GlobaLeaks

GlobaLeaks is a self-hosted whistleblowing platform for organizations that want to manage anonymous reporting in their own environment. It will suit teams able to maintain a Linux or Docker deployment and shape their own intake process. The trade-off is that hosting and administration remain the organization’s responsibility.

Overview

GlobaLeaks handles reporting, follow-up, and case organization in one system. Reporters can submit through configurable channels, exchange files, and message recipients anonymously in both directions; staff can label reports and track case statuses. Multiple virtual whistleblowing sites can share a single installation, a practical option for organizations serving distinct teams or programs.

A dynamic questionnaire builder supports multi-step submissions, so administrators can collect structured information rather than rely on an undifferentiated inbox. That flexibility is valuable when intake needs vary, but it calls for someone to design and maintain the reporting process.

Key features

• Anonymous follow-up: Two-way messaging and file exchange let reporters continue a conversation after submitting. GlobaLeaks supports Tor and states that it does not log IP addresses, useful safeguards for organizations where protecting reporter identity is central.
• Security controls: The platform includes TLS 1.3, two-factor authentication, AppArmor and network sandboxing, plus PGP for email notifications and file downloads. The project says it has undergone independent security audits since 2011 and publishes the reports in full. These are meaningful controls, though they do not remove the operator’s responsibility to deploy and maintain the system securely.
• Integration and administration: A web interface manages the platform, while a REST API, Tor Onion Services, website integration, and connections to enterprise case-management platforms support broader workflows. Organizations can run multiple virtual sites from one setup.
• Deployment choices: Debian and Ubuntu support, Debian package updates, and a Docker installation option give technical teams several documented routes to self-hosting. This is not a hosted service for teams seeking to avoid infrastructure work.
• Broad access: The user features page lists over 90 languages and right-to-left language support; the technical features page cites WCAG 2.2 accessibility recommendations. The default attachment limit is 30MB per file, although administrators can configure a virtually unlimited size. Teams accepting large evidence files should review that setting before launch.

The maker says GlobaLeaks is compliant with ISO 37002, EU Directive 2019/1937, and GDPR, and designed in adherence to ISO/IEC 27001:2022. Organizations should assess those claims against their own legal and security requirements.

Pricing

GlobaLeaks — free. The free plan is open-source software that organizations self-host. It includes the platform’s reporting and workflow capabilities, with a default 30MB per-file attachment limit that administrators can raise. There are no paid tiers or seat caps stated for this plan, but the organization must provide and maintain its own deployment; free software does not mean a managed service.

Documentation, a ticketing system, a forum, and a community site are support routes for operators. Teams should be comfortable taking responsibility for setup and ongoing administration rather than expecting a vendor-run environment.

Platforms

GlobaLeaks supports Linux, web, API, and self-hosted deployment. Its documented Linux support covers Debian and Ubuntu, with Docker as another installation option. The web interface provides administration; the API supports technical integration. It is a fit for organizations with deployment capacity, not those requiring a ready-made mobile app.

Who it's for

Independent media, activists, public agencies, corporations, and other organizations are among the intended users. It is especially compelling for teams that need anonymous two-way reporting, configurable channels, and control over where the platform runs. Organizations without technical capacity to operate Linux or Docker should consider a managed alternative instead.

Pros and cons

• Pro: Anonymous messaging, file exchange, Tor support, and a stated no-IP-logging policy support confidential follow-up rather than one-way submissions alone.
• Pro: Configurable channels, multi-step questionnaires, labels, statuses, and multiple virtual sites accommodate varied reporting processes on one installation.
• Pro: Audits, published reports, and a broad set of security controls give operators concrete safeguards to assess.
• Con: Self-hosting shifts deployment, administration, and maintenance to the organization, making it a poor fit for teams seeking a vendor-operated service.
• Con: The 30MB default attachment limit may constrain evidence submissions until an administrator changes it.

Alternatives

For a broader comparison, browse Whistleblower Hotline Software.

• NotMe is worth considering for organizations seeking a paid platform with a free plan; its NotMe Platform costs $99 a month and includes unlimited reports with up to 5–10 admin licenses.
• BoardEffect is another paid option for organizations evaluating a web and mobile platform.
• Whispli Core may fit teams seeking a paid product with tiered licence counts and workflow or automation allowances in its Plus plan.
• Whistleblower Software may suit organizations preferring a paid web platform with a free trial and annual billing.
• EQS Integrity Line is an option for small and medium-sized companies seeking a ready-to-use solution, standard case management, and over 80 languages; its Essential plan starts at £85 a month.
• EthicsGlobal CaseManager is another paid option with a free trial and configuration-based pricing.
• SpeakUp Report may suit organizations seeking tailored quotes based on size and channels, with web-browser, mobile, and phone intake plus case management.
• iVoiceUp is another web-based alternative with paid tiers that scale admin accounts and, on higher plans, automated routing and escalation.

Verdict

Choose GlobaLeaks if your organization needs configurable anonymous reporting, strong control over deployment, and the technical capacity to run its own platform. Its free, open-source model and broad workflow and security capabilities make it a serious option for that audience. Look elsewhere if you need a managed service or cannot assign staff to deployment and maintenance; check the attachment setting as well if reports may include large files.