The verdict in three sentences
Under EU Directive 2019/1937, transposed in France by the Waserman law of 21 March 2022, every company with at least 50 employees must provide an internal reporting channel that guarantees confidentiality, acknowledges receipt within 7 days and gives the whistleblower feedback within 3 months. For a single entity with a few reports a year, a SaaS tool at EUR 1,500 to 8,000 a year is more than enough. A custom build at EUR 25,000 to 45,000 excl. VAT makes sense for multi-subsidiary groups, sensitive sectors and companies that want the channel integrated with their HRIS and anti-corruption programme.
What the law actually requires from the reporting channel
The Directive and its national transpositions (France's Sapin 2 and Waserman laws, Germany's HinSchG, Ireland's Protected Disclosures Act, the Netherlands' Wbk) set precise obligations. A generic contact form or a shared mailbox does not meet them.
| Obligation | 2026 legal requirement | Technical translation | Risk if missing |
|---|---|---|---|
| Internal channel | Companies with 50+ employees | Dedicated form available 24/7 | Liability during an inspection |
| Confidentiality | Identity, facts and persons concerned protected | Encryption, named access, audit log | In France up to 2 years in prison and EUR 30,000 fine for disclosure |
| Acknowledgement | Within 7 days | Automatic reminder to the case handler | Procedural non-compliance |
| Feedback | Within 3 months | Deadline tracking and secure messaging | Easier external reporting |
| Anonymous reports | Must be handled if accepted | Dialogue box without an account | Lost reports |
| Retention | Strictly necessary period | Scheduled purge and anonymisation | GDPR breach |
| Obstructing a report | Criminal offence in France | Traceability of actions | France: 1 year in prison, EUR 15,000 fine; Germany: fine up to EUR 50,000 |
In France, for companies with over 500 employees and EUR 100 million turnover, the anti-corruption agency (AFA) also audits the internal alert system under the Sapin 2 programme. Its sanctions committee can impose fines of up to EUR 1 million on a legal entity and EUR 200,000 on an executive.
SaaS or custom build: the numbers
| Criterion | Market SaaS | Custom platform |
|---|---|---|
| Upfront cost | EUR 0 to 3,000 setup | EUR 25,000 to 45,000 excl. VAT |
| Annual cost | EUR 1,500 to 8,000 | EUR 3,000 to 7,000 (hosting, maintenance, testing) |
| Time to go live | 1 to 3 weeks | 10 to 14 weeks |
| Hosting | Usually EU, France depending on plan | Country of your choice, sovereign cloud possible |
| Multi-subsidiary and multilingual | Often a paid option per entity | Included in scope |
| HRIS and directory integration | Rare or limited | SSO, case handler mapping, rights per subsidiary |
| Investigation workflow | Standard | Matched to your procedure and committees |
| 5-year cost (1 entity) | EUR 7,500 to 43,000 | EUR 40,000 to 80,000 |
The maths is clear for an SME: below 3 or 4 subsidiaries and 30 reports a year, SaaS is cheaper and compliant immediately. A custom build becomes competitive when the SaaS charges for each additional entity (often EUR 1,000 to 2,500 a year per subsidiary, roughly USD 1,100 to 2,700) or when internal investigations must follow a specific procedure with several committee levels, large attachments and audit exports.
The features that make the difference
A good platform, bought or built, must at minimum encrypt attachments, strip metadata from uploaded files (author of a Word document, GPS coordinates of a photo), allow anonymous messaging with a tracking code and produce an annual statistical report without personal data. Check these four points in every demo.
Mini case study
Laurence Garnier, general counsel of a Lyon-based industrial group with 2,300 employees across 9 subsidiaries, 3 of them abroad, compares offers. The shortlisted SaaS charges EUR 4,500 a year for the parent company and EUR 1,800 per extra subsidiary: EUR 18,900 a year, or EUR 94,500 over 5 years. The custom platform, with SSO, a two-level investigation procedure and AFA reporting, costs EUR 42,000 excl. VAT then EUR 6,000 a year: EUR 66,000 over 5 years. The saving reaches EUR 28,500, and the compliance team expects to save 3 hours per report on 40 reports a year thanks to the integrated workflow, i.e. 120 hours a year.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Does a 60-employee company need a reporting channel?
Yes. Since 17 December 2023, companies with 50 to 249 employees are fully covered by the Directive. A SaaS tool at EUR 1,500 to 3,000 a year meets the need.
Is a dedicated email address enough?
In most cases no, because it guarantees neither encryption, nor tracking of the 7-day and 3-month deadlines, nor anonymous dialogue. It also exposes the whistleblower's identity to mailbox administrators.
Can several group companies share one channel?
Companies with fewer than 250 employees can share resources with their group. Above that, each company needs its own channel, which makes per-entity SaaS pricing more expensive.
Where should reports be hosted?
In the European Union, with a GDPR processing agreement. For sensitive sectors, sovereign cloud hosting adds EUR 3,000 to 10,000 a year.
How long does a custom platform take?
Allow 10 to 14 weeks, including 2 weeks of penetration testing. The budget ranges from EUR 25,000 to 45,000 excl. VAT depending on subsidiaries and integrations.
Let's scope your project. Share your headcount, number of subsidiaries and annual reports, and we will compare SaaS and custom over 5 years, with a priced scope between EUR 25,000 and 45,000 if custom wins. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
