Aellysa

The removal test leaves a complete and saleable product. Take the models away and what remains is a visual pipeline with drag and drop boards, account and contact management, MEDDPICC qualification scoring, energy based task prioritisation, meeting logging, website lead tracking, CSV and Excel import and export, team metrics and an entire gamification layer of points, levels, streaks, badges, leaderboards and incentive programmes. None of that requires a model.

What the models do supply is the mail composer, the smart updates, the deal scoring and the risk alerts, and those are assistive layers on a system of record rather than the reason the product exists. The vendor's own framing supports the reading, since the headline claim is that this is the first CRM built for how sellers actually work rather than a claim about intelligence.

Note for contrast with the rest of the category that the AI mail composer and deal scoring both appear in the entry tier rather than being gated upward, so this is not the packaging pattern seen elsewhere where the model is sold as an upgrade.

The vendor markets automatic outreach in plain terms, inviting the buyer to set up custom email workflows and let the platform handle the entire outreach automatically, and separately describes drafting an email and updating the record in a single click. Those are two different oversight postures sold on the same page and only one of them keeps a human in the loop.

Nothing published describes an approval step, a review queue, a confidence threshold, a withholding guardrail, an escalation path or a containment behaviour when a signal is wrong. The one oversight artefact located is advanced audit logging, and it is reserved for the top tier, so the record of what the system did on a seller's behalf is a purchased upgrade rather than a property of the product. The nudges and stale deal alerts are advisory and do reach the human, but advisory prompts are not an oversight model for the part of the product that sends.

AI is described functionally throughout and never technically. No model provider is named, no model family, no version, no inference location, no retention position for prompts or generated content, and no statement of what the system does when it is uncertain.

The strongest specific claim is behavioural rather than architectural, that the assistant learns a seller's communication style and adapts to sound just like them, which tells a buyer what the output will resemble but nothing about how it is produced. A feature called Supermemory sits in the top tier with no published explanation of what it retains, for how long, or across which boundary. For calibration, the newest and smallest vendors graded in this index have named their model provider outright, so this is a choice rather than a constraint of company stage.

Recorded as a stage fact rather than as concealment, in the same terms applied to other very young vendors here. There are no named customers, no logos, no case studies, no analyst coverage, no funding record and no located reviews on any major software review platform, although listings exist on more than one. The testimonials that do appear on the site are unattributed, so a reader cannot tell whether the quoted seller runs a two person team or a global one.

The single quantified claim is the headline promise to save five or more hours a week, published without a measurement basis, a sample or a period. One third party directory assigns a computed score of 47 out of 100 in its forecasting and lead scoring category, derived from material gathered around the web rather than from user reviews, so it corroborates nothing. Re verify once the vendor accumulates review platform history.

The product sends automated email sequences and tracks identified website visitors, which puts it squarely inside the direct marketing and electronic communications rules, and no regulation is named anywhere in the public material. There is no reference to CAN SPAM, to the GDPR grounds for unsolicited business email, to the ePrivacy rules that govern the tracking, to unsubscribe handling, to suppression lists or to the time within which an opt out is honoured.

The nearest thing to a position is a line in the pricing questions stating that the platform is designed for setups aligned to the GDPR, which is a gesture at a framework rather than a control the product enforces. That is a thin posture for a vendor whose infrastructure sits in the European Union and whose likely buyer is therefore in scope.

What is published is a single sentence, that the platform is designed for setups aligned to the GDPR, offered in the pricing questions alongside the hosting region. No privacy notice was located this pass, so there is no controller and processor split, no legal basis for any purpose, no retention schedule, no subject rights route, no data protection contact, no transfer mechanism and no sub processor list.

Recorded as observed rather than concluded, since this is a failure to locate documentation and not a finding that none exists. The site declines automated access, which is part of why retrieval failed here, and a terms document is published at aellysa.com/terms.html and was not read this pass. Re verify at aellysa.com for a privacy notice and read the terms document before this row is quoted.

The vendor does not sell a contact database and does not claim one, so the heaviest version of this question does not arise. What does arise is the signal layer. The product claims to spot buying signals and risk signals earlier than a person can, naming unusual account activity, buyer engagement patterns and competitive interference, and it tracks website leads. Competitive interference in particular cannot come from the customer's own records alone.

No source is named for any of it, no supplier is disclosed, and no licence or permitted use position is published. Prospecting is also marketed as a capability without a stated origin for the prospect data. Graded at the middle of the band because the volume of externally sourced personal data appears modest rather than because provenance is disclosed.

The exposure here is materially lower than in most of the surrounding roster and it is a property of the architecture rather than a policy. No automated action against a social network was located, no profile visiting, no connection requests, no automated commenting, no multi account rotation and no marketing that treats platform limits as an obstacle to be routed around.

Email runs through a connected mailbox and the named integrations are official ones, with Salesforce sync in the paid tiers and import wizards for Salesforce, HubSpot, Pipedrive and Close. Website lead tracking runs on the customer's own property. Held off the top of the band because the mailbox connection method is nowhere documented, so a buyer cannot tell whether the vendor holds a revocable scoped token or a credential, and that distinction has decided this axis for other vendors here.

The product's own marketing raises the training question and nothing published answers it. The assistant is said to learn a seller's communication style and adapt to sound just like them, which means it is being fitted to that individual's mail. A top tier feature called Supermemory implies accumulated context of unstated scope and duration.

Between them those two claims put customer mail content, deal notes and buyer intelligence into a model pipeline, and there is no published statement on whether that content trains models, whether any learning is scoped to the single tenant, whether prompts or outputs are retained, or whether a sub processor sees the content.

Other vendors at a far earlier stage have answered exactly this in writing, one of them in a headed clause confining training to the individual customer's own data, so the answer is available to a company this size and has not been given.

Nothing in the product pretends to be a person. There is no agent persona, no synthetic voice, no manufactured location and no automated conversation conducted under a human name, which puts it clear of the sharpest exposures in this index. What it does manufacture is effort and voice.

The assistant learns an individual seller's writing style so that generated drafts sound like that specific named human, and automated workflows can then send them, so the recipient receives a message that carries the signature of personal attention it did not receive.

Article 50 of the EU AI Act is not addressed, which is worth noting for a vendor hosting in the European Union and selling into it, and the marking duty under that article rests principally on the provider of the system rather than on the customer using it.

The entry point is well handled and the exit into a wider stack is not. A guided import wizard maps fields automatically from Salesforce, HubSpot, Pipedrive and Close, CSV and Excel import and export sit in the entry tier, and the vendor states migration assistance is included at no extra cost on every plan. Beyond that the surface thins.

Direct integration with Salesforce is reserved for the paid tiers, custom integrations and the API are gated to the top tier alone, no connector count or partner directory is published, no public developer documentation was located, and there is no marketplace listing, webhook description or agent facing endpoint. For a product whose whole argument is that it removes administrative friction, the absence of a generally available API is the notable gap, because integration is where that friction usually lives.

The vendor states plainly that the service runs on Microsoft Azure data centres in the North Europe region, which is a named single region published in an answer a prospective buyer will actually read rather than buried in a sub processor annex. A stated residency posture with no options in it beats silence, and that is the ground for the band. Two things hold it off the top.

There is no accompanying commitment that data does not leave the region, which is the sentence that has earned the highest grade on this axis elsewhere, and no residency choice is offered to the customer. More pointedly, the product's differentiator is generative, and nothing states where inference happens or whether prompt content crosses a border to reach a model provider, so the published region covers the database and leaves the part a European buyer would ask about unaddressed.

No certification is held. The vendor states it is preparing for SOC 2 and uses industry standard security controls, and that phrasing deserves a small amount of credit for candour, because saying a certification is in progress is more honest than asserting one without naming its type or period, which is the failure that has taken other vendors here to the same band from the opposite direction.

There is no trust centre, no report, no audit period, no auditor, no penetration test, no vulnerability disclosure policy and no enumerated control set. The specific controls that are visible appear as commercial gates rather than as security posture, with single sign on reserved for the middle tier and advanced audit logging for the top one, so the two capabilities a security reviewer asks about first are both upsells.

The buyer can budget this purchase without speaking to anyone, which is the test. Three plans are published and named, Base, Pro and Enterprise, each with its contents enumerated so the gates are visible in advance: the entry tier carries pipeline and deal management, account and contact management, the smart inbox and mail composer, deal scoring and import and export; the middle tier adds the management dashboard, smart updates, deal rescue and risk alerts, the workspace hub and single sign on; the top tier adds Supermemory, custom reports, advanced audit logging, custom integrations and the API, and a service level agreement.

The pricing page carries a slider that returns an estimated monthly and annual cost for a given team, which is a stronger disclosure form than a static table because it answers the buyer's own question. The commercial terms are published alongside it: no long term contract or lock in, upgrade and downgrade at any time, prorated on upgrade and effective next cycle on downgrade, a full refund inside fourteen days, and onboarding and migration assistance included on every plan at no extra cost.

One qualification belongs on the record. The site declines automated access and the figures are produced by the calculator, so the tier amounts were not read directly this pass and a third party directory records an entry point near thirty nine dollars. Re verify the numbers and check whether the top tier carries a figure or routes to a quote.

Export is a property of the cheapest plan rather than a purchased commodity. CSV and Excel import and export appear in the entry tier feature list with no metering, no credit cost and no volume ceiling published, which is the direct inverse of the credit metered export that has held other vendors down on this axis. The commercial terms reinforce it, with no long term contract or lock in and downgrade available at any time, so a customer is not held by the paper either.

What is missing is the second half of the question. Nothing published states what happens after termination: no retention period, no deletion timeline, no deletion confirmation artefact, no return mechanism and no stated post termination data rights. A terms document exists at aellysa.com/terms.html and was not read this pass, and it is the most likely place for those commitments, so re verify there before this row is quoted.

The product runs automated email sequences and no sending control is named anywhere. There is no warm up, no authentication guidance on SPF, DKIM or DMARC, no bounce or complaint threshold, no blocklist monitoring, no placement testing, no domain health reporting, no sending window or pacing description and no volume governance.

Nor is the sending architecture documented, so a buyer cannot tell whether messages leave their own mailbox and carry their own reputation or leave shared infrastructure. Recorded as observed rather than concluded, since this is a failure to locate published controls rather than evidence of poor delivery, and unlike the vendor that took the lowest grade on this axis here there is no public support material pointing at a delivery problem. Re verify if the vendor publishes deliverability documentation.

The positioning is coherent and consistent, which is more than several larger vendors here manage. The buyer is a business to business team that needs structured sales execution through MEDDPICC, playbooks and proposal stages, led by a revenue leader who wants visibility into risk and coverage, and typically a startup or smaller team that can run this as a light system of record and grow into a heavier process.

The vendor positions itself explicitly against Salesforce on ease of use and against the reporting first tools that tell a team what happened rather than what to do next, and a third party summary states just as plainly who it does not suit, namely teams wanting a basic contact list, pure outbound sequencing without pipeline context, or a document repository. Off the top of the band because no customer size distribution, industry mix or geographic coverage is published and there are no named customers against which to test the claim.