Software built for the EU Whistleblowing Directive
Directive (EU) 2019/1937 requires organisations with 50 or more workers to run a secure internal reporting channel, acknowledge every report within 7 days, and give feedback within 3 months. Provoxis is that channel — configured in minutes, with the deadlines running in the background.
What Directive (EU) 2019/1937 actually requires
The Directive draws a hard line at 50 workers (Art. 8(3)): cross it, and a secure internal reporting channel isn't optional. Article 9(1) sets out what that channel has to do — confidential intake, an acknowledgement within seven days, and feedback to the reporter within three months. Confidentiality is required regardless of whether a report is identified; most national laws go further and require the option to report anonymously.
The Directive also bans retaliation outright — dismissal, demotion, a bad review, blacklisting — and reverses the usual burden of proof: once someone shows they reported something and then suffered a detriment, it's presumed to be retaliation unless the employer proves otherwise. A channel that can't track a concern to resolution, or keep a defensible record of what happened, isn't meeting the rest of the law either.
How your country transposed it
The Directive sets the floor, but every member state then wrote its own transposing law — often with real differences in how anonymous reports are handled, how workers are counted, and what your national regulator can fine you for missing a deadline. Worth checking the one that actually applies to you rather than assuming the Directive's text alone covers it:
We have an extensive knowledge base that covers the law in depth — what it protects, how each member state transposed it, and how to run a case once your channel is live.
What Provoxis actually is
Provoxis is a whistleblowing platform: a branded reporting portal your people use to raise a concern, and a case-management dashboard your team uses to handle it — built specifically around what the Directive requires, not a general-purpose compliance suite. Here's how each requirement maps to what you get:
A secure internal reporting channel
A branded portal on your own subdomain, reachable by anyone, with written and voice reporting. Encrypted at rest and in transit, EU data residency.
Confidential and anonymous reporting
No name or email is ever required. A private case reference — not the reporter's identity — carries the two-way conversation. Voice reports are pitch-shifted before storage.
The 7-day and 3-month deadlines
Acknowledgement is issued automatically the moment a report is submitted. The 3-month feedback clock is tracked per case, with reminders to handlers before it lapses.
A defensible record
Every acknowledgement, action and response is time-stamped in an append-only audit log. Retention is tiered and automatic; a legal hold pauses deletion during an investigation.
From signup and setup to a resolved case, end to end
Branding, MFA and team setup, then an anonymous report followed through triage, a retaliation flag, a legal hold and the audit export.
Questions from software buyers
Does Provoxis meet Directive (EU) 2019/1937's requirements out of the box? +
Yes. Every account gets a branded internal reporting channel with anonymous or identified reporting, the 7-day acknowledgement and 3-month feedback clocks tracked automatically, a retaliation flag, and an audit trail — the elements Article 9(1) requires, live within minutes of signing up.
Do we still need a written whistleblowing policy as well as the software? +
Yes — the Directive expects a documented procedure, not just a tool. Generate one free in a couple of minutes; it's personalised with your company name and your Provoxis reporting channel address.
Does the software cover more than one EU country? +
Yes. The core obligations — the channel, the two clocks, confidentiality, the retaliation ban — are the same Directive requirements everywhere in the EU, and Provoxis doesn't charge per country or per entity. Where a country's transposing law adds something extra, our country guides above cover the detail.
What happens if we're not sure we're over the 50-worker threshold? +
Check the 50-employee threshold guide — it's assessed per legal entity, not group-wide, and a narrow set of regulated sectors (financial services, aviation, maritime) are obligated regardless of headcount.
Get your channel live today
Sign up, brand your portal, invite your handlers — live in minutes, for one flat €119 a month. No sales call, no setup fee, no implementation project.