Built to protect your most sensitive data
People only share reports and disclosures when they trust the system behind them. Independent auditors test how we protect that data, and your security team can check every certificate in our Trust Center.
ISO 27001 certified · SOC 2 Type II · TISAX AL3 · Hosted in the EU
Certifications and independent audits
Your security team can review the evidence directly in our trust center.
Standards and audits
ISO/IEC 27001:2022
We run our information security under the international standard, audited by A-LIGN.
SOC 2 Type II
An independent auditor tested our security controls over a period of months.
TISAX AL3
The automotive industry’s highest assessment level. Partners can view it in the ENX portal.
ISO/IEC 27701
Extends ISO 27001 to privacy management.
ISO/IEC 42001
The international standard for managing AI systems.
Regulations
GDPR
We process your data as your processor, under a formal Data Processing Agreement. Your data is hosted in the EU.
EU Whistleblower Directive
A secure, confidential internal reporting channel that meets the Directive’s requirements. Check that your other channels and follow-up procedures do too.
Multi-factor authentication
Multi-factor authentication and single sign-on (SSO) are crucial to safe and secure data processing. With these features, you remain in full control over who gains access to which data in your whistleblowing platform.
Regulations your program needs to meet
EU Whistleblowing Directive: A secure, confidential internal reporting channel that meets the Directive's requirements. Check that your other channels and follow-up procedures do too.
German Supply Chain Act (LkSG): People across your supply chain can report in 100+ languages, by web, app, or phone.
NIS2 and DORA: Our certifications and Trust Center documentation give your supplier risk review the evidence it needs.
Frequently asked questions
SpeakUp is certified against SOC 2 Type II, ISO/IEC 27001:2022, and TISAX. SpeakUp also maintains compliance with GDPR, the EU AI Act, NIS2, DORA, and other frameworks.
TISAX assessment results can be exchanged through the ENX Portal. If your organization is a TISAX participant, sign in at portal.enx.com and search for SpeakUp.
Yes. Certification audits for ISO/IEC 27701:2025 and ISO/IEC 42001 are in progress.
Your data is hosted in the EU. Primary: Frankfurt. Disaster recovery: Paris.
Yes. Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. This includes backups.
SpeakUp manages encryption keys in a managed key service across their full lifecycle, with documented rotation, logging of all key actions, and strict separation between keys and the data they protect. Each client receives a unique client master key, giving cryptographic isolation per tenant.
No. SpeakUp manages encryption keys within its key management service as part of the managed service; customer-managed keys are not offered.
The platform runs on a multi-tenant architecture with logical isolation between clients. Each client’s data is protected with a unique client master key, and role-based access controls prevent any user or process from reaching another client’s data.
SpeakUp acts as data processor; your organization remains the data controller. All processing is governed by a formal Data Processing Agreement.
Access by SpeakUp personnel to a specific client’s report data requires an approved support workflow tied to a ticket, is time-bounded, logged, and reviewed. Access is role-based and least-privilege.
Yes. SpeakUp engages a limited set of vetted subprocessors (see the subprocessors section of this Trust Center). Changes in subprocessors are notified to clients 30 days in advance.
You control retention for report and case data: your administrators configure retention periods in the platform, and the platform automatically removes data when the configured period expires. Deletion events are recorded.
We operate logging and monitoring across our services and follow a documented incident response plan with defined roles, escalation paths, and customer communication. Significant incidents are escalated and managed through to resolution and post-incident review.
On contract termination you can export your data, and deletion requests are honored within 30 days, subject only to overriding legal retention obligations.
AI features are optional and opt-in: your organization decides whether and how to use them. AI output is assistive and makes suggestions rather than decisions, and human oversight applies to every feature.
No. AI providers are contractually prohibited from using SpeakUp customer data for model training, and production data is never used for testing or training purposes.
Yes. Your users can authenticate through your corporate identity provider via SAML-based SSO.
Yes. MFA in SpeakUp is supported through OTP (One-Time Passwords), works with all known OTP authenticator apps, and can be enforced for all platform users.
Yes. The platform supports SCIM 2.0 for automated provisioning, updates, and deactivation from identity providers, including group sync and attribute-based role assignment. All SCIM activity is logged.
When detecting or reasonably suspecting a personal data breach, we will inform you within 24 hours.
Every change goes through peer code review, static analysis, and dependency scanning in the build pipeline, and is tested in segregated non-production environments before release. Production data is never used in test environments.
Yes. An independent external party performs a penetration test at least annually.
Production systems are scanned weekly, dependency and runtime scanning run continuously, and findings are prioritized by severity and remediated under defined timeframes through a tracked backlog.
SpeakUp guarantees a minimum of 99% monthly platform availability under the standard service agreement. Recovery objectives are an RTO of 48 hours and an RPO of 24 hours, backed by daily encrypted backups and a disaster recovery plan tested at least annually.
SpeakUp operates a documented incident response process with a dedicated response team for major incidents. Affected clients are notified within 24 hours of a confirmed or reasonably suspected personal data breach.
A dedicated Security Officer, functionally independent from IT operations, leads the information security management system. A Security Committee including the CTO meets at least quarterly to oversee security and privacy, and internal audits run quarterly.