How to choose whistleblowing software: 10 criteria

Choosing whistleblowing software is not just about switching on an online form to receive reports. The internal channel is required by law: it must protect the people who report, let those who handle reports work in an orderly way and keep a record of every step. A hasty choice risks creating a channel that exists on paper but does not stand up to scrutiny.

In this guide you will find 10 practical criteria for assessing a whistleblowing platform, a printable checklist to take to vendor meetings, the most common mistakes to avoid and answers to the questions we are asked most often.

10 criteria for choosing whistleblowing software

1. Compliance with the EU Directive, Legislative Decree 24/2023 and the ANAC guidelines

The starting point is the law. Directive (EU) 2019/1937 and, in Italy, Legislative Decree 24/2023 define who must set up an internal channel, how reports must be handled and what protections the whistleblower is entitled to; the ANAC guidelines explain how to apply these rules in practice. Ask the vendor how the software supports each requirement: a generic answer such as "we are compliant" is not enough. To refresh the rules, start with our guide what whistleblowing is and how it works.

2. Anonymity and confidentiality

Whistleblowers must be able to choose whether or not to identify themselves, and in both cases their identity must remain confidential. Check that the platform allows anonymous reports, lets you communicate with the whistleblower without knowing their name and makes information visible only to those authorised to handle it. Confidentiality also covers the people involved in and mentioned in the report.

3. Security and certifications

A report may contain personal data and sensitive information. Check that data is encrypted, that access is protected, for example with two-factor authentication, and that the provider can demonstrate its level of security with verifiable certifications. Certifications do not replace good configuration, but they are a concrete sign of the provider's attention to information protection.

4. Timeframes: acknowledgement within 7 days and feedback within 3 months

The rules require the whistleblower to receive an acknowledgement of receipt within 7 days and feedback within 3 months. Good software helps you never miss these deadlines: notifications when a new report arrives, reminders and a clear view of the status of each case. Without these tools, meeting the deadlines depends only on people's memory.

5. Roles and permissions

Not everyone should see everything. Those who handle reports, the Supervisory Body and any consultants have different tasks. The software should let you assign roles and permissions, route reports to the right people and handle conflicts of interest, for example when a report concerns one of the handlers.

6. Activity log

Every step in handling a report should be tracked: who read it, when the acknowledgement was sent, what checks were carried out and how it was closed. An orderly activity log helps you prove that the report was handled correctly and respond to any audit requests.

7. Documentation: procedure and privacy

The channel alone is not enough: you need a procedure explaining how to report and how reports are handled, and a privacy notice for the whistleblower. Check whether the vendor provides templates to adapt to your organisation and guidance on personal data management. Remember that in Italy report data must not be kept for more than 5 years from the communication of the final outcome.

8. Multiple languages and ease of use

If people in your company speak different languages, the channel must be understandable to everyone. Simplicity matters too: a clear form, accessible from computer and smartphone and reachable via a dedicated address or QR code, lowers the barriers to reporting. The same goes for those handling reports: a confusing interface leads to errors and delays.

9. Support and training

Ask how onboarding works, who helps you with configuration and how much support is included. The rules require those who handle reports to be trained: training materials and short demo videos help people use the channel correctly from day one.

10. Transparent costs

The price must be clear: what is included, what it depends on and what costs extra. Be wary of offers where essential features such as encryption, the activity log or documentation are only available in higher packages. To find out more, read our guide on how much whistleblowing software costs.

Printable checklist

Use this table in your vendor meetings and note the answer you get for each question.

Mistakes to avoid

• Using a simple email address or a generic form: it does not guarantee confidentiality, traceability or communication with an anonymous whistleblower.
• Looking only at the price: a cheap offer that excludes documentation, support or security features ends up costing more.
• Forgetting the procedure: the software must be accompanied by a written procedure and a privacy notice.
• Not training the handlers: those who receive reports must know how to handle them and what timeframes to meet.
• Not communicating the channel: employees and contractors must know that the channel exists and how to reach it.

F.A.Q. - Frequently asked questions