, root cause analysis, emails to external recipients, documenting reports from other channels | No | No | Yes |
| Insights, dashboards, statistics export, report generation | No | No | Yes |
| Keyword search across all cases | No | No | Yes |
| DeepL machine translation | No | No | Yes |
| Tamper-proof, cryptographically chained audit trail of every entry, view and change | Yes | Yes | Yes |
| Single sign-on via your identity provider (Microsoft Entra ID or SAML 2.0) | Yes | Yes | Yes |
| Two-factor authentication | No | Yes, activated per user | Yes, activated per user |
| External ombudsperson or law firm as a user | No (1 user) | Yes, as one of the 2 users | Yes |
| Support | Online support, no guaranteed response time; critical errors handled 24/7 | Online support, 48-hour response; critical errors 24/7 | Online support, 24-hour response; critical errors 24/7 |
| Free online whistleblowing training for employees | 30 days from paid start | 30 days from paid start | 30 days from paid start |
Premium (groups, enterprises, regulated clients, partners): individually deployed on a dedicated private server in the region of your choice or on your own infrastructure, your own domain. Forms are fully configurable: report categories, mandatory and free-text fields, guidance texts and file uploads can differ by legal entity or country, with an entity or country selection before the form. Roles and permissions are defined by the organisation in any number, including visibility by legal entity. Several legal entities in one environment, each with its own reporting channel, separate case pools and a consolidated group view. Retention periods configurable per data category, access review reports for periodic access reviews, mandatory MFA, contractual 99 % SLA, telephone hotline add-on, DORA addendum for financial entities. One-time setup fee plus annual licence, quoted individually. Book a walkthrough.
Pricing, billing and contract terms
| Item | Fact |
|---|---|
| Contract | Online Terms of Service plus Whistleblowing Additional Terms and Price Document (no individual contract on the self-serve plans); Swiss law, courts of Zug |
| Billing period | 12 months in advance, in EUR |
| Payment methods | Card or bank transfer against invoice (payments processed by Stripe); the first invoice is due within 7 days |
| Set-up fees, per-seat fees, language fees | None |
| VAT | Prices exclude VAT |
| Price changes | Annual indexation to the EU consumer price index (Eurostat); other price increases apply from the next renewal only |
| Term and renewal | Runs until cancelled; cancel at any time from within the app, effective at the end of the paid term, full access until then, no notice period |
| Immediate termination | Possible before the end of the term as a paid manual service request |
| Trial | 7 days free, all features unlocked; cancel within the trial and nothing is charged; if nothing is changed, the annual subscription starts on the selected plan on day 8 |
| What happens at the end | Account locked for 30 days with export and account management available, then permanently deleted from production; deletion from backups follows the regular backup rotation |
| Liability | Capped at EUR 30,000 under the Terms of Service |
| Plan changes during the term | Upgrade at any time, the difference is charged pro rata for the remaining term; a downgrade takes effect at the next renewal |
Legal requirements covered
EU Whistleblower Directive 2019/1937 and the national transpositions. Trusty is a software provider, not a law firm: the client remains responsible for its own compliance, the table shows which feature supports which obligation.
| Obligation (Directive article) | How Trusty covers it |
|---|---|
| Protect the identity of the reporter and of anyone named; accept reports in writing or orally (Art. 9(1)(a), 9(2), 16) | Public reporting website and pseudonymous inbox for confidential follow-up; the reporter decides whether to stay anonymous; voice messages in the browser on Advanced and Premium |
| Designate an impartial person or department to follow up and keep contact with the reporter (Art. 9(1)(c), (d)) | User roles control who sees a case; conflict-of-interest exclusion and granular visibility on Advanced; an external ombudsperson can be a user |
| Acknowledge within 7 days, give feedback within 3 months; keep records no longer than necessary (Art. 9(1)(b), (f); Art. 18(1)) | Automatic receipt confirmation on every plan, 90-day feedback countdown per case, retention period with deletion reminder on Advanced, permanent deletion with audit entry on every plan |
| Operate channels securely; process personal data under the GDPR (Art. 9(1)(a); Art. 17) | ISO 27001 certified hosting in Germany, encryption in transit and at rest, external penetration tests, no IP addresses or time stamps of whistleblowers stored, DPA under Art. 28 GDPR |
| 50-worker threshold and internal channel duty transposed by each member state (Art. 8, 26) | Reporting website and forms in all supported languages; retention periods set to match the local law |
| Diligent follow-up; clear information on external reporting (Art. 9(1)(d), (g)) | Dashboards and statistics export; upload of documents such as external reporting channels to the reporting page |
National laws most often asked about: Hinweisgeberschutzgesetz (Germany), Ley 2/2023 (Spain), D.Lgs. 24/2023 (Italy), loi Waserman and Sapin II (France), Lei 93/2021 (Portugal). Supply-chain reporting for the German LkSG on Advanced. US-listed companies: anonymous, confidential channel for accounting and audit concerns under Sarbanes-Oxley Section 301. NIS2 Directive 2022/2555: vulnerability reporting channel on Advanced. DORA: addendum for financial entities, Trusty acts as a non-critical ICT third-party service provider.
Security and data protection
| Item | Fact |
|---|---|
| Hosting location | Virtual servers at Hetzner Online GmbH in Nuremberg, Germany, ISO 27001 certified data centres; data stays in the EU |
| Other hosting regions | Switzerland (CloudSigma, Zurich), United States (DigitalOcean, California) or the client’s own infrastructure, with Premium; backups of Swiss and US environments are held in the EU An environment is never moved to another region without the client’s approval. |
| Architecture | Multi-tenant SaaS, one account per organisation, data logically isolated; Premium on a dedicated private virtual server |
| Encryption in transit | TLS 1.2 / 1.3 on all connections |
| Encryption at rest | Report contents and whistleblower dialogue encrypted with AES (CBC, OpenSSL); files encrypted with AES-256 CTR; passwords hashed with bcrypt |
| Application protection | Web application firewall (ModSecurity, OWASP Core Rule Set) and Linux iptables firewall; uploads validated server-side, restricted by type and stored outside the public web root; development along OWASP principles with parameterised queries and a content security policy; four-eyes code review before every release |
| Vulnerability management | Continuous automated scanning with tiered fix deadlines (critical: 1 day); annual external penetration test with retest, results available under NDA |
| Privacy by design | No IP addresses or time stamps of whistleblowers stored, session cookies only, random username per reporter |
| Access control | SSO (Microsoft Entra ID or SAML 2.0) on all plans; 2FA from Standard, mandatory MFA with Premium; role-based permissions. Server administration by SSH keys only, including hardware/FIDO2 keys, no password and no root login; MFA on every system holding customer or personal data |
| Audit trail | Cryptographically chained log of every entry, view and change on every plan; with Premium, access review reports (user listings and access reports) for periodic access reviews |
| Backups and recovery | Daily encrypted backups at two independent EU providers (France); recovery point objective 24 hours, recovery time objective 4 hours; disaster recovery plan tested annually; formal incident response process with defined escalation levels and annual exercises |
| Availability | 99 % per calendar month, commercially reasonable efforts, measured midnight to midnight including maintenance; pro-rata fee credit if missed; scheduled maintenance announced 2 business days ahead and outside 08:00 to 17:00. Contractual 99 % SLA with Premium |
| GDPR | Processing in the EU/EEA only (hosting Germany, backups France), no third-country transfers in regular operation; Data Processing Agreement under Art. 28 GDPR, signed copy on request; data breach notice to the client within 24 hours, to the authority within 72 hours where required Switzerland and the EU/EEA each recognise the other as providing an adequate level of data protection. Art. 28 agreements with every service provider and a register of all processors with their agreement status; designated data protection contact; annual data protection self-assessment |
| Retention concept | Documented retention and deletion concept per data category; retention period selectable per closed case on Advanced, configurable per data category with Premium |
| Sub-processors (whistleblowing, standard EU setup) | Hetzner Online GmbH, Germany (hosting); AWS EMEA SARL, Luxembourg (notification email relay). Full list in the DPA; 30 days’ notice before changes |
| Data export and deletion | Export from within the app during the 30-day retention period after termination; then permanent deletion from production and, in the regular rotation, from backups |
| Certifications | The hosting data centres are ISO 27001 certified. Trusty AG itself does not hold an ISO 27001 certificate; its information security and risk management framework is aligned with ISO/IEC 27001. Security questionnaires, including bank-grade forms, are answered on request; policies can be inspected under NDA |
| Policy framework | Complete set of versioned internal policies, reviewed at least annually, owned by the Head of IT / Information Security Officer: Information Security, Access Control, Password, Acceptable Use, Anti-Malware, Vulnerability Management and Secure Development policies; Data Protection Roles and Responsibilities, Data Processor Register and Retention/Deletion Policy; Cybersecurity Incident Response Plan and Disaster Recovery Plan; Third-Party Risk Management Policy with Supplier Register, Onboarding/Offboarding Policy, Information Security Risk Register. Confidential, available for due diligence under NDA |
| Access governance and risk | Least-privilege access with a governed joiner-mover-leaver process; documented target IT architecture and register of all cloud services in use; since August 2026 a second person is involved in code review, vulnerability triage, incident response cover and supplier reviews; risk register reviewed quarterly |
| Accessibility | WCAG 2.1 AA / EN 301 549: partially conformant, improvements in progress; an accessibility statement will be published in the Legal Center (trusty.report/documents) |
Implementation and support
| Item | Fact |
|---|---|
| Implementation effort (self-serve plans) | No IT project: choose a plan, add logo, colours and languages, invite case handlers, publish the reporting link or QR code, the same day |
| Implementation (Premium) | Draft texts from Trusty, client review, test deployment within a week, a 1 to 2 hour workshop, client testing, production go-live; usually within one month |
| Employee onboarding | 30 days of free online whistleblowing training for employees, included with every subscription |
| Integrations | SSO via Microsoft Entra ID or SAML 2.0; link or embed the reporting page on your website or intranet; link from a Compliance App hub; telephone hotline add-on with Premium. No HR-system integration |
| Support channel | support@trusty.report; critical errors (platform unavailable or loss of core functionality) handled 24/7 on every plan |
| Support response time | Standard 48 hours, Advanced 24 hours, Premium 8×5 (Mon to Fri, 09:00 to 17:00 Zug time); LITE without guaranteed response time |
| Support languages | All supported languages |
| Technology | Open-source stack (Linux, Apache, MySQL, Laravel), no licensed third-party programs |
Company
| Item | Fact |
|---|---|
| Legal entity | Trusty AG, Bösch 82, 6331 Hünenberg, Switzerland (canton of Zug) |
| Founded | 2022 |
| Products | Whistleblowing, Compliance App (policies, training, whistleblowing), QuickScreen360 third-party screening, EUDR Passport, Trusty Compliance App, MiCA Booster Pack |
| Customers | More than 1,000 companies use Trusty software |
| Partner model | White-label deployment for law firms, consultants and ombudspersons serving their own clients |
| Website | trusty.report; handler login on trusty-compliance.com |
This page is maintained by Trusty AG and reviewed with every product, price or contract change.