Cycling through all six. Tap any point to stop.

Measured on six things

Secure, anonymous whistleblowing platform for legal compl...

Speed

Lighthouse mobile performance 43/100 with LCP 6.1s, FCP 5.2s and TBT 819ms; desktop is a healthier 66/100. Mobile visitors — the ones clicking a report link from a phone — wait over six seconds for the main content.

Screenshots

1 / 1

TrustBox

About this app

I recently explored TrustBox, and it's a game-changer for organizations that need a reliable, compliant whistleblowing system. TrustBox is a secure, anonymous platform designed to help businesses comply with European whistleblower protection laws like Sapin 2 and Waserman, as well as the EU Whistleblowing Directive. It provides a safe space for employees to report misconduct—whether it's fraud, harassment, corruption, or discrimination—without fear of retaliation. What sets TrustBox apart is its focus on anonymity and two-way communication. Employees can submit reports anonymously, and management can respond without ever revealing the whistleblower's identity. The platform is incredibly user-friendly, with a 10-minute setup and no need for IT expertise. It also includes AI-powered sentiment analysis to help track and analyze reports, making it easier to spot trends and take proactive measures. TrustBox is fully compliant with GDPR and other data protection regulations, and it boas...

Key features

1Anonymous whistleblower reporting with two-way conversation that never reveals the reporter's identity to management.
2Compliance coverage for EU Directive 2019/1937, France's Sapin II and Waserman laws, plus GDPR-aligned data handling.
3AI-powered sentiment analysis on incoming reports to surface trends, plus a single all-features plan starting at €29 for 1-49 collaborators.

Target customer profile

Drawn from the product itself, not from a survey.

Demographic

HR Managers in mid-sized companies (50-250 employees)

Pain points

Struggling to manage internal reports manually, risk of non-compliance with whistleblowing laws

Primary needs

A secure, easy-to-deploy system to capture and manage alerts, ensure legal compliance, and protect anonymity

Demographic

Compliance Officers in large enterprises (1000+ employees)

Pain points

Complex regulatory requirements across multiple jurisdictions, need for robust data security and audit trails

Primary needs

A scalable, multilingual platform with strong security certifications, customizable workflows, and detailed analytics

Demographic

Small business owners (1-49 employees)

Pain points

Limited budget and IT resources, fear of legal penalties for non-compliance

Primary needs

An affordable, turnkey solution that requires no technical expertise, ensures anonymity, and meets basic legal obligations

Scout Review

Written by AI from measured evidence, scored out of 100.

TrustBox is a French whistleblowing platform targeting a legally mandated market: EU Directive 2019/1937, Sapin II, and Waserman compliance. The pitch is coherent — anonymous reporting, two-way conversation without identity disclosure, AI sentiment analysis, 10-minute setup, and a single €29 all-features plan for small teams. The landing page is clean and the signup path is frictionless. But the measured evidence exposes the gap between claims and reality. Mobile performance is 43/100 with a 6.1-second LCP. Security headers are 5/12, with no CSP, no HSTS, no frame protection — on a product handling retaliation-sensitive anonymous reports. The accessibility audit fails on contrast, heading order, alt text, and main landmark, while the homepage advertises WCAG 2.1. And the ISO/IEC 27001 and ISAE3000 badges are displayed without links to any certificate. For a compliance product, the compliance claims need to be verifiable, not decorative.

Measure by measure

Usability

Free signup and free trial are one click from the homepage, and a single all-features plan at €29 removes plan-picking friction. But the setup-time claim flips between '10 minutes' and '30 seconds' on the same page, and no help center or docs link is visible.

Design

Clean, modern French-first landing page with consistent icon cards and a clear hero CTA. Testimonials are anonymous quotes with no names or logos, and compliance badges (ISO, ISAE3000, WCAG) are shown without links to certificates.

Speed

Security

HTTPS enforced with SPF and DMARC, but HSTS, CSP, frame protection, X-Content-Type-Options and Referrer-Policy are all absent — 5/12 on the header checklist. The site claims ISO/IEC 27001 and ISAE3000 Type 1, but no certificates or audit reports are linked.

Accessibility

Lighthouse accessibility 89/100, but the failing audits are real: insufficient color contrast, non-sequential headings, images without alt text, and no main landmark. The site advertises WCAG 2.1 compliance, which those failures directly undercut.

Growth

Legally mandated demand (EU Directive 2019/1937, Sapin II, Waserman) gives this a real, non-optional market. The €29 SMB tier and 10-minute setup are a genuine wedge against EthicsPoint and WhistleB, which skew enterprise.

Improvement areas

Security headers are 5/12 — no CSP, HSTS, frame protection, X-Content-Type-Options or Referrer-Policy on a retaliation-sensitive platform.
Mobile Lighthouse performance 43/100 with a 6.1-second LCP; desktop is 66/100, so mobile is the clear weak side.
ISO/IEC 27001, ISAE3000 Type 1 and WCAG 2.1 badges are displayed without linked certificates, and the accessibility audit contradicts the WCAG claim.

Design & Usability

TrustBox presents a clean, modern French-first landing page with a clear hero, consistent icon-card feature grid, and a single all-features plan at €29 for 1-49 collaborators — which removes plan-selection friction and makes the free signup path obvious. The design is competent and on par with mid-market compliance SaaS, but the social proof is thin: three unattributed testimonial quotes with no names, roles, or company logos, and a compliance badge row (RGPD, ISO/IEC 27001, ISAE3000 Type 1, WCAG 2.1) displayed without links to any certificate. Usability is similarly solid-but-unremarkable: signup and trial are one click from the homepage, but the setup-time claim contradicts itself between '10 minutes' and '30 seconds' on the same page, and there is no visible help center or documentation link in the fetched content. For a product whose value proposition is legal compliance and audit-readiness, that missing documentation surface is a real gap, not a nitpick.

Speed & Security

Speed is the weakest measured dimension. Lighthouse mobile performance lands at 43/100 with an LCP of 6.1 seconds, FCP of 5.2 seconds and TBT of 819ms; desktop is a much healthier 66/100. For a whistleblowing tool where an employee may be clicking a report link from a phone in a hurry, a six-second mobile load is a genuine friction point, and the heavy hero imagery plus multiple icon-card sections are the likely culprits. Security is mixed. The HTTP probe confirms HTTPS enforcement, SPF and DMARC, but HSTS, CSP, frame protection, X-Content-Type-Options and Referrer-Policy are all absent — 5/12 on the header checklist. The site claims ISO/IEC 27001 and ISAE3000 Type 1 compliance, but no certificates, audit reports, or security page are linked from the fetched content. For a platform whose entire pitch is protecting anonymous reporters from retaliation, missing CSP and frame protection are not abstract hardening items — they are the exact controls that prevent a hostile page from framing or injecting into the reporting flow.

Accessibility & Growth

Accessibility scores 89/100 on Lighthouse, which sounds strong until you read the failing audits: insufficient color contrast, non-sequential heading order, images missing alt attributes, and no main landmark. The site advertises WCAG 2.1 compliance in its badge row, and those failures directly contradict the claim. Content is French-only in the fetched homepage with no visible language switcher, despite the product targeting 'multiple jurisdictions' and 'multilingual' enterprise buyers. Growth is the most interesting dimension. The problem is real and legally forced: the EU Whistleblowing Directive 2019/1937, France's Sapin II, and the Waserman law create non-optional demand, and the €29 entry tier plus 10-minute setup is a genuine wedge against EthicsPoint and WhistleB, which skew enterprise and expensive. The limit is that 'cheaper and faster' is a position any competitor can copy, and the enterprise segment — where the compliance budget actually lives — is already owned by incumbents with deeper certification portfolios.

Conclusion

The verdict depends on who you are. If you are a 30-person company that just needs a Sapin II checkbox and a cheap, working intake form, TrustBox at €29 is a reasonable entry point and the free trial lets you test it without commitment. If you are a compliance officer at a 1,000+ employee enterprise evaluating vendors, the missing security headers, unlinked certifications, and absent documentation surface are disqualifying until they are fixed — you cannot put an unverified ISO claim in a procurement file. The product's core idea is sound and the market is real, but the execution currently reads as a competent early-stage tool wearing enterprise compliance badges it has not yet earned. Fix the headers, link the certificates, publish the docs, and get mobile LCP under 2.5 seconds — then the badges start meaning something.

Suggestions for improvement

Link the ISO/IEC 27001 and ISAE3000 Type 1 badges to actual certificates or audit reports — unlinked compliance badges read as decoration to procurement teams.
Ship HSTS, CSP, frame protection, X-Content-Type-Options and Referrer-Policy. On a whistleblower platform, missing CSP and frame protection are directly relevant to reporter safety.
Fix the mobile LCP (6.1s). Compress hero imagery, lazy-load below-fold sections, and target sub-2.5s LCP — employees reporting from phones are the primary user.
Reconcile the setup-time claim ('10 minutes' vs '30 seconds') and add a visible help center or documentation link; compliance buyers evaluate documentation quality as a proxy for audit-readiness.

How we score

Alternatives comparison

Named competitors, point by point. Nobody paid to appear here or to be left out.

	TrustBox	EthicsPoint	WhistleB
Anonymous reporting with two-way conversation	Yes — core feature, two-way replies without revealing reporter identity	Yes — anonymous intake with case manager follow-up	Yes — anonymous reporting with secure two-way dialogue
Entry pricing for small teams (1-49 employees)	€29/month, single all-features plan	Enterprise quote-based pricing; no published SMB tier	Quote-based pricing; typically aimed at mid-market and enterprise
Published security certifications	Claims ISO/IEC 27001 and ISAE3000 Type 1; no linked certificates found	Enterprise-grade compliance program with published certifications	Publishes security and compliance documentation for enterprise buyers
Setup time / deployment effort	Claims 10-minute setup, no IT expertise required	Enterprise onboarding with implementation support	Guided onboarding; typically days to weeks for full rollout
AI sentiment analysis on reports	Yes — automatic sentiment tracking on incoming reports	Analytics and reporting dashboards; AI sentiment not a headline feature	Case analytics and trend reporting; AI sentiment not advertised