Rent a box
You’re not buying a form.
You’re buying the reports
you never hear.
A feedback box at your own tell.sg address, reachable by QR code on a counter, a pantry wall or a lift lobby. People write without leaving a name. You reply without ever learning one.
The problem with your current channel
Your staff know that an email to HR has their name on it. Your residents know the suggestion box is opened by the managing agent. So the small problems stay quiet until they’re large ones.
Why it works
Your people use it because of what we don’t let you do.
Every constraint below costs you something and buys their confidence. That trade is the entire product — and it’s why a tell.sg box collects what your inbox doesn’t. It also means the platform is built for organisations that intend to read what they’re sent. If that isn’t you, we’re the wrong tool, and your people will find out.
Require a name or email
No box on the platform may demand identity — including yours. There is no identity field on the form at all; someone who wants you to know who they are simply signs their message.
See who wrote
Your console shows the message, the attachments and a case number. No IP address, no device, no email. We don’t hold it either.
Automate your replies
Beyond the automatic receipt, every message a sender receives was written and sent by a person on your team who read the case.
Read without a record
Each case records who on your team first opened it, and deletions are written to an audit trail nobody can edit. Good governance, and reassuring to whoever raised it.
Cap what you receive
No message quotas, no overage billing. Plans cap your own tooling — doors and seats — never how much your people can say.
Ignore it quietly
If messages sit unread too long, your box page says so — no counts, no dates, just that messages have been waiting. It clears the moment you catch up, and you can’t switch it off.
You can hold a conversation
Ask follow-up questions, request detail, tell them the outcome — all through the case thread, all without their identity ever entering the system.
What you get
A console built for reading and replying.
Doors
Give each outlet, floor or department its own labelled QR code on your address, so reports arrive already sorted — with no dropdown for the sender to navigate.
Named seats
Every responder has their own login, so replies and closures are attributed and access is revoked individually when someone leaves. No shared password on a sticky note.
Evidence, sanitised
Photos and PDFs arrive virus-scanned and stripped of hidden metadata. You get the evidence; the sender doesn’t accidentally reveal themselves.
Ageing case alerts
The metric that matters most: cases nobody has read. Your digest warns you before the box page would have to say anything publicly.
Verified identity
Prove you control a bank account held in your business’s name, and your box shows your ACRA-registered name and UEN — at a readable address derived from that registered name, which nobody else can hold.
Poster kit
Every door generates print-ready QR posters and counter cards — in every language you enable. English, Chinese, Malay and Tamil are available on every plan.
Pricing
Every box is a real box, whatever you pay.
All four languages, anonymous dialogue and the full protection set ship on every plan — free included. What changes between plans is your own tooling, never what your people can do.
- 1 entry point, 1 console user
- Text messages (no attachments)
- Random address, no name shown
- QR & poster kit
- Your box never expires
Everything in Free, plus
- Attachments to 3 MB
- Company verification
- Your name & UEN on the box
- Readable address for posters
Everything in Lite, plus
- 5 doors with custom labels
- 10 named seats
- Attachments to 8 MB
- CSV export
Everything in Standard, plus
- 50 doors
- 30 named seats
- Attachments to 16 MB
Every new box starts with full Lite features for 30 days, no card. When a paid plan ends, the box drops to Free rather than expiring — open cases stay reachable and printed posters keep working. Your verified name is displayed while on any paid plan; the verification itself never expires, so the name returns the moment you upgrade again. Annual billing is available on every paid plan. Schools and non-profits: education and charity discounts are available on every paid tier — contact us for details.
Agencies & partners
Manage many boxes. Read none of them.
Managing agents, school groups, franchise operators: one account holds a box for every property or campus, each on its own plan. The part your clients will care about — the account that pays is structurally cut off from content the moment each box’s own admin first signs in. That is enforced in the database, not promised in a policy.
Running several boxes earns a multi-box discount on any paid tier. Set-up is concierge: we provision the boxes with you, hand each one to its admin, and agree the pricing together.
Workplace Fairness Act
The one requirement most grievance channels can’t satisfy.
What the Act asks of you
From its expected commencement, employers with 25 or more staff must run a written grievance-handling process that inquires into each grievance, keeps written records, protects the identity of the person who raised it, and informs that same person of the outcome.
Why that’s hard
Those last two duties pull against each other. Under an ordinary anonymous channel — a form, a box, a shared inbox — you cannot report an outcome back to someone whose identity you never learned.
A tell.sg case thread satisfies both at once: the sender stays anonymous, and they can still be told what happened. The thread itself is your written record.
tell.sg supports the intake, confidentiality, dialogue and record-keeping parts of a grievance process. It isn’t compliance in a box — the policy, the trained responders and the investigation are yours. We’d rather tell you that now than in a tribunal.
Who rents boxes
Four shapes of the same problem.
Workplaces
Grievances, harassment, safety concerns, and the quieter stuff — roster fairness, a manager who shouts, an expenses habit nobody wants to name.
“Would they tell HR? Really?”Estates & MCSTs
Residents raise noise, security, contractor and spending concerns without walking into the management office to do it.
“Who does a resident complain to about the agent?”Schools
Bullying and safeguarding reports from students, and concerns from parents and staff who don’t want to be seen raising them.
“Anonymity changes reporting rates most here.”Shopfronts
A QR at the counter catches what the customer would otherwise take to Google reviews — while you can still do something about it.
“They walk out instead of telling you.”Reasonable objections
The questions everyone asks.
Won’t anonymity just invite abuse and false accusations?
It’s the first thing most buyers ask, and the honest answer is that anonymity changes the mix rather than flooding you. Rate limiting, duplicate detection across boxes and a quarantine queue handle the automated end. For the human end, the two-way thread does more work than any filter: you can ask a vague or hostile report for specifics, and most bad-faith messages don’t survive a follow-up question.
How do we investigate if we can’t ask who it was?
You can ask anything except identity. The case thread stays open, the sender gets your questions, and they can answer for as long as they keep their passphrase. This is the single biggest difference from a form or a drop box — investigations that would otherwise stall on a missing detail get to keep going.
Can we require staff to identify themselves on our own box?
No — and this is the one thing we won’t build for anyone. A platform where some boxes demand identity is a platform where senders have to assess every box individually, and at that point none of them are trusted. There is no identity field on any box, full stop; someone who wants you to know who they are signs their message, and that choice is always theirs.
Could someone set up a fake box pretending to be us?
This is the attack we designed hardest against, because a counterfeit box is invisible — nobody sees its submissions, including you.
A box shows a name only when a verification backs it: you prove you control a bank account held in the business’s registered name, and the name displayed is the ACRA-registered one, never typed in. Your web address is derived from that registered name, so nobody whose registration doesn’t say “Acme” can hold an address that says Acme. The box page shows your UEN, which anyone can check against the public register — and a box with no verified name shows no name at all, so a counterfeit cannot wear yours.
What happens to our data if we leave?
You can cancel from your console — no phone call, no retention script. On cancelling you choose: wind the box down and keep it readable for 60 days so open conversations can finish, or request deletion outright. Your case export is available from the console at any time. Deletion is confirmed only after a safety window, and your box admin can stop it during that window — their veto is final, even against the account owner.
Is our data secure — where does it sit, who can read it?
The short answer: your data lives in Singapore and is encrypted, both in storage and in transit.
For the technically inclined: everything runs in AWS Singapore (ap-southeast-1). The database and its backups are encrypted at rest, attachments are encrypted at rest in storage, and every connection — yours, your senders’, and ours to the database — is TLS. The key protecting sender passphrases never touches a disk unencrypted: it lives in AWS KMS and is decrypted only into memory at boot.
And we’re honest about the part vendors usually leave vague: we can read what we store, because your console has to display it. What we don’t have is anything identifying the sender — no email, no IP logs, no device data — and passphrases are stored as one-way hashes we cannot reverse. Our threat model documents exactly what is and isn’t retained, including the parts that aren’t flattering.
What if we get busy and fall behind — will we be publicly shamed?
No, and the mechanism is designed so it rarely fires. Your digest warns you that messages are waiting well before anything appears. Only if they’re still unread past the threshold — long enough to survive a holiday weekend — does the box page mention it. It shows no counts, no dates and no names, just that messages have been waiting. And it clears the moment you read them.
We know this is the least comfortable thing on the page. It’s also why a tell.sg box means something: your people know that if you’d stopped reading, they’d have been told. That’s what makes them willing to write in the first place.
Our people won’t use it. Why would this be different?
Fair, and it’s the failure we watch for hardest. Two things move the needle: how the box is introduced, and whether replies actually come. The poster kit gives every door print-ready artwork in four languages, and the console flags cases nobody has read — because a box that swallows messages silently is dead within two months.
Start with one box.
Free to open, a poster to print, and a month of full Lite features to see what you’ve been missing. Cancel from the console whenever you like.