Alertcys

Notable

• France-native positioning centred on whistleblowing, psychosocial-risk handling, and optional external mediation.
• Public tier matrix is explicit: Essentiel, Standard, and Pro are all priced publicly.
• Standard plan is explicitly calibrated around 50+ employee organisations with 3 referent seats included.
• Vendor-stated customer count: 250+ clients on the offer page.
• Product positioning leans heavily on French legal compliance rather than pan-EU breadth.
• The site publisher named in the mentions legales is Concord SAS, registered at the Paris address of the Chambre Nationale des Commissaires de Justice, the statutory national body for French judicial officers, and of its publishing arm Editions Juridiques et Techniques.
• Handling is a managed service: Alertcys states that its own team performs the first analysis, works with the reporter to put the report in form, and sets aside reports it judges calumnious or unfounded; admissible reports pass to the employer’s designated referent, and a commissaire de justice then mediates between the parties.
• Reports can be submitted via the public web flow or by post; optional human mediation / outsourced handling is available for organisations that do not want an internal first-line process.

Vendor-page evidence - 2026-09-20

• Current vendor pages show 300EUR HT / an, 1 500EUR HT / an, 4 600EUR HT / an, Plateforme de gestion des alertes, Situe en France, postal/web intake, and France-law content for Sapin II, Loi Waserman, and Directive 2019/1937.
• The reporting surface at app.alertcys.io/file/create/ answers 200. Its HTML loads Bootstrap 3.3.7 and Font Awesome 4.7, both end-of-life front-end builds, alongside a Bootstrap 5.3 stylesheet.
• The same host returns Server: Microsoft-IIS/8.0. Recorded, not classified: an IIS banner is not evidence of patch level, because distributions backport security fixes without moving the advertised version. It did not contribute to the d20 score.
• alertcys.io publishes no SPF record. A DMARC record exists but is set to p=none, which monitors without enforcing, and its rua value contains a stray space after mailto:.
• The mentions legales names OVH as host of the marketing site and SAS OC3 Network (Paris) as host of app.alertcys.io. This is more hosting disclosure than the May 2026 pass credited.
• No public ISO 27001 certificate, sub-processor list, DPA pack, or API documentation was found in the public pages reviewed.

Scoring review - 2026-09-20

Scored under the 25-criterion rubric v2 at access tier P (public pages only; no self-serve trial or public handler environment).

Base score: 19 / 50. France country bonus: 8 / 8.

Changed since 2026-05-24: criterion d20 moves from 2 to 0. The May pass recorded no visible end-of-life components but did not open the reporting surface; this pass did, and found end-of-life front-end builds on the page that serves the report form. Security falls from 4 to 2 and the base score from 21 to 19. Criterion d21 keeps its score of 2, but its evidence is corrected in the vendor’s favour: hosting providers are disclosed in the mentions legales, which the May pass recorded as not found.

Evidence supporting the score: annual pricing, employee-band segmentation, referent limits, Sapin II and Loi Waserman content, France-location positioning, named French hosting providers, and mediator-supervised handling claims are public.

Unverified from public pages: reporter return-access method, structured intake, audit immutability, sub-processors, and security certifications. Alertcys is more documented on France-law service posture than on public technical disclosure.

Buyer fit: French SMEs and mid-market organisations that want a domestic vendor and may value a commissaire de justice as mediator. Buyers who need a second language, a documented security posture, or a channel that delivers reports to their own referent without third-party pre-screening will need vendor confirmation on each point.