Bigin by Zoho CRM

The vendor's own price list settles this axis and it does so more cleanly than any other entry in the index. The page title and meta description call Bigin an AI powered customer relationship management platform, and the top edition carries a Powered by AI badge, yet the free edition and the paid Express edition ship with no AI credit allowance at all.

Two of the four editions are therefore sold as complete products with the intelligence layer absent, and the AI features enter only at the third tier with a thousand credits a month and the fourth with three thousand. Remove the models entirely and what remains is a full system of record: pipelines with customisable stages, contact, company, product and activity management, workflow automation, stage transition rules, two way email, a built in phone with recording and routing, WhatsApp, mass email, forms, booking pages, payment links, dashboards and a developer API. That is the product 50,000 businesses bought. The intelligence layer is a real and growing addition to it rather than the reason it exists.

Top of band, and the vendor deserves credit for describing the loop plainly rather than leaving it to inference. The published deployment model has three steps, install an agent with no coding, configure the actions it may perform and supply its training data, and then sit back, and the vendor writes that once an agent is live it carries out the specified actions on its own while the operator can supervise, intervene and improvise at any time.

Scoping actions at install is a genuine control and the stated intervention right is more than most vendors here offer. What holds the grade is that no mechanism is described for any of it: no approval step, no review queue, no confidence threshold, no guardrail that withholds a response rather than sending it, no escalation by risk and no agent action audit trail.

Meanwhile the two customer facing agents are autonomous by design, since the Reply Assistant answers inbound customer mail without intervention and the CrossSell Genie sends recommendations to the customer automatically after a deal closes. An asserted right to intervene is not an oversight architecture.

Better than the corpus norm on two counts. First, the mobile intelligence features name their model providers outright, Apple Intelligence on iOS and Gemini Nano and Galaxy AI on Android, and describe them as on device, which tells a buyer both who is processing and where.

Second, the group publishes a service specific sub processor register that carries a distinct AI sub processor class, stating that those providers may process prompts, content or other inputs needed to deliver AI functionality, and stating a customer right to disable a particular third party provider except where it serves a critical requirement such as fraud prevention. A named class of AI sub processors with a disable right is rare at any size.

Off the top of the band because the models behind the server side Zia features inside Bigin, which is where the agents and the writing assistant actually run, are not identified, no version is published, and no inference location is stated for them.

Strong on attribution and scale, short on method. The customer evidence is properly attributed rather than anonymous, with a case study library carrying full names, job titles and companies across several continents, including Sealanes Brighton, ACF Events, Larsen and Toubro Cloudfiniti, V4Creative in South Africa, Premier Chess Academy and Beyond Egypt.

Scale claims are specific and checkable, more than 50,000 businesses across 150 or more countries in 28 languages, and the vendor publishes its own review platform scores of 4.6 on G2 and 4.8 on Trustpilot rather than only quoting favourable lines. One customer outcome is quantified and dated, a revenue increase of 232 percent in the first three months from May to July 2024.

Off the top of the band because that figure carries no measurement basis and revenue growth at a single small business is not isolable to a customer relationship management tool, and because no independent analyst evaluation or commissioned economic study exists for Bigin as a distinct product.

Four regulated communication surfaces run through this product and no regulation is named on any of them. Mass email goes out at up to a thousand messages a day per organisation on the top edition with add ons available to raise it, the built in phone makes and records calls and runs automated voice responses, WhatsApp Business messaging is held against the contact record, and an AI agent replies to inbound customer mail.

Nothing published addresses electronic marketing consent, unsubscribe handling, suppression lists, call recording notification, do not call screening or the WhatsApp business messaging policy. Recorded as observed rather than concluded, since group level acceptable use and anti spam terms exist and were not read this pass and this is a failure to locate a product level position rather than a finding that none exists.

One structural point belongs on the record even though the vendor did not build it: WhatsApp business messaging runs through the platform owner's own template approval and opt in machinery, so that channel carries controls the vendor inherits rather than publishes.

The group surface is substantial and it is published rather than gated. A privacy notice covers transfers, naming a group company agreement based on the European Commission's model contractual clauses as the mechanism for processing to which the General Data Protection Regulation applies, and offering a copy on request. A data processing addendum is available, requested through a form and returned for signature.

A service specific sub processor register is maintained per product and per data centre, naming entities, purposes and processing locations, and Bigin appears in it by name. The company states plainly that it does not sell customer data and does not use it for advertising, which is a commercial position rather than a legal one and is unusually load bearing given the company takes no advertising revenue.

Off the top of the band because the notice is group wide rather than product specific, Bigin's own domain carries no privacy statement of its own, and the processing addendum is a request and signature flow rather than a published document a buyer can read before contacting anyone.

The finding here is a single phrase. From the third edition upward the product ships a paid data enrichment feature described as enriching contact and company data from various sources, and various sources is the whole of the published provenance. No supplier is named, no sourcing route is described, no licence position is stated, and no accuracy or coverage figure is given, on a product sold in more than 150 countries including throughout the European Union.

There is no notification to the people whose records are being enriched, no self service lookup and no removal route located, which is the same gap several data vendors in this index have and which one of them discharges properly with a published notice telling the individual their information is held.

The rest of the data supply is clean and worth distinguishing: advertising lead capture from Meta, Instagram, LinkedIn and TikTok is first party and consented at source, and the business card scanner takes data the prospect physically handed over.

Low exposure, and it comes from the integration architecture rather than from a policy. Every third party surface here is an official one: WhatsApp through the business messaging interface, lead capture through the advertising platforms' own lead advertisement integrations at Meta, Instagram, LinkedIn and TikTok, mailbox and calendar through Google Workspace and Microsoft 365, meetings through Teams and Zoom, and more than two thousand further applications through an established automation platform.

Nothing scrapes, nothing automates actions against another platform's user surface, nothing rotates accounts, and no marketing anywhere treats a platform's limits as an obstacle to be routed around, which is what has taken other vendors in this index to the bottom of this axis.

Off the top of the band because no conformance position is stated in writing, which is the published bar for the highest grade, and because the messaging channel carries platform policy obligations that fall on the sender and are nowhere addressed.

Top of band on a genuinely useful control and held there by the one question that matters most. The creditable part is the group sub processor register's AI class, which discloses that AI providers may process prompts, content and other inputs and gives the customer a stated right to disable a particular provider, together with the company's standing position that it neither sells customer data nor uses it for advertising. What is missing is any statement on training.

Nothing published says whether customer records, email content or agent interactions inside Bigin are used to train or improve models, whether any learning is scoped to the single tenant, or how long prompts and generated outputs are retained.

The question is live rather than theoretical here, because the vendor invites customers to train the Reply Assistant on their own data to match brand tone, and because the MCP server deliberately exposes the customer's records to external language models. Other vendors far smaller than this one have answered the tenancy question in writing.

A new shape for this index and it is worth naming precisely. The Reply Assistant answers inbound customer enquiries sent to a company's team addresses without intervention, and the vendor invites the customer to train it on their own material so that the replies match the brand's tone and style. So a person writes to a company and a machine writes back in the company's voice, and no disclosure position is published anywhere.

This is milder than the impersonation cases graded elsewhere, because the recipient initiated the contact, the correspondent is a team alias rather than an invented human name, and nothing here clones a voice, manufactures a location or fabricates research effort.

It is also unambiguously in scope for Article 50 of the EU AI Act, since the recipient is a person and contact is not merely foreseeable but certain, the marking duty rests principally on the provider of the system, and this vendor operates European data centres and sells in 28 languages. The regulation is not mentioned.

The deepest integration surface graded so far at this price point, and the decisive detail is what sits in the free tier. Developer APIs and Model Context Protocol support are both available from the free edition upward, so a business paying nothing can connect its records to external language models and to its own systems. That is the fourth MCP server in this index and the first shipped at no cost.

The native connector set is broad and named rather than counted: Google Workspace with contacts and calendar sync and a Gmail add on, Microsoft 365, Outlook, Teams and Teams calling, Zoom, WhatsApp, QuickBooks, document signing, payment gateways, Mailchimp and Constant Contact, advertising lead capture from four platforms, more than a hundred telephony providers, and more than two thousand applications through an automation platform, alongside a large first party suite.

Migration is documented in both directions, single click in from three named competitors and one click up to the vendor's larger platform. The caveat that belongs on the record: a substantial number of the listed capabilities are marked as requiring a separate active subscription in the third party product.

A real multi region posture with published consequences, short of the top band only on documentation. The company operates data centres in several regions including the United States, the European Union at Amsterdam and Dublin, India and Australia, the customer's region is fixed by the domain through which the account is created, and the sub processor register is published per data centre so a buyer can see which third parties apply to their own region.

The pricing page adds an honest and unusual disclosure, that some features and integrations are not available in all data centres, which tells a buyer the choice has trade offs rather than pretending it does not. Off the top of the band on three counts: the selection mechanism and the region list are not documented on Bigin's own surface, the group privacy notice reserves processing, transfer and storage across the United States, the European Economic Area and other countries where the company operates, and no route is described for moving an existing account between regions. Re verify against the vendor's own data centre documentation before this row is quoted.

Substantial breadth, verified partly at one remove. Bigin's own answer names ISO 27001, SOC 2, GDPR and HIPAA and states that the product runs on the group's infrastructure. Independent reporting from 2026 extends that materially, recording ISO/IEC 27001, 27701, 27017 and 27018 held with validity through August 2028, SOC 2 Type 2 for general cloud services, and Cyber Essentials Plus at the United Kingdom and European data centres, with certificates described as downloadable from the company's accounts portal rather than merely asserted.

ISO 27701 is the privacy management standard whose absence has been a real differentiator elsewhere in this index. Held off the top of the band because the product's own surface states SOC 2 with no type, no audit period and no report route, no auditor is named, no penetration testing is attributed, and the strongest evidence here is third party rather than read directly from the vendor's trust pages this pass. Re verify at the group security and compliance pages.

The most complete commercial disclosure in the index. Four editions carry published per user prices in both billing cycles and four currencies, a free single user tier, then seven, twelve and eighteen dollars per user per month billed yearly against nine, fifteen and twenty one monthly, with no seat minimum on any paid tier.

The gates that decide the real bill are all enumerated rather than implied: record ceilings of 500, 50,000, 100,000 and one million, automation counts of three, thirty, fifty and a hundred, pipeline counts, custom field counts, mass email volume per day and booking page counts, each with a note saying whether an add on can raise it.

Commercial terms are published as prominently as the price, in a comparison table that names what other vendors do: cancel at any time with no penalty, a full refund inside thirty days on monthly or forty five on annual, prorated refunds after that if broken or discontinued functionality is not resolved, downgrade credits for unused value applied as a subscription extension, and no lock in. A subscription calculator and a return on investment calculator sit alongside.

Two honest gaps belong on the record. The AI credit allowances of a thousand and three thousand a month come with the vendor's own statement that consumption varies by feature and complexity so usage cannot be mapped to a fixed number of actions, which is candid and still leaves that line unbudgetable. And two adjacent lines on the same page contradict each other on whether local taxes are included in or added to the quoted prices.

Both halves of the exit question are answered and neither costs anything. Data export is a feature of every edition including the free one, with no credit metering, no volume ceiling and no upgrade requirement, and free data backup sits alongside it on every tier, so a customer's ability to leave with their records does not depend on what they are paying. The vendor states the principle in its own words, that the customer owns their data and can export it at any time.

The contract side is equally clear and is published as a deliberate comparison against the rest of the category: cancellation at any time with no penalty and no questions, a full refund window of thirty days on monthly plans and forty five on annual, prorated refunds after that where broken or discontinued functionality is not resolved, credits for unused value when partially downgrading an annual subscription, and an explicit statement of no lock in.

Migration is documented outward as well as inward, with one click upgrade to the vendor's larger platform. The gap, and it is the one that keeps this from being complete: nothing published states a post termination retention period, a deletion timeline or a deletion confirmation artefact. Re verify in the group terms of service.

Top of band on two published mechanics and no named controls behind them. What exists is a hard volume governor, a thousand mass emails a day per organisation on the top edition with add ons required to exceed it, and per message email insight reporting the status of each send. A published cap is a real discipline and most vendors here do not have one.

What is absent is the control set: no warm up, no guidance on sender authentication, no bounce or complaint threshold, no blocklist monitoring, no placement testing, no domain health reporting and no suppression mechanics. The architecture also splits in a way the vendor does not explain.

Ordinary correspondence rides the customer's own connected mailbox at Gmail, Outlook or the vendor's mail product and therefore carries the customer's own sending reputation, while mass email leaves through the vendor's infrastructure, and nothing published describes how the second is managed. Recorded as observed rather than concluded, and there is no public evidence of a delivery problem in either direction.

The clearest and most falsifiable segment statement in the index. The vendor names a headcount band rather than a euphemism, businesses of one to twenty employees, names the verticals it serves, agencies, consultancies, real estate firms, schools, clinics, retailers and ecommerce brands, and names the condition that qualifies a buyer, having outgrown spreadsheets while finding traditional platforms too complex or expensive.

More unusually it names where it stops and hands the customer on, stating that the larger platform in the same portfolio is built for mid market and enterprise teams with multi step workflows and deep customisation and that a growing customer should migrate up.

Coverage is quantified: more than 50,000 businesses in more than 150 countries, 28 named languages, multi currency operation from the third edition, and named customers spanning the United Kingdom, the United States, South Africa, Egypt and India. Independent review platform data corroborates the claim rather than contradicting it, with the reviewer base concentrated overwhelmingly at fifty employees or fewer. A vendor that publishes its own ceiling is describing its market rather than claiming all of it.