Clay

The core product is orchestration and the AI sits alongside it rather than underneath it. Waterfall enrichment, which is what the platform is bought for, is sequencing logic against a provider marketplace: query one source, and on a miss fall through to the next. That is routing rather than inference, and it works identically with every model switched off.

The research agent that reads pages and answers open questions per row is genuine model dependency and is a first class capability rather than a wrapper, and the sequencer generates message copy. But strip both and the tables, the waterfalls, the conditional logic and the integrations all still run, which is the majority of what the review evidence describes teams doing. The company dates to 2017 and the spreadsheet orchestration model predates its AI features. Ask which capabilities stop entirely without the research agent, and what share of a typical workflow's cost is model calls rather than data lookups.

Spend is bounded architecturally and behaviour is not described. Every operation consumes a metered credit or action from a finite monthly allocation, so a workflow that misbehaves exhausts a budget rather than running indefinitely, and the ceiling is visible to the operator before it is hit. That is a real constraint arising from how the product is built rather than from a policy.

What is absent is everything above it: no published statement describes what the research agent may do while investigating a row, whether it is bounded in the pages it will fetch or the actions it will take, what happens when it returns a confidently wrong answer into a field that then drives downstream branching, or whether any approval gate exists before generated content enters a sending sequence.

Workflows are built by the customer, so the blast radius is largely whatever the customer designed, which places responsibility rather than removing risk. Ask what bounds the research agent per row, and whether generated copy can enter a sequence without human review.

Model providers are named and the subprocessor list covering them is published as its own artifact. The documentation names a major provider's model family directly and describes others as leading providers, and a full list of artificial intelligence subprocessors is maintained on the trust site rather than referenced in passing.

Alongside it the vendor states that its model providers carry contractual obligations never to train on customer data and to hold their own security certifications, which is a supply chain commitment rather than a claim about the vendor's own systems. Publishing an AI subprocessor list separately from a general subprocessor list is uncommon and directly useful, because for this product the model layer and the data layer are different third party estates.

Two gaps hold it below the top band: no model version or evaluation is published, and no accuracy or error rate is stated for research agent output, which matters because that output lands in fields that drive branching logic and message copy. Ask which model versions are in use and what evaluation covers research agent output before it enters a workflow.

A measured performance figure exists in public with a stated method, which is rare on this axis and rarer still in this category. An independent reviewer ran a thirty day test across a two thousand contact list and reported email match rates near seventy eight percent through a multi provider waterfall against roughly forty two percent from single source tools.

The population, the duration and the comparison basis are all stated, and the reviewer sells a competing product, so the finding runs against their commercial interest, which strengthens rather than weakens it. Separate independent modelling puts a five step workflow at roughly seven data credits and five actions per record, which lets a buyer estimate unit economics from outside.

The vendor's own contribution is thinner: a claim of more than one hundred thousand teams and a named customer list including several large artificial intelligence and software companies, with no published study of its own. Match rate also depends entirely on the provider mix a customer configures, so the figure describes a good configuration rather than the platform. Ask for match rates by provider combination, and for the vendor's own measured accuracy on its default waterfalls.

The platform now sends, and the obligations that come with sending are not addressed. A built in email sequencer runs campaigns directly from enrichment tables with generated personalisation, which means contacts sourced from a marketplace of third party providers can move to outbound delivery without leaving the product.

That is the compliance surface, and nothing published describes what governs it: no statement on suppression list handling, no unsubscribe mechanics, no bounce or complaint policy, and nothing on whether a contact who has objected to one customer's outreach is suppressed anywhere else. The absence is more consequential here than for a pure enrichment tool, because the enrichment step and the send step share a table and the person in that row never gave either party permission directly. Ask how suppression and unsubscribe state is maintained in the sequencer, and what prevents a purchased record from being sequenced without a lawful basis.

Roles and deletion are stated plainly and the instruments behind them are not published. The documentation states that the vendor acts as a processor while the customer remains the controller, that customer data is primarily processed in the United States, that only the customer and authorised workspace users can reach it, and that deleting a workspace removes all data after thirty days.

A stated deletion window and a named processing location are both more than most vendors in this category offer. Against that, the processing agreement is available only by emailing a security address rather than published, no transfer framework certification was located, and no general subprocessor list covering the data providers was found, only the artificial intelligence one.

That last gap is the load bearing one for this product: the marketplace routes customer queries to more than a hundred and fifty third parties, and which of those are processors, under what terms, is the question a privacy review would ask first. Ask for the processing agreement, the full subprocessor list covering data providers, and the transfer mechanism for European customer data.

Field level attribution to a named provider, which almost nothing else in this category offers. Because the marketplace is the product, a customer building a waterfall selects providers by name and sees the credit price of each, so at the point of use they know which company supplied a given email address or phone number and what it cost.

That is more provenance visibility than an aggregated database can structurally provide, since a conventional data vendor returns a record without saying where inside its corpus the field came from. The vendor also states that it negotiates volume terms with partners and passes rates through, which describes a licensed reseller relationship rather than an undisclosed one.

What is missing sits one layer down and is not the vendor's to answer easily: nothing describes how any individual provider collected its data, under what lawful basis, or whether European records in the marketplace rest on consent or legitimate interest, and no indemnification position is stated. So a buyer can trace a field to a company and no further. Ask whether provenance is indemnified, and what diligence the marketplace applies to a provider's own collection basis before listing it.

Integration runs through official routes and the vendor's structural position keeps most platform risk at arm's length. More than eighty named partner integrations are published including customer record platforms, sequencers and model providers, with interface access and webhook automation offered as tier gated features rather than through unofficial means.

Because enrichment is executed by marketplace providers rather than by the vendor scraping directly, the collection exposure sits with those providers under their own terms, which is a genuine architectural distinction rather than a technicality. Nothing resembling credential storage or headless automation appears on the surface. Two things hold it below the top band. No stated conformance position against any specific platform's terms was located.

And the arm's length position cuts both ways: a customer whose waterfall includes a provider operating against a platform's rules inherits that exposure through the vendor without any published statement of what the marketplace screens for. Ask what a provider must demonstrate about its collection method to be listed, and whether any named platform conformance commitment exists.

The training commitment is pushed onto the supply chain contractually rather than asserted about the vendor's own systems. The documentation states that model providers carry contractual obligations never to train on customer data, that campaign and prospect data is processed only to generate that customer's content, and that it is neither used for training nor shared with other customers.

Locating the commitment in the provider contracts is the right place for it, because on this architecture the customer's data leaves for a third party model on nearly every AI operation, and a promise about the vendor's own behaviour would not reach that. The artificial intelligence subprocessor list is published so a buyer can see who those providers are.

Held below the top band on instrument tier and on a distinction the vendor draws itself: the commitments sit in product documentation rather than a published agreement, and the management standard for artificial intelligence is stated as planned rather than held, where the two vendors at the top of this axis hold it and publish the certificate. Ask whether the provider training restrictions are reflected in the customer's own agreement, and what the timeline is for the management standard.

Generated copy reaches a stranger under a seller's name and nothing addresses the fact. The sequencer composes personalised messages from enriched fields and research agent output, then sends them from the customer's identity to a person whose details were purchased from a marketplace moments earlier. That recipient has no relationship with either party and no way to know that the message referencing their company was assembled by a model reading their web presence.

Nothing published states a position on disclosing machine authorship, offers a setting to mark generated copy, or describes what the recipient is told. This lands mid band rather than lower because the vendor does not market the concealment as a feature, the send is initiated by a human operating a workflow they built, and the volume is bounded by metered credits rather than unlimited. Ask what the vendor's position is on disclosing AI authorship in sequencer output, and what a recipient asking how they were contacted would be told.

Two distinct ecosystems rather than one, and public documentation covering both. The data side carries more than one hundred and fifty marketplace providers a customer composes directly. The software side carries more than eighty partner integrations spanning customer record platforms, sequencers and model providers, plus interface access, webhook automation and customer record synchronisation.

A public documentation site is maintained with real operational depth, including plans and billing mechanics, credit consumption guidance and security notes per feature, which is genuinely useful reference material rather than marketing. Two limits.

Customer record synchronisation and interface access are gated to the middle tier rather than available across the range, so the integration depth a buyer gets depends on what they pay, and the review evidence identifies that gate as a common reason teams upgrade. And reported provider counts differ across sources between roughly seventy five and one hundred and fifty, so the marketplace size is not firmly established. Ask which integrations are gated to which tier, and for the current verified provider count.

The processing location is named specifically, which is more than most manage, and there is only one of it. The documentation states that customer data is primarily processed in the United States and names the cloud provider and region directly rather than describing a multi region estate in the abstract. Naming a region is a real disclosure and a buyer can act on it.

What follows from it is the limitation: no European or United Kingdom residency option is described anywhere, no tenancy model is stated, and no recovery time or recovery point objective is published. For a European customer enriching European contacts through a marketplace of third party providers, single region United States processing with no stated alternative is a material constraint rather than a detail, and the word primarily is doing unexplained work about where the rest goes. Ask whether European data residency is available, what primarily excludes, and what the recovery objectives are.

A live trust site carrying real certifications, with the documents themselves on request. The vendor holds a service organisation control type two report, completed and announced in September 2024, and the trust site lists the international information security standard alongside it, together with the artificial intelligence subprocessor list and security questionnaire responses. A dedicated security contact address is published and the processing agreement is obtainable through it.

Documentation of security posture also appears inside the product documentation per feature rather than only on a central page, which means a buyer evaluating one capability finds the relevant control notes where they are working. Held below the top band because no certificate or report is published openly, no audit period or auditor is named on the public face, and the management standard for artificial intelligence is stated as planned rather than held.

One caution recorded rather than graded: at least two unrelated companies operating under the same name publish their own certification claims, including a separate personal relationship product and a human resources platform, and their announcements surface readily in search against this vendor's name. Only material from this vendor's own domains was used. Ask for the report with its audit period and auditor.

The first vendor in this expansion cohort to publish real prices, and the disclosure is substantial. Four tiers are published with figures: a permanent free tier at one hundred data credits and five hundred actions monthly, two self serve tiers at one hundred and eighty five and four hundred and ninety five dollars monthly with stated credit and action allowances, and a custom enterprise tier.

Unit economics are published too, with data credits starting at five cents each, rollover rules stated as up to twice the monthly allowance on self serve and fifteen percent of prior year purchases on enterprise, and documentation mapping each tier to a monthly record volume so a buyer can self select. The vendor also published its internal pricing memo alongside the March 2026 restructure, which is unusual and creditable.

Three things keep it off the top band and they are the ones that decide the real bill. Customer record synchronisation and interface access are gated to the middle tier, so a feature gate rather than volume sets the entry point for most teams. Top up credits above the allowance are reported at a markup over the plan rate.

And the pricing page states its own prices two different ways, with the annual plan cards reading one hundred and sixty seven and four hundred and forty six dollars while the frequently asked questions lower on the same page describe the tiers as starting at one hundred and eighty five and four hundred and ninety five, with both cards also carrying lower slider floors. Ask which figure on the page governs, what the top up rate is, and the credit cost of your own intended waterfall.

A deletion timeline is committed and the export question is unanswered. The documentation states that deleting a workspace removes all data after thirty days, which is a specific and checkable commitment, and that the customer can delete data at any time. That covers getting data destroyed. It does not cover getting it out.

Nothing published states what a departing customer can export or in what format, whether enriched records leave with the account, or what happens to the workflow logic itself, which on this platform is the accumulated asset: a mature deployment holds waterfall configurations, conditional branching and prompt design built over months by someone the review evidence says takes four to six weeks to become competent.

Whether that configuration is portable, or whether it is only reproducible by rebuilding it, is not addressed. A further wrinkle specific to the marketplace model is that enriched fields were licensed from third parties, and no statement describes what a customer may retain and use after the subscription ends. Ask what exports and in what format, whether workflow configuration is portable, and what licence attaches to enriched records after termination.

Sending is a recent addition and none of the discipline around it is described. The built in sequencer sends campaigns from enrichment tables, which makes this a sending product rather than a pure data tool, and the axis applies in full.

Nothing published addresses the questions it applies: whether mail leaves from vendor infrastructure or the customer's own connected mailboxes, who configures authentication records, whether warmup exists, what bounce or complaint thresholds trigger intervention, or how one customer's sending behaviour is isolated from another's on shared infrastructure.

The risk profile is specific and elevated here, because the contacts being sequenced were purchased through a waterfall moments earlier and the review evidence reports that stale input lists commonly produce miss rates of twenty to thirty percent, which is exactly the profile that generates bounces. Ask which infrastructure sends, whether mailbox warmup is provided, and what bounce rate triggers a stop.

Fit is stated by volume rather than by company size, which is both unusual and more useful. The documentation maps each tier to a monthly record throughput, naming under one thousand records for the entry tier, one thousand to ten thousand for the middle tier and above ten thousand for enterprise, so a buyer self selects on the measure that actually drives their bill rather than on headcount.

A free tier means the smallest possible user is served rather than turned away, and the range runs continuously from there to custom enterprise contracts reported around thirty thousand dollars annually. Reported reach of more than one hundred thousand teams and named references among large artificial intelligence and software companies support the upper end.

The honest limit is one the vendor does not state and the independent evidence does: the platform assumes technical capability, with a four to six week learning curve reported and teams commonly assigning a dedicated operator, so the real constraint on fit is skills rather than volume or budget, and nothing on the vendor's surface says so. Ask what a team without a dedicated operator should expect for time to first working waterfall.