SpeakUp

The Compliance Officer

Reports can come in by phone, voicemail, web browser or the SpeakUp app, with multi-device intake, and the anonymous two-way follow-up dialog looks first-class rather than bolted on — a published 49% average check-back rate is operational proof people actually use the dialog. Translation support spans 100+ languages with machine and human translation plus transcription. I found no public information on accessibility standards, QR entry points, or how anonymity is preserved through the voice channels, so I stay just below the top marks. 7 13 8

Report an error

The Reporter's Advocate

Intake meets the frightened reporter where they are: phone, voicemail, web and app channels, multi-device, anonymous two-way follow-up, and a plain statement that the platform collects no IP addresses, device fingerprints or identifying metadata — identity documented as kept out of the channel itself. Language coverage runs broad with human and machine translation plus transcription, though the captured pages give different figures for supported languages. We found no public information on WCAG accessibility or whether every channel is anonymous-capable, so I stop below the top. 1 7 13

Report an error

The SME Operator

Phone, voicemail, web and app intake with 100+ languages, professional translation and an anonymous two-way follow-up is more channel than my staff will ever need, and the statement that no IP addresses, fingerprints or identifying metadata are collected makes anonymity look engineered rather than decorative. I found no public information on accessibility standards for the intake or on how anonymity holds on the phone channel, which keeps it below the top band. 7 13

Report an error

The Group Counsel

Intake spans phone, voicemail, browser and app with 100+ languages backed by machine and human translation and transcription, and anonymous two-way follow-up is first-class — a 49% check-back rate says reporters actually come back to the dialog. An explicit statement that the platform collects no IP addresses, device fingerprints or identifying metadata underpins the 100% anonymity guarantee. I found no public information on WCAG accessibility or per-channel anonymity engineering, which is what the top band demands. 7 13

Report an error

The Security Auditor

Intake is documented across phone, voicemail, web browser and a mobile app, with 100+ languages plus machine and professional human translation and transcription, multi-device access, and an anonymous two-way follow-up dialog evidenced by a published 49% check-back rate. The platform states it collects no IP addresses, device fingerprints or identifying metadata, which is a concrete claim about the intake path. We found no public information on QR entry points, accessibility-standard conformance, or documentation of how reporter identity is kept out of the channels themselves. 7 8 13

Report an error

The Skeptic

Reports can arrive by phone, voicemail, web browser or the SpeakUp app, with anonymous two-way follow-up the vendor says drives a 49% check-back rate, and the explicit statement that the platform collects no IP addresses, device fingerprints or identifying metadata is exactly the engineering detail an anonymity claim needs. Language coverage is stated as 100+ languages with human and machine translation in over 75. I found no public information on accessibility commitments such as WCAG, on QR entry points, or on whether the phone channel itself is anonymous-capable. 7 8 13

Report an error

The Compliance Officer

This is a real case environment — structured triage, investigation planning with logs, interviews and findings, custom roles for handler separation, remediation tasks with owners and deadlines, automatic audit logs, and dashboards with exports for regulators. But the statutory clocks are named only generically as acknowledgment timelines and follow-up requirements, and I found no public information on automated reminders for the 7-day and 3-month deadlines, conflict-of-interest exclusion of implicated handlers, or tamper-evidence of the case history — the exact points I answer for. 7 13

Report an error

The Reporter's Advocate

Reports flow into a structured triage-to-closure environment with custom roles, an audit-ready trail from report to closure, remediation tasks carrying owners and deadlines, and dashboards exportable for regulators — real discipline, not a spreadsheet next door. But we found no public information on automated statutory clocks for the acknowledgment and feedback duties, nor on excluding case handlers who are themselves implicated in a report. 7 13

Report an error

The SME Operator

Structured triage, custom roles, an audit-ready trail from report to closure, remediation tasks with owners and deadlines, and dashboards that export for regulators — the paperwork side is genuinely handled by the product. But statutory deadlines appear only as a generic reference to "acknowledgment timelines, follow-up requirements", and I found no public information on automated seven-day and three-month clocks or on excluding implicated case handlers, so deadline discipline would rest on my discipline. 7 8 13

Report an error

The Group Counsel

Cases flow into a structured environment with triage, investigation documentation, custom workflows, custom role-based access and an audit-ready trail from report to closure, plus dashboards and exports for regulators — that clears the working bar. But statutory deadline handling is referenced only generically, and I found no public information on automated acknowledgment and feedback clocks, exclusion of implicated case handlers for conflict of interest, or per-case retention and deletion rules, which is exactly what a dozen subsidiaries need to stay out of trouble. 4 7 13

Report an error

The Security Auditor

Structured triage with investigation planning, logs, interviews and findings is evidenced, alongside custom roles, remediation tasks carrying owners and deadlines, custom team workflows, an audit-ready trail from report to closure, and dashboards exportable for regulators. The acknowledgment-timeline and follow-up language is phrased as what such software must support rather than a documented automated clock. We found no public information on automated statutory deadlines, conflict-of-interest exclusion of implicated handlers, tamper-evidence of the case record, or per-case retention and deletion automation. 7 13

Report an error

The Skeptic

The case worker's side looks real: structured triage-to-closure case management, an audit-ready trail, attachments, custom roles rather than all-or-nothing permissions, remediation tasks carrying owners and deadlines, investigation planning with logs and interviews, and dashboards exportable for regulators. But the statutory clocks appear only as a general remark that such software must support acknowledgment timelines and follow-up requirements — I found no public information on automated seven-day and three-month deadline handling, exclusion of implicated case handlers, or tamper-evidence for the case record. 7 13

Report an error

The Compliance Officer

The EU Whistleblower Directive is supported, the 50-employee scope is stated correctly, and acknowledgment timelines, follow-up requirements and national whistleblower protection laws are named as obligations the software addresses, with German supply-chain law, GDPR, NIS2 and DORA also cited. I found no public information on per-country transposition rule sets, legal templates, or documented review by named counsel, so the legal mapping I could hand a regulator is not in the captured pages. 7 13

Report an error

The Reporter's Advocate

The Directive is named together with its 50-employee duty, acknowledgment timelines and follow-up requirements are invoked as obligations the software must support, and retention and localization duties are claimed met alongside the German Supply Chain Act, GDPR, NIS2 and DORA. The mapping stays at that level: we found no public information on national transposition details, legal templates, named counsel or documented legal review. 7 13

Report an error

The SME Operator

The EU Whistleblower Directive, German Supply Chain Act, GDPR, NIS2 and DORA are all named, with dedicated directive pages in English and German and claims that retention and localization duties are met. The mapping stays at the regulation-name level though: I found no public information on per-country rule sets, legal templates, or guidance maintained by named counsel, which is the homework I wanted shown in public. 7 11 12 13

Report an error

The Group Counsel

The Directive's duties are named concretely — the 50-employee scope, acknowledgment timelines, follow-up requirements — alongside GDPR, retention and localization commitments and a German supply-chain law among supported regulations, which is more than label-wearing. The mapping stays at that level though: I found no public information on per-country rule sets for national transpositions, legal templates or review by named counsel, or guidance for group-wide channels and external ombudsman setups, the exact items my roll-out would hinge on. 7 13

Report an error

The Security Auditor

The EU Whistleblower Directive is cited with the correct 50-employee obligation, and the vendor lists the Directive, the German Supply Chain Act, GDPR, NIS2 and DORA among supported regulations, with retention and localization duties claimed as fulfilled. The mapping stays at category level, and we found no public information on specific national transpositions such as the German whistleblowing act, legal templates, process guidance maintained by named counsel, or documented updates when a law changes. 7 13

Report an error

The Skeptic

The EU Directive, German Supply Chain Act, GDPR, NIS2 and DORA are all invoked, and the pages correctly note the Directive bites from 50 employees, but the mapping stays at the level of "we help you comply", with deadlines and follow-up duties named only as generic obligations such software must support. I found no public information on national transposition specifics, legal templates, named counsel, or any commitment to update the product when a law moves. 7 13

Report an error

The Compliance Officer

Quarterly ISAE 3000 Type II, SOC 2 and TISAX audits on top of ISO 27001 and 27701 certification is a recurring assurance rhythm I can put in front of an auditor, and the explicit statement that the platform collects no IP addresses, device fingerprints or identifying metadata is the right kind of specificity. What holds it back is that I found no public information on penetration tests, on an encryption architecture beyond highest-standards language, or on a security contact and disclosure policy. 7 13

Report an error

The Reporter's Advocate

A heavyweight, recurring assurance stack — ISO 27001 and 27701 certification with quarterly ISAE 3000 Type II, SOC2 and TISAX audits — plus the sentence I weigh most: no IP addresses, no device fingerprints, no identifying metadata. Encryption in transit and at rest is asserted without technical architecture behind it, and we found no public information on published penetration-test reports, a security contact or a disclosure policy. 7 13

Report an error

The SME Operator

ISO 27001 and 27701 for the organisation plus quarterly ISAE 3000 Type II, SOC2 and TISAX audits of the platform is the strongest third-party cadence I have seen, and the explicit no-IP, no-fingerprint, no-metadata statement covers the anonymity promise. It falls short of the top band because I found no public information on documented end-to-end encryption architecture, published penetration test summaries, or a security contact and disclosure policy. 7 13

Report an error

The Group Counsel

The assurance stack is strong and recurring — ISO 27001 and 27701 with quarterly ISAE 3000 Type II audits alongside SOC2 and TISAX, encryption at rest and in transit, MFA and SSO — and the anonymity engineering goes beyond adjectives with an explicit no-IP, no-device-fingerprint, no-identifying-metadata statement. I found no public information on penetration-test attestations, documented end-to-end encryption architecture, or a published security contact and disclosure policy, which keeps it shy of the top band. 7 13

Report an error

The Security Auditor

Certification is claimed for ISO 27001 and ISO 27701 with quarterly ISAE 3000 Type II audits plus SOC 2 and TISAX, and the platform states it collects no IP addresses, device fingerprints or identifying metadata — that is a minimization statement I can actually work with. Encryption is asserted at rest and in transit, but "highest encryption standards" and "100% anonymity guaranteed" are adjectives, not architecture. We found no public information on penetration tests, the visible scope of the certificates, end-to-end encryption of report content, or a published security contact and disclosure policy, so the question of whether the operator could unmask a reporter goes unanswered in public. 7 13

Report an error

The Skeptic

The claims are unusually specific for this market — ISO 27001 and 27701, quarterly ISAE 3000 Type II plus SOC 2 and TISAX audits, MFA and SSO — and the explicit no-IP, no-fingerprint, no-identifying-metadata statement is the metadata minimization I hunt for. My discount: the captured pages assert certificates without showing them, describe encryption only as "highest standards" at rest and in transit, and I found no public information on an end-to-end encryption architecture, penetration test reports, or a security contact and disclosure policy. "100% Anonymität garantiert" is a slogan; the metadata statement is the part a buyer can hold them to. 7 13

Report an error

The Compliance Officer

Support for organizations with entities in multiple countries and a customer base including Nestlé, Daimler Truck, Electrolux and Swarovski suggest group fitness, with dashboards showing trends across locations and custom roles enabling some access separation. But I found no public information on per-entity channels, delegated administration, external ombudsman or counsel access, or per-entity branding — the structures a corporate group would actually rely on are not evidenced. 4 7 13

Report an error

The Reporter's Advocate

The vendor says it is suited to organizations with entities in multiple countries and shows global enterprise customers with custom team workflows and dashboards cutting across locations. But that is fit, not architecture: we found no public information on channels separated per legal entity, per-entity branding, delegated administration or external ombudsman access. 4 7 13

Report an error

The SME Operator

Multi-country entities are explicitly supported, custom roles and per-team workflows let case handlers be separated, and dashboards roll up across locations for the global customers they name. I found no public information on per-entity branding, delegated administration or external ombudsman access, so the group structure is asserted rather than documented — as a single-entity firm I only care about that at renewal time. 4 7 13

Report an error

The Group Counsel

There is group-level evidence: suitability for organizations with entities in multiple countries is affirmed, dashboards trend across locations, teams and custom roles structure access, and global enterprises like Nestlé and Daimler Truck are named customers. But I found no public information on separate channels per legal entity with hard access separation, delegated administration, external ombudsman roles, or group reporting that respects entity boundaries — so a 25-subsidiary roll-out would rest on customer logos rather than demonstrated entity architecture. 4 7 13

Report an error

The Security Auditor

The vendor states it is suited to organizations with entities in multiple countries, and dashboards show trends across locations with custom roles, custom team workflows and a multinational customer list. We found no public information on per-entity channels with separated case access, delegated administration, external ombudsman or counsel roles, or per-entity branding and white-label reporting pages. 4 7 13

Report an error

The Skeptic

Multi-country entities are claimed as supported and enterprise logos are everywhere, with analytics across locations, configurable teams and custom workflows — but the captured pages stop at "perfectly suited for international companies". I found no public information on per-entity channels, per-entity case-access separation, per-entity branding, delegated administration, or external ombudsman and counsel roles. 4 7

Report an error

The Compliance Officer

The European contracting entity is the Dutch People InTouch B.V. with full registry details, and the privacy statement commits to no transfers outside the EEA — but that statement expressly covers only the marketing website, and the document governing the SpeakUp product's own data processing was not in the captures. I found no public information on a published DPA, a subprocessor list for the product, or named data centers, and a New York sister entity plus Bengaluru and New York offices sit alongside the Dutch core. 5 3 6

Report an error

The Reporter's Advocate

The European contracting party is a Dutch company with registration, tax and VAT details published, though the captured pages also list a New York entity and office within the group. The only no-transfer statement we found sits in a privacy statement that expressly covers the marketing website alone and points to a separate document for the SpeakUp system's data processing — so we found no public information confirming where report data itself is hosted, nor a published DPA or subprocessor list. 3 5 6

Report an error

The SME Operator

The contracting entity is Dutch with a stated GDPR commitment and an EEA-only transfer statement, and the pages claim data localization requirements are met. But that transfer statement covers only the marketing website, and I found no public information on where the whistleblowing system's reports are hosted, on a public DPA, or on any subprocessor list — for the most sensitive data a company holds, that is thin. 3 5 13

Report an error

The Group Counsel

The contracting entity is the Dutch People InTouch B.V. with an EEA-no-transfer statement and GDPR posture, and the one US tracking tool is explicitly limited to US visitors, so the default direction is European. But the privacy statement expressly covers only the marketing website and refers product-data processing to a separate document, and I found no public information on a published DPA, a product subprocessor list, or named data centers for report content — while a US sibling entity and New York office sit alongside the Dutch company. 3 5 6

Report an error

The Security Auditor

The European contracting entity is the Dutch People InTouch B.V. at an Amsterdam address, and the privacy statement says personal data is not transferred to processors outside the EEA — but that statement expressly covers only the marketing website, with the product's data processing documented separately. We found no public information on where the product's report data is hosted, on product subprocessors, on named data centers, or on a published data processing agreement and technical measures. A US sibling entity (SpeakUp US, Inc., New York) and offices in New York and Bengaluru sit alongside the Dutch entity. 3 5 9

Report an error

The Skeptic

The Dutch contracting entity is verifiable down to KvK number, VAT number and an Olympisch Stadion address — the best-documented fact in this file. But the EU-only transfer statement expressly covers only the marketing website, with product data processing referred to a separate document not among the captured pages; I found no public information naming product data centers, product subprocessors, a DPA or TOMs, while a US sister entity and a US-visitor identity-resolution tool tying browsing to a known email address appear on the vendor's own pages. 3 5 6

Report an error

The Compliance Officer

Pricing is explicitly customized on company size and features such as advanced analytics and SSO, and no figures appear on any captured page, so I cannot compute an invoice for a 600-employee company from public information. The only public pricing facts are qualitative — case management is always included in the price and support packages carry no additional costs — which tells me about scope, not cost. 4

Report an error

The Reporter's Advocate

Every price is a sales conversation: the public pricing page says pricing is customized to company size and features, and no figures are published for any tier. Small credit for stating that the case management system is always included within the price and that support packages carry no hidden fees — but an obligated company cannot compute an invoice from the public pages. 4

Report an error

The SME Operator

The pricing page carries no numbers at all — "Our pricing is customized based on your company size and the features you need" — and it describes the platform as serving companies from 500 employees to global enterprises, while a solutions page also says small and medium businesses are supported; either way a 60-employee buyer cannot compute any invoice without a sales call. The only comfort is public — case management is always included and support packages carry "no additional costs, no hidden fees" — but that is a promise, not a price. 4

Report an error

The Group Counsel

The public answer is a sales conversation: "Our pricing is customized based on your company size and the features you need, such as advanced analytics or SSO," aimed at companies from 500 employees to global enterprises, with no tier, band, entity or setup figures anywhere in the captured pages. A support package with "no additional costs, no hidden fees" is a fairness promise, not a computable invoice — I cannot price a five-entity group from public information at all. 4

Report an error

The Security Auditor

Every tier is a customized quote based on company size and features needed, and we found no public price figures for any tier on the captured pricing page. The only disclosed terms are that case management is always included in the price and that support packages carry no additional costs or hidden fees, with the target market stated as 500 employees up to global enterprises — none of which lets an obligated company compute an invoice. 4

Report an error

The Skeptic

Every price is a sales conversation: the pricing page says quotes are customized on company size and features such as SSO, and the stated audience starts at 500 employees — so an obligated 60-employee company cannot even establish it is in scope, let alone compute an invoice. "No hidden fees" and "case management always included in that price" are promises about a price nobody is shown; we found no public figures at all. 4

Report an error