Autotouch AI

The strongest form of evidence on this axis: the AI agent is the pricing unit. Autotouch's own pricing page defines the tier ladder by how many configurable agents the plan includes - two on Founder, three on Growth, custom on Enterprise - so a buyer is literally purchasing quantities of AI worker. Self-described as AI-first and as the execution layer for agent-driven sales.

Remove the models and what remains is a dialer and a shared inbox with no research, no enrichment reasoning, no generated copy and no memory layer. Fifth A on this axis and the vintage pattern still holds without a single exception across sixteen graded vendors.

Agents are described as configurable workers that run prospecting, enrichment and outreach steps on the customer's behalf, and third-party categorisation tags the product with independent decision making. The word configurable is doing a lot of work and nothing behind it is published: no description of what the configuration surface actually governs, no approval gate before an agent sends or dials, no guardrails that withhold a non-compliant action, no escalation threshold, and no audit trail of what an agent did and why.

The memory layer adds a second unexamined dimension - the system is stated to learn from rep actions and carry team preferences across touchpoints, so behaviour drifts over time with no published mechanism for a manager to inspect or reset it.

No model provider, family or version named for the research, generation or enrichment layers. What lifts this to the upper end of C rather than the floor is a real architectural disclosure in the privacy policy: Autotouch states that connected Gmail data may be used to train PERSONALISED machine learning models built on that customer's own data and usage patterns.

That tells a buyer something structural about how the system works, which is more than the functional descriptions most vendors offer. It is still a training disclosure rather than a model disclosure - no model family, no evaluation results, no accuracy figure for the enrichment waterfall, and no measured quality claim for generated copy or call scripts.

Named customers are published rather than implied (NEO, Spinwheel, Worksuite, Advent Tech Inc.), which is more than several better-funded vendors in this index manage, and one G2 review from a named sales manager at a company under fifty employees describes daily use, smoother onboarding and more meetings and pipeline after adoption. That is the whole evidence base.

No case studies, no quantified outcomes with a stated methodology, no analyst coverage, and effectively no review volume - listings on multiple software directories carry no reviews at all. C is the honest read for an early-stage vendor whose product may well work; there is simply not enough independent record to grade it higher.

Three regulated outreach surfaces and no published posture on any of them. The product dials - a built-in power dialer is included on every plan - and there is no DNC list management, no registry scrubbing, no A2P 10DLC registration, no STIR/SHAKEN attestation and no abandoned-call handling, against the Aloware A on this axis which was built on exactly those controls. It sends email with no unsubscribe implementation, opt-out handling or CAN-SPAM treatment documented.

It automates LinkedIn actions with no consent framework. No GDPR lawful basis is stated for the enriched contact data, and no statement identifies where responsibility transfers to the buyer. C rather than lower because nothing markets evasion; this is silence across the board.

A published privacy policy with a named legal entity and physical address (Autotouch LLC, 425 South 5th Street, Brooklyn NY), which already puts it ahead of several vendors here. Inside it, one clause is specific, deliberate and well drafted - the Gmail training disclosure graded under AI Safety - and the rest is standard policy-generator boilerplate, including a security section whose substance is that no method of internet transmission is 100% secure.

Missing: any DPA, any sub-processor list, any enumerated lawful basis for holding and enriching third-party contact records, any DPO or EU representative, any cross-border transfer mechanism, and any data subject request route for the individuals the waterfall enriches. The contrast inside a single document is the finding: where someone thought carefully, the drafting is good, and everywhere else it is a template.

The enrichment MECHANISM is described unusually clearly - email addresses and phone numbers verified through multi-provider waterfalls with automatic fallbacks - and not one provider in that waterfall is named. A buyer can see how the accuracy is achieved and not who supplies any of it, which means no licensing basis, no provenance chain and no way to answer where a given record came from.

Second collection surface with no stated basis: the Chrome extension builds prospect lists directly from web pages the rep visits, so contact data enters the system by scraping the open web through the customer's browser, and no terms, permission model or lawful basis is published for it.

Automated LinkedIn profile visits and connection requests are a documented product feature, alongside personalised outreach recommendations on LinkedIn and a Chrome extension operating across the pages the rep browses. No position is stated on LinkedIn's User Agreement, no conformance claim is made, and the delivery mechanism is never described - and the account that gets restricted belongs to the buyer, not the vendor.

Same grade and same reasoning as Amplemarket, which lists the same automation set: this is C rather than D because there is no account-rotation-to-beat-limits marketing and no claim to hold network credentials. The mitigating half is genuine: email flows through the customer's own Gmail or Outlook by OAuth, or through named third-party infrastructure (Instantly, Smartlead), rather than through scraped sessions.

The finding of this build, and it comes from the smallest vendor in the session. Autotouch's privacy policy states plainly that if a customer connects a Gmail account, data from emails sent and received through the platform may be used to train machine learning models - and then answers the boundary question in a headed clause titled personalised training only, stating that Gmail-derived data will only be used to train personalised models designed to enhance features and provide recommendations based on that individual's own data and usage patterns.

That is the cross-tenant training question answered in writing, at the most sensitive data source a GTM tool touches. Alta, Artisan, Autobound and Apollo all leave it unanswered; a Brooklyn LLC with four named customers wrote it down.

Held at B rather than A because it is a privacy-policy statement rather than a contractual commitment in an MSA or DPA (Adobe holds the only A on this axis on exactly that distinction), and because no retention schedule, encryption specification, sub-processor list or account of what happens to the trained model artefact on termination accompanies it.

Local presence dialing is included on every plan and described plainly - caller ID matched to the prospect's locale - which is the deliberate manufacture of a false signal about where the caller is, sold as a default rather than an option.

Aloware took C on this axis for the same feature, but Aloware sold Branded Calling as its counterweight, showing the real company name on the recipient's screen; Autotouch has no counterweight, no branded calling and no STIR/SHAKEN attestation mentioned anywhere.

Compounding it: AI-generated call scripts, automated LinkedIn connection requests sent under the rep's identity, and emails generated to match the individual rep's own writing style - the product is explicitly tuned to imitate a specific named human. No Article 50 position and no disclosure mechanism at any touchpoint. Bottom of the C band.

Punches well above the vendor's size, and unusually the depth is verifiable from outside. Named integrations across Gmail, Outlook, Instantly, Smartlead, LGM, Zapier, Attio and HubSpot, plus API and command-line tooling with published developer documentation and webhooks tiered by plan (outbound on Founder, inbound and outbound on Growth, advanced on Enterprise).

The Attio integration is documented at object level on Attio's own app directory rather than only on autotouch's site: enriched account data pushed back to the CRM, contacts synced alongside accounts, tasks, emails and calls logged as activities, and sync triggered by enrichment and engagement actions, with setup steps published. A third-party-hosted, object-level integration description is stronger evidence than a large vendor's unverified connector count. Held at B: the named connector list is short, and no equivalent depth documentation exists for HubSpot.

Nothing published: no hosting region, no cloud provider, no residency option, no data centre location, and no statement on where enriched contact records, call recordings, connected mailbox content or the personalised model artefacts are processed and stored. A US legal entity in Brooklyn implies US processing and the vendor never says so. For a product that ingests Gmail content and trains models on it, where that training happens is a question a buyer will be asked and cannot answer.

No SOC 2, ISO 27001, penetration test attestation, trust centre or security page located. The only security content is the boilerplate paragraph inside the privacy policy stating that no method of internet transmission or electronic storage is 100% secure and that absolute security cannot be guaranteed - which is a disclaimer, not a control set, and is the opposite of what this axis measures.

Weighed against what the platform holds: Gmail OAuth tokens, mailbox content used for model training, dialer access and enriched contact records. C rather than the floor for two reasons that genuinely distinguish it from the bottom of this axis - access runs through revocable scoped OAuth rather than custody of the user's credentials, and the vendor publishes a real legal entity and address rather than hiding behind a domain.

Publishes the mechanics, which is rarer and more useful than publishing a headline number. The pricing page states how the model actually works: sales seats cover reps while credits are consumed by enrichments and actions, with a stated conversion rate - phone numbers cost 5 credits and everything else costs 1. Mailboxes are priced at $5 per inbox per month and explicitly excluded from plans rather than quietly assumed.

The power dialer including local presence is stated as included on all plans. Agent allocations and webhook capability are published per tier. A directory listing records a Premium plan at $20 per month including 50 research credits. A published credit conversion rate is the thing that lets a buyer model cost per prospect, and almost no credit-priced vendor in this index supplies one.

Held at B: the Founder and Growth dollar figures did not resolve from the retrieved surface, Enterprise is quote-only, and one major directory still lists the vendor as having provided no pricing information at all - a staleness conflict in which the vendor's own page is authoritative.

A real practical portability answer sits inside the product design and is worth crediting: bi-directional sync with Attio and HubSpot pushes enriched accounts, contacts, tasks, emails and calls back into the customer's own CRM continuously, so the valuable output leaves the vendor by default rather than on request at termination. That is better portability than most export features.

Everything formal is absent: no post-termination data rights, no deletion timeline or confirmation, no export path for the memory layer or sequence history, and no statement on unused credits at cancellation. The sharpest unanswered question on this record follows directly from its best disclosure - a personalised ML model has been trained on the customer's Gmail content, and nothing says whether that model artefact is destroyed when the customer leaves.

Substantially delegated, and honestly so. Sending runs either through the customer's own Gmail or Outlook by OAuth, or through Instantly and Smartlead - both dedicated cold-email infrastructure products with their own warmup, rotation and placement tooling - so the discipline sits with a named specialist rather than being claimed and not delivered. That is a legitimate architecture.

What Autotouch itself publishes is nothing: no warmup, no inbox placement testing, no domain health monitoring, no bounce or complaint threshold, no volume governance for agents acting at machine speed. Worth flagging without overclaiming: mailboxes are sold as a metered add-on at $5 per inbox per month, which is functionally an inbox-rotation economy, and no policy governs how many a customer should run or why.

Three incompatible descriptions in circulation: Attio's integration directory calls it built for small teams, a software directory places it with mid-sized to large B2B organisations in technology, software and professional services, and another says companies of varying sizes without an industry focus.

The tier names do imply a genuine ladder starting at the individual - Founder, Growth, Enterprise - and the named customers are all small US technology companies, which is the most likely truth. The vendor publishes no segment definition, no employee-count band, no ideal-customer framing, no geographic coverage and no supported markets or languages, and no per-region density for enrichment - which for a waterfall built on unnamed providers is the practical limit on non-US prospecting.