EQS Integrity Line vs Hintbox

EQS Integrity Line

Anonymous two-way dialog is first-class ("complete anonymity... anonymous dialogue between the whistleblower, case handler and external experts", no tracking mechanisms), with 80+ languages, integrated machine translation, browser auto-detect and mobile optimization — but voice/hotline or QR intake is never evidenced as an engineered anonymous channel; the "telephone call" in the multichannel fact is a handler manually creating a case, not reporter voice intake, and WCAG only at bronze.

Hintbox

Anonymous reporting with a generated post-submission login for two-way messages, file uploads and new reports is first-class, and 24–30 languages with AI translation is genuinely broad. But phone intake exists only as a €49/month voice-bot add-on, and the evidence is silent on accessibility, QR entry points and mobile use — the frightened reporter gets a solid form, not engineered intake.

EQS Integrity Line

Integrated case management with a per-activity revision log, granular need-to-know permissions, configurable dual control and partial case anonymisation is a real permission model — but the evidence is entirely silent on the statutory clocks: no 7-day acknowledgment automation, no 3-month feedback deadline, no conflict-of-interest exclusion of implicated handlers, no per-case retention or deletion rules. The deadlines would be my problem again, and dashboards don't fix that.

Hintbox

The statutory clocks appear as product features — receipt confirmation and active support for the reporter-feedback deadline — with tamper-proof logging of every processing step and access rights steered per entity and per case. I stay below the top anchors because there is no evidence of automated clock reminders, conflict-of-interest exclusion of implicated handlers, or retention rules applied per case.

EQS Integrity Line

The EU Whistleblowing Directive appears exactly once, as a marketing assertion that the hotline "ensures that your organisation fully complies" — no national transposition (HinSchG or otherwise), no deadline or documentation duties implemented as features, no retention periods, no named counsel or legal review. The mapping is the customer's problem.

Hintbox

The Directive's duties are implemented as features, not just marketing — acknowledgment of receipt, feedback deadline support, deletion per GDPR and the EU Whistleblower Directive — plus awareness of the 50-employee threshold and public-sector obligations. But the evidence never names a national transposition (HinSchG), no named counsel, no documented legal review or update process — one generic EU mapping, not per-country rule sets.

EQS Integrity Line

Strong on attestations: ISO 27001 with stated scope ("EQS Group and our data centres"), PwC ISAE 3000 Type I and II, CSA STAR Registry, OWASP threat analysis, 2FA as standard. It falls short of the top anchors because the "EQS Group can at no time access your data" claim is asserted rather than documented — no published pentest summaries, no cryptographic architecture, and "no tracking mechanisms" is the only metadata statement we get.

Hintbox

ISO 27001 is claimed for the product and the ISMS, end-to-end encryption with TLS and a separately encrypted database is described with some technical detail, and the explicit no-IP/MAC statement plus metadata stripping before encryption is exactly the anonymity evidence I want. But regular professional pentests are asserted, never attested or published, and there is no disclosure policy or documented crypto architecture — a hostile auditor gets assertions, not artifacts.

EQS Integrity Line

Corporate branding and granular per-case access are evidenced, and external experts can join the anonymous dialogue — but there is not a single fact on per-entity channels, separated entity case stores, group-level consolidated oversight, delegated administration, or per-entity legal rules. Whether one contract can serve a corporate group is simply unanswered.

Hintbox

Groups can create entities, the whistleblower selects the entity at intake, and access rights are controlled per entity and per case with external persons invitable per case, plus a separate ombudsman platform and white-label offer. Missing: any consolidated group-level reporting that respects entity boundaries, delegated administration per entity, and group contracts are pushed to a custom quote.

EQS Integrity Line

German legal entity (EQS Group GmbH, Munich) and hosting "exclusively in Germany" with a named Munich East data centre are anchor-grade facts on where reports live — but the registry contains no DPA, no subprocessor list and no TOMs at all, and the vendor has been owned by US PE firm Thoma Bravo since 2024. For the most sensitive data a company holds, the chain past the first data centre is undocumented, so I cannot go higher.

Hintbox

The chain is factually German end to end — lawcode GmbH registered at Amtsgericht Koblenz, hosting exclusively at Hetzner in an ISO-certified German datacenter with no hosting or data sharing outside the EU, and fully in-house development. But no DPA, no subprocessor list and no TOMs are published, so the clean chain is claimed on a webpage rather than documented — that gap keeps it below the 8.

EQS Integrity Line

The only pricing fact in the entire registry is a "Start free trial" button — no tier prices, no employee bands, no entity rules, no VAT treatment, no setup fees. I could not begin to compute the invoice for a 600-employee company from these pages.

Hintbox

Every tier and every add-on carries a real net price with VAT treatment and billing period stated — €99/€149 base, €49 voice bot, €29 email and domain mapping, €390 onboarding, €199/hour training — and pricing is seat-independent, so a single-entity 600-person invoice is a two-minute exercise. The deduction: what separates Basis from Premium is not laid out, and corporate groups and Konzerne are explicitly moved to a custom quote.