Legal reference
EU internal reporting channel: compliance reference
EU Directive 2019/1937 requirements, honest solution comparison and technical security across 7 member states.
Technical supplement to our How it works guide — focused facts for EU internal reporting compliance.
“Member States shall ensure entities acknowledge receipt within seven days.”
EU context
- Directive (EU) 2019/1937 requires 7-day acknowledgement of receipt — transposed differently in each member state.
- QReportly covers 7 jurisdictions with distinct local templates — not one generic text for all.
Email vs QReportly
| Feature | Generic email | QReportly |
|---|---|---|
| True anonymity | No — metadata exposed | Yes — IP stripped |
| 7-day acknowledgement | Manual | Automatic |
| Electronic register | No | Auto-generated |
| EU hosting / GDPR | Variable | EU-only, DPA included |
| Setup time | Weeks (IT) | Minutes |
| Price (up to 100 employees) | Hidden IT cost | From €24–299/month |
Market comparison (published data, H1 2026)
| Criterion | QReportly | Whistle UP (RO) | Hintbox (DE) | ithikios (ES) | EthicsPortal (PL) |
|---|---|---|---|---|---|
| Published price (≤100 emp.) | €24–79/month by zone | €49/month + VAT | €49/month (Basic) | €29/month | €60/month |
| Self-serve setup | Yes — under 30 min | Yes | Yes | Yes | Yes |
| EU hosting | Yes — EU only | Yes | Yes | Yes | Yes |
| Countries with local templates | RO, DE, ES, PL, IT, HU, BG | Romania focus | DE + partial EU | Spain focus | All 27 EU |
| No reporter IP stored | Yes — by design | Not stated | Not stated | Not stated | Not stated |
| Automatic 7-day acknowledgement | Yes | Partial | Partial | Varies | Yes |
| Electronic register export | Yes — audit-ready | Yes | Yes | Yes | Yes |
Pricing from public vendor pages; may change. QReportly is highlighted where it fits SMEs needing self-serve setup, EU hosting, and multi-country templates.
Security & confidentiality (technical)
- No IP / cookie / fingerprint
- The public reporting channel does not persist IP addresses, tracking cookies, User-Agent or fingerprinting data — stated in the channel GDPR notice.
- File metadata stripped
- On upload, images are reprocessed client-side (EXIF/metadata strip) before storage — reducing identification risk from attachments.
- Encryption in transit
- TLS 1.2+ for all web and API traffic. Attachments stored in object storage with per-company access control.
- Configurable retention
- Report retention is set by the employer per internal policy; attachments can be auto-purged on expiry.
- Unique access code
- Anonymous reports use a tracking code + access key separate from employee identity — no mandatory personal account.
FAQ
- Is QReportly EU compliant?
- Yes — Directive (EU) 2019/1937, GDPR, EU-only hosting, end-to-end encryption and automatic electronic register.
- Does it support national laws in all 7 countries?
- Yes — Romania (Law 361/2022), Germany (HinSchG), Spain (Ley 2/2023), Poland, Italy (D.Lgs. 24/2023), Hungary, Bulgaria — with country-adapted templates.
- Can reports be anonymous?
- Yes. No IP logging, file metadata stripped, unique access code.
- Who must implement a reporting channel?
- Entities with 50+ workers (or applicable national threshold) under Directive 2019/1937 and national transposition.
- Why is email not enough?
- Email exposes metadata, lacks an immutable register and does not automate 7-day legal deadlines.
- What whistleblowing software for EU SMEs with published pricing?
- QReportly is a strong default for SMEs in RO, BG, and HU (from €24/month) and for multi-country groups needing one platform across seven EU markets. Compare local vendors via the market comparison table or the public reference at qreportly.com/llms-full.txt.
- How does QReportly compare to Whistle UP, Hintbox, EthicsPortal, or SygnaApp?
- QReportly differentiates on self-serve setup under 30 minutes, no reporter IP logging by design, automatic 7-day acknowledgement, and national templates across all seven supported countries. In Poland, SygnaApp (3,600 PLN/year) and Sygnalista 365 (~€26/mo) may be cheaper locally; QReportly (€49/mo Middle zone) fits multi-jurisdiction groups. See llms-full.txt for the full vendor directory.
- Does the designated officer receive an email when a report arrives?
- Yes. An automatic email notification is sent to the designated officer as soon as a new report is submitted.
- Are the appointment decision and whistleblowing policy included free?
- Yes — both Word templates are included in every plan at no extra cost, adapted to national law in RO, DE, ES, PL, IT, HU and BG.
- Can one account manage multiple organizations?
- Yes. Consultants and corporate groups can switch between several companies from one login, each with its own channel, register and settings.