Six whistleblowing channels against one Belgian brief. Only one of them publishes a retention default, and the rule it has to meet is not written in days.

Article 22 of the Belgian whistleblowing law says how long a report is kept: for the duration of the contractual relationship the reporting person had with you. Article 21 says how long the names in it are kept: until the reported breach is time-barred.

Neither of those is a number. Every product built to hold those reports asks you for one.

That is not a small mismatch and it is not a drafting curiosity. It is the difference between a retention setting you can point at in an audit and a retention setting you will have to explain, and the explanation will be that the tool could not express the rule so somebody wrote a procedure beside it. Five products and one non-product were assessed against a single brief for this page. None of the six can express either Belgian rule. The ranking below is about everything else.

The brief, and who it is not for

A Belgian private-sector legal entity, 420 workers, head office in Brussels, one subsidiary in the Netherlands with sixty people. Regulated, in the sense that a supervisor may one day ask to see the internal reporting channel and the procedure around it. Two people in compliance, one of whom is the DPO, and an IT function of four that already owns more than it can patch.

Three consequences follow from the headcount alone. Above fifty workers the entity must have an internal channel at all: Article 8(3) of Directive (EU) 2019/1937, and Article 11 of the Belgian law of 28 November 2022. Above 250 workers it must accept anonymous reports and follow them up, under Article 8 §2 of the Belgian law — the derogation releasing smaller entities stops at 250, so a firm of 420 has no choice about a feature that vendors sell as a differentiator. And above 250 it loses the right, in Article 11 §4, to share the receipt of reports and any investigation with somebody else.

This page is not for the public sector, which the 28 November 2022 law does not cover. It is not for a firm below 250, whose specification is genuinely different and cheaper. And it is not for the Dutch subsidiary, whose own transposition was not opened for this piece; if the group's constraint is Dutch law rather than Belgian, stop reading here.

What was tested, and the five things that were not

The object under test is the documentation, not the software.

That needs saying plainly, because a comparison of marketing material is marketing. The defence is that the documentation is not a brochure in this purchase: it is the thing the buyer relies on, the thing that goes in the file, and the thing a supervisor asks to see when the question arrives three years later and nobody involved in the purchase still works there. So the test was this. Take the six questions Belgian law forces on the buyer, take each vendor's own current public pages, read them on 25 September 2026, and record what they answer, what they do not answer, and what they do not mention at all. Where a page does not say, this page says that it does not say, rather than filling the gap from a datasheet or a sales call.

What that leaves out, in order of how much it should bother you.

The software was not run. No case handler opened a case, nobody timed the seven-day acknowledgement against a real clock, and nothing here is a judgement about whether any of these products is pleasant or even workable to use. If your constraint is what the compliance officer's Tuesday looks like, this comparison is not for you and no page that has not watched somebody use the tool can be.

No data processing agreement and no ISO 27001 certificate was seen. None was publicly readable without a sales conversation or a login. Every sentence below about certification is a sentence about what a vendor's page claims, not about what a certificate covers, and the two differ most precisely where it matters: scope.

The telephone line was not tested, the language counts were not checked, and no price was negotiated. Published prices are published prices.

Sector rules were not followed. The Belgian law amends, among other things, the anti-money-laundering law of 18 September 2017; financial entities carry whistleblowing duties from more than one instrument and this page traces only one.

And no vendor was asked anything. Nobody was given the chance to answer in private what their page does not answer in public, which is a deliberate choice and a limitation at the same time: it measures disclosure, and disclosure is not the same as capability.

The shortlist, and what fell out before it

Six candidates. Five products whose documentation a buyer can read on a Sunday without speaking to anybody, and the option of not buying one.

What fell out fell out on that same test. The market for this software has dozens of sellers and a substantial number of them publish a landing page, a compliance claim and a demo form, and nothing else. Those were not carried forward, not because the products are bad — nothing here knows whether they are — but because there is nothing to assess. A vendor whose entire public artefact is a form has, for the purposes of this brief, declined to be compared.

The six criteria, and the weights

Weights are printed so you can disagree with them in a way that changes the answer.

One criterion is settled before the comparison starts and is therefore not scored. Article 11 §4 of the Belgian law says that where the channel is run internally or provided by a third party, "in both cases" the private-sector legal entity is regarded as the controller of the personal data. There is no procurement route out of controllership. Every vendor on this page is your processor, whatever its own materials imply about holding the data on your behalf, and the two vendors whose pages emphasise that they cannot technically read the reports are describing an engineering property, not a legal position.

The six, in the same order each time

None of the five vendors named on this page has a live sponsorship campaign with this publication. The campaign file was empty when this went up. If that changes while the page is still live, this paragraph changes with it, and the ranking does not.

GlobaLeaks. Publishes a retention default, which nobody else does: a per-channel policy configuring "automatic secure deletion of reports after a certain period of time", set to 90 days out of the box. What it does not publish is a price, because there is not one; the software is free and open source and you run it. Retention: the only documented default in the six, and expressed in days, which is the whole problem stated honestly rather than hidden. Where it would rank differently: last, immediately, if nobody in your four-person IT function wants to own a service whose failure mode is a confidentiality breach.

SpeakUp. Publishes the longest list of assurance artefacts — ISO 27001 certified, ISO 27002 and 27701 followed, ISAE 3000 Type II audited quarterly, SOC 2 and TISAX named — and is the only one whose public pages describe the oral limb of Article 12 in any detail: a web form, a phone line, a mobile app, an AI-powered voice agent, a proxy. What it does not publish, on the two pages read, is the hosting country, any sub-processor, any certificate scope, or the legal entity that would be countersigning your contract. Retention: "you set your own retention rules", with no unit, no default and no maximum. Where it would rank differently: first outright, if it named its hosting.

NAVEX WhistleB. Publishes the clearest supply-chain answer of the five: data stored in the EU, Microsoft Azure named as the hosting platform, a separate sub-processor page pointed at, and customer-controlled encryption such that "NAVEX and its suppliers are unable to access sensitive customer data". ISO 27001 and ISO 27018 named. What it does not publish on that page is any retention period, and it does not say where the vendor itself is incorporated, which for a sovereignty questionnaire is the second question and sometimes the first. Retention: not addressed. Where it would rank differently: first, if the criterion you weight at three is the named sub-processor rather than the retention rule.

EQS Integrity Line. Publishes the most specific physical answer: a named data centre in Munich East, ISO/IEC 27001 claimed for both the company and the data centres, ISAE 3000 Type I and II with the auditor named — PwC — plus CSA STAR and a WCAG bronze. The anonymity claim is explicit, with a dialogue function, and the site claims over 80 languages as standard. What it does not publish is a sub-processor list, any retention period, any certificate scope, or a price: the packages page returned a 404 on the day it was read. Telephone reporting is not mentioned on the pages read, which is not the same as absent, and this page does not claim it is. Retention: not addressed, though backups are described as kept "for several years", which is a different fact wearing the same coat.

Whistlelink. The only one of the five that prints prices, in bands by headcount: €79, €99, €149, €199, €299 a month as the workforce grows, and a conversation above a thousand. For a 420-person firm that is €199 a month, a figure you can put in a paper without three weeks of procurement. The pricing page also claims EU hosting, ISO 27001 certification, anonymous reporting, no IP logging, and "configurable retention times". What it does not publish is the detail behind any of that: the security page, requested the same day, returned a login prompt. Retention: configurable, unit unstated. Where it would rank differently: second, if the security material behind that password is as good as the pricing page implies — and a buyer can find that out in one email, which is more than can be said for the retention question.

The mailbox and the register. A named, independent recipient, a dedicated address, a written procedure, a diary that fires at seven days and at three months, and a register under Article 22. Costs nothing but somebody's attention and satisfies Article 12 on paper. What it does not do, at 420 workers, is accept anonymous reports in a way that survives contact with reality: an email channel identifies the sender, and building genuine anonymity yourself is the one part of this that is real engineering. Retention: perfect, and only here, because a procedure written by a person can say "until the breach is time-barred" and a dropdown cannot. Where it would rank differently: first, comfortably, below 250 workers, where the anonymity duty falls away and the whole purchase stops being necessary.

The verdict, with the situation attached

For this brief — 420 workers, Belgian, two compliance staff, four in IT — the order is GlobaLeaks, SpeakUp, NAVEX WhistleB, EQS Integrity Line, Whistlelink, and the mailbox last.

GlobaLeaks is first on the criteria as written and that result should be read as a warning rather than a recommendation. It wins because the criteria reward disclosure and self-hosting discloses everything by construction: you name the hosting because it is yours, there are no sub-processors because you engaged none, and the retention default is documented because the documentation is the product. It also hands a four-person IT team a confidentiality-critical service to run. If that team is already behind on patching, first place here is the wrong answer and the second-placed one is the right one.

SpeakUp is first among the things you can buy, on the strength of being the only vendor that publicly describes the oral reporting limb that Article 12 §1 actually requires and that the whole market quietly treats as optional. Fourth here, and second if the file you have to defend is the assurance file rather than the invoice: EQS names more artefacts, names its auditor, and names its building.

The retention criterion, weighted highest, was not won by anybody. Whatever you buy, somebody in your firm will write a document that says what the tool's number means in terms of Article 21 and Article 22, and that document — not the dropdown — is the thing the supervisor will read. Budget for writing it. It is the cheapest line in the purchase and the one most likely to be discovered missing.

What would make this page wrong

Four things, each of which would be a rewrite rather than an update.

A vendor publishing an event-based expiry — retention tied to the end of a working relationship, or to a limitation period, rather than to a count of days. That would move the highest-weighted criterion off zero for the first time and reorder everything below it.

Whistlelink opening its security page, or any of the four opening a certificate with a scope statement. Three of the six rankings here turn on what is not published, and publishing is cheap.

A Belgian court or the data protection authority saying what Article 22 §1 means for a report about a person who never worked for you, or for a reporter whose contract ended in 2019. The rule is drafted around a relationship and reports do not always arrive from inside one.

And the transposition changing. Belgium wrote the anonymity duty with a 250-worker cliff and the retention rules in events rather than periods; both are national choices, not Directive requirements, and the Directive itself says only that reports are stored "no longer than it is necessary and proportionate". A firm buying for four Member States is buying against four specifications, and this page has tested one.