GlobaLeaks

GlobaLeaks is a free, open-source whistleblowing system for organizations that want to operate their own reporting platform. It will suit teams with Linux deployment and administration capacity, from independent media and activists to public agencies and companies. Its configurable reporting process and security controls make it a capable option for that audience, with hosting and upkeep squarely the organization’s responsibility.

Overview

GlobaLeaks handles reporting from structured intake through follow-up and case organization. Reporters can submit through configurable channels, exchange files, and continue an anonymous two-way conversation. Staff can label reports and track case statuses, while a single setup can serve multiple virtual whistleblowing sites.

The dynamic questionnaire builder supports multi-step submissions, so organizations can shape intake to their reporting needs rather than settle for a single generic form. That flexibility is valuable when channels or teams require different questions, but it calls for administrators to design and maintain the process. This is self-hosted software, not a managed service that takes deployment off the organization’s hands.

Key features

• Anonymous reporting and follow-up: Two-way messaging and file exchange let reporters continue a conversation after submitting. GlobaLeaks supports Tor and says it does not log IP addresses, useful protections for sensitive reporting.
• Case handling and intake: Configurable channels, multi-step questionnaires, labels, and case statuses support a more organized process than an unstructured inbox. Workflow automation is also supported.
• Security controls: The platform lists TLS 1.3, two-factor authentication, AppArmor and network sandboxing, and PGP for email notifications and file downloads. The project says independent security audits have taken place since 2011 and publishes their full reports.
• Integration and deployment: A REST API, Tor Onion Services, integration with existing websites, and integration with enterprise case-management platforms provide ways to connect the system to broader operations. Deployment options include Debian and Ubuntu, Debian package updates, and Docker.
• Language and accessibility support: GlobaLeaks supports more than 90 languages, including right-to-left languages, and its technical features cite WCAG 2.2 accessibility recommendations.

The maker says GlobaLeaks complies with ISO 37002, EU Directive 2019/1937, and GDPR, and is designed in adherence to ISO/IEC 27001:2022. These claims may help organizations assessing policy fit, but do not remove the need to evaluate their own deployment and procedures.

The default attachment cap is 30MB per file. Administrators can raise it to a virtually unlimited size, but organizations expecting large submissions should plan that configuration rather than assume the default will suffice.

Pricing

GlobaLeaks: free. The plan is free, open-source software and self-hosted, with a default attachment limit of 30MB per file that administrators can configure higher. There are no paid tiers or seat limits in the stated plan; the trade-off is that the organization must run and maintain the deployment itself.

Platforms

GlobaLeaks is available for Linux and self-hosted deployments, with a web administration interface and API. The documented Linux options are Debian and Ubuntu, with Docker also supported. This suits organizations able to manage their own hosting; teams seeking a provider-operated service should look elsewhere.

Who it's for

Independent media, activists, public agencies, corporations, and other organizations can use GlobaLeaks to run whistleblowing channels. It is particularly apt for teams that need anonymous two-way communication, configurable intake, and control over their own deployment. It is a weaker fit for organizations without the technical capacity or operational appetite to host and administer the platform. Support routes include documentation, a ticketing system, a forum, and a community site.

Pros and cons

Pros

• Free and open source: Organizations can deploy the software without a subscription price.
• Structured, configurable process: Questionnaires, channels, labels, statuses, and two-way follow-up cover more than initial report collection.
• Multiple security layers: Tor support, no IP logging, encryption, and the stated security controls support sensitive reporting needs.
• Broad language reach: Support for over 90 languages, including right-to-left languages, can serve multilingual reporting audiences.

Cons

• Self-hosting is required: The organization must take responsibility for deployment and ongoing administration.
• Attachment cap needs planning: The 30MB default may constrain large files unless administrators raise it.
• Workflow flexibility needs configuration: Teams must shape and maintain their own questionnaires and reporting channels.

Alternatives

Whistleblower Hotline Software is a useful starting point for comparing options across the category.

• BoardEffect is a paid option with Android, iOS, API, and web platforms; consider it if those platforms better match your organization’s requirements.
• NotMe offers a free plan and a paid NotMe Platform plan at $99 a month, with unlimited reports and up to 5-10 admin licenses. Choose it if that plan’s employee-count pricing and admin allowance fit better than managing a self-hosted installation.
• iVoiceUp is a paid web option with plans that specify different admin-account counts and, on Professional, automated routing and escalation paths. Consider it if a web-based paid plan better fits your administration needs.
• Ethics Suite is a paid web alternative.
• OpenWhistle is another free option for web and Linux.
• WrightLine is a paid web alternative.
• EQS Integrity Line offers a free trial and an Essential plan at £85 a month, with standard case management and over 80 languages. It may suit small and medium-sized companies seeking a ready-to-use solution.
• Ethics Hotline Portal is a paid web alternative.

Verdict

Choose GlobaLeaks if your organization needs configurable anonymous reporting and case follow-up, values its security controls, and can host and administer the system. Its free, open-source model avoids subscription costs, while self-management is the main operational price. Look elsewhere if you need a provider-operated service or do not have the capacity to maintain your own deployment.