Amplemarket

Fails the removal test, and the timeline shows why. Amplemarket was founded 2018 and shipped a complete outbound platform for six years before Duo launched in September 2024. Strip the AI out and the buyer still has a 200M contact database, multichannel sequencer, native dialer, LinkedIn automation and a full deliverability suite. The AI-only surfaces (Duo Copywriter, Duo Voice, Duo Inbox) are tier-gated add-ons on top of that platform, which is the tell.

Amplemarket's own framing is honest about this - it describes Duo as "the first AI sales copilot built on top of a unified sales platform", naming the platform as the substrate. Same grade and same reasoning as ActiveCampaign, Marketo, Agentforce and Aloware: established platform vintage, not marketing volume, decides this axis.

The clearest Copilot posture in the index, stated as a design commitment rather than left to inference. Duo's three agents surface signals, research prospects and draft multichannel sequences, and the rep approves with one click and runs the sequence. Amplemarket states the boundary explicitly in its own competitive material, describing reps as staying in control and running the sequences, in direct contrast to autonomous-agent vendors.

Human-in-the-loop approval plus continuous learning from rep feedback is a documented oversight model, which is what B requires. Held below A: no configuration surface is documented for approval thresholds or escalation, no guardrails are described that would withhold a non-compliant draft, no audit trail of AI-generated actions is published, and Duo Inbox handles inbound reply handling automatically on the top tier - autonomous action on the response side with no described oversight at all.

No model provider, family or version named for any Duo capability. No model cards, no evaluation results, no accuracy or hallucination figures for the copywriter, and no technical description of the voice cloning model - which is the sharpest omission, because voice synthesis of a named individual is the one AI surface here where model provenance, consent handling and revocation genuinely matter to a buyer. Duo is described functionally throughout (what it surfaces, drafts and generates) and never architecturally.

Named customers with attributed quotes (Deel, Cabify, and an Account Executive at Horizons quoted by name on the pricing page), third-party analyst recognition as a Gartner Cool Vendor in Generative AI for B2B Sales, and quantified data claims with stated bases: 200m+ contacts, 70m records refreshed weekly, under 3% average bounce rate, 96.5% phone number accuracy. That is more measurable specificity than most vendors publish.

Two things hold it at B. First, independent reviews contradict the claims in practice, reporting deliverability problems despite the warmup infrastructure and outdated contact data in some segments and geographies, and at least one directory notes no independent verification of the data metrics has been published.

Second, the Aloware catch applies: Amplemarket publishes comparative capability scoring on its own blog that awards itself 21 of 21 on deliverability and 18 of 18 on social prospecting. Vendor-run comparative evaluation presented in the format of independent analysis. Always check the host domain.

The deepest published outreach compliance surface in the index so far, and the first A on this axis for an email-first platform. A dedicated GDPR page names legitimate interest as the operative legal basis and works through the balancing reasoning rather than asserting compliance; Article 14 is referenced by name as the source of what must be disclosed to a data subject whose data was not collected from them; a 30-day response window for data subject complaints is stated; and a DSAR route is published for individuals who want their data erased and to never be contacted again.

The piece nothing else in the index has: published operational guidance instructing customers to include data disclosure statements when reaching out - written at the top of emails or spoken at the beginning of calls - explaining where the prospect's data was acquired and why they are being contacted, with a worked example.

The Terms of Service section on Service Output Data states plainly that the customer must hold explicit consent or another lawful basis and may be required to obtain consent or provide notice in specific countries and US states. Naming the law, describing the mechanism, and stating exactly where responsibility transfers is the Aloware A pattern applied to data protection rather than telephony.

First A on this axis for a data vendor, and the reason is an unusual piece of honesty: Amplemarket designates itself a controller of both its licensed data and its customers' data under GDPR. Most contact-data vendors work hard to be characterised as processors precisely to avoid the notice and lawful-basis obligations that follow controller status. Accepting it, in writing, is the harder position.

Supporting evidence: the legal basis is enumerated per processing purpose rather than blanket-asserted (contract fulfilment for service delivery, legitimate interest for B2B business-relationship initiation with consumer-oriented and purely personal communications explicitly excluded, consent for tracking technologies); cross-border transfers rest on the EU-US Data Privacy Framework with FTC oversight named, plus Standard Contractual Clauses under Implementing Decision (EU) 2021/914 as amended, adopted for the UK and Switzerland.

Compare 9lenses, still citing the invalidated Privacy Shield six years after Schrems II - Amplemarket is the counter-example that shows what current looks like. A dedicated privacy portal covers DPA terms. The one gap named honestly: accepting controller status over a 200M-record database implies Article 14 notice duties to those individuals, and the published mechanism is reactive (contact us to be erased) rather than proactive notification on first entry, which is the bar Adapt.io set.

Partial credit and a real gap. In its favour: the privacy policy uses the word "licensed" to characterise the database, which is itself a provenance claim, and a lawful basis for holding and processing it is stated. Against: not one supplier, aggregator or acquisition channel is named for a database of 200M+ contacts refreshed 70M records a week; the phrase "AI-verified contacts" describes validation, not sourcing; and the GDPR page discloses that clients can collect prospect signal data including liked posts, which raises a professional-network collection question the vendor never addresses. A buyer who has accepted GDPR controller duties for records Amplemarket supplies cannot trace those records to a source or a licence from anything public.

LinkedIn social automation is a first-class product surface here: Amplemarket's own capability scoring claims fully automated connection requests, messages and profile views, and the signal layer collects professional-network engagement data including liked posts. No position is stated on LinkedIn's User Agreement, no conformance claim is made, and the delivery mechanism is never described.

Materially better than the bottom of this axis - there is no account-rotation-to-beat-limits marketing and no claim to hold users' network credentials - which is why this is C rather than D. Email is the strong half and pulls the grade up: native sending infrastructure with SPF, DKIM and DMARC handling, per-tier mailbox allocations and named CRM and mailbox connectors rather than scraped access.

Two AI-specific stewardship questions, both unanswered. First, the training boundary: Duo is marketed on continuous learning from rep feedback, and nothing states whether that learning is confined to the contributing tenant or pooled across the customer base, which matters when competitors share a platform.

Second, and more unusual, voice cloning creates a persistent synthetic artefact of a named individual and nothing published covers how the voice model is created, where it is stored, how long it is retained, whether the rep can revoke it, or what happens to it when that rep leaves the company or the customer churns. A cloned voice is closer to biometric data than to a message template and is governed as such in several jurisdictions.

What counts in favour and keeps this off the bottom: Google Cloud KMS with hardware security modules for key management, encryption at rest and in transit, semi-annual employee access reviews and role-restricted internal access.

A genuine split, and the most instructive one in the index so far. On provenance disclosure Amplemarket leads the field: it is the only vendor here that publishes guidance telling customers to state, at the top of an email or spoken at the start of a call, where the prospect's data came from and why they are being contacted, with a worked example. Nobody else does this.

On AI disclosure it has the sharpest exposure in the index: Duo Voice generates AI voice messages using cloned rep voices, sent to prospects at scale, and a customer testimonial on Amplemarket's own pricing page describes the voice cloning as a game-changer for personalised outreach at scale.

Synthetic audio delivered to a person is squarely the artificially generated content Article 50(2) requires to be marked as such, and there is no Article 50 position anywhere on the site, no statement that cloned-voice messages are labelled, and no mechanism described for a recipient to know they are hearing a synthesis. Best-in-index on where the data came from, silent on whether the voice is real. C on the net.

Depth over breadth, and the depth is real: bi-directional Salesforce and HubSpot sync, plus Zendesk Sell, Gmail, Microsoft Outlook and Zapier, a full API, and multi-team hierarchy support. Bi-directional sync on the two CRMs that matter is a stronger claim than a large connector count with shallow one-way pushes.

Held at B: the supported-integration list is narrow by comparison with peers (third-party directories describe it as a small but practical set against ActiveCampaign's 1,000+ or Alta's 60+), no object-level field mapping is published, and no MCP or agent-gateway surface exists.

Worth flagging for buyers and it recurs in this index: SSO is available only on the top elite tier - an access-control primitive sold as an upgrade, the same pattern as Aloware gating transcript PII redaction to its highest plan.

A clean single-region posture, stated plainly rather than left to inference: services are hosted in US-based data centers, the privacy policy confirms personal data may be stored in the United States, and cross-border transfer from the EEA, UK and Switzerland is covered by the Data Privacy Framework and Standard Contractual Clauses. Infrastructure is Google Cloud (identified via the Cloud KMS key-management disclosure) with data protection agreements stated to be in place with vendors.

Same band and same reasoning as 9Lenses: a residency posture with no customer-selectable options in it, disclosed clearly, beats silence. No EU or UK region is offered, which is a genuine constraint for European buyers with residency requirements and not one the vendor obscures.

The strongest single security disclosure in the index: Amplemarket states that its system is subject to an annual third-party penetration test and that the yearly report evidencing potential vulnerabilities is shared on its trust center. Publishing the findings report rather than an attestation that a test occurred is rarer than publishing SOC 2, and it inverts the usual incentive - most vendors treat pen test findings as the most tightly held document they own.

Alongside it: SOC 2 Type II maintained with annual audits by external cybersecurity auditors, a Trust Center and Trust Portal for compliance documentation, encryption at rest and in transit, Google Cloud KMS with hardware security modules for encryption key management, application secrets held in secret managers, role-based employee access with semi-annual reviews, and controlled API access.

One caveat that belongs in any comparison but does not reverse the grade: SSO is gated to the Elite tier, so the buyers most likely to need enforced identity federation on a lower plan cannot have it.

One tier is genuinely published with usable units, two are not. Startup: $600 per month for 2 users, annual billing only, roughly $300 per seat per month or $7,200 a year, including 30,000 contacts, 15,000 email credits and 480 phone credits per user per year, Duo Copilot and Copywriter, multichannel sequences, the dialer and the full deliverability suite.

Credit mechanics are explained (credits consumed on reveal, a revealed contact not re-charged on reuse) and phone credit top-ups are published at $0.50 each. Growth (4+ users, 280,000 contacts, adds Duo Voice) and Elite (10+ users, 1,000,000 exportable contacts per user per year, adds Duo Inbox and SSO) are quote-only, with third-party estimates spanning a very wide range.

Against: annual commitment with no monthly option, so the minimum entry is $7,200 before any evaluation of fit; additional mailboxes carry "starting from" language with no figures; and third-party accounts conflict on whether a free trial actually exists. The established test is whether the buyer can budget their own purchase - a Startup buyer can, a Growth or Elite buyer cannot. Same shape as ActiveCampaign's B: published tiers with load-bearing add-ons left unpriced.

Export exists and is quantified as a commercial unit rather than a right - exportable contacts are metered per tier, up to 1,000,000 per user per year on Elite - which tells the buyer the ceiling but not the mechanism. Published Terms of Service govern customer use of Service Output Data after extraction, which is more than several indexed vendors offer.

Missing: any post-termination data rights statement, any deletion timeline or confirmation artefact, any account for sequence history, engagement data, call recordings or cloned voice models on exit, and any documented export path for anything other than contact records. The annual-only contract structure sharpens rather than softens the question, since a buyer who concludes at month three that the fit is wrong owes nine more months and has no documented offboarding path at the end of it.

The deepest deliverability surface in the index and the only one sold as a first-class product layer rather than assumed. Included on every tier, not gated: native email warmup, a Domain Health Center, a Deliverability Booster, an Email Spam Checker, and Mailbox Recommendation that selects which mailbox sends.

Add inbox placement testing, SPF/DKIM/DMARC monitoring, structured per-user mailbox allocations (2, 4 and 6 by tier) and a published aggregate result - under 3% average bounce rate across the database, with 70m records refreshed weekly as the mechanism that sustains it. Amplemarket's competitive positioning explicitly targets platforms that discontinued warmup and left customers with no native deliverability protection, so this is a stated strategic commitment, not a feature list.

Two honest caveats in the note rather than the grade: independent reviews report deliverability problems in practice despite the infrastructure, and mailbox warmup is itself a contested practice - it manufactures positive engagement signals to influence filter reputation, which is inbox-signal management, not consent.

Segments are explicitly mapped to tiers with seat counts and allocations rather than described in adjectives: Startup for small businesses, startups and founder-led sales at 2 seats; Growth at 4+; Elite for larger enterprise teams at 10+. Third-party analysis places the strongest fit at 2 to 10 reps in mid-market running high-volume outbound on Salesforce or HubSpot. Named customers span geographies (Deel, Cabify). Founded 2018, San Francisco, with a European engineering heritage.

Held at B: no enumerated country coverage, no per-region data density published for a 200M-record global database, and independent reviews report that contact data quality varies materially by segment and geography - which is exactly the coverage detail this axis asks for and the vendor does not supply.