Rent a box
You’re not buying a form.
You’re buying
the trust it brings.
A feedback box at your own tell.sg address, reachable by QR code on a counter, a pantry wall or a lift lobby. The address is spelled from your ACRA-registered name, and the page confirms it — name and UEN — before anyone types a word. And you can reply — without ever learning who, unless they choose to tell you.
New to tell.sg? Book ten minutes and we’ll walk you through it.
The problem with your current channel
Your staff know that an email to HR has their name on it. Your residents know the suggestion box is opened by the managing agent. And the survey-form QR taped to the wall? Singapore has spent years teaching people not to scan a link with no name on it. So the small problems stay quiet until they’re large ones. A tell.sg box gives them a lower-pressure way to start.
Who we built it for
tell.sg was not built around the buyer.It was built around the person deciding whether to speak.
That is precisely why an organisation would offer it.
Why it works
Your people use it because of what we don’t let you do.
Every constraint below costs you something and buys their confidence. That trade is the entire product — and it’s why a tell.sg box collects what your inbox doesn’t. It also means the platform is built for organisations that intend to read what they’re sent. If that isn’t you, we’re the wrong tool, and your people will find out.
See who wrote
Your console shows the message, the attachments and a case number. No IP address, no device, no email. We don’t hold it either.
Wear a name you haven’t proved
Your boxes show your ACRA-registered name only after verification backs it — proven through your bank account or in person, never typed into a settings page. The same rule is why no other organisation can wear your name either.
Read without a record
Each case records who on your team first opened it, and deletions are written to an audit trail nobody can edit. Good governance, and reassuring to whoever raised it.
Cap what you receive
No message quotas, no overage billing. Plans cap your own tooling — boxes and seats — never how much your people can say.
Ignore it quietly
If messages sit unread too long, your box page says so — no counts, no dates, just that messages have been waiting. It clears the moment you catch up, and you can’t switch it off.
You can hold a conversation
Ask follow-up questions, request detail, tell them the outcome — all through the case thread, all without their identity ever entering the system.
What you get
A console built for reading and replying.
Verified identity
Prove you control a bank account held in your business’s name — or be verified in person when we onboard you directly — and your boxes show your ACRA-registered name and UEN, at a readable address derived from that registered name, which nobody else can hold.
Boxes
Give each outlet, floor or department its own labelled QR code on your address, so reports arrive already sorted — with no dropdown for the sender to navigate. Standard includes as many as you have places to put them.
Named seats
Every responder has their own login, so replies and closures are attributed and access is revoked individually when someone leaves. No shared password on a sticky note.
Seats read the whole organisation, which is wrong for one kind of report: the one about a person on the team. On Standard that box can be private — only the custodians you name open it, not the rest of the seats and not you unless you are one of them.
Follow-up questions
A report that arrives missing the one detail you need is a dead end, and the sender is anonymous — there is no address to write to. So shortly after one lands, a model drafts a question from the context you write about that box, and it waits in the conversation for them. They are told the report already reached you and that answering is optional. You choose which boxes use it, and a box that should ask nothing simply has it off.
Ageing case alerts
The metric that matters most: cases nobody has read. Your digest warns you before the box page would have to say anything publicly.
Poster kit
Every box generates print-ready QR posters and counter cards — in every language you enable. English, Chinese, Malay and Tamil are available on every plan.
Pricing
Every box is a real box, whatever you pay.
All four languages, anonymous dialogue and the full protection set ship on every plan — free included. What changes between plans is your own tooling, never what your people can do.
- 1 box, 1 console user
- Photo and PDF attachments, up to 8 MB
- Random address, no name shown
A random address
Every box gets a permanent web address the moment you sign up. Until you verify, that address is 26 random characters:
tell.sg/to/velffklczh7342vwand67iu2vcNothing appears above the form claiming who you are, because we have not checked yet — and the sender is told so in as many words rather than left to notice the silence. Everything else works: reports arrive, the passphrase is issued, you read and reply.
It never changes and it never stops working. Verify later and your readable address is added; anything already printed with the random one keeps working for good.
- QR & poster kit
- Your organisation never expires*
Everything in Free, plus
- Company verification
- Your name & UEN on your box
- Readable address for posters
A readable address
Once you are verified, your box also answers at your registered name — which is what makes a QR code on a wall read as yours rather than as a scam.
It is your ACRA name in full, lowercased, with spaces and punctuation as hyphens.
ABC PTE. LTD.becomestell.sg/to/abc-pte-ltd, andTan & Sons Tradingbecomestell.sg/to/tan-sons-trading.It is never shortened to something tidier. A trimmed address would name a different company than the register does, which is the impersonation the whole scheme exists to prevent.
Nobody else can ever hold it — an address is never reassigned to another business, because posters outlive subscriptions. If your registered name changes, the old address goes on working too.
- Follow-up questions, on up to 30 reports a month
Follow-up questions
On the boxes you switch it on for, an AI model reads each report as it arrives and writes a short list of questions into the thread — the detail a reader would have had to come back and ask for, asked while the sender is still there.
Answering is always optional, and the report is delivered either way. Nobody is ever required to identify themselves, whatever a box asks.
The allowance is 30 reports a month across your whole organisation, not per box — one report is one run, and a run can produce several questions. A run we could not make, because the month’s allowance is spent or the model failed, does not count against it.
Everything in Lite, plus
- unlimited boxes, with custom labels
Custom labels
Each box carries its own label and welcome note, in every language you have enabled — “Warehouse — Safety”, say. That label is the heading the sender sees, so they can tell at a glance that they landed where they scanned.
Your main box takes one too, once you are verified. Before that it shows no heading at all: a label would be the only readable name on the page, and an unverified box must not be able to name itself.
- unlimited seats
- Private boxes — read by named custodians only
A private box
An ordinary box is read by every seat. A private box is read only by the custodians you name — not the other seats, and not you unless you are one of them. It is for the report about someone on the team.
You choose private when you create the box, and it cannot be switched either way afterwards. Turning it on later would expose an archive people wrote into an open channel; turning it off would lock a team out of cases they are working.
Once the first custodian accepts, your say over who holds it ends — an administrator cannot quietly add themselves to it afterwards. And its cases stay out of the CSV export for anyone who is not a custodian.
- Follow-up questions, on up to 120 reports a month
Follow-up questions
On the boxes you switch it on for, an AI model reads each report as it arrives and writes a short list of questions into the thread — the detail a reader would have had to come back and ask for, asked while the sender is still there.
Answering is always optional, and the report is delivered either way. Nobody is ever required to identify themselves, whatever a box asks.
The allowance is 120 reports a month across your whole organisation, not per box — one report is one run, and a run can produce several questions. A run we could not make, because the month’s allowance is spent or the model failed, does not count against it.
- CSV export
The CSV export
One file, one row per message: the case reference, the sender’s per-case handle (“Anonymous #4F2A” — it links to nothing and to no other case), the status, when the case arrived, when you first replied, when it closed, which way the message went, when it was sent, and the text.
Administrators only. Private boxes you do not hold are not in it, and attachments are not included — the file is text. Taking an export is itself written to your activity log, with the number of rows.
Every new organisation starts with full Standard features for 30 days, no card — and we email you at ten days, five days and the day before it ends, so it never lapses by surprise.When a paid plan ends, your organisation drops to Free rather than expiring — your main box keeps accepting and open cases stay reachable, while any extra boxes stop taking new messages and say so. Your verified name is displayed while on any paid plan; the verification itself never expires, so the name returns the moment you upgrade again. Annual billing is available on every paid plan. Schools and non-profits: education and charity discounts are available on every paid tier — contact us for details.
*Free boxes ask one thing: someone from your team signs in at least once a year. If nobody has signed in for 9 months we email your administrators — and again at 60 and 30 days before the deadline. A box that reaches 12 months without a visit closes until someone signs back in: nothing is deleted, and one visit reopens it exactly as it was. Boxes on a paid plan are never closed for inactivity.
Agencies & partners
Manage many boxes. Read none of them.
Managing agents, school groups, franchise operators: one account holds a box for every property or campus, each on its own plan. The part your clients will care about — the account that pays is structurally cut off from content the moment each box’s own admin first signs in. That is enforced in the database, not promised in a policy.
Running several boxes earns a multi-box discount on any paid tier. Set-up is concierge: we provision the boxes with you, hand each one to its admin, and agree the pricing together. Or email partners@tell.sg if you would rather write.
Workplace Fairness Act
The one requirement most grievance channels can’t satisfy.
What the Act asks of you
From its expected commencement, employers with 25 or more staff must run a written grievance-handling process that inquires into each grievance, keeps written records, protects the identity of the person who raised it, and informs that same person of the outcome.
Why that’s hard
Those last two duties pull against each other. Under an ordinary anonymous channel — a form, a box, a shared inbox — you cannot report an outcome back to someone whose identity you never learned.
A tell.sg case thread satisfies both at once: the sender stays anonymous, and they can still be told what happened. The thread itself is your written record.
tell.sg supports the intake, confidentiality, dialogue and record-keeping parts of a grievance process. It isn’t compliance in a box — the policy, the trained responders and the investigation are yours. We’d rather tell you that now than in a tribunal.
Who rents boxes
Four shapes of the same problem.
Workplaces
Grievances, harassment, safety concerns, and the quieter stuff — roster fairness, a manager who shouts, an expenses habit nobody wants to name.
“Would they tell HR? Really?”Estates & MCSTs
Residents raise noise, security, contractor and spending concerns without walking into the management office to do it.
“Who does a resident complain to about the agent?”Schools
Bullying and safeguarding reports from students, and concerns from parents and staff who don’t want to be seen raising them.
“Anonymity changes reporting rates most here.”Shopfronts
A QR at the counter catches what the customer would otherwise take to Google reviews — and your verified name is on the page it opens, which is what makes a stranger willing to scan at all.
“They walk out instead of telling you.”Reasonable objections
The questions everyone asks.
Won’t anonymity just invite abuse and false accusations?
It’s the first thing most buyers ask, and the honest answer is that anonymity changes the mix rather than flooding you. Rate limiting, duplicate detection across boxes and a quarantine queue handle the automated end. For the human end, the two-way thread does more work than any filter: you can ask a vague or hostile report for specifics, and most bad-faith messages don’t survive a follow-up question.
How do we investigate if we can’t ask who it was?
You can ask anything except identity. The case thread stays open, the sender gets your questions, and they can answer for as long as they keep their passphrase. This is the single biggest difference from a form or a drop box — investigations that would otherwise stall on a missing detail get to keep going.
Can we require staff to identify themselves on our own box?
No — and this is the one thing we won’t build for anyone. A platform where some boxes demand identity is a platform where senders have to assess every box individually, and at that point none of them are trusted. Someone who wants you to know who they are signs their message, and that choice is always theirs.
Why would a scam-wary public scan our QR at all?
The check lands with the page, not the poster: a QR code can encode anything, so what matters is what opens. It confirms the claim before they type a word — your registered name with your UEN under it, the same check-the-name reflex as a PayNow transfer, against the same public register. And because your address is derived from that registered name, a counterfeit cannot hold an address that says Acme.
Just as important is what the form doesn’t do: no login, no account, no payment. The only credential a sender ever holds is a passphrase we generate for them, and nothing they are asked is ever a condition of being heard. A page that demands nothing is the opposite of what they were warned about.
Could someone set up a fake box pretending to be us?
This is the attack we designed hardest against, because a counterfeit box is invisible — nobody sees its submissions, including you.
A box shows a name only when a verification backs it — proof of control of a bank account in the business’s registered name, or in-person verification by tell.sg staff during direct onboarding — and the name displayed is the ACRA-registered one, never typed in. Your web address is derived from that registered name, so nobody whose registration doesn’t say “Acme” can hold an address that says Acme. The box page shows your UEN, which anyone can check against the public register — and a box with no verified name shows no name at all, so a counterfeit cannot wear yours.
Can we use this outside Singapore?
Partly, and we would rather be straight about which part. The box itself works anywhere: your people write, you reply, posters print, all four languages, nothing about the sender experience is Singapore-specific.
What is Singapore-only today is name verification. We prove an organisation controls a bank account in its registered name using PayNow and Singapore’s company register — rails that do not exist elsewhere. So a non-Singapore organisation can run a box, but it stays nameless at a random address, which is most of what the paid plans are for.
If you are outside Singapore and this is still useful to you, write to partners@tell.sg — we are working out what an equivalent check looks like, and demand is what decides the order.
What happens to our data if we leave?
You can cancel from your console — no phone call, no retention script. On cancelling you choose: wind the box down and keep it readable for 60 days so open conversations can finish, or request deletion outright. Your case export is available from the console at any time. Deletion is confirmed only after a safety window, and your organisation’s admin can stop it during that window — their veto is final, even against the account owner.
Is our data secure — where does it sit, who can read it?
The short answer: your data lives in Singapore and is encrypted, both in storage and in transit.
For the technically inclined: everything runs in AWS Singapore (ap-southeast-1). The database and its backups are encrypted at rest, attachments are encrypted at rest in storage, and every connection — yours, your senders’, and ours to the database — is TLS. The key protecting sender passphrases never touches a disk unencrypted: it lives in AWS KMS and is decrypted only into memory at boot.
And we’re honest about the part vendors usually leave vague: we can read what we store, because your console has to display it. What we don’t have is anything identifying the sender — no email, no IP logs, no device data — and passphrases are stored as one-way hashes we cannot reverse. Our threat model documents exactly what is and isn’t retained, including the parts that aren’t flattering.
What if we get busy and fall behind — will we be publicly shamed?
No, and the mechanism is designed so it rarely fires. Your digest warns you that messages are waiting well before anything appears. Only if they’re still unread past the threshold — long enough to survive a holiday weekend — does the box page mention it. It shows no counts, no dates and no names, just that messages have been waiting. And it clears the moment you read them.
We know this is the least comfortable thing on the page. It’s also why a tell.sg box means something: your people know that if you’d stopped reading, they’d have been told. That’s what makes them willing to write in the first place.
Our people won’t use it. Why would this be different?
Fair, and it’s the failure we watch for hardest. Two things move the needle: how the box is introduced, and whether replies actually come. The poster kit gives every box print-ready artwork in four languages, and the console flags cases nobody has read — because a box that swallows messages silently is dead within two months.
Start with one box.
Free to open, a poster to print, and a month of full Standard features to see what you’ve been missing. Cancel from the console whenever you like.
Rather see it with someone? Book a ten-minute demonstration.