Skip to main content
InviziPoll
Get Started

Compliance Hotline Vendors: The Column Nobody Publishes

Most comparisons of compliance hotline vendors grade the same five things: intake channels, case management, languages, integrations, price. Those matter.…

Most comparisons of compliance hotline vendors grade the same five things: intake channels, case management, languages, integrations, price. Those matter. They're also all published, which is why every listicle agrees with every other listicle.

This one adds a column nobody publishes: can the vendor technically re-identify a reporter who chose anonymity? It's the question a reporter would ask if they were in the room, and it's the one column that's mostly blank across the market. That blankness is the finding.

Every cell below is filled strictly from the vendor's own pages. Where a vendor doesn't publish something, the cell says "not published" rather than guessing. If you want a different answer for your shortlist, the ten-question audit in is your anonymous hotline actually anonymous? is the thing to send them.

All vendor pages checked 2026-08-16. Vendor documentation changes frequently; re-check before you rely on any row. This is general information, not legal advice.

What changed in this market recently

Three of the names that still appear on comparison lists no longer exist as independent products, which is worth knowing before you send an RFP to a company that was acquired years ago:

  • Lighthouse Services is now part of Mitratech, sold as Standard Hotline, described on Mitratech's own page as formerly LightHouse. The Enterprise Hotline is described as formerly ClearView.
  • Vault Platform states on its own site that Vault is now part of Diligent, which announced the acquisition in May 2025.
  • Speakfully was acquired by HR Acuity in November 2022, per HR Acuity's own press release. Its standalone product page no longer resolves.

Capabilities, from vendor pages only

VendorPublished intake channelsCase managementAnonymous two-way dialogueData residency
NAVEX (EthicsPoint)Web, mobile, telephone, open doorYes, incident managementYes, states the reporter remains anonymous for as long as they wantNot published on pages checked
EQS Integrity LineWeb and mobile reporting, secure mailboxYesYes, described as fully anonymous reporting with a dialogue functionGermany, hosting stated
WhistlelinkWritten web form, anonymous form, oral (voice message); live operators as a paid add-onYes, built in with deadline remindersYes, secure two-way communicationEU, stated on the pricing page
Mitratech (formerly LightHouse and ClearView)Phone or webYes, both tiers route to the same case managementYes, anonymous dialogue via a confidential inboxNot published on the page checked
Case IQOmni-channel intake plus a 24/7/365 live-answer hotlineYesYes, anonymous and two-way communicationNot published on the page checked
AllVoicesAny channel or language, no logins, PINs or formsYes, one structured system with an auditable recordYes, chat-style two-way messagingAWS, region not published
Vault Platform (Diligent)Secure mobile app, Open Reporting, VaultTalkYes, Resolution HubNot explicitly publishedNot published
Syntrio24/7 anonymous employee hotlineYes, secure case managementNot published on the page checkedNot published
Speakfully (HR Acuity)Not published, standalone page no longer resolvesVia HR Acuity employee relations platformNot published on pages checkedNot published
InviziPollWeb link only. Not a hotline productNo. Not case-management softwareNot offered as a hotline capability todayNot published as a customer-selectable region

The column nobody publishes

Here's the same set of vendors graded only on re-identification, using their own words.

VendorPublished position on re-identifying an anonymous reporter
NAVEX (EthicsPoint)Closest to an explicit answer. States it doesn't track IP addresses or other data that could identify a person sending a message, and that messages can only be decrypted by designated individuals. That's a statement about what it collects, not a blanket claim that re-identification is impossible.
EQS Integrity LinePartial. States on its security page that EQS Group can at no time access whistleblower data, and that the system doesn't employ tracking mechanisms on users. Doesn't publish, on the pages checked, whether IP addresses, location data or device data are recorded.
WhistlelinkNot published. Describes anonymous reporting with identity protection and ISO 27001 certified encryption. No statement found on IP logging or technical traceability.
Mitratech (formerly LightHouse)Not published. Describes optional anonymity and anonymous dialogue via a confidential inbox. No statement found on technical traceability.
Case IQNot published, and ambiguous. Advertises three levels of anonymity without publicly defining what each level means for traceability. Worth asking about directly, because a tiered model implies the levels differ in exactly the way this column measures.
AllVoicesNot published. Publishes strong encryption detail (AES-256 at rest, TLS 1.3 in transit) but no statement on whether identifying metadata is retained or whether staff can trace a reporter.
Vault Platform (Diligent)Not published.
SyntrioNot published.
Speakfully (HR Acuity)Not published.
InviziPollCan't, for poll responses, by design. Responses are encrypted in the respondent's browser and servers store ciphertext only, so individual answers aren't readable by InviziPoll. This applies to anonymous polling, which is a narrower thing than a hotline.

Read that table for its shape, not its winner. One vendor of nine publishes a specific, checkable claim about what it collects. The rest describe anonymity in adjectives. That's not an accusation: encryption detail is genuinely hard to market, and several of these products are likely stronger than their pages suggest. It does mean that if re-identification risk is what your reporters actually worry about, the public record won't answer it for you and you have to ask in writing.

How to read the rows

A live-answer phone line changes the question. Case IQ, Syntrio, NAVEX and Whistlelink (as an add-on) all offer human intake. A person hearing a voice is an identification surface no encryption addresses. If you buy this, ask whether calls are recorded, who can access recordings, and for how long.

"No logins, PINs or forms" is a usability claim, not an anonymity claim. AllVoices is right that friction suppresses reporting. Low friction and low traceability are different properties and a vendor can have one without the other.

Data residency is a proxy for legal exposure, not for anonymity. EU hosting (EQS, Whistlelink) matters for GDPR and for which courts can reach the data. It says nothing about whether the vendor can identify a reporter.

A tiered anonymity model deserves a specific question. If a vendor sells levels of anonymity, ask what changes between them technically, not what changes in the UI.

Which one to shortlist

I am not going to rank these, because the honest ranking depends on facts none of us can read off a website. What I will offer is a shortlisting rule:

  • Large, multinational, phone-heavy workforce, EU obligations: NAVEX and EQS are the two that publish the most about scale and about anonymity respectively. NAVEX is the only one with a published IP-collection statement; EQS is the one with published EU hosting.
  • Smaller organisation that wants a published price: Whistlelink is the only vendor in this set that publishes a rate card at all, which is worth something on its own.
  • HR-owned rather than legal-owned programme: AllVoices and HR Acuity are built around employee relations workflow rather than compliance case law.
  • You already own a GRC suite: check Diligent (Vault) and Mitratech before you buy standalone, because you may already have entitlement.

Then send all of them the ten questions.

Where InviziPoll fits, honestly

Founder disclosure: I built InviziPoll.

InviziPoll isn't a compliance hotline and should not be shortlisted as one. It has no case intake triage, no investigation workflow, no interview notes, no corrective-action tracking, no regulatory case reporting, and no staffed phone line. If you've an EU transposition obligation or a SOX 301 obligation, you need a case-management product and one of the vendors above, not this.

The row is in the table because a comparison that quietly leaves its author out isn't a comparison, and because the re-identification column is the one place where the answer differs in kind rather than degree.

Where InviziPoll is genuinely useful is the layer next to the hotline: anonymous, cryptographically-backed polling that tells you whether people trust the channel, whether they would use it, and what stops them. A hotline that receives no reports isn't evidence of a clean organisation, and the survey that tells you which of those it's has to be more anonymous than the hotline is. That's what speak up is for.

For the mechanics of where identity leaks, see is your anonymous hotline actually anonymous?. For the same question on the survey side, see is your employee survey actually anonymous? and confidential vs anonymous. The architecture is on security.

FAQ

Who are the main compliance hotline vendors? NAVEX (EthicsPoint), EQS Integrity Line, Whistlelink, Mitratech (formerly Lighthouse Services and ClearView), Case IQ, AllVoices, Vault Platform (now part of Diligent), Syntrio, and Speakfully (now part of HR Acuity).

Which ethics hotline providers state they can't identify a reporter? On the pages checked on 2026-08-16, none makes an unqualified claim. NAVEX comes closest by stating it doesn't track IP addresses or other data that could identify a person sending a message. EQS states its own group can't access whistleblower data.

Do whistleblower hotline providers publish pricing? Mostly no. Whistlelink is the exception in this set and publishes banded monthly pricing by employee count with a 30-day trial.

Does a hotline need anonymous two-way dialogue? For EU internal reporting channels it's effectively required in practice, because Article 9(1) of Directive (EU) 2019/1937 obliges you to acknowledge within seven days and give feedback within three months, and you can't do either for an anonymous reporter without a return channel.

What single question separates these vendors? Whether they can technically re-identify an anonymous reporter by any means at all. Ask for a yes or a no in writing, plus the mechanism if the answer is yes.

Sources

Keep reading