NAVEX One EthicsPoint vs SpeakUp

NAVEX One EthicsPoint

Web, mobile and 24/7 phone intake, anonymous by default across channels, 60+ languages with machine translation for reports and follow-ups, and two-way dialogue — that is the intake footprint my subsidiaries' workforces need. It stops short of the top anchor because nothing addresses accessibility, QR or low-friction entry, and no documentation explains how the reporter's identity is kept out of the channel itself.

SpeakUp

Intake spans phone, voicemail, browser and app with 100+ languages backed by machine and human translation and transcription, and anonymous two-way follow-up is first-class — a 49% check-back rate says reporters actually come back to the dialog. An explicit statement that the platform collects no IP addresses, device fingerprints or identifying metadata underpins the 100% anonymity guarantee. I found no public information on WCAG accessibility or per-channel anonymity engineering, which is what the top band demands.

NAVEX One EthicsPoint

Implicated-party screening that blocks access, complete auditable case history with per-user view/edit logging, and audit- and board-ready reporting (Power BI) are all evidenced. But the statutory machinery is absent: no 7-day acknowledgment or 3-month feedback clock anywhere in the evidence, and retention is whatever the business customer directs rather than legally aware automation — so it sits below the anchor it almost reaches.

SpeakUp

Cases flow into a structured environment with triage, investigation documentation, custom workflows, custom role-based access and an audit-ready trail from report to closure, plus dashboards and exports for regulators — that clears the working bar. But statutory deadline handling is referenced only generically, and I found no public information on automated acknowledgment and feedback clocks, exclusion of implicated case handlers for conflict of interest, or per-case retention and deletion rules, which is exactly what a dozen subsidiaries need to stay out of trouble.

NAVEX One EthicsPoint

The directive exists here only as marketing vocabulary — 'Confidently meet whistleblowing requirements like the EU Whistleblowing Directive and SOX' — with no national transposition named (HinSchG et al. nowhere), no deadline features, no legal templates and no counsel review. WhistleB's 'alignment with the EU Whistleblowing Directive and national legislation' is the same vagueness in regional packaging, and retention duties are explicitly the customer's problem.

SpeakUp

The Directive's duties are named concretely — the 50-employee scope, acknowledgment timelines, follow-up requirements — alongside GDPR, retention and localization commitments and a German supply-chain law among supported regulations, which is more than label-wearing. The mapping stays at that level though: I found no public information on per-country rule sets for national transpositions, legal templates or review by named counsel, or guidance for group-wide channels and external ombudsman setups, the exact items my roll-out would hinge on.

NAVEX One EthicsPoint

Encryption, MFA and role-based permissions are asserted, but nothing is audited — no ISO 27001, no pentest, no statement on IP logging. Worse than silence: the privacy statement admits cookies, beacons, tags and scripts collect personal information inside the Application, with targeted-advertising cookies governed by a preference tool — a whistleblowing channel that tracks sessions in its own app is an anonymity problem, not just a gap.

SpeakUp

The assurance stack is strong and recurring — ISO 27001 and 27701 with quarterly ISAE 3000 Type II audits alongside SOC2 and TISAX, encryption at rest and in transit, MFA and SSO — and the anonymity engineering goes beyond adjectives with an explicit no-IP, no-device-fingerprint, no-identifying-metadata statement. I found no public information on penetration-test attestations, documented end-to-end encryption architecture, or a published security contact and disclosure policy, which keeps it shy of the top band.

NAVEX One EthicsPoint

This is the make-or-break for a 25-subsidiary rollout, and the evidence is silent on per-entity channels, delegated administration, external ombudsman roles and group reporting that respects entity boundaries — nothing beyond 'enterprise organizations meeting multinational regulatory requirements'. 'Up to two custom workflows' for teams, departments or regions plus 'global collaboration' and a central dashboard is single-tenant phrasing, not a multi-tenant group structure.

SpeakUp

There is group-level evidence: suitability for organizations with entities in multiple countries is affirmed, dashboards trend across locations, teams and custom roles structure access, and global enterprises like Nestlé and Daimler Truck are named customers. But I found no public information on separate channels per legal entity with hard access separation, delegated administration, external ombudsman roles, or group reporting that respects entity boundaries — so a 25-subsidiary roll-out would rest on customer logos rather than demonstrated entity architecture.

NAVEX One EthicsPoint

The vendor is a US entity (NAVEX Global, Inc., Lake Oswego, Oregon, BC Partners-backed), and the only EU-hosting claim — 'Data is stored in the EU', GDPR-first architecture — attaches to the acquired WhistleB sibling, not to the flagship. No public DPA or subprocessor list is in evidence, and the application runs targeted-advertising cookies; for the most sensitive data a group holds, that is anchor-zero territory with one sibling-product credit.

SpeakUp

The contracting entity is the Dutch People InTouch B.V. with an EEA-no-transfer statement and GDPR posture, and the one US tracking tool is explicitly limited to US visitors, so the default direction is European. But the privacy statement expressly covers only the marketing website and refers product-data processing to a separate document, and I found no public information on a published DPA, a product subprocessor list, or named data centers for report content — while a US sibling entity and New York office sit alongside the Dutch company.

NAVEX One EthicsPoint

There is not a single number in the evidence: three named solutions with 'fast, affordable' positioning and sales-led Professional Services, and every tier routed to a conversation. Neither a 60-employee subsidiary nor my 25-entity group could compute one line of the invoice from public pages.

SpeakUp

The public answer is a sales conversation: "Our pricing is customized based on your company size and the features you need, such as advanced analytics or SSO," aimed at companies from 500 employees to global enterprises, with no tier, band, entity or setup figures anywhere in the captured pages. A support package with "no additional costs, no hidden fees" is a fairness promise, not a computable invoice — I cannot price a five-entity group from public information at all.