Skip to main content
UBSW.EU

Ethics software · requirement

ISO 27001 certified ethics platforms

Platforms publishing an ISO 27001 certification, alone or alongside further schemes such as SOC 2, ISO 27701 or a national scheme.

See all 15 platformsSearch all platforms

Last updated 13 November 2026

12 of 15 platforms meet this requirement

ISO 27001 is the certification EU buyers anchor on. A certificate is only useful if the scope covers the product being bought: several vendors certify the hosting provider or the company rather than the application, and the entry says which.

12

publish the fact this requirement asks for

3

do not publish it, or state it is not offered

Publishes an ISO 27001 certificate

The test applied to every entry on this page.

All 15 platforms, qualifying first

The evidence column quotes the fact the decision was made from. A dash means the vendor publishes nothing either way, which is recorded as a finding rather than a gap.
PlatformHeadquartersEvidenceLanguagesScoreMeets
NAVEXNon-EULake Oswego, Oregon, United StatesISO 27001 (WhistleB product page) · SOC 2 Type II (WhistleB product page)60 languages74/100Meets the requirement
OneTrustNon-EUAtlanta, Georgia, United StatesISO 27001 · SOC 2 Type IILanguages not published76/100Meets the requirement
EQS Integrity LineMunich, GermanyISO/IEC 27001:2022 (DQS 541715 ISMS22) · ISAE 3000 Type I and II · WACA Bronze80 languages62/100Meets the requirement
WhistleBStockholm, SwedenISO 27001 · SOC 2 Type II60 languages60/100Meets the requirement
AllVoicesNon-EULos Angeles, California, United StatesSOC 2 Type II · ISO/IEC 27001:2022Languages not published52/100Meets the requirement
ResolverNon-EUToronto, Ontario, CanadaISO/IEC 27001:2022 · ISO/IEC 27017:2015 · ISO/IEC 27701:2019 · SOC 2 Type II (report under NDA)60 languages62/100Meets the requirement
SpeakUpAmsterdam, NetherlandsISO 27001 · ISO 27701 · ISAE 3000 Type II / SOC 2 (quarterly audit) · TISAX100 languages60/100Meets the requirement
FaceUpPrague, Czech RepublicISO 27001:2022 · SOC 2 (hosting servers; current public wording)113 languages60/100Meets the requirement
WhistlelinkStockholm, SwedenISO 2700150 languages64/100Meets the requirement
EthicontrolTallinn, EstoniaISO 27001 · ISO 2770160 languages76/100Meets the requirement
Legality WhistleblowingCagliari, ItalyISO 9001 · ISO 27001 · ISO 27017 · ISO 27018 · ISO 2230110 languages56/100Meets the requirement
WhispliNon-EUSydney, AustraliaISO 27001 · SOC 2 Type II70 languages62/100Meets the requirement
EthicoNon-EURichmond, Virginia, United StatesNo certification published200 languages64/100Does not meet the requirement
Ethico Hotline & IntakeNon-EUCharlotte, North Carolina, United StatesNo certification publishedLanguages not published40/100Does not meet the requirement
Case IQNon-EUOttawa, Ontario, CanadaSOC 2 Type II150 languages50/100Does not meet the requirement

Shortlist by another requirement

Apply a different test

Each shortlist is derived from the same entries, so the counts cannot drift away from the data.

Ethics platforms hosting data in the EU

The vendor names an EU country where report data is stored.

8 of 15 platforms qualify

Ethics software with published pricing

An entry price appears on the vendor's own website.

4 of 15 platforms qualify

Ethics software you can buy without a sales call

You can open an account and evaluate the product yourself.

2 of 15 platforms qualify

Ethics platforms with a conflicts-of-interest register

Conflicts declarations are collected, reviewed and retained in the product.

3 of 15 platforms qualify

Ethics platforms with a gifts and hospitality register

Gifts, hospitality and entertainment are declared and approved in the product.

2 of 15 platforms qualify

Ethics platforms with no published AI processing

Report content does not pass through a published AI feature.

12 of 15 platforms qualify

Ethics platforms that document the EU Whistleblowing Directive

Directive 2019/1937 is referenced on the product or legal pages.

10 of 15 platforms qualify

Ethics platforms with a public API

A documented API lets cases reach an existing GRC or case system.

6 of 15 platforms qualify