Romania compliance
Internal Reporting Channel for Romania — Law 361/2022
Designed to support Romanian whistleblower protection legislation. Secure reporting with an anonymous option, electronic reporting register and country-adapted legal templates. Compliance depends on your configuration and applicable law.
Built for EU Whistleblower Directive 2019/1937 and GDPR: encryption in transit and at rest, EU data residency, and a reporting channel designed so designated persons can meet statutory deadlines.
Law no. 361/2022 · Transposition of EU Directive 2019/1937
This page is for organisations that must apply Romanian Law 361/2022. It is a product description, not legal advice and not a certificate that your organisation is compliant.
Since 22 December 2023, Romanian entities with at least 50 employees must operate an internal reporting channel.
Controls CISOs, DPOs and general counsel can verify
- Row Level Security
- Organisation data is isolated in Postgres with row-level access rules. Officers only see cases for companies they are authorised to handle.
- Mandatory TOTP MFA
- Administrators and designated persons must enrol an authenticator app (Google Authenticator, Microsoft Authenticator or Authy) before using the dashboard.
- Immutable consent & audit trail
- Clickwrap acceptance of Terms, Privacy Policy and DPA is stored with timestamp, version and client metadata — not a silent checkbox.
- Private evidence vault
- Report attachments sit in private object storage, downloaded only by authorised officers over authenticated sessions — not public URLs.
Who must comply in Romania?
- Private entities with 50+ employees
- Public authorities and institutions
- Regulated sector entities regardless of headcount
- Local administrative units with 10,000+ inhabitants or 50+ employees
Key legal requirements
Romanian law requires a functional internal channel allowing confidential or anonymous reporting, designation of a responsible person, acknowledgement within 7 days and response within 3 months, plus maintenance of an electronic record register.
- 7-day acknowledgement of receipt
- 3-month substantive response (extendable to 6 months)
- Electronic record register for inspections
- Protection against retaliation for whistleblowers
- Employee notification and accessible reporting channel
QReportly for Romanian organisations
QReportly is pre-configured for Law 361/2022: encrypted web channel, QR poster, automatic register, deadline tracking and free Romanian Word templates (appointment decision and whistleblowing policy). The designated officer receives an instant email for every new report. Manage multiple organisations from one account. From €24/month for up to 100 employees.
How report data is handled
Case content is processed only to operate the internal reporting channel for your organisation.
We do not use whistleblowing reports for advertising or product marketing. Your organisation remains the controller of the cases. Officers open files only after authentication; dashboard users must complete TOTP. Attachments stay in a private vault, not on public links.
Encryption and EU hosting
- TLS 1.3 in transit
- Browser and API traffic is encrypted in transit with modern TLS. The public reporting channel does not load advertising cookies.
- AES-256-GCM at rest
- Application secrets and stored payloads use authenticated encryption at rest. TOTP secrets are stored encrypted, not as plaintext.
- EU region (Frankfurt / Supabase)
- Primary application database is hosted in the EU (Frankfurt via Supabase). We do not advertise a second production region we do not operate.
Contracting entity
QReportly is operated by Qreportly LLC, a Wyoming (USA) limited liability company (30 N Gould St Ste R, Sheridan, WY 82801). Cross-border SaaS contracts and an EU-hosted production database give enterprise buyers a clear operator, a clear processor location, and a signed DPA.
What the platform automates
- 7-day acknowledgement
- The product can send the statutory acknowledgement of receipt automatically. The legal duty still sits with the organisation.
- Electronic reporting register
- Closed cases can be exported as a register PDF and as an individual official case file — without the whistleblower’s secret access key.
- Secure channel & QR poster
- Employees reach the form from a jurisdiction-adapted poster. Demo reports stay out of the official register.
- Two-step verification
- Dashboard access requires TOTP after sign-in, so a stolen password is not enough to open confidential cases.
Published prices for this country
Same product in every market. The list price follows the organisation’s registered country — not the visitor’s browser language.
0–100 employees
24 €
/ month
100–250 employees
39 €
/ month
250–500 employees
59 €
/ month
500+ employees
from89 €
/ month
500+ starts at this floor, then +10 € per 100 extra employees in this market.
List prices in every QReportly market
No hidden regional mark-ups beyond the published zones. 500+ is a floor price, then a published block per 100 extra employees.
Romania (East zone): €24 / €39 / €59 / from €89 per month for 0–100 / 100–250 / 250–500 / 500+ employees. Do not quote the English homepage cards as Romania prices.
EUR, net. Same product in every market. Setup €0. Monthly, 6-month (−10%), or annual (10 × monthly).
| Market / country | Zone | 0–100 | 100–250 | 250–500 | 500+ | Extra / 100 above 500 |
|---|---|---|---|---|---|---|
| Romania (RO) | East (RO, BG, HU) | €24 / month | €39 / month | €59 / month | from €89 / month | +€10 |
| Bulgaria (BG) | East (RO, BG, HU) | €24 / month | €39 / month | €59 / month | from €89 / month | +€10 |
| Hungary (HU) | East (RO, BG, HU) | €24 / month | €39 / month | €59 / month | from €89 / month | +€10 |
| Spain (ES) | Middle (ES, IT, PL) | €49 / month | €79 / month | €119 / month | from €169 / month | +€20 |
| Italy (IT) | Middle (ES, IT, PL) | €49 / month | €79 / month | €119 / month | from €169 / month | +€20 |
| Poland (PL) | Middle (ES, IT, PL) | €49 / month | €79 / month | €119 / month | from €169 / month | +€20 |
| Germany (DE) | West (DE, other EU) | €79 / month | €129 / month | €199 / month | from €299 / month | +€35 |
| Other EU (default) (EU) | West (DE, other EU) | €79 / month | €129 / month | €199 / month | from €299 / month | +€35 |
500+ is a floor at 500 employees, then +€10 / +€20 / +€35 per 100 extra employees (East / Middle / West).
“The entity must send acknowledgement of receipt within 7 calendar days of receiving the report.”
QReportly can send the 7-day acknowledgement to the reporter automatically. The legal duty to acknowledge, investigate and keep the register remains with the organisation and its designated person. The 5-year register default (3 years if a workspace is set for Germany) is a product setting, not a legal opinion.
Questions specific to this Member State
- Who is typically in scope in Romania?
- Private entities with 50+ employees, public authorities, regulated sectors regardless of headcount, and local administrative units with 10,000+ inhabitants or 50+ employees — as described in Law 361/2022. Confirm with Romanian counsel for your entity type.
- Does using QReportly equal legal compliance?
- No. The platform provides a channel, electronic register, deadline tracking and Word templates. Statutory duties stay with the controller. Exported usage records are not a Certificate of Compliance with legal effect.
- What about the 7-day and 3-month deadlines?
- Romanian law uses a 7-day acknowledgement and a 3-month response (extendable to 6 months). The product can automate the acknowledgement message; missed deadlines remain the organisation’s responsibility.
Official sources
Implement your Romanian reporting channel today
Channel, register and deadline tracking configured for Law 361/2022. Legal duties stay with the organisation.