Whistleblowing Portals
Vault Platform
EU origin, foreign-owned Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 2 of 4 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Vault Platform Ltd · vaultplatform.com
Report an error on this page Is this your product? →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Vault Platform, a whistleblowing portal absorbed by US-based Diligent in a May 2025 acquisition, was judged from two captured pages — a homepage and a privacy policy that states verbatim it "does NOT cover the Vault Platform SaaS solution for misconduct reporting." That exclusion recurs through the rationales: reporting channels & reporter experience, case management & deadline discipline and group & multi-entity capability sit at 0, with no intake channel, statutory clock or per-entity capability evidenced anywhere in the capture. Legal compliance alignment and security & anonymity assurance reach only 0-1, the single points coming from one judge crediting a named EU representative and admitted third-country metadata flows. Sovereignty spans 0-1 against the evidence's 0 of 10: four judges allow a point for the Irish EU representative (Diligent Governance Ireland Limited) and model-contract/adequacy wording, while two hold at zero over the US parent, group processors in the US and Israel, and analytics and sales vendors outside the UK/EEA. The evidence lists data residency and subprocessor exposure as unknown. Prices are unpublished; persona-weighted totals (weights not shown) top out at 0.6.
Speaks for it
- Named EU representative on file: Diligent Governance Ireland Limited, Dublin 4.
- Disclosed transfer mechanisms — UK Government or European Commission approved model contracts and adequacy decisions.
- Privacy policy openly lists non-EEA subprocessors (Google, Hubspot, Apollo, Zoominfo; US/Israel group companies) rather than omitting them.
- Published privacy contact (privacy@vaultplatform.com) with a one-month response commitment.
Held against it
- Privacy policy expressly excludes the Vault Platform SaaS solution for misconduct reporting from its scope.
- No intake channel of any kind evidenced — no form, hotline, anonymous route or language coverage (reporting channels & reporter experience 0).
- No case-management evidence: no statutory clocks, role separation or audit trail (case management & deadline discipline 0).
- No per-entity channels, delegated administration or group oversight evidenced (group & multi-entity capability 0).
- No ISO 27001, pentest, encryption claim or security contact in the capture, while Google Analytics cookies run on the vendor's homepage.
Best for
- You need a vendor that at least names an EU representative (Diligent Governance Ireland Limited, Dublin) and documents model-contract/adequacy transfer wording — the only items the bench scored above zero.
- You value a privacy policy that openly lists its non-EEA subprocessors rather than omitting them — the disclosure behind the single security-assurance point.
- You intend to verify post-acquisition product continuity directly with the vendor, as the evidence itself instructs, before relying on anything published.
Avoid if
- You need an evidenced intake channel for reporters — the capture shows no form, hotline or anonymous route (reporting channels & reporter experience 0).
- Your compliance calendar depends on the vendor for statutory deadlines such as a 7-day acknowledgment or 3-month feedback clock — ask the vendor: the public pages we read do not show it
- You run a multi-entity group needing per-entity channels, delegated administration or group oversight — group & multi-entity capability sits at 0.
- You need documented data residency or subprocessor exposure for report content — the evidence lists both as unknown, and the published policy excludes the SaaS product.
The scores
Reporting channels & reporter experience
Show reasoningHide reasoning
How this is scored
The intake side: how a reporter actually submits — web form, anonymous dialog, phone/voice, languages, accessibility — and whether anonymity survives first contact.
0 — A web form that is an email in disguise: no anonymous route, no way to reach the reporter afterwards.
3 — An anonymous form exists but the dialogue ends there — no secured mailbox for follow-up questions, few languages, desktop-only.
5 — Anonymous two-way dialog via a protected mailbox, a usable set of languages, mobile-friendly; voice or phone intake missing or an add-on.
8 — Multiple channels (web, voice message or hotline, QR entry points), broad language coverage with translation support, accessibility considered, and the anonymous dialog is first-class rather than bolted on.
10 — Intake engineered around the frightened reporter: every channel anonymous-capable, dozens of languages, WCAG-conscious, no app install or account required, and the vendor documents how the reporter's identity is kept out of the channel itself.
The Compliance Officer
The captured pages say nothing about intake at all — no anonymous route, no secured follow-up mailbox, no language coverage, no phone option, so reporter anonymity is entirely unevidenced. If I cannot show a reporter an evidenced anonymous dialog with two-way follow-up, I have no channel to defend to a works council. 1 2
The Reporter's Advocate
No intake channel of any kind is evidenced — no form, no hotline, no anonymous dialog, no languages, nothing. The only privacy terms the vendor publishes explicitly state 'This Privacy Policy does NOT cover the Vault Platform SaaS solution for misconduct reporting', so a frightened worker cannot even learn how a report would be received. That is below even the email-in-disguise anchor: no documented route at all. 1 2
The SME Operator
No intake channel of any kind is evidenced — no form, no anonymity statement, no languages, not even a hotline marketed on the homepage — and the privacy policy expressly excludes the SaaS misconduct product, so I cannot confirm a reporter-facing front door exists. That is the zero anchor: I can't even verify a web form. 2 1
The Group Counsel
The captured corpus contains no intake channel of any kind — no form, no anonymous route, no hotline, no languages, no accessibility statement — and the only substantive document explicitly excludes the SaaS misconduct product from its scope. As far as this evidence goes, a reporter at one of my subsidiaries has nowhere to report. 1 2
The Security Auditor
Zero evidence of any intake channel — no form, no anonymous route, no follow-up mailbox, no languages, no accessibility statement. The only privacy document on file explicitly excludes the SaaS misconduct product from its scope, so even the reporter-facing data handling is unevidenced; this sits at the bottom anchor. 1 2
The Skeptic
Not one word in this capture describes how a reporter submits anything — no form, no hotline, no secured mailbox, no languages. The only privacy policy on file expressly disclaims the misconduct-reporting SaaS, so intake is unevidenced end to end. Silence this total is the bottom anchor, and I treat it as such. 1 2
Case management & deadline discipline
Show reasoningHide reasoning
How this is scored
The case worker's side: triage, statutory deadlines (7-day acknowledgment, 3-month feedback), role separation, audit-proof documentation.
0 — Reports land in an inbox; deadlines, roles and history live in a spreadsheet next door.
3 — A case list with status fields, but deadlines are manual, permissions are all-or-nothing, and the record of who did what is thin.
5 — Deadline tracking with reminders for the statutory clocks, case notes and attachments, basic role separation between case handlers; reporting on the caseload is limited.
8 — Automated statutory clocks, conflict-of-interest handling (excluding implicated case handlers), complete tamper-evident case history, retention and deletion rules applied per case, and management reporting.
10 — A case system an external investigator can rely on: enforced workflows, full audit trail, legally aware retention/deletion automation, evidence handling, and statistics that survive a regulator's questions.
The Compliance Officer
No deadline automation, no 7-day or 3-month statutory clocks, no role separation, no audit trail — the only clock anywhere in the evidence is the vendor's own one-month reply to privacy requests. Every deadline would live in my spreadsheet, which is precisely the product type I refuse to run. 1 2
The Reporter's Advocate
The captured pages are silent on deadlines, role separation, case history and audit trails — not even a case list with status fields appears. For a product sold into EU obligations, the total absence of any 7-day/3-month clock or casework evidence leaves nothing to score above rubric level 0. 1 2
The SME Operator
Nothing on statutory clocks (7-day acknowledgment, 3-month feedback), role separation, attachments or audit trails appears anywhere in the two captured pages. If I bought this, the deadlines would be my spreadsheet's problem — the definition of the zero anchor. 1 2
The Group Counsel
No case list, no statutory clocks, no role separation, no audit trail appears anywhere; even the 'deadlines in a spreadsheet next door' baseline is unevidenced. Nothing here would let a case worker run the 7-day acknowledgment or 3-month feedback timeline for a dozen jurisdictions. 1 2
The Security Auditor
Nothing on triage, statutory deadlines, role separation, retention automation, or audit trails for cases. The policy that could touch the product disclaims it, so as far as this sheet goes, reports land in an inbox I cannot even confirm exists. 2
Legal compliance alignment
Show reasoningHide reasoning
How this is scored
How specifically the product implements EU Directive 2019/1937 and national transpositions (HinSchG et al.) — not whether the marketing mentions them.
0 — Generic feedback software wearing a whistleblowing label; no reference to the legal obligations it claims to satisfy.
3 — The directive is invoked in marketing but the mapping is vague; deadline rules, documentation duties and retention periods are the customer's problem.
5 — The statutory duties are implemented as product features — acknowledgment and feedback clocks, documentation, deletion after the retention period — for at least one national law, with guidance for the rest.
8 — Multiple national transpositions supported with their differing details, legal templates and process guidance maintained by named counsel or documented review, and updates when the law moves.
10 — The product is a legal instrument: per-country rule sets kept current, documented legal review, guidance for edge cases (group-wide channels, external ombudsman setups), and the vendor shows its homework in public.
The Compliance Officer
Directive 2019/1937 and any national transposition are absent from the evidence, and the one legal text captured explicitly states it does not cover the whistleblowing SaaS. The named supervisory authority is the UK ICO — website privacy hygiene, not HinSchG implementation. 2
The Reporter's Advocate
Directive 2019/1937 and transpositions like HinSchG are never mentioned; the only legal frame visible is UK GDPR with the ICO as supervisory authority. Generic software wearing a whistleblowing label — rubric level 0 by the definition itself. 1 2
The SME Operator
Not one word on Directive 2019/1937 or HinSchG; the only legal substance on offer is a 16-and-over age clause and an ICO complaint route for the marketing site. A vendor that hasn't even name-dropped the law that obligates me shows no homework, and the fines land on my desk, not theirs. 1 2
The Group Counsel
Directive 2019/1937, HinSchG and every national transposition are absent; the GDPR text captured concerns the marketing website's cookies and sales tools, not whistleblowing obligations. The legal alignment is a category label on a the evidence, not a mapped feature set. 1 2
The Security Auditor
Directive 2019/1937, HinSchG, acknowledgment and feedback clocks — none of it appears anywhere in the two captured pages. The only legal artifact is a website privacy policy that excludes the whistleblowing SaaS from its scope; this is a whistleblowing label with no homework shown. 1 2
The Skeptic
Zero mentions of Directive 2019/1937, HinSchG, or any whistleblowing transposition anywhere in the registry; the GDPR machinery on display (ICO as supervisory authority, erasure, portability) governs the marketing website only, since the policy excludes the SaaS. A single point for having a named EU representative and documented transfer mechanisms at all — nothing for the product the directive actually regulates. 1 2
Security & anonymity assurance
Show reasoningHide reasoning
How this is scored
Whether the confidentiality promise is engineered and evidenced: encryption, metadata handling, penetration tests, certifications.
0 — Security is a paragraph of adjectives; no certificates, no test reports, no statement on metadata.
3 — TLS and encryption at rest asserted, but nothing audited: no ISO 27001 or equivalent, no published pentest, silence on IP and metadata logging.
5 — A current ISO 27001 (or equivalent) certificate for vendor or hosting, end-to-end encryption of report content claimed with some technical detail, an explicit no-IP-logging statement.
8 — Certified ISMS covering the product, regular third-party penetration tests attested, documented end-to-end encryption architecture, metadata minimization explained, security contact and disclosure policy published.
10 — Assurance a hostile auditor accepts: current certificates with visible scope, recurring pentest summaries public, cryptographic architecture documented, anonymity analysed against the operator itself — the vendor can answer "how would you unmask a reporter?" with "we cannot, and here is why".
The Compliance Officer
No ISO 27001, no pentest, no encryption architecture, and total silence on IP and metadata logging; the only security-adjacent statement is boilerplate about model contracts for outbound transfers. The confidentiality promise is asserted nowhere and evidenced nowhere. 2
The Reporter's Advocate
No certificate, no penetration test, no encryption claim and no product metadata statement anywhere — and the policy that might have spoken to any of it explicitly excludes the SaaS. Worse, the marketing site itself runs Google Analytics cookies, so even the brochure page tracks visitors; I have no basis to believe the confidentiality promise is engineered at all. 1 2
The SME Operator
No ISO 27001, no pentest, no encryption claims, no security contact — not even a paragraph of adjectives. The only technical facts disclosed are that Google, Hubspot, Apollo and Zoominfo plus group companies in the US and Israel process data, which for a confidentiality product reads as the opposite of metadata minimization. 2 1
The Group Counsel
No certificate, no penetration test, no encryption architecture, no metadata statement — not even a paragraph of adjectives about the product's security. The nearest facts are approved model clauses for website transfers, which say nothing about how report content and reporter identity are protected in the pipeline. 2
The Security Auditor
No certificate, no pentest, no encryption claim, no metadata statement, no security contact or disclosure policy — I do not even get adjectives to reject. The homepage ships Google Analytics cookies, and the privacy policy disclaims the product itself, so the confidentiality promise is entirely unevidenced. 1 2
The Skeptic
No ISO 27001, no pentest attestation, no encryption architecture — and Google Analytics cookies run on the vendor's own front door while group companies in the US and Israel act as processors. For a vendor whose entire product is a confidentiality promise, analytics scripts plus an explicitly unscored SaaS is precisely the pattern I exist to flag. One point only because the policy at least admits third-country metadata flows rather than hiding them. 1 2
Group & multi-entity capability
Show reasoningHide reasoning
How this is scored
Whether one contract can serve a corporate group: separate channels per legal entity, central oversight, ombudsman access, white-labeling.
0 — One company, one channel; a group buys and administers N separate instances.
3 — Multiple channels under one account, but no separation of case access per entity and no consolidated view.
5 — Per-entity channels with separated case handlers and a group-level overview; branding per entity is basic; external counsel access possible.
8 — Real multi-tenant group structure: per-entity channels, languages and branding, delegated administration, external ombudsman roles, group reporting that respects entity boundaries.
10 — Group compliance as architecture: hundreds of entities manageable centrally, per-country legal rule assignment per entity, white-label reporting pages, and access separation strong enough to satisfy each subsidiary's works council.
The Compliance Officer
Nothing on per-entity channels, separated case access, delegated administration or ombudsman roles; the only group structure in evidence is the vendor's own internal processors in the US and Israel, which tells me about their sales admin, not the product. For a multi-entity buyer this sheet shows no scaling capability at all. 1 2
The Reporter's Advocate
Nothing in the evidence evidences per-entity channels, separated case access, group oversight, ombudsman roles or branding — the evidence base stops at a homepage and a privacy policy. 1 2
The SME Operator
One London address, one UK entity, a US parent, and zero evidence of per-entity channels, delegated admin or group reporting. If a 5-entity group needs this, everything in the evidence says it's N sales conversations — the zero anchor. 1 2
The Group Counsel
For a product I would need across 25 entities, there is zero captured evidence of per-entity channels, entity-level access separation, delegated administration, ombudsman roles or boundary-respecting group reporting. The only group structure documented is the vendor's own internal group, sharing personal data with processors in the US and Israel. 1 2
The Security Auditor
No evidence of per-entity channels, separated case access, delegated administration, ombudsman roles, or group reporting. The only group structure documented is the vendor's own internal companies in the US and Israel — which speaks to their operations, not the product's multi-entity capability. 2
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where reports about people actually live and under whose law — entity, hosting, subprocessors, DPA. In this category the data is by definition the most sensitive a company holds.
0 — Non-EU entity, non-EU-default hosting, no public DPA or subprocessor list — for whistleblowing data.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad or undocumented.
5 — EU hosting is the default, DPA and subprocessor list published; the vendor or a critical subprocessor is still within non-European jurisdictional reach.
8 — EU entity, EU hosting with named data centers, published subprocessor list free of content-touching non-EU processors, DPA and TOMs public.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors for report content and metadata, on-premises or sovereign-cloud options, and the whole chain documented publicly.
The Compliance Officer
A UK entity absorbed by a US GRC vendor, with hosting, product subprocessors and any product DPA wholly undocumented — the privacy policy pointedly excludes the SaaS where the reports would live. Every subprocessor I can see (Google, Hubspot, Apollo, ZoomInfo, US and Israel group companies) sits outside the EEA. 1 2
The Reporter's Advocate
The vendor is England-and-Wales registered and now part of US company Diligent, with internal processors in the US and Israel and Google, Hubspot, Apollo and Zoominfo outside the UK/EEA. And the one published privacy policy does NOT cover the misconduct-reporting solution, so where the most sensitive data a company holds actually lives, and under whose law, is entirely undocumented — rubric level 0, precisely. 1 2
The SME Operator
A UK (non-EU) entity now owned by US Diligent, group processors in the US and Israel, analytics and sales tools outside the UK/EEA, no stated hosting for report data, no DPA and no product subprocessor list. A Dublin EU representative and SCC language are the only crumbs, and the policy disclaims covering the whistleblowing SaaS itself, so even that doesn't touch reports. 2 1
The Group Counsel
An England-and-Wales entity under a US parent since the Diligent acquisition, internal group processors in the US and Israel, and no hosting location, DPA or subprocessor list for the whistleblowing data itself — the privacy policy expressly disclaims the SaaS product. For the most sensitive data a company holds that is anchor-zero territory; a single point only for the Irish EU representative and the documented adequacy/model-contract transfer mechanisms. 1 2
The Security Auditor
A UK entity (England and Wales) with an Irish EU representative is the only jurisdictional positive, and the UK is outside the EU; Diligent ownership puts the group under US CLOUD Act reach, internal processors sit in the US and Israel, and hosting, product DPA, and content subprocessors are entirely undocumented. For the most sensitive data a company holds, this is a hair above the floor — one point for the adequacy-country entity and SCC-based transfer wording, nothing more. 1 2
The Skeptic
UK entity now owned by US-based Diligent, internal processors in the US and Israel, analytics and sales vendors outside the UK/EEA, and — decisive — the only privacy policy expressly disclaims the SaaS product where report content would live. The evidence's own sovereignty computation is 0/10; I grant one point for the named EU representative and the explicit model-contract/adequacy transfer mechanism covering what little is documented. 1 2
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether an obligated company can compute the real invoice — per entity, per employee band, per year — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — An entry price exists, but the tiers most obligated companies need are unpriced, or the maths is obscured by employee bands, per-report fees or mandatory setup charges.
5 — Most tiers carry real numbers with billing period and VAT treatment stated, but at least one commonly needed capability — extra entities, extra languages, phone intake — hides in an unpriced add-on.
8 — Every tier priced publicly with employee-band boundaries, entity rules and setup fees stated; only genuine corporate-group contracts are custom.
10 — Complete price computability: every tier, band, add-on and renewal rule public, so the invoice for a 60-employee company and a 5-entity group is a two-minute exercise.
The Compliance Officer
No prices, tiers, employee bands, entity rules or setup fees appear anywhere in the captured pages — every invoice would be a sales conversation. I cannot compute even a baseline quote for a 600-employee company from public evidence, let alone a multi-entity group. 1 2
The Reporter's Advocate
No tier, price, employee band or add-on appears anywhere on the captured pages. Every number is a sales conversation — rubric level 0. 1
The SME Operator
No public prices at all — not an entry tier, not an employee band, nothing on the homepage. For a 60-employee company that needs the invoice computable before the year-end review, this is dead on arrival. 1
The Group Counsel
No tier, price, employee band, setup fee or renewal rule appears anywhere in the captured pages. Nothing about the invoice — not for one 60-employee entity, let alone a five-entity group — is computable; every tier is a sales conversation. 1
The Security Auditor
Not a single tier, price, employee band, or billing term appears in either captured page. Every invoice is a sales conversation by construction, which is the bottom anchor. 1 2
European sovereignty — proven facts
2 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Incorporated in GB ⚠ unverified | 1/3 pts | 2 Report an error |
|---|---|---|---|
| Ownership | Not determined ⚠ unverified | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | US CLOUD Act reach ⚠ unverified | 0/2 pts | 3 Report an error |
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 15 Sep 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Ownership, Data residency. Not confirmed on the vendor’s own pages as captured.
- Weak sourcing — Legal entity. England and Wales is in the United Kingdom (GB), which is outside the EU following Brexit, so this is a non-EU jurisdiction from an EU sovereignty standpoint.
- Weak sourcing — Subprocessors. AWS is US-headquartered, so US CLOUD Act jurisdiction applies regardless of the EU/UK data-center region; the privacy policy separately names US- and Israel-based group processors, but only for website data, not the SaaS product.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (vaultplatform.com, vaultplatform.com/privacy-policy, vaultplatform.com/products/security, vaultplatform.com/terms-conditions, vaultplatform.com/inside-vault/staying-anonymous-with-vault, vaultplatform.com/eu-whistleblower-directive-your-fasttrack-to-compliance and 1 more). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
- 12 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 8 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (7)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage vaultplatform.com Checked 15 Sep 2026 Details →
- 2 Privacy policy vaultplatform.com Checked 15 Sep 2026 Details →
- 3 Security / trust page vaultplatform.com Checked 30 Sep 2026 Details →
- 4 Terms of service vaultplatform.com Checked 30 Sep 2026 Details →
- 5 Reporting channels & reporter experience — found from sitemap vaultplatform.com Checked 1 Oct 2026 Details →
- 6 Legal compliance alignment — found from sitemap vaultplatform.com Checked 1 Oct 2026 Details →
- 7 Legal compliance alignment — found from sitemap vaultplatform.com Checked 1 Oct 2026 Details →