top of page
Business & Enterprise
HR Technology
Employee Engagement Software
Vault Platform
Modernized corporate Speak Up programs by making misconduct reporting confidential, evidence-rich, and collective, despite legacy hotlines, employee fear of retaliation, and compliance-driven procurement.
1
MODEL
BUSINESS MODEL
SaaS
- Sold enterprise SaaS to ethics, compliance, HR, legal, and employee-relations leaders. - Started with a confidential employee reporting app that let workers document incidents and preserve time-stamped evidence. - Added GoTogether, allowing employees to act collectively only when others also came forward, reducing the fear of being the sole complainant. - Built a corporate resolution hub for intake, case management, investigations, and audit-ready reporting. - Expanded into AI-enabled triage, data reporting, and broader Active Integrity workflows before Diligent acquired the company in 2025.
1. Identify a high-stakes behavior that people avoid reporting because the current channel creates fear, friction, or disbelief. 2. Build the smallest trust mechanism that changes the reporter’s risk calculus before adding enterprise workflow. 3. Make the employee experience private and useful even if they choose not to submit a formal case. 4. Connect reports to the organization’s investigation, legal, and audit obligations only after employee trust is established. 5. Price around employee coverage and governance scope because both scale with enterprise risk. The common mis-build is building a case-management system for the company before solving the reporter’s trust problem.
DISTRIBUTION MODEL
Enterprises faced unreported harassment, discrimination, fraud, and ESG violations because legacy hotlines were underused and employees feared retaliation. Vault Platform’s employee app, evidence diary, GoTogether collective-reporting mechanism, and case-management hub addressed this gap; customers included Airbnb, Lemonade, OVO Energy, Kavak, and G2 by 2021.
HOW THEY BUILT IT
HOW TO ARCHITECT IT
Direct Sales, Enterprise Sales, Partnerships, Analyst/Research Relations
HOW THEY OPERATIONALIZED
HOW TO REPLICATE WHAT WORKED
dm
- Enterprise sales targeted chief compliance officers, HR leaders, legal counsel, and employee-relations teams at organizations with 1,000+ employees. - Trust and safety positioning, including “TrustTech,” differentiated Vault from legacy hotline vendors. - Customer proof from Airbnb, Lemonade, OVO Energy, Kavak, G2, and Telegraph reduced perceived adoption risk. - Investor and ecosystem credibility from Gradient Ventures, Kindred Capital, and Illuminate Financial supported enterprise trust and category visibility.
What worked: naming a new category—TrustTech—gave buyers a language for a problem that legacy hotlines did not solve. Trap if copied blindly: category creation requires sustained education and proof; without case studies and regulatory relevance, a new label becomes marketing noise rather than a buying criterion.
| PATTERNS OF THIS MODEL
PATTERNS IN TRUST-AND-SAFETY ENTERPRISE SAAS: 1. REPORTER TRUST PRECEDES ADOPTION. The end user must believe the system protects confidentiality and reduces retaliation risk before the enterprise sees volume. 2. REGULATORY RISK CREATES EXECUTIVE BUDGETS. Compliance obligations turn culture initiatives into procurement-backed software purchases. 3. CASE DATA BECOMES THE GOVERNANCE ASSET. Longitudinal reports, investigation outcomes, and patterns create value beyond individual complaints. THE WEAKNESS: Low reporting volume can make the platform appear unused, even when the absence of reports reflects trust rather than absence of misconduct.
What companies with this model reveal
| OPPORTUNITY INTELLIGENCE
GOLDMINE 1 — PREVENTION, NOT JUST REPORTING. The opportunity is identifying cultural risk before a formal complaint: manager behavior, team climate, policy confusion, and repeated patterns. GOLDMINE 2 — INVESTIGATION QUALITY AS A PRODUCT. Enterprises need structured evidence handling, chain of custody, fairness checks, and defensible outcomes—not merely ticket routing. GOLDMINE 3 — CROSS-FUNCTIONAL RISK GRAPH. Connecting HR, legal, security, finance, and ESG signals can reveal systemic issues earlier than a single reporting channel. THE PIT — REPORTING APP WITHOUT INVESTIGATION DEPTH. Employees may submit reports, but enterprises still need resolution, documentation, and accountability. THE SECOND PIT — SURVEILLANCE FRAMING. If employees perceive the tool as management monitoring, trust collapses and usage declines. MOVE WITH CAUTION — Do not sell a Speak Up platform without rigorous confidentiality, data-residency, retaliation-prevention, and audit controls; a trust failure is existential in this category.
Untapped Business Model / Gaps / Goldmines / Pits
Patterns & Insights
2
MARKET
mkt mt es
Vault positioned itself as “TrustTech,” reframing workplace misconduct from a hotline-compliance problem into an active-integrity and employee-trust problem. It educated buyers around Speak Up, evidence preservation, collective reporting, and investigation resolution rather than competing solely as another hotline.
MARKET TYPE
Emerging Market
ENTRY STRATEGY
Brownfield Entry
WHY THEY WON
The market is an Emerging Market: ethics hotlines and compliance case management existed, but employee-centered, AI-enabled integrity platforms were still being defined. Vault’s structural opening was that enterprises needed more than a reporting channel; they needed a system that increased reporting willingness and improved resolution quality. By naming TrustTech and emphasizing employee protection, Vault changed the buying frame from compliance cost to risk prevention and culture infrastructure. The transferable lesson is that category creation works when the new frame exposes a failure the old category cannot solve.
EXECUTION
Vault entered by replacing or modernizing legacy ethics hotlines and fragmented misconduct-reporting processes. Its initial bet was that enterprises would adopt a digital, employee-centered platform if it increased reporting willingness and reduced investigation risk. This required mobile accessibility, confidentiality, evidence handling, case management, and audit-ready reporting. The approach was viable because compliance failures and cultural risk were costly; it would fail where the buyer viewed Speak Up as a checkbox rather than an operational risk system.
FOOTHOLD STRATEGY
Lighthouse Customer Strategy
Vault used recognizable, values-conscious enterprises such as Airbnb, Lemonade, OVO Energy, Kavak, G2, and Telegraph as early proof points. These customers were reachable through compliance and HR networks and could pay because misconduct, ESG, and reputational risk were board-level concerns. Their adoption served as a lighthouse for similar enterprises evaluating modern Speak Up systems.
GROWTH CAMPAIGN
CAMPAIGNS THAT WORKED
SO WHAT: Vault’s category and lighthouse-customer campaigns converted a sensitive, low-visibility problem into an enterprise risk-management purchase. KEY LEARNING: In trust-sensitive categories, credibility signals matter more than feature comparisons because the buyer is purchasing protection from reputational and legal failure. HOW TO USE: Name the underlying failure mode, secure credible early customers, and make the product’s trust mechanisms visible before scaling feature claims.
KEY LEARNING
THE STANDARD: In an Emerging Market, the vendor must define the problem, prove the mechanism, and create a buying category before competitors define it for them. RULE 1 — NAME THE FAILURE, NOT THE TECHNOLOGY: “Unreported misconduct” is stronger than “reporting software.” RULE 2 — BUILD TRUST BEFORE SCALE: The end user’s willingness to engage is the leading indicator. RULE 3 — CONNECT TO REGULATORY AND REPUTATIONAL RISK: The economic buyer must see a budget line beyond HR culture. RULE 4 — CATEGORY CREATION FAILS WITHOUT PROOF: A new label requires customer evidence and repeatable outcomes. MARKET TYPE: Emerging Market (category).
gc
Market Context
| MARKET INTELLIGENCE
PATTERNS IN CATEGORY-CREATION ENTERPRISE MARKETING: 1. A NEW CATEGORY NAME CHANGES THE BUYING CRITERION. Buyers evaluate the new problem rather than comparing feature-for-feature with legacy vendors. 2. CREDIBLE CUSTOMERS REDUCE SENSITIVE-ADOPTION RISK. Recognized brands signal that the product can handle confidentiality and governance. 3. THOUGHT LEADERSHIP CREATES DEMAND BEFORE COMPARISON. Education helps buyers recognize a failure they had normalized. 4. THE WEAKNESS: Category creation is expensive and slow; without repeatable proof, the market reverts to familiar procurement categories.
| MARKET ENTRY PLAYBOOK
THE STANDARD: Brownfield entry is appropriate when a legacy process exists but fails the human behavior the category depends on. RULE 1 — Identify why people avoid the incumbent process, not merely why it is outdated. RULE 2 — Design for the vulnerable end user before designing for the administrator. RULE 3 — Prove confidentiality, security, and auditability before enterprise rollout. RULE 4 — Reject brownfield entry when the buyer will not fund a new category and only wants a cheaper hotline replacement. Example: OneTrust entered privacy by connecting compliance obligations to operational workflows; failure occurs when entrants sell a new category without a regulatory or financial forcing function.
How to enter
| FOOTHOLD STRATEGY PLAYBOOK
THE STANDARD: A lighthouse customer is a credible early adopter whose use makes the product safer and more desirable for similar buyers. RULE 1 — Choose customers whose brand or regulatory posture makes adoption meaningful. RULE 2 — Ensure the customer can produce a referenceable outcome, not merely a logo. RULE 3 — Use the lighthouse to refine implementation, security, and workflow requirements. RULE 4 — A lighthouse fails when the customer’s use case is too unique to transfer to the broader market. Example: Veeva used leading pharmaceutical companies as lighthouse customers before expanding across life sciences; failure occurs when one logo substitutes for repeatable demand.
How to get the first strong position
MARKET PATTERNS & PLAYBOOK
3
MONEY
money rev pri
Vault sold enterprise SaaS subscriptions for Speak Up, case management, and integrity reporting. Its enterprise focus, annual contracts, and acquisition by Diligent indicate a recurring, governance-led revenue model, though public pricing and ARR were not disclosed.
REVENUE MODEL
Subscription
PRICING MODEL
Custom Enterprise Pricing, Value-Based Pricing, Tiered Pricing
WHY THEY WON
Enterprises pay recurring subscription fees for employee coverage, case-management capacity, investigation workflows, analytics, and security controls. Revenue expands as customers add employees, regions, modules, and investigation users; value is tied to risk coverage and governance rather than employee engagement volume.
Vault used custom enterprise pricing based on employee population, modules, regions, and governance requirements. Public list pricing was not disclosed; its value case rested on reduced misconduct risk, investigation efficiency, regulatory readiness, and reputational protection.
TARGET AUDIENCE
Global enterprises (Enterprise; Speak Up coverage and investigation governance); Scale-ups with compliance obligations (Enterprise; scalable reporting and case management); HR and employee-relations leaders (Enterprise; culture, retaliation prevention, and case resolution); Legal, compliance, and audit leaders (Enterprise; regulatory readiness and defensible records).
CUSTOMER BUYING BEHAVIOUR
A regulatory requirement, ESG commitment, cultural incident, or investigation failure triggers evaluation. Compliance, HR, legal, and security stakeholders assess confidentiality, data residency, workflow fit, and auditability; procurement reviews security and enterprise deployment before rollout.
| PRICING INTELLIGENCE
What makes this model effective & make customers pay
Customers are buying protection from the cost of unreported misconduct, not a reporting inbox. RULE 1 — PRICE ENTERPRISE RISK COVERAGE. Employee population and geographic footprint determine the exposure the platform must govern. RULE 2 — PRICE INVESTIGATION RELIABILITY. Defensible evidence handling and case outcomes reduce legal and reputational risk. RULE 3 — SELL TRUST AS AN ADOPTION ASSET. A system employees actually use produces better risk visibility than a dormant hotline. RULE 4 — VENDOR TRAP: If reporting volume is low, the buyer may question value even when low volume reflects trust and prevention. The buyer is really buying an enterprise-integrity risk budget, proven by employee coverage, case volume, and investigation outcomes.
PRICE & REVENUE
| Revenue Risk - The biggest threat to revenue stability
Trust failure is the existential risk: a confidentiality breach, perceived retaliation, or poor investigation experience can destroy employee adoption and enterprise credibility. Low engagement risk arises if employees do not trust or use the system, making the platform appear inactive even when prevention is working. Regulatory complexity creates cost because privacy, employment law, data residency, and investigation rules vary by jurisdiction. Enterprise sales concentration can emerge because large customers require custom security, implementation, and support. Competitive pressure from NAVEX, OneTrust, and Diligent can compress differentiation once they add modern reporting and AI workflows. Funding/valuation: Vault raised $4.2 million in 2019 and $8.2 million in 2021, for $12.4 million total; Diligent acquired it in 2025 for an undisclosed price, and ARR was not publicly disclosed.
Where the model can break
4
MOTION
motion ge cs
Vault sold a security-sensitive, multi-stakeholder platform to enterprises with 1,000+ employees, requiring HR, legal, compliance, security, and procurement involvement. Customers including Airbnb, Lemonade, OVO Energy, and G2 demonstrate an enterprise sales and governance-led motion.
GROWTH EXPANSION MODEL
Product Line Expansion, Ecosystem Expansion
HOW THEY EXPAND
Vault expanded from employee reporting into case management, investigations, analytics, AI triage, and Active Integrity workflows. Ecosystem expansion through Diligent’s governance, risk, and compliance platform created a path into broader enterprise GRC buyers. The dependency is that expansion must preserve employee trust; adding surveillance or analytics features without clear boundaries can undermine the reporting behavior that makes the system valuable.
COMPETITIVE STRATEGY
Differentiation
HOW THEY COMPETE
Against legacy hotline vendors, NAVEX, OneTrust, and compliance case-management systems, Vault differentiated through employee-centered reporting, evidence preservation, GoTogether collective reporting, and modern investigation workflows. Its sequence moved from reporting trust to enterprise case resolution and AI-enabled integrity. The viable resource was category positioning and credible customers; the constraint is that established GRC vendors have greater distribution and compliance depth.
GROWTH ENGINE
GTM
Content Flywheel
Compliance, HR, and legal leaders discover Vault through category content, referrals, and risk-driven evaluation. A pilot activates a defined employee population and tests reporting willingness, confidentiality, and case handling. Successful adoption expands to more regions, employee groups, and investigation workflows. The repeatable trigger is a regulatory requirement, cultural incident, or audit finding. The engine requires enterprise trust, strong security, credible references, and effective implementation; it breaks when employees do not trust the system or when the buyer treats it as a compliance checkbox. A founder can reproduce this by solving the end user’s risk calculus before optimizing the administrator’s workflow.
Vault ran an enterprise, sales-led GTM built around trust and risk. Category content created awareness among compliance and HR leaders; lighthouse customers reduced perceived adoption risk; direct enterprise sales managed multi-stakeholder evaluation and procurement; implementation and customer success drove rollout and expansion. Integrations and AI capabilities deepened the investigation and governance workflow. The primary motion was enterprise sales, supported by category education and customer proof. The transferable components are a reporter-first trust mechanism, a risk-based economic buyer, and credible lighthouse evidence; they require security depth, regulatory expertise, and high-touch implementation.
SUSTAINING MOATS
High Customer Lock-In
moat
The moat is High Customer Lock-In: once Vault holds misconduct reports, evidence, investigation records, and audit trails, replacement creates legal, compliance, and organizational risk. Multi-region deployment and integrated case workflows deepen that dependence.
| MOAT INTELLIGENCE
THE STANDARD: Governance lock-in lasts when the system holds sensitive records and supports defensible processes. RULE 1 — EVIDENCE CONTINUITY: Time-stamped reports and investigation records create historical and legal value. RULE 2 — WORKFLOW DEPENDENCE: Intake, triage, investigation, and reporting become interdependent. RULE 3 — REGULATORY ALIGNMENT: Data residency, auditability, and retention policies increase migration complexity. THE SIGNAL: Vault served enterprises including Airbnb, Lemonade, OVO Energy, Kavak, and G2, and was acquired by Diligent in 2025; these indicate enterprise trust and governance relevance. The moat does not protect against a major GRC vendor offering equivalent trust, integration, and distribution.
Why this company remains defensible
ARR & TAKEAWAY
ARR Journey - what to do at each stage
PRE-$1M ARR — VALIDATE THE REPORTER-TRUST WEDGE: Founded in 2018, Vault launched its employee app and GoTogether mechanism in 2019 to make misconduct reporting safer and more credible. WATCH: Confidentiality, security, and employee adoption. $1–5M ARR — PROVE ENTERPRISE DEMAND: A $4.2 million seed round in 2019 supported product and market expansion; Vault needed to convert trust-based adoption into enterprise contracts. $5–10M ARR — SCALE THE GOVERNANCE WORKFLOW: A $8.2 million Series A in 2021 supported case management, AI, and expansion across North America and Europe; customers included Airbnb, Lemonade, OVO Energy, and G2. $10–50M ARR — EXPAND INTO ACTIVE INTEGRITY: Vault broadened from reporting into investigations, data reporting, and AI-enabled risk detection. WATCH: Enterprise implementation and regulatory complexity. $50–100M ARR — NOT REACHED publicly verified; Vault’s ARR was not publicly disclosed. $100M+ ARR — EXIT THROUGH GOVERNANCE CONSOLIDATION: Diligent acquired Vault in 2025, integrating it into a broader governance, risk, and compliance platform. Rule: Solve the end user’s trust problem first, then expand into the enterprise governance workflow that makes the data operationally necessary.
COPY PLAYBOOK : What Worked → What Failed → What to Replicate → What to Avoid
THE STANDARD: Build trust with the vulnerable end user before building enterprise workflow, then monetize the governance and risk reduction that the resulting data enables. SEQUENCE: 1. First, identify a behavior people avoid reporting because the current process increases their risk; prerequisite: a credible confidentiality and safety mechanism. 2. Next, prove employee willingness to engage before scaling enterprise features; gate expansion on reporting quality and trust signals. 3. Then, add investigation, analytics, and AI only when the core trust loop is established; prerequisite: security, auditability, and clear data boundaries. WORKED: Vault’s employee-first design, GoTogether mechanism, and TrustTech positioning created a distinct reason for enterprises to modernize Speak Up programs. CAUTION: Do not build a case-management system before solving reporter trust; enterprise adoption fails if employees will not use the intake layer. CAUTION: Do not add analytics that feel like surveillance; employee trust is the asset that makes the data valuable. LIMITATION: Vault does not publicly disclose ARR, churn, pricing, or acquisition terms; customer logos and funding demonstrate credibility but not revenue quality.
bottom of page