SpeakUp

The Skeptic

Reports can arrive by phone, voicemail, web browser or the SpeakUp app, with anonymous two-way follow-up the vendor says drives a 49% check-back rate, and the explicit statement that the platform collects no IP addresses, device fingerprints or identifying metadata is exactly the engineering detail an anonymity claim needs. Language coverage is stated as 100+ languages with human and machine translation in over 75. I found no public information on accessibility commitments such as WCAG, on QR entry points, or on whether the phone channel itself is anonymous-capable. 7 8 13

Report an error

The Skeptic

The case worker's side looks real: structured triage-to-closure case management, an audit-ready trail, attachments, custom roles rather than all-or-nothing permissions, remediation tasks carrying owners and deadlines, investigation planning with logs and interviews, and dashboards exportable for regulators. But the statutory clocks appear only as a general remark that such software must support acknowledgment timelines and follow-up requirements — I found no public information on automated seven-day and three-month deadline handling, exclusion of implicated case handlers, or tamper-evidence for the case record. 7 13

Report an error

The Skeptic

The EU Directive, German Supply Chain Act, GDPR, NIS2 and DORA are all invoked, and the pages correctly note the Directive bites from 50 employees, but the mapping stays at the level of "we help you comply", with deadlines and follow-up duties named only as generic obligations such software must support. I found no public information on national transposition specifics, legal templates, named counsel, or any commitment to update the product when a law moves. 7 13

Report an error

The Skeptic

The claims are unusually specific for this market — ISO 27001 and 27701, quarterly ISAE 3000 Type II plus SOC 2 and TISAX audits, MFA and SSO — and the explicit no-IP, no-fingerprint, no-identifying-metadata statement is the metadata minimization I hunt for. My discount: the captured pages assert certificates without showing them, describe encryption only as "highest standards" at rest and in transit, and I found no public information on an end-to-end encryption architecture, penetration test reports, or a security contact and disclosure policy. "100% Anonymität garantiert" is a slogan; the metadata statement is the part a buyer can hold them to. 7 13

Report an error

The Skeptic

Multi-country entities are claimed as supported and enterprise logos are everywhere, with analytics across locations, configurable teams and custom workflows — but the captured pages stop at "perfectly suited for international companies". I found no public information on per-entity channels, per-entity case-access separation, per-entity branding, delegated administration, or external ombudsman and counsel roles. 4 7

Report an error

The Skeptic

The Dutch contracting entity is verifiable down to KvK number, VAT number and an Olympisch Stadion address — the best-documented fact in this file. But the EU-only transfer statement expressly covers only the marketing website, with product data processing referred to a separate document not among the captured pages; I found no public information naming product data centers, product subprocessors, a DPA or TOMs, while a US sister entity and a US-visitor identity-resolution tool tying browsing to a known email address appear on the vendor's own pages. 3 5 6

Report an error

The Skeptic

Every price is a sales conversation: the pricing page says quotes are customized on company size and features such as SSO, and the stated audience starts at 500 employees — so an obligated 60-employee company cannot even establish it is in scope, let alone compute an invoice. "No hidden fees" and "case management always included in that price" are promises about a price nobody is shown; we found no public figures at all. 4

Report an error