Yes, hitbox is tournament legal. There is no reason why it should not be. It simply replaces a joystick with directional buttons. However, the question is completely valid. The major concern with hitbox-type controllers is SOCD cleaning. SOCD stands for simultaneous opposing cardinal directions. An SOCD cleaner prevents two directions from being registered simultaneously.
Consider holding back and forward at the same time when playing Street Fighter. If the Hitbox did not have an SOCD cleaner, both back and forward would be registered as inputs, potentially allowing the player to block both sides at the same time, which is not meant to happen. Fortunately, most if not all hitbox-style controllers have SOCD cleaning.
Another concern is variations. Consider the Smash Box, which is a controller by Hit Box Arcade. It has the ability to map button macros, which puts it at risk of getting banned at any specific tournament you may be attending, so be careful. The Cross Up is the third controller by Hit Box Arcade. It has directional buttons plus a joystick, which should not be a problem, but always check if the tournament you are going to allows such innovations.
If you are still unsure about buying a hitbox, check out our top hitboxes list.