HERE WeGo vs TomTom GO Navigation

No public independent audit of WeGo consumer location telemetry found; privacy claims rest on policy text (offline mode, random identifiers).

Vendor claims journey location is not linked to accounts, not sold, and re-identifying data is erased within 24h after shutdown. No independent public no-logs audit PDF specific to GO Expert was found.

HERE certifications page asserts ISO/IEC 27001:2022 (and related 27017/27018) with Schellman certificate references. Confirm scope covers services you use.

TomTom safety page claims ISO/IEC 27001:2022 with downloadable registration certificate PDF. Confirm certificate scope vs GO Expert processing systems.

HERE states SOC 2 Type 2 for HERE Platform Foundation and Workspace—not clearly scoped to consumer WeGo alone.

No public SOC 2/3 report for the consumer GO Expert app found in this research pass.

EU controller HERE Global B.V.; GDPR programme and Type 1 attestation described on certifications page. Consumer rights and lawful bases detailed in WeGo privacy supplement.

Dutch EU controller; detailed GDPR privacy notices, DPO, data-subject rights, and consent for location/journey data. Not a legal compliance certification.

EU entity / no known single US parent, but AWS and Azure listed with United States processing locations; US SaaS subprocessors and Intel shareholding add US nexus. Offline use reduces device telemetry to HERE. Indicative only—not legal advice.

EU entity / no known US parent, but public subprocessors include AWS EMEA SARL, Microsoft Ireland, and US-headquartered SaaS (Zendesk, Airship, Atlassian cloud) plus TomTom North America Inc. affiliate. Medium exposure. Not legal advice.

Consumer WeGo is under personal Service Terms; no public self-serve DPA for the free app located. Enterprise/platform customers should request HERE commercial DPA separately.

Privacy pages reference DPAs/SCCs for transfers and processor arrangements; self-serve B2B DPA package for individual GO Expert consumers not found. Fleet/enterprise buyers should request terms via TomTom sales.

Consumer navigation app; HERE separately markets ISO/IEC 42001 for corporate AI management—not treated as AI-system primary product here.

Consumer/professional GPS navigation app; not marketed as a high-risk AI system product in materials reviewed.

HERE claims TISAX AL3 assessment (Scope ID S0H13Y) on certifications page—relevant for automotive supply-chain trust more than consumer app downloaders.

TomTom states successful TISAX assessment for automotive-industry information security; details via ENX portal.

Vendor claims ISO/IEC 27018:2019 with downloadable certificate for PII processor role in public clouds.

Public subprocessor list includes AWS and Azure with United States locations, plus ServiceNow and MailChimp in the US. WeGo also discloses Amplitude analytics. Organisations with strict no-US-processor policies need offline-only personal use or a different product.

Dutch HQ and controller do not equal simple single-EU ownership. Intel and other non-EU shareholders appear in HERE’s public shareholder narrative; validate ownership for sovereignty-sensitive procurement.

Service Terms restrict the free app to private, non-commercial purposes. Using WeGo as unpaid fleet navigation may violate licence—budget for commercial HERE products instead.

Privacy supplement describes cookies/SDKs, Amplitude product analytics, location-based advertising, and advertising IDs when online features and consent apply—materially different from offline-only sessions.

ISO/SOC/TISAX claims are strong at company/platform level; still confirm which systems and data flows are in scope before relying on them for consumer-app risk acceptance.

Seed and market materials mix PND hardware, free TomTom App, and the premium GO Navigation→GO Expert app. Buyers can easily shortlist the wrong SKU or expect free-app parity with truck offline features.

Even with EU HQ and default EU account storage, published processors include AWS EMEA, Microsoft Ireland, Zendesk, Airship, and Atlassian cloud. Organisations with strict no-US-cloud policies need deeper vendor questionnaire answers.

GO Expert is commercially a paid app (trials/promos vary). Free multi-modal alternatives may be enough if truck profiles and classic TomTom offline UX are not required.

Corporate certificates are published, but public pages do not map certificate scope sentence-by-sentence to GO Expert consumer telemetry paths. Security teams should verify SoA/scope before treating certs as product-level proof.

Recent Google Play reviews (including mid-2026 map-blank reports) show support-visible reliability complaints. Pilot on target phone models and CarPlay/Android Auto setups before fleet-wide rollout.