OpenWhistle

OpenWhistle is open-source software for running an internal whistleblowing channel on your own server. It is best suited to companies and public bodies that can handle self-hosting and want anonymous reporting with follow-up. Its free licence removes subscription costs, but you supply the infrastructure and there is no paid support tier.

Overview

Designed for organisations covered by EU Directive 2019/1937 and Germany’s HinSchG, OpenWhistle offers a reporting route that the organisation operates itself. The maker identifies companies from 50 employees and financial firms among its intended users. That makes it relevant to organisations with compliance obligations, but it is not a ready-to-use hosted hotline: deployment and ongoing operation sit with the organisation.

The software is licensed under the GNU General Public License v3.0. It runs on an organisation’s server using Docker Compose or a Helm chart, on Linux and through the web. The self-managed model may suit teams that want control over their deployment; organisations without the capacity to run a server should choose a hosted alternative.

Key features

Whistleblowers can submit a report without an account or email address, then receive a case number and UUID4 PIN. Those credentials let them return to a status page to read replies and send messages. This preserves a route for two-way communication without requiring a reporter to identify themselves through an account, though the organisation still needs to manage the case and respond.

Confidential mode encrypts the reporter’s name and contact details, revealing them to the case handler only after an audited reason. That is a useful middle ground for processes that may need to identify or contact a reporter while restricting routine access to their details.

Administrators can authenticate with a password, LDAP or OIDC, and TOTP is required in every case. LDAP and external OIDC allow use of an existing identity provider, while optional ClamAV scanning can check attachments. The interface supports English, German, French and Brazilian Portuguese.

The maker says OpenWhistle does not store IP addresses at any layer, and outbound requests are opt-in and off by default. Closed reports are deleted after 1,095 days by default. These choices support a privacy-conscious setup, although organisations should consider whether the default retention period fits their own obligations and practices.

Pricing

The Free plan costs nothing. It is open-source software with no paid tier or subscription, and there is no free-trial clock to manage. The trade-off is operational rather than a licence fee: the organisation pays for its own server, and the maker offers no paid support tier, directing users to GitHub Issues for community support.

Anonymous reporting, workflow automation and single sign-on are included. There are no seat or report caps stated for the plan. For an organisation able to deploy and maintain the software, this makes OpenWhistle a cost-conscious alternative to subscription services; for one that needs vendor hosting or paid assistance, the zero-price plan does not solve the main service requirement.

Platforms

OpenWhistle is available for Linux and the web, but it is self-hosted rather than offered as a hosted service. Deployment uses Docker Compose or a Helm chart on the organisation’s own server. This fits teams already equipped to run server software, not readers looking for a mobile app or a vendor-managed installation.

Who it's for

Choose OpenWhistle if your organisation needs an internal channel for whistleblowing, is covered by the relevant EU or German rules, and can take responsibility for infrastructure and administration. Its anonymous submission and follow-up, controlled disclosure in confidential mode, and LDAP or OIDC options address practical needs for reporting and access management.

Look elsewhere if you need a vendor to host the service, require a paid support arrangement, or cannot assign staff to operate a server. The free plan is not a substitute for those services.

Pros and cons

• Free and open source: the GPL v3.0 software has no subscription, which suits organisations able to fund and manage their own hosting.
• Anonymous two-way follow-up: a case number and PIN let reporters return to read replies and send messages without an account or email address.
• Restricted confidential identity: encrypted contact details are disclosed to a case handler only after an audited reason.
• Self-hosting is mandatory: the organisation must provide and operate its own server; there is no hosted service.
• No paid support tier: organisations needing contracted vendor assistance must look for another product.
• Default retention is lengthy: closed reports remain until deletion after 1,095 days, so organisations should assess whether that default suits their needs.

Alternatives

Whistleblower Hotline Software is a useful category overview for readers comparing reporting tools rather than deciding between a single product and OpenWhistle.

GlobaLeaks is another free, open-source, self-hosted option for Linux and web, with API support. Its default attachment limit is 30MB per file, configurable higher; consider it if that stated file limit and its configurability suit your reporting needs.

NotMe is a paid, multi-platform alternative with a free plan. Its NotMe Platform costs $99 a month, based on employee count, and includes unlimited reports with up to 5–10 admin licences; choose it if those terms fit better than operating your own server.

BoardEffect is another paid option to consider when comparing products.

iVoiceUp is a paid alternative without a free plan, with mobile, web, API and self-hosted platform options. Its Essential plan includes two admin accounts, while Professional adds five admin accounts and two automated routing and escalation paths; consider it if those account and workflow allowances suit your organisation.

Whispli Core is a paid alternative with no free plan. Its Essentials plan includes three licences, while Plus adds five licences, one automation and one workflow; consider it if that licence-based structure better fits your team.

Whistleblower Software is a paid web product with a free trial. Its Core plan for 0–49 employees costs €99 a month, billed annually; consider it if you prefer a web service and the annual price fits your organisation.

EQS Integrity Line is a paid mobile and web service with a free trial. Its Essential plan starts at £85 a month and includes standard case management and support for over 80 languages; consider it if those language options and a ready-to-use solution matter more than self-hosting.

EthicsGlobal CaseManager is a paid mobile and web alternative with a free trial. Its Advanced plan is custom pricing based on configuration and covers up to three countries, two languages, 30 worksites, 15 users and 20 GB of evidence storage; consider it if those stated configuration limits suit your operation.

Verdict

OpenWhistle is a strong fit for organisations that need an internal whistleblowing channel and can run it on their own infrastructure. Anonymous reporting, follow-up and controlled access to confidential identity come without subscription fees. The decisive reason to look elsewhere is the same as the product’s central trade-off: there is no hosted service or paid support tier.