Hintbox

German whistleblowing platform with flat Basic/Premium pricing from EUR 49/month, 30 languages, AI translation, and ISO 27001 certification.

AI processes report content — EU AI Act consideration

This vendor applies AI or machine learning to whistleblower reports (for example summarisation, severity or category classification, drafting replies, or machine translation). Automated processing of disclosures can bring the deployment within scope of the EU AI Act and routes sensitive personal data through a third-party inference provider. Confirm the model provider, its data-retention terms, and whether report content can be excluded before relying on it.

Rubric score

32 / 50

Evidence tier P

Public pages only. No reporter submission or handler environment was reviewed.

How this score is produced →

Facts

Website: www.hintbox.de(opens in new tab)
Headquarters: Germany
Hosting: Germany; Hetzner-hosted ISO/IEC 27001-certified data centre (vendor-stated)
Pricing: Basic from EUR 49/month; Premium from EUR 69/month. Annual billing shown as EUR 588 / EUR 828.
Free trial available. Prices exclude 19% VAT. Public pricing says prices are independent of employee count and number of agents; phone bot and email intake are optional add-ons.
Languages on reporting form: 30
Founded: 2019
Customers: 1,000+ companies and government agencies (vendor claim)
Product scope: Standalone whistleblower product
Encryption posture: End-to-end

Measured, not published

Established by checking the vendor's own infrastructure rather than by reading its marketing. Every figure here can be reproduced from the links given.

DMARC policy: Enforced (reject)
DNSSEC: Unsigned
Legal entity: lawcode GmbH HRB 28116 · imprint

Capabilities

Anonymous reporting ✓
Multi-channel intake ✓
Public API ✗
Free trial ✓
Two-factor authentication ✓
Audit log ✓
EU Directive 2019/1937 (vendor claim) ✓

✓ published by the vendor · ✗ vendor states it is not offered · — not published either way

Certifications

ISO 27001

National laws referenced

Germany (HinSchG)
Austria

Typical buyer

DACH-region companies subject to HinSchG with ISO 27001 procurement requirements.

Distinctive features

Public flat pricing independent of employee count
ISO 27001 certification and German data residency are stated by the vendor
30 reporting languages with AI translation between handler and reporter

Add-ons and conditions

Costs or terms not included in the headline price.

19% German VAT added to all prices
Phone bot, email intake, custom domain, onboarding, and training are paid add-ons
No public subprocessor list was found on the public pages reviewed

Notable

Two product tiers: Basic and Premium; public pricing starts at EUR 49/month and EUR 69/month respectively.
The pricing page reviewed says employee count and number of agents do not affect the monthly price.
Reporting form available in 30 languages; AI-based translation between handler and reporter.
End-to-end encryption; 2FA; isolated per-customer database (no shared multi-tenant DB).
Automatic virus scanning and metadata removal from uploads.
Multi-client capability for group companies operating multiple entities.
Optional add-ons: phone bot intake, email intake, custom domain, onboarding, and training.
Premium tier adds dynamic no-code forms, live chat for caseworkers, and granular external-editor permissions.
Hosted by Hetzner in a German ISO-certified data centre, according to vendor copy reviewed.
No public API documentation or subprocessor list was found on the public pages reviewed.

Frequently asked questions about Hintbox

Answers derived from vendor-published materials dated on this page.

Is Hintbox suitable for SMEs under 250 employees?

Hintbox does not publish entry-tier pricing, so SME buyers need to request a quote to assess fit. Buying path: Self-serve sign-up. DACH-region companies subject to HinSchG with ISO 27001 procurement requirements.

Which national whistleblower laws does Hintbox explicitly reference?

Hintbox explicitly cites the following national transpositions of Directive 2019/1937 in its public materials: Germany (HinSchG), Austria. Absence from this list does not mean the platform can't be used in other EU jurisdictions — all 27 member states have transposed the Directive. Verify jurisdictional fit with the vendor directly.

Does Hintbox process whistleblower report content with AI?

Yes — Hintbox processes report content with AI (typically for translation, summarisation, or classification). If your compliance posture requires keeping disclosures out of third-party LLMs or machine-translation services, confirm data-processing terms and vendor subprocessors before procurement.