NAVEX One EthicsPoint vs SpeakUp

NAVEX One EthicsPoint

Web, mobile and phone intake 24/7 in 60+ languages, anonymous or named, with machine translations for report details and follow-ups — that serves the night-shift caller well. But nothing shows the mobile route needs no app or account, accessibility is never mentioned, and the privacy statement admits cookies, beacons, tags and scripts collect personal information inside the Application — nobody documents that the reporter's identity stays out of the channel itself.

SpeakUp

Intake meets the frightened reporter where they are: phone, voicemail, web and app channels, multi-device, anonymous two-way follow-up, and a plain statement that the platform collects no IP addresses, device fingerprints or identifying metadata — identity documented as kept out of the channel itself. Language coverage runs broad with human and machine translation plus transcription, though the captured pages give different figures for supported languages. We found no public information on WCAG accessibility or whether every channel is anonymous-capable, so I stop below the top.

NAVEX One EthicsPoint

Complete auditable case history, per-user view/edit visibility, role-based permissions with safeguards that keep implicated parties out of case files, and Power BI management reporting. It falls short of the top anchors because 'reminders' is the only nod to deadlines — no evidenced 7-day/3-month statutory clocks — and retention is explicitly 'as directed by our business customer', so deletion discipline is outsourced.

SpeakUp

Reports flow into a structured triage-to-closure environment with custom roles, an audit-ready trail from report to closure, remediation tasks carrying owners and deadlines, and dashboards exportable for regulators — real discipline, not a spreadsheet next door. But we found no public information on automated statutory clocks for the acknowledgment and feedback duties, nor on excluding case handlers who are themselves implicated in a report.

NAVEX One EthicsPoint

The directive appears only as marketing: 'meet whistleblowing requirements like the EU Whistleblowing Directive and SOX' and WhistleB's 'alignment with the EU Whistleblowing Directive and national legislation' name no transposition, no implemented deadline rule, no legal review. Retention periods are delegated to the customer, which is exactly the anchor-3 pattern of vague invocation and shifted burden.

SpeakUp

The Directive is named together with its 50-employee duty, acknowledgment timelines and follow-up requirements are invoked as obligations the software must support, and retention and localization duties are claimed met alongside the German Supply Chain Act, GDPR, NIS2 and DORA. The mapping stays at that level: we found no public information on national transposition details, legal templates, named counsel or documented legal review.

NAVEX One EthicsPoint

Encryption and 'privacy protections built into AI-supported tools' are asserted words, and MFA plus role-based access are real, but there is no certificate, no pentest, no no-IP-logging statement anywhere in the registry. Worse, the privacy statement affirmatively discloses collection of personal information via cookies, beacons, tags and scripts inside the Application — for a product promising anonymity, silence on metadata plus an affirmative collection statement is the opposite of assurance.

SpeakUp

A heavyweight, recurring assurance stack — ISO 27001 and 27701 certification with quarterly ISAE 3000 Type II, SOC2 and TISAX audits — plus the sentence I weigh most: no IP addresses, no device fingerprints, no identifying metadata. Encryption in transit and at rest is asserted without technical architecture behind it, and we found no public information on published penetration-test reports, a security contact or a disclosure policy.

NAVEX One EthicsPoint

'Global collaboration across languages and regions' and up to two custom workflows for regions hint at groups, and 13,000+ customers with 75% of the Fortune 500 prove big companies buy it. But the evidence never evidences per-entity channels, per-entity branding, ombudsman access or case-access separation along legal-entity lines — I see the customer list, not the architecture.

SpeakUp

The vendor says it is suited to organizations with entities in multiple countries and shows global enterprise customers with custom team workflows and dashboards cutting across locations. But that is fit, not architecture: we found no public information on channels separated per legal entity, per-entity branding, delegated administration or external ombudsman access.

NAVEX One EthicsPoint

WhistleB promises 'Data is stored in the EU', but this is a Lake Oswego, Oregon vendor, and every sovereignty attribute in the evidence is unknown: no DPA, no subprocessor list, no named data centers, with NAVEX acting merely as the customer's processor. EU storage asserted by a US entity over an undocumented chain is barely a step above the floor.

SpeakUp

The European contracting party is a Dutch company with registration, tax and VAT details published, though the captured pages also list a New York entity and office within the group. The only no-transfer statement we found sits in a privacy statement that expressly covers the marketing website alone and points to a separate document for the SpeakUp system's data processing — so we found no public information confirming where report data itself is hosted, nor a published DPA or subprocessor list.

NAVEX One EthicsPoint

The pages sell three solutions and a 'fast, affordable way', and a professional tier for enterprises, but not a single number — no prices, bands, entity rules or setup fees — appears anywhere in the registry. Every tier is a sales conversation, which is the definition of the zero anchor.

SpeakUp

Every price is a sales conversation: the public pricing page says pricing is customized to company size and features, and no figures are published for any tier. Small credit for stating that the case management system is always included within the price and that support packages carry no hidden fees — but an obligated company cannot compute an invoice from the public pages.