EQS Integrity Line vs Hintbox

EQS Integrity Line

Anonymous two-way dialog is first-class with no tracking mechanisms, 80+ languages with integrated machine translation, mobile-optimized and WCAG bronze — that earns most of the 8 anchor. But there is no reporter-facing voice, hotline or QR channel evidenced: the multichannel fact is my caseworker creating a case from a letter or phone call, not a frightened employee calling in.

Hintbox

Anonymous two-way dialog is genuinely first-class: the reporter gets generated login credentials after submitting and can keep messaging, uploading files and even file new reports anonymously, with 24-30 languages and automatic AI translation. But phone intake is a 49€/month add-on and email a 29€/month add-on, and the evidence says nothing about accessibility or app-free mobile design — that lands it between the anchors, dialog strong, channels paywalled.

EQS Integrity Line

Integrated case management with a per-activity revision log, granular need-to-know rights with dual control, partial case anonymisation and dashboards are solid bones. But the evidence is silent on the two things I'm legally on the hook for — automated 7-day/3-month deadline clocks and per-case retention/deletion — and on excluding implicated handlers, so the statutory discipline is my problem, not the product's.

Hintbox

Revisionssichere audit trail of every handling step, automatic triage and prioritization, Eingangsbestätigung, active deadline support for the reporter-feedback clock, and access rights steerable per company and case — more than a status list. What I don't see is conflict-of-interest handling (excluding an implicated case handler) or per-case retention automation, which is what separates this from the 8 anchor.

EQS Integrity Line

One marketing sentence claims full EU Whistleblowing Directive compliance with no mapping to actual duties: no national transposition (HinSchG et al.) named, no acknowledgment/feedback clock features, no documentation or retention rules in the product, no counsel review. That's the 3 anchor verbatim — the directive is invoked, the obligations stay mine.

Hintbox

The 2019/1937 duties appear as product features, not slogans: receipt confirmation, active support for the feedback deadlines, deletion per the Directive, and even a public-sector compliance statement. But it's one German-sized shoe: no HinSchG named, no national transposition differences, no legal review or counsel documented — for my single-country obligation that's workable, but the evidence can't evidence more.

EQS Integrity Line

ISO 27001 covering both EQS Group and the data centres, a PwC ISAE 3000 Type I and II audit, CSA STAR registration and OWASP-based threat analysis, plus 2FA as standard and a vendor-cannot-access encryption claim — that is audited assurance, not adjectives. It stops short of 8 because there are no public pentest summaries, no explicit IP-logging statement (only a generic no-tracking claim) and no published security contact or disclosure policy.

Hintbox

ISO 27001 certification, regular external penetration testing, and an explicit statement that no IP, MAC or location data is stored, plus metadata stripped before encryption and a real E2E story — data arrives pre-encrypted so 'neither we nor third parties can read it'. What's missing for an 8 is anything an auditor can read: no published pentest summaries, no security contact or disclosure policy in the evidence.

EQS Integrity Line

The evidence is entirely silent on multi-entity structure — no per-entity channels, no entity-separated case access, no group overview. What exists are building blocks: custom branding, granular user rights and external experts in the anonymous dialog, which is not the same as per-subsidiary separation or ombudsman roles.

Hintbox

Groups can create per-entity companies, the whistleblower selects the affected entity at submission, and case-handler rights are steerable per company and case; there's also an ombuds solution and a white-label partner offering. But no delegated administration or consolidated group reporting is evidenced, and anything calling itself a group gets pushed into a custom quote — adequate for one company, unproven as group architecture.

EQS Integrity Line

Hosting is exclusively in Germany with a named data centre (Munich East) under a Munich-based GmbH — the core of the 8 anchor's facts. But nothing here shows a published DPA or subprocessor list, backups go to 'geographically distributed' centres of unstated location, and the vendor sits under US PE ownership (Thoma Bravo) — the chain is undocumented, which caps it at 5.

Hintbox

A German GmbH with a Koblenz register number and German address, hosted by Hetzner in an ISO-certified German datacenter, with an explicit no-hosting, no-transfer-outside-EU statement. The gap is paperwork: no published subprocessor list and no public DPA document — the processor-on-documented-instruction sentence is a claim, not a contract I can inspect, so it stops short of the 8 anchor.

EQS Integrity Line

The only pricing-related fact in the entire sheet is 'Start free trial' — no tiers, no numbers, no employee bands, no VAT treatment, no setup-fee disclosure. I cannot compute my invoice from these pages, and everything above entry implies a sales conversation, which is precisely what my year-end review will question.

Hintbox

Both tiers carry public net prices with VAT treatment stated (99€ and 149€ monthly), pricing is independent of handler accounts with unlimited users, and every add-on is priced in the open — voice bot 49€/month, email 29€/month, domain mapping 29€/month, onboarding 390€ one-time. For my 60-employee company the invoice is genuinely a two-minute exercise; what keeps it from a 10 is that the premium tier's annual figure and what it actually adds over base are left vague, and the 390€ onboarding smells like a setup charge I'd have to justify even if it's optional.