EMP Intake vs Resolver: investigation case management
Resolver is broad GRC software delivered as SaaS. EMP is the local evidence layer underneath: originals preserved on your own machine, every file hashed at intake, and an export reviewers can verify without EMP installed.
Resolver is a broad GRC platform delivered as SaaS. EMP Intake is an investigation-specific evidence layer that runs on your own workstation, with chain-of-custody built in. Here is where each fits, and where it doesn't. Use Resolver when you need enterprise investigation workflows, dashboards, and cross department risk and compliance management.
Use EMP when you need a local evidence integrity layer, a structured case workspace, and a verifier-ready export package.
Related: EMP for corporate security investigations and compliance teams, plus the workplace investigation software buyer's guide, and real pricing from public records.
How they compare
| Criteria | EMP Intake WS | Resolver |
|---|---|---|
| Scope & focus | ||
| Primary focus | Evidence integrity + casework | Broad GRC suite |
| Risk, audit, compliance breadth | No, investigations only | Yes, core strength |
| Chain of custody | SHA-256, originals, append-only log | Workflow audit trail |
| Verifiable export | Manifest-enabled packages include a browser verifier; no EMP installation required. SHA-256 tools can also check extracted listed files. | An equivalent recipient hash-manifest workflow was not established in the linked sources; confirm with Resolver |
| AI assistance | No built-in AI assistant claimed | AI-assisted workflows |
| Deployment & data | ||
| Deployment | Local, your workstation | Resolver-managed SaaS |
| Where evidence lives | Your local disk | Vendor cloud regions |
| Works offline | Core casework: yes. Activation, license validation, update checks, and online maps may need internet | Web case management needs internet; Resolver Mobile supports offline incident capture and later submission |
| Investigation workflow | ||
| Timeline reconstruction | Professional: synchronized logs, video and retained map clips | Activity timelines and audit history; a synchronized log-and-video reconstruction workflow was not established in the linked sources |
| Incident map | Standard and Professional: Incident Maps and PDF export; Professional adds plan overlays | Map/location visualization in parts of the product family; confirm module |
| Link analysis | Professional: link-analysis graph | Built-in Link Analysis & Visualization; entity linking |
| Pricing & fit | ||
| Security assurance and compliance | Not certified, local-first | SOC 2 Type II; ISO 27001/27017/27701; TISAX assessment; CSA STAR Level 1 self-assessment |
| Pricing model | $29 / $49 / $99 monthly, per workstation | Custom quote: solutions, configuration, active users; modular and bundle options |
EMP features vary by tier. Core includes package exports. Standard adds Chain of Custody, Incident Maps and Audit Timeline; Professional adds Timeline Recon, Link Analysis, Global Heat Map and plan overlays. Package contents depend on selection; enable Manifest for checksums and the verifier.
Updated 2026-08-23. The highlighted column is EMP Intake WS.
Sources checked
Official Resolver materials reviewed on 2026-08-23:
Vendor capabilities may depend on edition, configuration, or contract; confirm details with Resolver.
Where each one wins
Where EMP wins
- Investigations are the core job and keeping a visible record of what changed is the requirement.
- You need evidence to stay on your own machine, with nothing uploaded to a SaaS service.
- You want per-workstation pricing that fits a solo investigator or a small practice.
- Counsel or a regulator must be able to verify the export without your software.
Where they win
- You need the full GRC breadth: enterprise risk, audit, and compliance in one platform.
- You want built-in Link Analysis & Visualization connecting related cases and transactions inside that suite.
- An enterprise SaaS deployment is acceptable (or required) and you already run Resolver.
- You want a single vendor across compliance functions beyond investigations.
What EMP is not
- Not a managed cloud service. EMP is local-first and self-hosted.
- Not certified. NIST SP 800-86 is a design target, not a certification, and admissibility is the court's call.
- Not a forensic acquisition tool. EMP organizes and preserves what you already collected.
- Not an enterprise GRC or risk platform. EMP is narrower: evidence integrity plus the case workspace around it.
Competitor details here are drawn from public sources such as vendor websites and documentation, and can change. Verify current capabilities with the vendor. This comparison covers EMP Intake WS. Features vary by tier. Teams has a separate deployment model and pilot scope.
Frequently asked questions
Can EMP and Resolver coexist?
An organization could retain Resolver for GRC and use EMP for selected local evidence handling. Exported files can support a manual handoff, subject to receiving-system requirements; this is not a claimed built-in integration.
Is EMP a GRC platform?
No. EMP doesn't claim the breadth of risk, audit, and compliance. It focuses narrowly on investigations and the evidence layer underneath them.
How does pricing actually compare?
EMP Intake Workstation is $29 to $99 per workstation per month. Resolver's pricing is a custom quote based on selected solutions, configuration, and active users, with modular and bundle options and no public dollar amount. The model gap between per-workstation and enterprise licensing is real.
What about compliance certifications?
Resolver publishes SOC 2 reporting, ISO certifications, a TISAX assessment and a CSA STAR Level 1 self-assessment. EMP is local-first on your workstation, so your evidence never reaches us. NIST SP 800-86 is a design target for EMP, not a certification.
See the difference for yourself
Try Workstation free for 14 days, with no credit card. For shared cases across PCs, discuss a Teams pilot.
About this comparison: it is based on publicly available materials as of August 2026, and products change. If anything here is out of date, email hello@falcrex.com and we will correct it. All third-party product and company names are trademarks of their respective owners. Falcrex Systems Inc is not affiliated with, sponsored by, or endorsed by any of them.