Bombora

The models are what turn page views into a product. Raw cooperative signal is a record of which company looked at which page, and converting that into topic level intent requires understanding what each page is about, which the vendor does with natural language processing, named entity recognition and transformer based classification against a taxonomy of tens of thousands of business topics.

Remove that layer and there is no Company Surge output at all, only undifferentiated traffic, so the removal test fails cleanly rather than leaving a diminished product. A second model layer performs the scoring itself, evaluating behavioural change per account and topic pair against that account's own baseline. Both predate the current market vocabulary, since the company has operated this way since 2014, so this is a long standing modelled product rather than a recent repositioning.

Held below the top band because the vendor itself locates the moat elsewhere: the durable advantage described across its own material is the exclusive publisher relationships, not the modelling, and a competitor with the same cooperative could in principle build comparable classification. Ask what accuracy the topic classification achieves and against what ground truth.

Nothing here acts. The product is a scored data feed delivered on a weekly cadence into the customer's own systems, and every decision about what to do with a surging account is taken by a person or by software the customer operates elsewhere. There is no agent, no sending, no outreach and no action taken in the world, so the questions this axis exists to ask have little to attach to and the grade reflects scope rather than a shortfall.

The one autonomous process is the classification and scoring pipeline itself, which runs continuously and unsupervised across the cooperative, and nothing published describes what oversight applies to it: whether topic assignments are reviewed, whether misclassification can be reported and corrected, or what recourse a company has if it believes its own activity has been mischaracterised. Ask what human review applies to topic classification and how a scoring error would be raised and corrected.

The scoring method is published rather than protected, which is rare for a product whose entire output is a number. The vendor states the architecture in named terms, describing natural language processing, named entity recognition and transformer based classification, and then publishes how the score is actually computed: behaviour per account and topic pair is compared against that account's own historical baseline, using roughly the most recent three weeks against a twelve week reference period, producing a weekly value from zero to one hundred, with scores above sixty representing a statistical increase in research activity.

A buyer can therefore understand what a surge score means, why it is relative rather than absolute, and what threshold matters, which is materially more than a platform reporting an opaque propensity number. Held below the top band because the evaluation half is missing.

No accuracy, precision or false positive rate is published for the topic classification, no measure exists of how often a surge above the threshold corresponds to real buying activity, and no model version or provider is named. Ask for classification accuracy against labelled content and for the false positive rate at the stated threshold.

Independent analyst standing and published methodology, without the measurement the category turns on. An industry analyst named the vendor a leader in its evaluation of intent data providers and described its content consumption model as the standard for third party behavioural data, which is genuine external assessment rather than self report.

The vendor publishes its scale in specific figures and, unusually, publishes how its score is calculated, so a buyer can reason about what the output means. What is absent is the decisive evidence the category editorial names: measured incremental lift against a holdout, showing that accounts flagged as surging convert at a higher rate than comparable accounts that were not. No such study was located from the vendor or independently.

Third party analysis raises a related practical point the vendor does not address, that the signal arrives as a weekly report of surging accounts and requires substantial additional tooling before a team can act on it. Ask for measured conversion lift on surging accounts against a matched holdout, over a stated period.

The vendor sends nothing and supplies the input that triggers other people's sending, which places the obligations one step downstream. No sequencer, dialer or campaign delivery exists here, so consent capture, suppression and calling rules sit entirely with whatever systems the customer uses to act on a surge signal.

The vendor does maintain the upstream half properly, with consent obtained at collection and an opt out route, and the company level design means the feed itself does not hand a customer a person to contact. What is not addressed is the handoff. Nothing published states what obligations transfer to a customer that combines this signal with contact data from elsewhere and begins outreach, and no guidance describes whether a company flagged as surging can be contacted on that basis alone.

That is the question a customer's counsel would ask and the published surface does not answer it. Ask what the vendor's stated position is on using surge signal as a basis for outreach, and what obligations it considers to transfer to the customer.

Working rights machinery on a current policy, sitting alongside contract and guidance documents that have not been touched in eight years. On the current side the privacy policy was revised in June 2026, a dedicated data subject request address and form are published separately from a general privacy address, an opt out route is maintained, rights under European law are enumerated, and the vendor states a candid limitation about individual notice arising from company level aggregation rather than glossing it.

That candour is worth crediting. Against it sits a staleness problem that is unusual in its extent. The processing agreement published on the site is versioned effective May 2018 and has not been reissued through the intervening changes to transfer law. A separate page addressing the European regulation remains live written in the future tense, describing the law as coming into effect and the vendor as running a readiness programme, eight years after it applied.

For a business whose entire product is regulated personal data, a contract instrument and a compliance page frozen in 2018 are material. No transfer mechanism, data protection officer or retention period was located. Ask for the current processing agreement with its version date, the transfer mechanism, and the retention period for cooperative signal.

The most complete provenance disclosure recorded in this index, and the only one that answers every question the category editorial asks. The collection mechanism is named precisely: a proprietary tag placed on each cooperative site under direct publisher agreement, writing to first party cookies, with consent obtained at the publisher and consent strings that can be traced and honoured for deletion under named privacy regimes.

The exclusion is stated as plainly as the inclusion, with the vendor declaring that it does not use bidstream data and explaining why that source sits in questionable territory, which is a vendor naming and rejecting the practice most of its competitors rely on. Individual publisher members are named rather than described in aggregate, spanning general business titles and vertical publications across technology, telecommunications, legal and retail.

Exclusivity is quantified at eighty six percent of cooperative signal contributed only to this vendor. The architecture supplies its own privacy limit, since signal resolves to a company domain rather than to a named person, which is a design constraint rather than a promise. The vendor's own framing is that there is no secret about how the data is gathered, and the published record supports that. Three honest limits belong on the record.

Consent is obtained by the publishers rather than by this vendor, so a buyer inherits the co-op members consent practices. No indemnification position was located. And the vendor's own pages disagree on scale, giving site counts of five thousand and five thousand five hundred, domain counts of four point seven and four point nine million, monthly interaction counts of fifteen point eight and sixteen point six billion, and topic counts of six thousand eight hundred, twenty thousand one hundred and twenty one thousand six hundred, which reflects pages of different vintages left live rather than a disputed claim.

The collection surface is owned through direct agreement rather than borrowed from a platform, which is the structural reason this vendor is durable. The tag runs on cooperative sites under contracts with those publishers, writing to first party cookies, so the signal does not depend on a platform whose terms could be withdrawn and does not rely on third party identifiers whose deprecation has disrupted much of the advertising ecosystem.

The vendor addresses that transition directly, arguing that publisher first party cookies persist through it, which is a durability position most signal vendors cannot make and is checkable rather than rhetorical. Distribution runs through named activation partnerships and through the larger account based platforms that license the feed, all commercial arrangements rather than extraction.

Held below the top band because the dependency has moved rather than disappeared: the cooperative rests on publisher relationships that individual members could exit, and nothing published describes what happens to coverage if significant members leave or what contractual term binds them. Ask what commitment period governs cooperative membership and how coverage would be affected by member departures.

The architecture supplies a real boundary and the stewardship position around the models is undescribed. Aggregating to a company domain rather than to a named individual is a design decision that limits what the corpus can reveal about any person, and it is stated consistently across the vendor's material rather than claimed once. Beyond that the public surface is silent on the questions this axis asks.

Nothing states how long raw cooperative signal is retained before or after aggregation, whether derived scores persist indefinitely, whether any customer supplied data submitted for matching contributes to model training, or what governs the classification models beyond their architecture being named. For a system continuously ingesting billions of monthly interactions and deriving persistent behavioural profiles of companies, retention is the load bearing question and it is not answered. Ask what retention applies to raw signal and to derived scores, and whether customer supplied data is used to train or tune classification.

The person whose behaviour is measured is given a consent decision at the point of collection and a route out afterwards, which is a stronger position than most signal vendors can describe. Consent is captured at the publisher when the tag fires, written to a first party cookie, and the vendor states that the resulting consent strings are traceable so that a later deletion request can be honoured against the specific signal.

A browser level opt out control is published alongside a data subject request form, a dedicated request address and a separate privacy address. The design limits exposure further, since signal is aggregated to a company domain rather than held against a named person. Three limits keep it below the top band and the vendor states one of them itself.

Consent is obtained by the publisher rather than by this vendor, so what a reader actually agreed to depends on that site's notice, and few readers would understand they were joining a business intent cooperative. The browser opt out is device and browser scoped rather than identity scoped, so it does not persist across machines or survive clearing cookies.

And the vendor discloses candidly that company level aggregation may prevent it providing individual notice where data cannot be linked to a person without disproportionate effort. Ask what the publisher consent notice actually says about cooperative participation.

The distribution model is the integration strategy, and it reaches further than most vendors own surfaces do. Rather than requiring buyers to work in its own interface, the vendor supplies signal into the platforms they already run, with named activation partnerships including a major marketing cloud and licensing arrangements that place the feed inside several of the larger account based platforms in this index.

A buyer running one of those may already be consuming this data without a direct contract. Several published data set types are offered beyond the core intent score, spanning demographic, firmographic, behavioural and contextual segments, so the feed can serve targeting as well as prioritisation.

Held below the top band on verification rather than architecture: no developer documentation, interface reference or authentication model was reached on the routes taken this pass, no integration inventory was counted, and one third party marketplace listing carries a materially smaller topic count than the vendor's current pages, indicating some partner listings are stale. Ask for the interface documentation and the current verified activation partner list.

Delivery is a feed rather than a tenancy, and nothing about where it is produced is published. The customer receives scored data into systems they already run, whether through a direct integration, an activation partner or a platform that licenses the feed, so there is no application tenancy to isolate and no seat based deployment to configure. That reduces what this axis normally examines without removing it.

No hosting provider or region is named on the vendor surface, no residency election is described for European cooperative signal, and no recovery time or recovery point objective is published. The residency question is live rather than academic here, because the cooperative collects from publishers serving European readers and the vendor states in its privacy material that operating internationally necessarily involves transmitting personal information across borders. Ask where cooperative signal is processed and stored, whether European signal can be kept in region, and what the recovery objectives are.

The thinnest published security surface of any vendor built in this project. No trust centre was located, no certification or attestation of any kind was found on the vendor surface, no penetration testing or vulnerability disclosure programme was described, and no security page enumerating controls was reached on the routes taken this pass.

What exists is a reference within the privacy material to using adequate security measures to safeguard data on systems the vendor owns or manages, which is a general assurance rather than a control set. That is a conspicuous gap for a business whose entire product is data, which supplies several of the largest platforms in this category as an upstream dependency, and which therefore sits in the supply chain of many enterprise buyers who never contract with it directly.

Recorded as what could be established on this pass rather than as a finding that nothing is held, since a vendor of this standing may well hold certifications behind a sales conversation. Ask which certifications or attestations are held, with audit periods and auditors, and whether a security questionnaire response is available.

No figure appears on any vendor surface and the purchase path is a conversation. No pricing page, no rate card, no unit of pricing, no minimum and no contract term is published, and third party analysis confirms that pricing does not appear on the site. What third parties report places entry around thirty thousand dollars a year for a data feed, with enterprise deployments described as sitting in six figure budgets.

Two structural points make the opacity harder for a buyer than the headline suggests. The product is a signal rather than a working tool, and independent analysis estimates that acting on it requires a further forty thousand to one hundred and seventy thousand dollars of surrounding tooling, so the licence understates the cost of getting value even if it were published.

And the same signal reaches many buyers indirectly inside platforms that license the feed, meaning a company may already be paying for this data within another subscription while separately quoted for it directly, with no way to compare the two. Ask for the annual rate by topic and domain volume, the minimum term, and whether signal already consumed through a licensed platform is credited against a direct contract.

Nothing published addresses what happens at the end of a contract. The delivery model means a customer accumulates scored signal inside their own systems throughout the term, whether in a marketing platform, a customer record system or a warehouse, so unlike a hosted application the data is already on the customer's side and the practical question is not extraction but permission.

No statement was located on whether a customer may continue to use previously delivered scores after the subscription ends, whether derived segments built from the feed must be deleted, or what deletion obligation attaches to signal already written into the customer's own records. That is the load bearing exit question for a licensed data feed and it is unaddressed, as are retention, notice and renewal terms. The published processing agreement is eight years old and was not reissued. Ask in writing what licence attaches to delivered signal after termination, whether derived segments may be retained, and what deletion obligation applies.

The vendor operates no sending infrastructure of any kind. There is no mail, no messaging, no dialing and no campaign delivery, so shared reputation, warmup, bounce handling and complaint thresholds have nothing to attach to. The product is a data feed consumed by other systems, and where a customer acts on the signal the sending happens on that customer's own estate under their own domains.

The closest analogue is delivery of the feed itself, meaning whether scores arrive on schedule and complete, and nothing published describes a service level, a delivery guarantee or what happens when a weekly refresh fails. That is the reliability question for a subscription whose entire value is timely signal. Ask what service level covers feed delivery and what recourse applies to a missed or incomplete refresh.

Topic coverage is broad and the buyer this actually suits is defined by third parties rather than by the vendor. The taxonomy spans tens of thousands of business topics across the full range of categories, and cooperative membership includes both general business titles and vertical publications in technology, telecommunications, legal and retail, so signal exists for most categories including niche ones. What the vendor does not state is who should buy it.

Independent analysis is consistent and specific on this point: the product suits enterprises with a mature technology stack and substantial budget, and is a poor fit for smaller teams because the signal requires significant additional tooling before anyone can act on it.

No industry pages, localisation, segment pages or stated minimum deployment were located on the vendor surface, and the distribution model complicates the picture further, since much of the reach comes through platforms that license the feed rather than through direct customers. Ask what the smallest direct deployment looks like and what surrounding tooling the vendor assumes a buyer already has.