25 questions · 100 points
How ethics and compliance tools are scored
Twenty-five questions across five areas, answered only from pages the vendor publishes. A score says how much of the rubric the published facts support, not whether the product is good.
Rubric edition 2026.11 · recalculated 13 November 2026 · 15 entries
Facts first, score second
The entry records
What a vendor says about its own product, taken from a named page and stamped with the date it was read. Where a vendor publishes nothing, the entry says "not published". That is a finding in its own right.
The score judges
How much of these 25 questions the recorded facts support. A product can be strong and still score low, because strong products often publish little. The breakdown shows which answers were found, which were partial and which were missing.
How points are awarded
4 points
The vendor's pages describe the capability clearly, not just in a logo or a slogan.
2 points
The pages describe a narrower or partial version of the capability.
0 points
The vendor says it is absent, the offer does not meet the question, or no supporting page was found. Only the last case is flagged as missing.
The questions
Speak-up channel5 questions, 20 points
The reporting duty itself: anonymous intake, more than one channel, two-way dialogue and a documented legal basis.
| ID | Question | What earns the points |
|---|---|---|
| A1 | Anonymous reporting offered | Anonymity is offered on the reporting form, not only on request · no anonymous path · not published. |
| A2 | More than one intake channel | Web plus at least one of phone, email, messaging app · web only · not published. |
| A3 | Two-way dialogue with the reporter | A thread the reporter can return to · one-way submission · not published. |
| A4 | EU Directive 2019/1937 documented | Directive or a national transposition law named on the vendor's pages · generic compliance claim · not published. |
| A5 | Reporting form in multiple languages | 20 or more languages · two to nineteen · a single language. |
Case work5 questions, 20 points
What happens after a report lands: workflow, deadlines, access control and the audit trail a regulator can read.
| ID | Question | What earns the points |
|---|---|---|
| B1 | Case workflow with statuses | Received → acknowledged → investigating → closed, with transitions · freeform statuses · email inbox · not published. |
| B2 | Audit trail for handler actions | Append-only or per-action log · editable log · none · not published. |
| B3 | Role-based access control | At least three scoped roles · two roles · everyone is an admin · not published. |
| B4 | Internal notes invisible to the reporter | Notes hidden from the reporter · notes visible to the reporter · not published. |
| B5 | Deadline tracking and reminders | Seven-day acknowledgment and three-month feedback timers with reminders · one timer · none · not published. |
Ethics programme5 questions, 20 points
The records that sit beside the channel: conflicts, gifts, attestation, policy and training.
| ID | Question | What earns the points |
|---|---|---|
| C1 | Conflicts-of-interest register | Declarations collected, reviewed and retained · a form with no review workflow · not offered. |
| C2 | Gifts and hospitality register | Declarations with approval thresholds · a register with no approvals · not offered. |
| C3 | Code-of-conduct attestation | Versioned attestation with a record per employee · a one-off acknowledgement · not offered. |
| C4 | Ethics or compliance training records | Training delivered and recorded in the product · recorded elsewhere · not offered. |
| C5 | Policy management | Versioned policies with distribution records · document storage only · not offered. |
Security and hosting5 questions, 20 points
Certification, residency, single sign-on and an interface for the systems that already hold the rest of the record.
| ID | Question | What earns the points |
|---|---|---|
| D1 | ISO 27001 certified | Certificate published with scope · certification claimed without a certificate · none published. |
| D2 | Additional assurance (ISO 27701 or SOC 2) | ISO 27701 or SOC 2 published · neither · not published. |
| D3 | EU data residency with country named | An EU country named for report storage · an EU region with no country named · non-EU or not published. |
| D4 | Single sign-on | SAML or OIDC SSO on published plans · SSO at an enterprise tier only · not published. |
| D5 | Documented public API | Interface documentation published · integrations listed without documentation · not published. |
Commercial transparency5 questions, 20 points
How the product is sold: published price, self-serve path, trial, billing terms and a public trust page.
| ID | Question | What earns the points |
|---|---|---|
| E1 | Published pricing | 4 points for a published price range or band · 2 for a starting-from figure · 0 when no numeric price is published. |
| E2 | Self-serve sign-up | An account you can open yourself · demo gate · not published. |
| E3 | Free trial or sandbox | Self-serve trial · sandbox by request · demo only · not published. |
| E4 | Monthly billing option | Monthly billing published · annual only · not published. |
| E5 | Public trust or security page | A trust centre or security page with current detail · a certifications page only · not published. |
What we could review
| Review scope | What was reviewed | Platforms |
|---|---|---|
| Public sources | Product, pricing, security and legal pages the vendor publishes. Nothing behind a sign-up. | 15 |
| Public sources and reporter side | A report was submitted, so the reporter's side of the exchange was observed as well. | 0 |
| Public sources and handler environment | The workflow was examined from inside the product, but no report was filed through the live form. | 0 |
| Public sources, reporter and handler | Workflow, roles, audit trail and settings were examined inside the product, and the reporter side was tested. | 0 |
Most platforms are scored from public sources alone, because most are sold through a demo gate that a directory cannot pass without the vendor's help. Read a score with that in mind: it measures what a vendor publishes as much as what it built.
What is not scored
- Voice intake with pitch modification: a single-vendor capability, not something buyers weigh across a shortlist.
- Mailbox size, storage limits and seat counts: commercial detail rather than a compliance differentiator.
- Custom branding and white-label: table stakes that buyers rarely look past.
- Dedicated mobile apps: employees click a poster URL, and installing an app works against anonymity.
- Severity and priority classification: almost every handler renames the scale.
- Statistics dashboards: opened once a year, never the deciding factor.
- Bulk actions, template responses and spam flagging: convenient, not differentiating.
- End-to-end encryption: almost no vendor offers true end-to-end encryption, so the claim says little.
- SOC 2 and ISAE 3000 as separate questions: one extra assurance is enough; the other is recorded but not scored twice.
- Penetration-testing disclosure, uptime SLA and backup claims: marketing statements that are rarely verified.
- Customer logos and references: marketing, not product.
- UI language count: already covered by the reporting-form question, where it matters to the reporter.
Editions
Edition 2026.11 · 13 November 2026
Current edition. Separates a published no (0) from an answer that was not found (0, flagged), gives 2 points for a published starting price or partial language coverage, and is applied to every live profile.
Edition 2026.10 draft · never used
The first draft was never used for a published score. It mixed questions that separate realistic finalists with expectations every product already meets, which squeezed the range and made the totals harder to act on.