NAVEX One EthicsPoint vs SpeakUp

NAVEX One EthicsPoint

Web, mobile and phone intake, anonymous or named, 60+ languages with two-way dialogue and machine translation of report details and follow-ups — that satisfies the 8 anchor almost fully. It stops short of 10 because the vendor documents nothing about keeping reporter identity out of the channel itself, and there is no accessibility or QR-entry evidence.

SpeakUp

Reports can come in by phone, voicemail, web browser or the SpeakUp app, with multi-device intake, and the anonymous two-way follow-up dialog looks first-class rather than bolted on — a published 49% average check-back rate is operational proof people actually use the dialog. Translation support spans 100+ languages with machine and human translation plus transcription. I found no public information on accessibility standards, QR entry points, or how anonymity is preserved through the voice channels, so I stay just below the top marks.

NAVEX One EthicsPoint

Implicated-party screening, complete auditable case history with per-user view/edit visibility, and genuine management reporting are evidenced — that is real discipline, not an inbox. But the statutory clocks surface only as generic 'reminders' with no 7-day/3-month automation named, and retention is 'as directed by our business customer', so per-case deletion rules remain my problem.

SpeakUp

This is a real case environment — structured triage, investigation planning with logs, interviews and findings, custom roles for handler separation, remediation tasks with owners and deadlines, automatic audit logs, and dashboards with exports for regulators. But the statutory clocks are named only generically as acknowledgment timelines and follow-up requirements, and I found no public information on automated reminders for the 7-day and 3-month deadlines, conflict-of-interest exclusion of implicated handlers, or tamper-evidence of the case history — the exact points I answer for.

NAVEX One EthicsPoint

'Alignment with the EU Whistleblowing Directive and national legislation' is marketing mapping, not implementation: no national transposition named, no legal templates, no counsel review, and the privacy statement confirms deadline, documentation and retention duties are the customer's to direct. The dedicated EU-focused product line keeps this just above pure label-wearing.

SpeakUp

The EU Whistleblower Directive is supported, the 50-employee scope is stated correctly, and acknowledgment timelines, follow-up requirements and national whistleblower protection laws are named as obligations the software addresses, with German supply-chain law, GDPR, NIS2 and DORA also cited. I found no public information on per-country transposition rule sets, legal templates, or documented review by named counsel, so the legal mapping I could hand a regulator is not in the captured pages.

NAVEX One EthicsPoint

Encryption, MFA and role-based permissions are asserted, but nothing is audited — no ISO 27001, no pentest, no encryption architecture. And it is worse than metadata silence: the privacy statement discloses cookies, beacons, tags and scripts collecting personal information within the Application, which is an anonymity problem for a whistleblowing channel.

SpeakUp

Quarterly ISAE 3000 Type II, SOC 2 and TISAX audits on top of ISO 27001 and 27701 certification is a recurring assurance rhythm I can put in front of an auditor, and the explicit statement that the platform collects no IP addresses, device fingerprints or identifying metadata is the right kind of specificity. What holds it back is that I found no public information on penetration tests, on an encryption architecture beyond highest-standards language, or on a security contact and disclosure policy.

NAVEX One EthicsPoint

Regional custom workflows, role-based permissions and multinational enterprise positioning are evidenced, but the evidence never mentions per-entity channels, delegated administration, or a group overview that respects entity boundaries. The Fortune-500 customer base implies scale; the evidence does not show the multi-tenant mechanics.

SpeakUp

Support for organizations with entities in multiple countries and a customer base including Nestlé, Daimler Truck, Electrolux and Swarovski suggest group fitness, with dashboards showing trends across locations and custom roles enabling some access separation. But I found no public information on per-entity channels, delegated administration, external ombudsman or counsel access, or per-entity branding — the structures a corporate group would actually rely on are not evidenced.

NAVEX One EthicsPoint

'Data is stored in the EU' is stated for the EU product line, but the vendor is a US entity acting as processor for the most sensitive data we hold, and no DPA, subprocessor list or TOMs appear anywhere in the evidence. Subprocessor exposure to non-EU jurisdictional reach is entirely undocumented.

SpeakUp

The European contracting entity is the Dutch People InTouch B.V. with full registry details, and the privacy statement commits to no transfers outside the EEA — but that statement expressly covers only the marketing website, and the document governing the SpeakUp product's own data processing was not in the captures. I found no public information on a published DPA, a subprocessor list for the product, or named data centers, and a New York sister entity plus Bengaluru and New York offices sit alongside the Dutch core.

NAVEX One EthicsPoint

Three solutions, one described as 'fast, affordable', and not a single number anywhere — no tiers, bands, billing periods or setup fees. No obligated company can compute any invoice from these pages; everything is a sales conversation.

SpeakUp

Pricing is explicitly customized on company size and features such as advanced analytics and SSO, and no figures appear on any captured page, so I cannot compute an invoice for a 600-employee company from public information. The only public pricing facts are qualitative — case management is always included in the price and support packages carry no additional costs — which tells me about scope, not cost.