TrustBox

French Sapin II and Waserman reporting channel with one feature set at every tier, priced €29–€99 by headcount and hosted at OVHcloud Roubaix.

AI processes report content — EU AI Act consideration

This vendor applies AI or machine learning to whistleblower reports (for example summarisation, severity or category classification, drafting replies, or machine translation). Automated processing of disclosures can bring the deployment within scope of the EU AI Act and routes sensitive personal data through a third-party inference provider. Confirm the model provider, its data-retention terms, and whether report content can be excluded before relying on it. Vendor detail: Automatic sentiment tracking and analysis of reporter feedback is listed as a product feature.

Facts

Website: trustbox.report(opens in new tab)
Headquarters: Malzéville / Nancy, France
Hosting: OVHcloud, Roubaix, France, with backups in Strasbourg, Croix and Gravelines. Named on both the security page and the legal notice.
Pricing: €29, €59, €79 or €99 for 1-49, 50-249, 250-999 and 1,000+ employees. Every tier includes the full feature set; only headcount differs. The billing period is not stated on the pricing page.
A 14-day free trial is advertised on the security page and self-serve registration is open at app.trustbox.report/register. The pricing page states the tiers differ only by company size, not by features: "La différence de prix entre les abonnements ne se base pas sur les fonctionnalités disponibles." No billing period, contract term or cancellation policy was published on the pages reviewed.
Languages on reporting form: 1
Product scope: Standalone whistleblower product
Encryption posture: End-to-end

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Published but not enforcing
DNSSEC: Signed
Legal entity: TrustBox RCS 789404993 · imprint

Capabilities

Anonymous reporting ✓
Multi-channel intake ✗
Public API —
Free trial ✓
Two-factor authentication —
Audit log —
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

None published

National laws referenced

EU Directive 2019/1937
France (Loi Sapin II, Loi Waserman)

Typical buyer

French employers that want a Sapin II and Waserman channel live the same day at a published headcount price, with French data residency named, and that do not need a certification to clear procurement.

Distinctive features

Full price matrix published by headcount band, with an identical feature set at every tier
Hosting provider, city and backup regions are all named — OVHcloud Roubaix, with Strasbourg, Croix and Gravelines
A dedicated page maps the French obligation to the product, and blog guides cover the Belgian and Luxembourg obligations

Add-ons and conditions

Costs or terms not included in the headline price.

The pricing page gives no billing period, so whether €29 is monthly or annual cannot be established from the published pages
No contract term, notice period or refund policy is published
ISO 27001, ISO 27017 and ISO 27018 appear on the homepage as trust marks, but the security page attributes them to the configuration of the OVHcloud servers, not to a certificate TrustBox itself holds
The homepage prints the Directive number as "2019/19378" and one trust mark as "ISO/IEC 2700"
The legal notice still ends with its own template disclaimer, telling the operator to adapt it, and gives two different addresses for the same company (54220 Malzéville in the notice, 54000 Nancy in the footer)
The site is published in French only, while "support multilingue" is listed as an included feature

Notable

One of the few profiles here where the hosting answer is complete: OVHcloud at Roubaix for primary data, with backups spread across Strasbourg, Croix and Gravelines, named consistently on the security page and in the legal notice.
Pricing is deliberately flat on features. All four bands buy the same product and differ only by employee count, which removes the common pattern of putting two-way messaging or retention behind an upper tier.
The security page describes AES-256 encryption in transit and at rest, TLS, firewalls and DDoS protection, continuous vulnerability assessment and penetration testing by security professionals, and optional two-factor authentication. Nothing is dated and no auditor or report is named.
The ISO claims need reading carefully. The homepage prints ISO/IEC 27001, ISAE 3000 Type 1 and WCAG 2.1 as trust marks; the security page’s own wording is that “les serveurs de TrustBox sont configurés selon les normes ISO pertinentes, notamment ISO 27001, ISO 27017 et ISO 27018”, which is a statement about the hosting configuration rather than a certificate held by the vendor. No certificate number, scope or certification body is published.
Intake covers a customisable category list that already includes harassment, fraud, conflict of interest, money laundering, corruption, environmental protection and influence peddling — close to the Article 2(1) set, though no article mapping is published.
Two errors sit on public pages a buyer would read first: the Directive cited as “2019/19378”, and a legal notice that still carries its own template disclaimer telling the operator to adapt it.

Status: not yet scored

TrustBox was added from the September 2026 AI-citation coverage audit. The entry above records what the vendor publishes. It carries no 25-criterion rubric score yet and does not appear in the France ranking; a score will be added when the product has been reviewed under the same tier rules as every other scored tool.

Frequently asked questions about TrustBox

Answers derived from vendor-published materials dated on this page.

Is TrustBox suitable for SMEs under 250 employees?

Yes — TrustBox's entry-tier pricing is published under €50/month, inside the range most 50–249-employee organisations budget for a reporting channel. €29, €59, €79 or €99 for 1-49, 50-249, 250-999 and 1,000+ employees. Every tier includes the full feature set; only headcount differs. The billing period is not stated on the pricing page. French employers that want a Sapin II and Waserman channel live the same day at a published headcount price, with French data residency named, and that do not need a certification to clear procurement.

Which national whistleblower laws does TrustBox explicitly reference?

TrustBox explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: EU Directive 2019/1937, France (Loi Sapin II, Loi Waserman). Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does TrustBox process whistleblower report content with AI?

Yes — TrustBox processes report content with AI (typically for translation, summarisation, or classification). If your compliance posture requires keeping disclosures out of third-party LLMs or machine-translation services, confirm data-processing terms and vendor subprocessors before procurement. Automatic sentiment tracking and analysis of reporter feedback is listed as a product feature.