Everyman Brand Archetype
Automotive
Employee Engagement Software
Vault Platform
Modernized corporate Speak Up programs by making misconduct reporting confidential, evidence-rich, and collective, despite legacy hotlines, employee fear of retaliation, and compliance-driven procurement.
• BUSINESS MODEL
• REVENUE
• MARKET TYPE
• MARKET ENTRY
• GROWTH MODEL
• MOAT
• EDGE
1
MODEL
Enterprises faced unreported harassment, discrimination, fraud, and ESG violations because legacy hotlines were underused and employees feared retaliation. Vault Platform’s employee app, evidence diary, GoTogether collective-reporting mechanism, and case-management hub addressed this gap; customers included Airbnb, Lemonade, OVO Energy, Kavak, and G2 by 2021.
Question this model answers
We need to prove that customers have an urgent problem.
BUSINESS MODEL
SaaS
HOW THEY BUILT IT
'- Sold enterprise SaaS to ethics, compliance, HR, legal, and employee-relations leaders.
- Started with a confidential employee reporting app that let workers document incidents and preserve time-stamped evidence.
- Added GoTogether, allowing employees to act collectively only when others also came forward, reducing the fear of being the sole complainant.
- Built a corporate resolution hub for intake, case management, investigations, and audit-ready reporting.
- Expanded into AI-enabled triage, data reporting, and broader Active Integrity workflows before Diligent acquired the company in 2025.
HOW TO ARCHITECT IT
1. Identify a high-stakes behavior that people avoid reporting because the current channel creates fear, friction, or disbelief.
2. Build the smallest trust mechanism that changes the reporter’s risk calculus before adding enterprise workflow.
3. Make the employee experience private and useful even if they choose not to submit a formal case.
4. Connect reports to the organization’s investigation, legal, and audit obligations only after employee trust is established.
5. Price around employee coverage and governance scope because both scale with enterprise risk. The common mis-build is building a case-management system for the company before solving the reporter’s trust problem.
DISTRIBUTION MODEL
Direct Sales, Enterprise Sales, Partnerships, Analyst/Research Relations
HOW THEY OPERATIONALIZED
'- Enterprise sales targeted chief compliance officers, HR leaders, legal counsel, and employee-relations teams at organizations with 1,000+ employees.
- Trust and safety positioning, including “TrustTech,” differentiated Vault from legacy hotline vendors.
- Customer proof from Airbnb, Lemonade, OVO Energy, Kavak, G2, and Telegraph reduced perceived adoption risk.
- Investor and ecosystem credibility from Gradient Ventures, Kindred Capital, and Illuminate Financial supported enterprise trust and category visibility.
HOW TO REPLICATE WHAT WORKED
What Worked
Naming a new category—TrustTech—gave buyers a language for a problem that legacy hotlines did not solve.
Trap if Copied Blindly
Category creation requires sustained education and proof; without case studies and regulatory relevance, a new label becomes marketing noise rather than a buying criterion.
Insight on Untapped Business Model / Gaps / Pitfalls
GOLDMINE
GOLDMINE 1 — PREVENTION, NOT JUST REPORTING. The opportunity is identifying cultural risk before a formal complaint: manager behavior, team climate, policy confusion, and repeated patterns.
GOLDMINE 2 — INVESTIGATION QUALITY AS A PRODUCT. Enterprises need structured evidence handling, chain of custody, fairness checks, and defensible outcomes—not merely ticket routing.
GOLDMINE 3 — CROSS-FUNCTIONAL RISK GRAPH. Connecting HR, legal, security, finance, and ESG signals can reveal systemic issues earlier than a single reporting channel.
THE TRAP TO WATCH
THE PIT — REPORTING APP WITHOUT INVESTIGATION DEPTH. Employees may submit reports, but enterprises still need resolution, documentation, and accountability.
THE SECOND PIT — SURVEILLANCE FRAMING. If employees perceive the tool as management monitoring, trust collapses and usage declines.
MOVE WITH CAUTION
Do not sell a Speak Up platform without rigorous confidentiality, data-residency, retaliation-prevention, and audit controls; a trust failure is existential in this category.
2
MARKET
MARKET TYPE
Emerging Market
WHY THEY WON
The market is an Emerging Market: ethics hotlines and compliance case management existed, but employee-centered, AI-enabled integrity platforms were still being defined. Vault’s structural opening was that enterprises needed more than a reporting channel; they needed a system that increased reporting willingness and improved resolution quality. By naming TrustTech and emphasizing employee protection, Vault changed the buying frame from compliance cost to risk prevention and culture infrastructure. The transferable lesson is that category creation works when the new frame exposes a failure the old category cannot solve.
Vault positioned itself as “TrustTech,” reframing workplace misconduct from a hotline-compliance problem into an active-integrity and employee-trust problem. It educated buyers around Speak Up, evidence preservation, collective reporting, and investigation resolution rather than competing solely as another hotline.
Question this model answers
We need to create a new category.
ENTRY STRATEGY
Brownfield Entry
EXECUTION
Vault entered by replacing or modernizing legacy ethics hotlines and fragmented misconduct-reporting processes. Its initial bet was that enterprises would adopt a digital, employee-centered platform if it increased reporting willingness and reduced investigation risk. This required mobile accessibility, confidentiality, evidence handling, case management, and audit-ready reporting. The approach was viable because compliance failures and cultural risk were costly; it would fail where the buyer viewed Speak Up as a checkbox rather than an operational risk system.
FOOTHOLD STRATEGY
Lighthouse Customer Strategy
THE HOW
Vault used recognizable, values-conscious enterprises such as Airbnb, Lemonade, OVO Energy, Kavak, G2, and Telegraph as early proof points. These customers were reachable through compliance and HR networks and could pay because misconduct, ESG, and reputational risk were board-level concerns. Their adoption served as a lighthouse for similar enterprises evaluating modern Speak Up systems.
MARKET TYPE PLAYBOOK
RULE 1 — NAME THE FAILURE, NOT THE TECHNOLOGY: “Unreported misconduct” is stronger than “reporting software.”
RULE 2 — BUILD TRUST BEFORE SCALE: The end user’s willingness to engage is the leading indicator.
RULE 3 — CONNECT TO REGULATORY AND REPUTATIONAL RISK: The economic buyer must see a budget line beyond HR culture.
RULE 4 — CATEGORY CREATION FAILS WITHOUT PROOF: A new label requires customer evidence and repeatable outcomes.
In an Emerging Market, the vendor must define the problem, prove the mechanism, and create a buying category before competitors define it for them.
GENERAL RULES
WHAT HAPPENS IN THIS MARKET TYPE
RULE 1 — Identify why people avoid the incumbent process, not merely why it is outdated.
RULE 2 — Design for the vulnerable end user before designing for the administrator.
RULE 3 — Prove confidentiality, security, and auditability before enterprise rollout.
RULE 4 — Reject brownfield entry when the buyer will not fund a new category and only wants a cheaper hotline replacement.
Brownfield entry is appropriate when a legacy process exists but fails the human behavior the category depends on.
A lighthouse customer is a credible early adopter whose use makes the product safer and more desirable for similar buyers.
HOW TO APPLY FOOTHOLD STRATEGY
RULE 1 — Choose customers whose brand or regulatory posture makes adoption meaningful.
RULE 2 — Ensure the customer can produce a referenceable outcome, not merely a logo.
RULE 3 — Use the lighthouse to refine implementation, security, and workflow requirements.
RULE 4 — A lighthouse fails when the customer’s use case is too unique to transfer to the broader market.
Veeva used leading pharmaceutical companies as lighthouse customers before expanding across life sciences; failure occurs when one logo substitutes for repeatable demand.
HOW TO APPLY MARKET ENTRY STRATEGY
OneTrust entered privacy by connecting compliance obligations to operational workflows; failure occurs when entrants sell a new category without a regulatory or financial forcing function.
PATTERNS OF THIS MARKETING MODEL
PATTERNS IN CATEGORY-CREATION ENTERPRISE MARKETING:
1. A NEW CATEGORY NAME CHANGES THE BUYING CRITERION. Buyers evaluate the new problem rather than comparing feature-for-feature with legacy vendors.
2. CREDIBLE CUSTOMERS REDUCE SENSITIVE-ADOPTION RISK. Recognized brands signal that the product can handle confidentiality and governance.
3. THOUGHT LEADERSHIP CREATES DEMAND BEFORE COMPARISON. Education helps buyers recognize a failure they had normalized.
WEAKNESS
Category creation is expensive and slow; without repeatable proof, the market reverts to familiar procurement categories.
GROWTH CAMPAIGNS
'- “TrustTech” category positioning and thought leadership on workplace integrity.
- Enterprise customer evidence from Airbnb, Lemonade, OVO Energy, Kavak, G2, and Telegraph.
- Speak Up, Listen Up, and Active Integrity product campaigns.
- AI-enabled misconduct reporting, investigation, and data-reporting positioning.
- Investor credibility from Gradient Ventures, Kindred Capital, Illuminate Financial, and Angular Ventures.
| So What
Vault’s category and lighthouse-customer campaigns converted a sensitive, low-visibility problem into an enterprise risk-management purchase.
| Key Learning
In trust-sensitive categories, credibility signals matter more than feature comparisons because the buyer is purchasing protection from reputational and legal failure.
| How to Use
Name the underlying failure mode, secure credible early customers, and make the product’s trust mechanisms visible before scaling feature claims.
3
MONEY
REVENUE MODEL
Subscription
Vault sold enterprise SaaS subscriptions for Speak Up, case management, and integrity reporting. Its enterprise focus, annual contracts, and acquisition by Diligent indicate a recurring, governance-led revenue model, though public pricing and ARR were not disclosed.
Question this model answers
We need to build a predictable revenue model.
PRICING STRATEGY
Custom Enterprise Pricing, Value-Based Pricing, Tiered Pricing
WHY THEY WON
Enterprises pay recurring subscription fees for employee coverage, case-management capacity, investigation workflows, analytics, and security controls. Revenue expands as customers add employees, regions, modules, and investigation users; value is tied to risk coverage and governance rather than employee engagement volume.
TARGET AUDIENCE
Global enterprises (Enterprise; Speak Up coverage and investigation governance); Scale-ups with compliance obligations (Enterprise; scalable reporting and case management); HR and employee-relations leaders (Enterprise; culture, retaliation prevention, and case resolution); Legal, compliance, and audit leaders (Enterprise; regulatory readiness and defensible records).
Vault used custom enterprise pricing based on employee population, modules, regions, and governance requirements. Public list pricing was not disclosed; its value case rested on reduced misconduct risk, investigation efficiency, regulatory readiness, and reputational protection.
CUSTOMER BUYING BEHAVIOUR
A regulatory requirement, ESG commitment, cultural incident, or investigation failure triggers evaluation. Compliance, HR, legal, and security stakeholders assess confidentiality, data residency, workflow fit, and auditability; procurement reviews security and enterprise deployment before rollout.
WILLINGNESS TO PAY
CORE INSIGHT
Customers are buying protection from the cost of unreported misconduct, not a reporting inbox.
RULES OF ADOPTION
RULE 1 — PRICE ENTERPRISE RISK COVERAGE. Employee population and geographic footprint determine the exposure the platform must govern.
RULE 2 — PRICE INVESTIGATION RELIABILITY. Defensible evidence handling and case outcomes reduce legal and reputational risk.
RULE 3 — SELL TRUST AS AN ADOPTION ASSET. A system employees actually use produces better risk visibility than a dormant hotline.
RULE 4 — VENDOR TRAP: If reporting volume is low, the buyer may question value even when low volume reflects trust and prevention. The buyer is really buying an enterprise-integrity risk budget, proven by employee coverage, case volume, and investigation outcomes.
The buyer is really buying protection from the cost of unreported misconduct, proven by enterprise governance budgets for Speak Up programs and investigation reliability rather than an inbox licence.
REVENUE RISK
Trust failure is the existential risk: a confidentiality breach, perceived retaliation, or poor investigation experience can destroy employee adoption and enterprise credibility. Low engagement risk arises if employees do not trust or use the system, making the platform appear inactive even when prevention is working. Regulatory complexity creates cost because privacy, employment law, data residency, and investigation rules vary by jurisdiction. Enterprise sales concentration can emerge because large customers require custom security, implementation, and support. Competitive pressure from NAVEX, OneTrust, and Diligent can compress differentiation once they add modern reporting and AI workflows. Funding/valuation: Vault raised $4.2 million in 2019 and $8.2 million in 2021, for $12.4 million total; Diligent acquired it in 2025 for an undisclosed price, and ARR was not publicly disclosed.
4
MOTION
Vault sold a security-sensitive, multi-stakeholder platform to enterprises with 1,000+ employees, requiring HR, legal, compliance, security, and procurement involvement. Customers including Airbnb, Lemonade, OVO Energy, and G2 demonstrate an enterprise sales and governance-led motion.
Question this model answers
We need to build an enterprise sales motion.
GROWTH EXPANSION MODEL
Product Line Expansion, Ecosystem Expansion
HOW THEY EXPAND
Vault expanded from employee reporting into case management, investigations, analytics, AI triage, and Active Integrity workflows. Ecosystem expansion through Diligent’s governance, risk, and compliance platform created a path into broader enterprise GRC buyers. The dependency is that expansion must preserve employee trust; adding surveillance or analytics features without clear boundaries can undermine the reporting behavior that makes the system valuable.
COMPETITIVE STRATEGY
Sales-Led Growth
HOW THEY COMPETE
Compliance, HR, and legal leaders discover Vault through category content, referrals, and risk-driven evaluation. A pilot activates a defined employee population and tests reporting willingness, confidentiality, and case handling. Successful adoption expands to more regions, employee groups, and investigation workflows. The repeatable trigger is a regulatory requirement, cultural incident, or audit finding. The engine requires enterprise trust, strong security, credible references, and effective implementation; it breaks when employees do not trust the system or when the buyer treats it as a compliance checkbox. A founder can reproduce this by solving the end user’s risk calculus before optimizing the administrator’s workflow.
GTM
Vault ran an enterprise, sales-led GTM built around trust and risk.
$5–10M ARR
Category content created awareness among compliance and HR leaders; lighthouse customers reduced perceived adoption risk; direct enterprise sales managed multi-stakeholder evaluation and procurement; implementation and customer success drove rollout and expansion. Integrations and AI capabilities deepened the investigation and governance workflow. The primary motion was enterprise sales, supported by category education and customer proof. The transferable components are a reporter-first trust mechanism, a risk-based economic buyer, and credible lighthouse evidence; they require security depth, regulatory expertise, and high-touch implementation.
SUSTAINING MOATS
High Customer Lock-In
The moat is High Customer Lock-In: once Vault holds misconduct reports, evidence, investigation records, and audit trails, replacement creates legal, compliance, and organizational risk. Multi-region deployment and integrated case workflows deepen that dependence.
| Why This Moat Lasts
Governance lock-in lasts when the system holds sensitive records and supports defensible processes.
| Standard Rules
RULE 1 — EVIDENCE CONTINUITY: Time-stamped reports and investigation records create historical and legal value.
RULE 2 — WORKFLOW DEPENDENCE: Intake, triage, investigation, and reporting become interdependent.
RULE 3 — REGULATORY ALIGNMENT: Data residency, auditability, and retention policies increase migration complexity.
| The Signal
Vault served enterprises including Airbnb, Lemonade, OVO Energy, Kavak, and G2, and was acquired by Diligent in 2025; these indicate enterprise trust and governance relevance. The moat does not protect against a major GRC vendor offering equivalent trust, integration, and distribution.
ARR
JOURNEY
Pre-$1M ARR
VALIDATE THE REPORTER-TRUST WEDGE: Founded in 2018, Vault launched its employee app and GoTogether mechanism in 2019 to make misconduct reporting safer and more credible.
WATCH: Confidentiality, security, and employee adoption.
$1–5M ARR
PROVE ENTERPRISE DEMAND: A $4.2 million seed round in 2019 supported product and market expansion; Vault needed to convert trust-based adoption into enterprise contracts.
$5–10M ARR
SCALE THE GOVERNANCE WORKFLOW: A $8.2 million Series A in 2021 supported case management, AI, and expansion across North America and Europe; customers included Airbnb, Lemonade, OVO Energy, and G2.
$10–50M ARR
EXPAND INTO ACTIVE INTEGRITY: Vault broadened from reporting into investigations, data reporting, and AI-enabled risk detection.
WATCH: Enterprise implementation and regulatory complexity.
$50–100M ARR
NOT REACHED publicly verified; Vault’s ARR was not publicly disclosed.
$100M+ ARR
EXIT THROUGH GOVERNANCE CONSOLIDATION: Diligent acquired Vault in 2025, integrating it into a broader governance, risk, and compliance platform.
BREAKDOWN
THE STANDARD
Build trust with the vulnerable end user before building enterprise workflow, then monetize the governance and risk reduction that the resulting data enables.
THE SEQUENCE
1. First, identify a behavior people avoid reporting because the current process increases their risk; prerequisite: a credible confidentiality and safety mechanism.
2. Next, prove employee willingness to engage before scaling enterprise features; gate expansion on reporting quality and trust signals.
3. Then, add investigation, analytics, and AI only when the core trust loop is established; prerequisite: security, auditability, and clear data boundaries.
Vault’s employee-first design, GoTogether mechanism, and TrustTech positioning created a distinct reason for enterprises to modernize Speak Up programs.