Overview

GlobaLeaks handles reporting from intake through case follow-up: reporters can submit through configurable channels, exchange files, and continue anonymous two-way conversations. Staff can label reports and track case statuses, and a single installation can host multiple virtual whistleblowing sites. That makes it more adaptable than a simple anonymous inbox, especially for organizations with distinct reporting processes.

A dynamic questionnaire builder supports multi-step submissions, so administrators can structure the information collected at intake. The trade-off is operational responsibility: the organization configures and maintains its own workflows and deployment rather than handing those tasks to a hosted provider.

Key features

Anonymous reporting and follow-up: Two-way messaging and file exchange let a reporter respond after submitting without revealing their identity. GlobaLeaks supports Tor and says it does not log IP addresses.
Security controls: The platform lists TLS 1.3, two-factor authentication, AppArmor and network sandboxing, plus PGP for email notifications and file downloads. The project says it has undergone independent security audits since 2011 and publishes the reports in full. These measures are useful for sensitive reporting, but they do not remove the need for sound deployment and administration.
Integration and administration: A REST API, Tor Onion Services, and integration with existing websites give technical teams options for fitting intake into existing systems. The platform is managed through a web interface and supports multiple virtual sites on one setup; its legal features also mention enterprise case-management integrations.
Accessibility and languages: The user features include over 90 languages and right-to-left support, while the technical features list WCAG 2.2 accessibility recommendations. These make it a more plausible choice for varied reporter communities.
Attachment sizing: Files are capped at 30MB each by default, though administrators can raise the limit to a virtually unlimited size. Teams expecting large evidence files should plan to change the setting and account for their own storage capacity.

The maker says GlobaLeaks complies with ISO 37002, EU Directive 2019/1937, and GDPR, and is designed in adherence to ISO/IEC 27001:2022. Organizations should assess those claims against their own legal and security requirements.

Pricing

GlobaLeaks — free: The free, open-source plan includes self-hosted software, anonymous reporting, workflow automation, and custom intake forms. There is no software subscription to budget for, but hosting and ongoing administration remain with the organization. The default attachment cap is 30MB per file, configurable higher. There are no paid tiers or seat and quota terms given for this plan.

Deployment is documented for Linux Debian and Ubuntu, with Debian package updates and a Docker installation option. Support resources include documentation, a ticketing system, a forum, and a community site; this is a different support model from relying on a hosted vendor to operate the platform.

Platforms

GlobaLeaks is available as a web interface and supports Linux, self-hosted deployment, and an API. The documented Debian and Ubuntu support and Docker option make it best suited to organizations with technical capacity to install and maintain server software, not teams seeking a turnkey hosted service.

Who it's for

Independent media, activists, public agencies, corporations, and other organizations can use GlobaLeaks to provide structured, anonymous reporting. It fits especially well when control over deployment, configurable intake, and two-way follow-up matter more than outsourced hosting. Organizations without Linux or Docker administration capacity should consider a hosted alternative instead.

Pros and cons

Pros

Free, open-source software avoids a platform subscription while allowing a self-hosted setup.
Anonymous two-way messaging, file exchange, configurable channels, and multi-step questionnaires support a fuller reporting workflow than one-way intake.
Multiple virtual sites, an API, and website integration give technical teams room to connect reporting to existing operations.
Tor support, no IP logging as stated by the project, encryption, listed security controls, and published audit reports address important confidentiality concerns.

Cons

Self-hosting puts deployment, maintenance, and workflow configuration on the organization.
The default 30MB-per-file attachment limit may be restrictive for evidence-heavy reports unless administrators raise it.
Its documented Linux deployment options require technical capability that a hosted service may not demand.

Alternatives

Whistleblower Hotline Software is a category directory for comparing options. Whistleblower Software is a paid web option with a free trial and annual-billed Core plans starting at 99.00 EUR per month for 0–49 employees; consider it if a paid service better fits your organization. EQS Integrity Line offers a paid, trial-available web and mobile option, with Essential at 85.00 GBP per month and a ready-to-use solution for small and medium-sized companies; it may suit teams wanting that package rather than self-hosting.

EthicsGlobal CaseManager has paid plans with custom pricing based on configuration. OpenWhistle is another free, self-hosted Linux and web option, with no paid tier or subscription and the server cost left to the user. Whistlelink is a paid web option with a free trial and an annual subscription starting at 79.00 EUR per month for 0–49 employees, with standard features included.

NotMe offers a paid platform with a free plan and trial, including a 99.00 USD per month plan with unlimited reports and up to 5–10 admin licenses. BoardEffect is a paid option. iVoiceUp is a paid web and self-hosted option with plans that include administrative accounts and, at Professional, automated routing and escalation paths.

Verdict

Choose GlobaLeaks if your organization needs configurable anonymous reporting and follow-up, values control over its platform, and can manage self-hosting. Its no-cost software, security controls, and flexible intake make a compelling combination for technically capable teams. Look elsewhere if you need a provider to run the service or want to avoid configuring deployment and attachment limits yourself.

	GlobaLeaks	RiskFox Whistleblower System
Free plan	Yes	No
Free trial		Yes
Paid from	Free	€150/mo
Platforms	api, Linux, self-hosted, Web	Web
Free plan	Yes	No
Anonymous reporting	Yes	Yes
Workflow automation	Yes	Yes
Custom intake forms	Yes	No
Phone hotline		No

GlobaLeaks vs RiskFox Whistleblower System

GlobaLeaks

RiskFox Whistleblower System