Workplace investigation software: a buyer's guide

Workplace investigation software: the evidence-integrity guide

Workplace investigation software is software that helps HR, compliance, and corporate-security teams run and document internal investigations, and the kind that matters here adds an evidence-integrity layer: it hashes every file at intake, preserves originals, records intake, custody, edit and export events, and produces a package a reviewer can verify. A well-run investigation can still be difficult to review when its files and handling records are scattered. The interview happens, the witness emails arrive, the screenshots get saved. A year later the finding is contested in arbitration, and the audit trail is an inbox and a folder of renamed files. This guide is for HR, compliance, and corporate-security teams who need their investigations to hold up.

The short answer

Defensible workplace investigation software takes custody of the evidence so a reviewer can check the listed file contents against the supplied manifest. The chain-of-custody software guide covers that integrity model in full; this guide is about choosing a tool for HR, compliance, and corporate-security investigations.

Two different products both call themselves “workplace investigation software,” and confusing them is the most common buying mistake. The rest of this guide is how to tell them apart and what to ask before you sign.

The record is the problem, not the investigation

A workplace investigation makes a specific kind of mess. Interview recordings live on a recorder or in Teams. Witness emails sit across Outlook, a shared mailbox, and someone's OneDrive. Screenshots get pasted into a Word doc and renamed three times. Policy excerpts, badge logs, an HRIS export, and the complainant's first message all land in one folder somebody organized by hand.

The investigation may be competent, but the evidence handling isn't defensible. No record of who handled the interview file. No proof the screenshot is the original and not a re-save. No timestamp on when each item came in. And no way to show opposing counsel, or an arbitrator, that the file you're producing today is the file as it stood when the finding was made. That gap is where good investigations get attacked.

Two categories, one label

The first category is case management and intake: hotline and whistleblower platforms like NAVEX EthicsPoint, Case IQ (formerly i-Sight), and HR Acuity. They run the front of the funnel: anonymous reporting, triage, assignment, investigator notes, deadlines, and reporting across a portfolio of matters. They are workflow systems, mostly cloud SaaS, and that fits what they do.

The second category takes responsibility for the files themselves: hashing on intake, preserved originals, an append-only audit log, and a manifest a reviewer can check without your software. Case-management platforms can also include file storage and audit features. Ask whether intake hashes are retained, how originals are protected and whether a complete export can be checked independently. For example, Case IQ documents evidence handling and audit features; those capabilities should be evaluated rather than assumed absent.

What to ask the vendor

Whatever category a tool sits in, judge the evidence handling against these. Each is a question to put on the table in the demo, and each is a place weak products fail loudly.

1. Integrity model. Does it hash every file with SHA-256 on intake? (SHA-256 is the floor; MD5 and SHA-1 are legacy and weak.) Is the original preserved so any alteration is detectable on re-hash? Are annotations stored as separate objects that point back to the original by hash, never edits to it?
2. Audit logging. Intake, custody, edit and export events recorded with timestamp, actor, object, operation, result. Append-only, and exportable. A log that lives only inside the app can't be handed to a reviewer, so it proves nothing to them.
3. Export package. This is the artifact the other side holds. It should stand alone: a manifest with one row per item (hash, type, intake date, source), the log, the case data, all readable with nothing of the vendor's installed. Ask for a sample export before you buy.
4. Where the data lives. For sensitive HR matters, this is a real decision. Some teams want a workstation where case content stays on the machine; others want hosted multi-user access. Know which you're buying. Read the privacy page, not the marketing.
5. NIST alignment. Ask how the tool’s handling workflow relates to SP 800-86. Any SP 800-101 claim should specify its mobile-device scope and distinguish handling acquired evidence from device extraction. Alignment is a design target, not a certification. Ask the vendor to walk the mapping; if they can't, the alignment is marketing.
6. Tamper-evident, not tamper-proof. A defensible tool is tamper-evident: a change shows because the hash stops matching. No software is tamper-proof, and none guarantees admissibility. The court decides that. A vendor that claims either is overselling.
7. Independent verification. Can the recipient check the package without trusting you or installing your tool? Standard SHA-256 tools can compare file contents with a trusted expected hash; package verifiers can add supported manifest checks. Ask to see it done in the demo.

What do HR and counsel actually worry about?

A few questions decide whether an investigation tool earns its place. They map to the people who will second-guess the file later: the reporter who used the hotline, the employee whose data you are holding, and the lawyer who has to defend the finding.

Hotline intake

Most matters start in a reporting or case-management system (NAVEX EthicsPoint, Case IQ, HR Acuity, and similar). Those tools run anonymous reporting, triage, and deadlines well. File-handling controls vary by product and plan. So the question to answer up front is how the export from your hotline tool reaches the system that will hash and preserve it. A clean answer is a CSV or file export that gets hashed the moment it lands, so the intake date and the original bytes are both on the record. Retain the source export and its context, whether your workflow uses shared storage or a dedicated evidence tool.

PII handling

Workplace matters carry some of the most sensitive data HR holds: named complainants, medical references, off-the-record statements. The buyer question is plain. Where does the case content live, and who can reach it? A workstation model keeps case data on the machine and adds no new SaaS vendor to your exposure. A hosted model trades that for shared access. Either can be defensible, but you should know which one you are buying and read the privacy page, not the marketing. Confirm that no cloud service, including any AI feature, reads the case content.

Counsel being able to verify

The finding gets contested in front of someone who does not trust your software: opposing counsel, an arbitrator, a regulator. They need to confirm the file is unchanged without installing anything of yours. That is what an independent hash check gives them. The export should carry a manifest with one hash per item, and a reviewer should be able to recompute those hashes with sha256sum, PowerShell, or a browser tool and see they match. Ask to watch that check happen in the demo. If the package only opens inside the vendor tool, it is not something counsel can stand behind.

Where an integrity layer fits

A tool like EMP Intake sits underneath the hotline and HRIS systems you already run. It does not replace them. It takes custody of the files: hashing each one on intake, preserving the originals, recording custody and export events, and producing an export a reviewer can verify on their own. It is not a forensic acquisition tool (that is Cellebrite, EnCase, or Magnet Axiom, whose output it takes custody of) and not an eDiscovery platform. It is tamper-evident, not tamper-proof, and it makes no promise about admissibility, because the court decides that.

A buying process you can defend

A short process separates software you can rely on from software you merely demoed.

Run a real matter, not demo data. Take a closed case, or a stripped-down open one, and push it through intake, hashing, the log, and the export end to end. Evidence software you can't run on a real case is software you can't evaluate.

Open the export outside the software. Its whole value is that it stands alone. Have a colleague who was not on the matter open the manifest, check a handful of hashes, and read the log without you explaining it. If it only opens inside the vendor's tool, it isn't a defensible artifact.

Ask one precise question and watch the answer: “Walk me from this export back to its audit entry, and tell me who could change that entry after the fact.” A vendor who answers cleanly has built the discipline in. One who deflects hasn't.