Aircall

The pricing structure settles the removal test more clearly than any product page could. Post call summaries and customer record auto logging are an add on at nine dollars per licence on the entry tier. Real time coaching and live transcription are a separate add on at forty nine dollars per licence across every tier including the top one. Autonomous voice agents are metered by usage on top of the seat.

A capability sold separately at every level is by construction detachable from the thing it attaches to, and here the vendor has priced that separation itself. Strip all of it and a complete cloud phone system remains, which is what the platform was from 2014 and what the integration marketplace is built around.

The contrast with the other voice platform built in this project is instructive: that vendor includes speech features at its fifteen dollar floor, which evidences integration, while this one charges for them at its top tier, which evidences the opposite. The vendor now describes itself as an AI powered platform for customer conversations. Ask which AI capabilities are included at the tier being quoted and which are billed separately.

A handoff is described, which is more than most autonomous voice products state, and nothing around it is. The voice agent is described as handling routine calls on its own, answering common questions, scheduling, and logging to the customer record system before passing to a human, so a boundary exists in the product description and the escalation is presented as a designed step rather than an afterthought.

What is not published is anything that would let a buyer rely on it: no statement of what triggers the handoff, what the agent may commit to before it happens, what an administrator can constrain, or what happens when the caller asks something outside the routine set. Usage metering supplies an incidental spend ceiling rather than a behavioural one.

The vendor also discloses that agent language coverage runs to four languages, which bounds where the agent can operate and is a more concrete limit than most vendors publish. Ask what triggers handoff to a human, what the agent may commit to, and what an administrator can disable.

A specific and unusual disclosure about language coverage, and nothing about the models delivering it. The vendor publishes that its voice agent supports four languages, English, Spanish, French and German, while post call summaries support English only. Stating where a capability stops working is uncommon and directly useful, particularly for a vendor selling into multilingual European markets, and it is the kind of limit most competitors leave a buyer to discover after purchase.

Against that, no model provider, family or version is named anywhere, no model card exists, no evaluation or red teaming documentation was located, and no accuracy figure accompanies transcription, summarisation or sentiment analysis even though each is separately purchased. For a European headquartered vendor the absence of any published position on the European artificial intelligence regulation is also notable. Ask which models process call audio, what accuracy they achieve by language, and what evaluation covers agent output.

Deployment speed is the only quantified claim and it measures setup rather than outcome. The vendor states teams go live in under an hour, and the mechanics support it: choose a number, install a softphone, connect a customer record platform, with no hardware and no exchange to provision. That is a real and checkable operational claim, and for the buyer this product targets it is arguably the relevant one. Everything past it is absent.

No transcription or summary accuracy figure is published despite those being sold as paid capabilities, no connect rate, handle time or conversion effect is measured, and no customer study across a stated population and period was located. Independent review coverage is extensive and converges on cost of ownership rather than performance, consistently reporting that the real bill runs materially above the advertised seat once add ons are counted. Ask for measured transcription and summary accuracy, and for outcome measurement across a stated customer population.

One architectural property works in the buyer's favour and the vendor never claims it. The dialer is power mode only, queueing numbers and dialling them one at a time rather than launching several lines per agent, which is the design that generates abandoned calls when a parallel dialer connects more people than it has agents to answer.

A platform that cannot dial in parallel cannot produce that failure, so the regulatory exposure the abandoned call limit addresses does not arise here by construction. That is a real safety property and it is inferred from the product's design rather than asserted by the vendor.

Everything else on this axis is missing from the vendor surface: nothing published on consent capture, preference register screening, calling window enforcement, caller authentication attestation or messaging registration, and no statement of where responsibility transfers to the customer. Aloware, in the same lane, cites the abandoned call limit and the narrowed dialer definition by name and states plainly which obligations remain the customer's. Ask what preference register screening and calling window controls exist, and what caller authentication attestation applies.

The processing agreement is published openly, which is the single most useful privacy artifact and one most vendors gate. A buyer can read the terms before contacting sales rather than requesting them under a confidentiality agreement, and the document defines controller and processor roles by reference to the European regulation, scopes the processing in a named exhibit, and describes data centre security in its own clause.

For a French headquartered vendor selling across Europe that ungated publication is consistent with the market it serves rather than incidental. Alongside it a trust page, a status page and a security white paper are published, and a vendor management programme is described for evaluating subprocessors against internal standards.

Held below the top band because several elements a privacy review needs were not located: no subprocessor list, no stated retention period for recordings or transcripts, no transfer framework certification and no named data protection officer, where the vendors at the top of this axis publish request metrics, registration numbers and named representatives. Ask for the subprocessor list, the retention schedule for call audio and transcripts, and the transfer mechanism.

Nothing is purchased or resold, and the provenance question concerns call audio the customer generates. There is no contact database, no intent feed and no third party corpus behind this product, so the usual sourcing questions have nothing to attach to. What the platform accumulates is recorded conversations, transcripts and summaries, and the question that follows is whether that audio contributes to improving the speech capabilities the vendor sells as paid add ons.

Nothing published addresses it: no statement on training or tuning with customer audio, no description of what any model provider receives, and no option described for a customer to exclude its recordings. The commercial incentive is plain, because transcription and summarisation improve with real conversational audio and the vendor charges separately for both.

Call recording storage is separately capped at one year on the entry tier and stated as unlimited above it, which is a retention disclosure of a sort though framed as a feature limit rather than a data handling commitment. Ask whether customer call audio or transcripts train or tune any model, and whether a customer can opt out.

Integration is the product's centre of gravity and it runs entirely through sanctioned routes. A published marketplace carries connectors to the major customer record, helpdesk, productivity and messaging platforms, each built on those platforms' own integration surfaces, and a customer record telephony integration with the largest platform is offered as a named product. Nothing resembling credential storage, scraping or unsanctioned automation appears anywhere on the surface.

Two qualifications hold it below the top band. Interface access with developer support is gated to the top tier, which carries a twenty five licence minimum, so programmatic extension is unavailable to the large majority of the customer base and the openness is narrower in practice than the marketplace suggests.

And the integration count is stated inconsistently across sources, appearing as more than one hundred in some vendor derived material and more than two hundred and fifty in other, so the headline figure is not firmly established. Ask which tier includes interface access, and for the current verified integration count.

Paid speech capabilities process customer conversations and no stewardship position covering them was located. The platform transcribes, summarises, scores sentiment and now answers calls autonomously, all of which means call audio moves through model infrastructure, and nothing published states whether that material trains models, which providers process it, how long transcripts are retained, or whether any of it crosses a tenant boundary.

No artificial intelligence governance document, evaluation record, red teaming artifact or model subprocessor list was found, where the other voice platform built in this project maintains a dedicated governance section with four named entries and publishes its model provider in a public subprocessor list. The general security programme describes encryption, penetration testing and a bug bounty, which addresses who can reach the data rather than what the vendor may do with it. Ask whether call audio or transcripts train or tune any model, which providers process them, and what retention applies.

An autonomous agent answers calls and no disclosure position is published. A person telephoning a business on this platform can be handled end to end by a synthetic voice that answers questions, books appointments and writes to a customer record system before any human is involved, and nothing published states whether the caller is told, whether disclosure can be configured, or what the agent says if asked directly.

A second surface sits underneath and applies to every customer rather than only those enabling agents: calls are recorded and transcribed, consent requirements vary by jurisdiction with several requiring every party to agree, and no automatic announcement or per jurisdiction handling is described. For a vendor headquartered in a market where both recording consent and machine disclosure are regulated, the silence on both is the finding. Ask whether the voice agent identifies itself as automated, whether that is configurable, and what recording announcement is applied by jurisdiction.

A marketplace that is genuinely the reason to buy this product rather than a list appended to it. Connectors span customer record platforms, helpdesks, productivity suites and messaging tools, and the depth on the largest customer record platform extends past logging into a separately sold telephony product providing call controls, real time transcription and supervisor barge in inside that platform's own agent console.

A messaging integration covering a major consumer platform across more than one hundred and eighty countries is offered as its own priced module. Deployment is genuinely fast because integration is the design centre. Three things hold it below the top band. Integration with the largest customer record platform requires the middle tier, so the entry seat does not reach the connector most buyers want.

Interface access with developer support requires the top tier at a twenty five licence minimum. And the published integration count differs materially between sources. Ask which connectors are available at the tier quoted, and for the interface documentation.

A European vendor hosting on a United States cloud provider, with no residency election published. The processing agreement states that personal data is hosted primarily in that provider's data centres and describes their physical security, and the security page names the same provider. Backups are described as running across availability zones.

What is absent is the customer facing part: no region is named, no European or United Kingdom residency option is described, no tenancy model is stated, and no recovery time or recovery point objective is published. The word primarily is undefined.

This matters more here than for most software because the company is headquartered in France with offices across Europe, sells substantially into European markets, and the data in question is recorded voice, which is personal data subject to jurisdictional recording law as well as data protection. A European buyer would reasonably expect a residency answer from this vendor and cannot find one. Ask which regions call audio and transcripts are stored in, whether European residency is available, and what primarily excludes.

The vendor's own wording is careful and a third party directory is not, and the difference is the finding. The security page states that the information security programme is aligned with the information security standard and the service organisation control standards. Aligned is not certified, and the vendor does not claim otherwise.

The certifications named on that same page, covering the information security standard, service organisation controls, payment card rules and the United States federal authorisation, are attributed to the cloud hosting provider rather than to the vendor, which is accurate and properly scoped.

Against that a third party vendor risk directory presents this vendor as itself holding all of those including the federal authorisation, which is implausible for a French cloud telephony company and appears to be the hosting provider's certifications transposed onto the customer. That is the same directory that produced an unsupported federal authorisation claim for another vendor in this project. Only the vendor's own material was used.

What is published on the vendor's own surface is a real enumerated control set: encryption in transit and at rest at named strengths, regular third party application penetration testing, a bug bounty programme, a vendor management programme, backups across availability zones, a status page and a downloadable security white paper. That is a fuller enumeration than several better funded vendors manage and it carries no certification or attestation a buyer can request. Ask whether any certification or attestation is held by the vendor itself rather than its hosting provider.

Substantial published rates including most add ons, undercut by a minimum that makes the headline unreachable and by usage components with no price at all. Published and tightly corroborated across many independent sources: thirty and fifty dollars per licence monthly on annual billing for the two named tiers, forty and seventy on monthly billing, with add ons priced at nine dollars per licence for post call summaries, forty nine for real time coaching, fifteen for extended analytics, six per additional number, ten for the consumer messaging module and thirty for the deep customer record telephony integration.

Publishing that many add on rates is better than most vendors manage. Three things hold it here. A three licence minimum applies to both published tiers, so the advertised thirty dollars is not purchasable and the true floor is ninety dollars monthly, which a one or two person team pays for seats it cannot staff. The top tier is quote only behind a twenty five licence minimum.

And the components the vendor now leads with commercially are unpriced: voice agent usage beyond a small monthly allowance is sold in bundles or on a pay as you go basis with no published rate, message overage rates above a stated per user allowance are not published, and a newer single user entry plan carries no published price.

Multiple independent sources also report that the vendor's own pricing page renders its figures as null, with the citable numbers appearing instead on its blog and help pages. That claim was not verifiable on this pass, since the pricing page could not be reached directly, and is recorded as attributed rather than confirmed. Ask for the voice agent rate per minute or bundle, the message overage rate, and confirmation of which figures are current.

One retention figure is published as a feature limit and nothing else about leaving is addressed. Call recording storage is capped at one year on the entry tier and stated as unlimited above it, which tells a buyer something real about how long their own recordings survive, though it is framed as a reason to upgrade rather than as a data handling commitment.

Nothing published states export scope or format, whether recordings, transcripts and analytics history leave in bulk, what deletion timeline applies after termination, or what the renewal and notice terms are. Two exposures are specific to this category. Recordings are frequently a regulated business record the customer is separately obliged to keep, and a one year cap on the entry tier means the platform may delete material the customer still needs.

And telephone numbers are the harder asset, since porting away is governed by carrier process rather than vendor tooling, and nothing describes that process or its timeline. Ask what exports and in what format, what happens to recordings at termination, and what the number porting process and timeline are.

Two real controls exist at opposite ends and the machinery between them is undescribed. On the outbound side the dialer is power mode only by design, working a queue one number at a time, which structurally avoids the abandoned call pattern that parallel dialling produces. On the inbound side a number blocking feature is published for filtering unwanted callers.

Between those, nothing addresses what actually determines whether outbound calls connect: no caller authentication attestation level is stated, no position on spam labelling or remediation appears, and no messaging registration process is described even though the platform sends messages with a stated per user allowance.

For a product sold to outbound sales teams, whether calls arrive marked as suspected spam is the deliverability question, and it is determined by the platform rather than the customer. Ask what caller authentication attestation the platform signs at, what spam label remediation is available, and how messaging registration is handled.

A genuinely European footprint with a floor and a ceiling both stated in licences. Dual headquarters in Paris and New York with offices in London, Madrid, Berlin and Sydney gives a credible presence in the markets the product sells into, which distinguishes this vendor from United States competitors addressing Europe from a distance, and support is described as covering three regions.

The licensing structure states the boundaries plainly rather than leaving them to be discovered: three licences minimum on both published tiers and twenty five on the top tier, so a buyer knows immediately whether they are too small. The vendor also discloses that its speech features cover fewer languages than its geographic footprint, which is an honest limit.

Held below the top band because the stated floor excludes a real segment, since a solo operator or a two person team cannot buy at the advertised rate and must fund seats they cannot staff, and because a team of fifteen wanting top tier capabilities must license twenty five. Ask what the smallest deployment is that includes the customer record integration and dialer.