NAVEX

EthicsPoint hotline and WhistleB whistleblowing products within the NAVEX One GRC suite.

Non-EU HQ Part of NAVEX One

Non-EU headquarters — data sovereignty risk

Lake Oswego, Oregon, United States. This vendor is headquartered in the United States. US-incorporated providers are subject to the CLOUD Act, which can compel disclosure of EU customer data regardless of where it is hosted. Transfers require the EU-US Data Privacy Framework or Standard Contractual Clauses — both are subject to legal challenge (see Schrems I and II). For institutional buyers prioritising European data sovereignty, prefer an EU-headquartered provider.

AI processes report content — EU AI Act consideration

This vendor applies AI or machine learning to whistleblower reports (for example summarisation, severity or category classification, drafting replies, or machine translation). Automated processing of disclosures can bring the deployment within scope of the EU AI Act and routes sensitive personal data through a third-party inference provider. Confirm the model provider, its data-retention terms, and whether report content can be excluded before relying on it. Vendor detail: Whistleblowing platform page markets AI-supported case briefs, suggested rewrites, and higher-level insights.

Rubric score

27 / 50

Evidence tier P

Selected public-source evidence corrected on 2026-10-23 and 2026-10-24 (a4, c16, d21 raised from vendor pages); historical product-review date and access tier retained. No reporter submission or handler retest.

How this score is produced →

Facts

Website: www.navex.com(opens in new tab)
Headquarters: Lake Oswego, Oregon, United States
Pricing: Quote-based. The current UK WhistleB product page no longer publishes the previously observed £75/month starting price; EthicsPoint pricing is also unpublished.
EthicsPoint and WhistleB remain separate products with sales-led procurement. The old UK WhistleB URL redirects to the current product page; no equivalent-package price change can be calculated.
Languages on reporting form: 60
Founded: 2012
Domain registered: August 1996 navex.com
Ownership: Private; NAVEX's homepage reports that a consortium led by Goldman Sachs Alternatives, including Blackstone, completed a majority stake acquisition
Customers: 13,000+ organizations; 88M+ employees supported worldwide (vendor claim)
Product scope: Module of NAVEX One

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Enforced (reject)
DNSSEC: Unsigned

Capabilities

Anonymous reporting ✓
Multi-channel intake ✓
Public API —
Free trial ✗
Two-factor authentication —
Audit log —
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

ISO 27001 (WhistleB page)
SOC 2 Type II (WhistleB UK page)

National laws referenced

EU Directive 2019/1937
France (Sapin II)
United States (Sarbanes-Oxley, Dodd-Frank)

Typical buyer

Organizations wanting NAVEX whistleblowing products with web and phone intake, managed services, WhistleB EU storage disclosures, and public service-provider information.

Distinctive features

Web and phone reporting through EthicsPoint Essentials / Professional
WhistleB pages state EU storage, customer-controlled encryption, web and mobile reporting in 60+ languages, and IVR in 40
Public service-hosting provider page for EthicsPoint

Add-ons and conditions

Costs or terms not included in the headline price.

EthicsPoint and WhistleB prices require a quote on the current pages reviewed
No self-serve trial found on public pages reviewed
API access, DPA download, and detailed package limits were not found on current public pages reviewed

Notable

NAVEX positions whistleblowing inside NAVEX One, with EthicsPoint Essentials for fast setup, EthicsPoint Professional for enterprise workflows, and WhistleB as a whistleblowing system page.
Current EthicsPoint product copy supports web and phone reporting, straightforward case tracking, configurable intake, AI-powered compliance tools, multilingual reporting, and anonymous reporting.
The current UK WhistleB page advertises flexible pricing without a public amount. It states web and mobile reporting in 60+ languages and IVR in 40, with machine or human translation for case teams. The previously observed £75/month starting price is historical.
The UK WhistleB page says reports get an automatic acknowledgement, reminders keep seven-day acknowledgement and three-month feedback in view, IVR and live telephony are add-ons, and most customers are live in 4-6 weeks.
The WhistleB privacy/security page states data is stored in the EU with customer-controlled encryption and that NAVEX and suppliers are unable to access sensitive customer data.
WhistleB pages also list MFA, encrypted transmission/storage, activity logs, redundancy, Microsoft Azure hosting, Microsoft Translator localization, ISO 27001 adherence, and SOC 2 Type II on the UK page.
The EthicsPoint service-hosting provider page publicly lists hosting, translation, interpretation, analytics, and platform service providers, including EU services hosted at data centres in Frankfurt, Germany and Rozenburg, Netherlands, with AWS processing limited to Europe.
Public pages reviewed did not disclose a free trial, API access, a DPA download, or article-level EU Directive mapping.

Frequently asked questions about NAVEX

Answers derived from vendor-published materials dated on this page.

Is NAVEX suitable for SMEs under 250 employees?

NAVEX does not publish entry-tier pricing, so SME buyers need to request a quote to assess fit. Buying path: Sales contact required. Organizations wanting NAVEX whistleblowing products with web and phone intake, managed services, WhistleB EU storage disclosures, and public service-provider information.

Which national whistleblower laws does NAVEX explicitly reference?

NAVEX explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, France (Sapin II), United States (Sarbanes-Oxley, Dodd-Frank). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does NAVEX process whistleblower report content with AI?

Yes — NAVEX processes report content with AI (typically for translation, summarisation, or classification). If your compliance posture requires keeping disclosures out of third-party LLMs or machine-translation services, confirm data-processing terms and vendor subprocessors before procurement. Whistleblowing platform page markets AI-supported case briefs, suggested rewrites, and higher-level insights.