NAVEX One EthicsPoint vs SpeakUp

NAVEX One EthicsPoint

Web, phone and mobile intake 24/7 in 60+ languages, anonymous or named, with two-way dialog and machine translations of follow-ups — the complete channel set an obligated company needs. It stops short of the top anchor: no accessibility statement, no QR entry, and nothing documenting how the reporter's identity is kept out of the channel itself.

SpeakUp

Phone, voicemail, web and app intake with 100+ languages, professional translation and an anonymous two-way follow-up is more channel than my staff will ever need, and the statement that no IP addresses, fingerprints or identifying metadata are collected makes anonymity look engineered rather than decorative. I found no public information on accessibility standards for the intake or on how anonymity holds on the phone channel, which keeps it below the top band.

NAVEX One EthicsPoint

Complete auditable case history, per-user view/edit visibility, role-based permissions with implicated-party exclusion, automated escalations and board-ready reporting are genuinely there. But the statutory 7-day/3-month clocks are never named as automated features, and retention is 'retained as directed by our business customer' — the deadline and deletion duties stay on my desk, not the product's.

SpeakUp

Structured triage, custom roles, an audit-ready trail from report to closure, remediation tasks with owners and deadlines, and dashboards that export for regulators — the paperwork side is genuinely handled by the product. But statutory deadlines appear only as a generic reference to "acknowledgment timelines, follow-up requirements", and I found no public information on automated seven-day and three-month clocks or on excluding implicated case handlers, so deadline discipline would rest on my discipline.

NAVEX One EthicsPoint

The EU Whistleblowing Directive appears as a marketing bullet and WhistleB claims alignment with 'national legislation', but no transposition is named, no acknowledgment/feedback clocks are evidenced, and retention is customer-directed. The mapping is exactly what rubric level 3 describes — invoked, vague, and my problem.

SpeakUp

The EU Whistleblower Directive, German Supply Chain Act, GDPR, NIS2 and DORA are all named, with dedicated directive pages in English and German and claims that retention and localization duties are met. The mapping stays at the regulation-name level though: I found no public information on per-country rule sets, legal templates, or guidance maintained by named counsel, which is the homework I wanted shown in public.

NAVEX One EthicsPoint

'Secure data hosting and encryption' plus MFA is assertion, not assurance: no ISO 27001, no pentest, no word on IP or metadata logging. The privacy statement admits cookies, beacons, tags and scripts 'within the Application' and targeted-advertising cookies in the preferences tool — the opposite of metadata minimization next to an anonymous hotline.

SpeakUp

ISO 27001 and 27701 for the organisation plus quarterly ISAE 3000 Type II, SOC2 and TISAX audits of the platform is the strongest third-party cadence I have seen, and the explicit no-IP, no-fingerprint, no-metadata statement covers the anonymity promise. It falls short of the top band because I found no public information on documented end-to-end encryption architecture, published penetration test summaries, or a security contact and disclosure policy.

NAVEX One EthicsPoint

Enterprise positioning with region-specific workflows, role permissions and giant scale claims (88M employees, 75% of Fortune 500), but the evidence never documents per-entity channels, separated case access per legal entity, or a group-level view. Scale claims are not multi-tenant architecture, and nothing on delegated administration or ombudsman access.

SpeakUp

Multi-country entities are explicitly supported, custom roles and per-team workflows let case handlers be separated, and dashboards roll up across locations for the global customers they name. I found no public information on per-entity branding, delegated administration or external ombudsman access, so the group structure is asserted rather than documented — as a single-entity firm I only care about that at renewal time.

NAVEX One EthicsPoint

NAVEX Global, Inc. is an Oregon company, and 'Data is stored in the EU' on the WhistleB page is the only sovereignty fact offered — no published DPA, no subprocessor list, no named data centers, and the evidence's own attributes are all unknown. For the most sensitive data a company holds, undocumented beats only total silence.

SpeakUp

The contracting entity is Dutch with a stated GDPR commitment and an EEA-only transfer statement, and the pages claim data localization requirements are met. But that transfer statement covers only the marketing website, and I found no public information on where the whistleblowing system's reports are hosted, on a public DPA, or on any subprocessor list — for the most sensitive data a company holds, that is thin.

NAVEX One EthicsPoint

'Fast, affordable' is the entirety of the pricing language; not one number, band boundary or setup fee appears anywhere in the evidence. Every tier is a sales conversation plus a Professional Services team to buy — I cannot compute the invoice for a 60-employee company, and my year-end review needs an invoice, not a negotiation.

SpeakUp

The pricing page carries no numbers at all — "Our pricing is customized based on your company size and the features you need" — and it describes the platform as serving companies from 500 employees to global enterprises, while a solutions page also says small and medium businesses are supported; either way a 60-employee buyer cannot compute any invoice without a sales call. The only comfort is public — case management is always included and support packages carry "no additional costs, no hidden fees" — but that is a promise, not a price.