NAVEX

EthicsPoint hotline and WhistleB whistleblowing products within the NAVEX One GRC suite.

Non-EU HQ Part of NAVEX One

Non-EU headquarters — data sovereignty risk

Lake Oswego, Oregon, United States. This vendor is headquartered in the United States. US-incorporated providers are subject to the CLOUD Act, which can compel disclosure of EU customer data regardless of where it is hosted. Transfers require the EU-US Data Privacy Framework or Standard Contractual Clauses — both are subject to legal challenge (see Schrems I and II). For institutional buyers prioritising European data sovereignty, prefer an EU-headquartered provider.

AI processes report content — EU AI Act consideration

This vendor applies AI or machine learning to whistleblower reports (for example summarisation, severity or category classification, drafting replies, or machine translation). Automated processing of disclosures can bring the deployment within scope of the EU AI Act and routes sensitive personal data through a third-party inference provider. Confirm the model provider, its data-retention terms, and whether report content can be excluded before relying on it. Vendor detail: Whistleblowing platform page markets AI-supported case briefs, suggested rewrites, and higher-level insights.

Rubric score

27 / 50

Evidence tier P

Public pages only. No self-serve trial found; EthicsPoint product details remain sales-led.

How this score is produced →

Facts

Website: www.navex.com(opens in new tab)
Headquarters: Lake Oswego, Oregon, United States
Pricing: EthicsPoint pricing not published. NAVEX's UK WhistleB page says new customers can get started from £75/month; other WhistleB and NAVEX One pricing remains sales-led.
NAVEX positions EthicsPoint Essentials and Professional as demo-led products. WhistleB has a separate localized UK page with a published starting price.
Languages on reporting form: 150
Founded: 2012
Domain registered: August 1996 navex.com
Ownership: Private
Customers: 13,000+ organizations; 88M+ employees supported worldwide (vendor claim)
Product scope: Module of NAVEX One

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Enforced (reject)
DNSSEC: Unsigned

Capabilities

Anonymous reporting ✓
Multi-channel intake ✓
Public API —
Free trial ✗
Two-factor authentication —
Audit log —
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

ISO 27001 (WhistleB page)
SOC 2 Type II (WhistleB UK page)

National laws referenced

EU Directive 2019/1937
France (Sapin II)
United States (Sarbanes-Oxley, Dodd-Frank)

Typical buyer

Organizations wanting NAVEX whistleblowing products with web and phone intake, managed services, WhistleB EU storage disclosures, and public service-provider information.

Distinctive features

Web and phone reporting through EthicsPoint Essentials / Professional
WhistleB pages state EU storage, customer-controlled encryption, and up to 150 languages
Public service-hosting provider page for EthicsPoint

Add-ons and conditions

Costs or terms not included in the headline price.

EthicsPoint pricing is not published; WhistleB UK has a published starting price
No self-serve trial found on public pages reviewed
API access, DPA download, and detailed package limits were not found on current public pages reviewed

Notable

NAVEX positions whistleblowing inside NAVEX One, with EthicsPoint Essentials for fast setup, EthicsPoint Professional for enterprise workflows, and WhistleB as a whistleblowing system page.
Current EthicsPoint product copy supports web and phone reporting, straightforward case tracking, configurable intake, AI-powered compliance tools, multilingual reporting, and anonymous reporting.
NAVEX’s UK WhistleB page says new customers can get started from £75/month and that WhistleB supports up to 150 languages; EthicsPoint pricing remains unpublished on public pages reviewed.
The WhistleB privacy/security page states data is stored in the EU with customer-controlled encryption and that NAVEX and suppliers are unable to access sensitive customer data.
WhistleB pages also list MFA, encrypted transmission/storage, activity logs, redundancy, Microsoft Azure hosting, Microsoft Translator localization, ISO 27001 adherence, and SOC 2 Type II on the UK page.
The EthicsPoint service-hosting provider page publicly lists hosting, translation, interpretation, analytics, and platform service providers, including Europe-limited AWS processing for some services.
Public pages reviewed did not disclose a free trial, API access, a DPA download, or article-level EU Directive mapping.

Frequently asked questions about NAVEX

Answers derived from vendor-published materials dated on this page.

Is NAVEX suitable for SMEs under 250 employees?

NAVEX does not publish entry-tier pricing, so SME buyers need to request a quote to assess fit. Buying path: Sales contact required. Organizations wanting NAVEX whistleblowing products with web and phone intake, managed services, WhistleB EU storage disclosures, and public service-provider information.

Which national whistleblower laws does NAVEX explicitly reference?

NAVEX explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, France (Sapin II), United States (Sarbanes-Oxley, Dodd-Frank). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does NAVEX process whistleblower report content with AI?

Yes — NAVEX processes report content with AI (typically for translation, summarisation, or classification). If your compliance posture requires keeping disclosures out of third-party LLMs or machine-translation services, confirm data-processing terms and vendor subprocessors before procurement. Whistleblowing platform page markets AI-supported case briefs, suggested rewrites, and higher-level insights.