GlobaLeaks

Overview

The platform supports configurable reporting channels, anonymous two-way messaging, file exchange, report labels, and case statuses. Reporters can return to a conversation after submitting, while staff can organize incoming reports beyond a simple inbox. Multiple virtual whistleblowing sites can run on one installation, a useful way to serve different teams or programs without separate deployments.

A dynamic questionnaire builder supports multi-step submissions, so administrators can shape intake to gather structured reports. That flexibility suits organizations with distinct reporting processes, but it requires local configuration and administration. The web interface provides management tools; it does not remove the responsibility to maintain the system.

Key features

• Anonymous reporting and follow-up: Anonymous messaging in both directions and file exchange support ongoing contact without making anonymity a one-way intake feature. GlobaLeaks supports Tor and says it does not log IP addresses.
• Security controls: The platform lists TLS 1.3, two-factor authentication, AppArmor, network sandboxing, and PGP for email notifications and file downloads. The project says independent security audits have taken place since 2011 and publishes the reports in full. These controls and audit transparency matter for sensitive reporting, though they do not eliminate the operator’s deployment and security responsibilities.
• Integration and deployment: A REST API, Tor Onion Services, integration with existing websites, and connections to enterprise case-management platforms give technical teams options for fitting reporting into existing systems. Deployment is documented for Debian and Ubuntu, with Debian package updates and a Docker installation option.
• Intake capacity and accessibility: The default attachment limit is 30MB per file, configurable by administrators to a virtually unlimited size. Support for more than 90 languages, right-to-left languages, and WCAG 2.2 accessibility recommendations broadens its suitability for diverse reporting audiences.

The maker says GlobaLeaks complies with ISO 37002, EU Directive 2019/1937, and GDPR, and is designed in adherence to ISO/IEC 27001:2022. Those claims may be relevant to organizations assessing their reporting obligations, but they do not replace the organization’s own compliance review.

Pricing

GlobaLeaks: 0.00 USD per free. The free plan is open-source software for self-hosting, with a 30MB default attachment limit per file that administrators can configure higher. There is no software charge, but the organization must run and maintain its own deployment. This makes the plan compelling for teams able to supply that operational capacity; it is a weaker fit for buyers who need a vendor-operated service.

Platforms

GlobaLeaks supports web access and an API, and is available for Linux in self-hosted deployments. Documented installation options include Debian and Ubuntu support and Docker. This is a practical match for teams with Linux or container operations already in their stack, rather than organizations looking for a turnkey hosted platform.

Who it's for

Independent media, activists, public agencies, corporations, and other organizations are among the intended users. Its configurable channels, questionnaires, and multiple-site support suit organizations that need to adapt intake to different groups or reporting programs. Documentation, a ticketing system, a forum, and a community site provide support routes, but the organization remains responsible for operating the software.

Pros and cons

• Pro — Strong control over reporting: Anonymous follow-up, file exchange, configurable forms, labels, and statuses cover intake and case organization in one self-hosted platform.
• Pro — No software price: The open-source plan costs 0.00 USD per free, making it accessible to organizations that can handle deployment and maintenance.
• Pro — Broad security and integration options: Tor support, encryption, listed security controls, published audit reports, a REST API, and website and case-management integrations give technical and security teams substantial scope to adapt it.
• Con — Operational ownership falls to the organization: Self-hosting offers control, but requires teams to manage deployment and ongoing administration themselves.
• Con — Attachment limit needs review: The default 30MB per-file cap may not suit large evidence files unless administrators raise it.

Alternatives

Organizations that want a paid platform rather than a self-hosted open-source system can compare NotMe, which has a free plan and a NotMe Platform plan at 99.00 USD per month based on employee count, with unlimited reports and up to 5–10 admin licenses.

BoardEffect is another paid option with pricing available by demo request. Whispli Core is paid and has licence-based Essentials, Plus, and Business plans, with Plus including one automation and one workflow. SpeakUp Report is a paid option with tailored quotes based on organization size and channels, plus web-browser, mobile, and phone intake and a case-management system.

For teams comparing paid web-based services, Whistleblower Software offers a free trial and a Core plan at 99.00 EUR per month for 0–49 employees, billed annually. Whistlelink also offers a free trial; its 0–49 employee plan is 79.00 EUR per month with annual invoicing and all standard features included. AllVoices HR Case Management starts at 275.00 USD per month, with a custom quote based on employees and access requirements. EQS Integrity Line is a paid alternative with an Essential plan from 85.00 GBP per month and standard case management for small and medium-sized companies.

For a broader comparison, see Whistleblower Hotline Software.

Verdict

Choose GlobaLeaks if your organization needs configurable anonymous reporting, values open-source control, and can own a Linux or Docker deployment. Its reporting workflow and security options make it more capable than a basic intake channel, while its free price removes a software licence cost. Look elsewhere if you need a vendor-operated service or cannot take responsibility for administration and the default attachment limit.