Clevenio

A genuine middle case, which is rare on this axis, and the vendor's own method statement is what puts it there: public business registers give the foundation, and large language models cross reference them with public data across the web to match the right decision makers to the right companies, monitored continuously.

The models are therefore load bearing for the differentiator, because a register extract without decision makers attached is a free download from PRH or Bolagsverket, and the decision maker layer is what customers buy. Against that, roughly half the platform is mechanical and would survive intact: sequences, the lightweight CRM, CRM sync, buying signal triggers, the REST API and the audience builder are all conventional software, and the register foundation has independent value. Not A because a saleable product remains after removal; not C because what remains is not the product the vendor sells.

The autonomy here is unusual because it points at the customer's own system of record rather than at a prospect. The vendor states the design goal plainly: nobody has to notice a new company for it to end up in your CRM. Model matched decision maker records are pushed automatically into HubSpot, Pipedrive or Salesforce and refreshed continuously as companies and roles change, so a machine judgement about who works where becomes a CRM record without a human confirming it.

Nothing published describes a review step, a confidence threshold below which a match is withheld, or an audit trail of what was written and on what basis. Sequences and triggers add conventional send side automation with no described approval. The mitigating factor is scope: the product does not compose messages autonomously or handle replies.

The mechanism is published, which no other data vendor in this index does. Clevenio states on its homepage that public business registers give the foundation and that large language models cross reference them against public data across the web to match decision makers to companies, with the whole dataset monitored continuously.

That is a data vendor telling buyers that its contact records are model produced rather than verified by a researcher, and it is the kind of admission most vendors in this category work hard to avoid making. Not A because the disclosure stops at the method: no model provider, family or version is named, nothing states where inference runs, and critically no accuracy or error rate is published for the matching itself, which is the single number that matters here, since a mismatched decision maker means a rep phones the wrong person at the right company and the buyer has no way to size that risk.

Top of band on attribution and short on substantiation. Twelve customer logos are named organisations rather than anonymous images, four testimonials carry full names, job titles and companies including Fondion, Villi.io, HeiaHeia and Right People Group Spain, a case studies library and a wall of love exist, and roughly 500 B2B sales teams is a specific and plausible scale claim for a three year old company.

What is missing is any quantified outcome with a method: the headline data claims of complete coverage of the Nordic markets, high email deliverability and decision maker match rates carry no published methodology, and the cost of inaction argument on the homepage rests on unsourced category statistics, that reps spend 70 percent of their week on non selling work and that the fix returns around two selling hours per rep per day. Third party reviewers also note the absence of independent reviews on the major platforms, so there is little outside check on any of it.

Recorded as observed rather than concluded: multichannel sequences run across email, phone and other channels, and nothing located on the vendor's own site sets out a consent basis, suppression mechanism, opt out route or do not call handling for the outreach the product performs.

The gap is more consequential for this vendor than for a US equivalent, because a Finnish controller selling data on named individuals across the Nordics, Baltics, DACH, Benelux, Poland and the UK is operating under national supervisory authorities that publish their own and not always consistent guidance on legitimate interest for B2B contact, and under ePrivacy rules on electronic marketing. Affiliated content elsewhere does work through legitimate interest reasoning for B2B outreach in some detail, but the ownership of that property could not be confirmed and it is not relied on here.

Recorded as observed rather than concluded: a privacy policy, cookie policy and terms are published under a clearly identified Finnish legal entity, Sales Led Oy, but the policy bodies were not read this pass, so no controller designation, lawful basis, retention position or data subject rights process has been verified. The specific question this product creates is the sharpest privacy question of any EU domiciled vendor in the index and it deserves naming precisely.

Clevenio holds direct phone numbers and email addresses for named decision makers across at least ten countries, assembled by model inference from public web data and, in Finland, from telecom operator data matched to the individual. Article 14 of the GDPR applies squarely when personal data is obtained from sources other than the data subject, and no notification, no self service lookup and no removal route was located anywhere on the site. That is the piece Apollo publishes and which this vendor, operating inside the jurisdiction that wrote the rule, does not appear to.

Top of band, and on sourcing alone this is the most authoritative record in the index. The company layer comes from each country's official national business register rather than from scraping or user contribution, which means registration numbers, financial statements, industry codes, headcount, ownership and group structure are government sourced and independently checkable, and the vendor names this as its foundation rather than burying it.

The person layer is disclosed separately and honestly: matched by large language models from public data across the web and, in the European product, from professional networks, which is as close as anyone here comes to naming LinkedIn as a source. The Finnish product adds a genuinely unusual disclosed route, phone numbers drawn from telecom operator data and matched to the named person. Publishing three distinct source classes and the method that joins them is exemplary. Not A on the same ground that holds Privacy down: Apollo earns the A partly by publishing an actual Article 14 discharge and a self service removal path, and neither was located here.

Low exposure and mostly by construction. The primary data source is official public registers, which are published for exactly this kind of use, so the bulk of the dataset carries no platform dependency at all. Integrations are official CRM connectors into HubSpot, Pipedrive and Salesforce, and the developer surface is a documented REST API plus an MCP server the vendor operates itself.

There is no browser extension, no credential custody and no automation performed against a third party platform on the buyer's behalf. Not A because the person layer is described as drawn from professional networks and the open web, which is the contested surface in this category, and no conformance position is stated on it anywhere.

Recorded as observed rather than concluded: nothing located addresses model training, tenant separation, retention or what happens to customer CRM data, sequence content and reply text that passes through the platform. One structural point is worth recording because it inverts the usual concern.

The models here operate on public register and web data to build a database that is shared by every customer by design, so the cross tenant question that dominates elsewhere in this index barely applies to the dataset itself; nobody is surprised that another customer can see the same company. What is unaddressed is the other direction, whether anything a customer does inside the platform feeds the models or the shared dataset.

No impersonation and no synthetic identity anywhere in the product: sequences are composed by and sent from real reps, and the company makes no claim to autonomous agents contacting anyone. What sits behind it is quieter and worth naming. The person who receives the call is in the database because a language model matched them to a company from public web data, and in Finland their direct number may have come from telecom operator data.

They did not provide it, were not notified, and have no visible route to see or remove the record. No Article 50 position exists and none is really needed, since the AI here shapes who gets contacted rather than what is said to them, which is a different and less examined shape of the same problem.

Top of band on agent readiness and narrow on everything else. The MCP server is live for every customer, included in both plans rather than sold as an upgrade, and carried as the first banner on the homepage, naming ChatGPT and Claude explicitly so a buyer can query their own mapped market from inside an AI tool.

That is the third MCP server graded in this index after ActiveCampaign and Clari, and by some distance the most prominently positioned; a three year old Finnish company is ahead of most of the corpus on the surface that will matter next. A documented rest API for developers sits alongside it, and there is a page addressed to AI systems in the footer. Not A because the conventional connector set is three CRMs and nothing else, with no sequencer, dialer, marketing platform or verified marketplace listing.

Recorded as observed rather than concluded: no hosting provider, region, residency option or sub processor list was located on the vendor's own surface. What is established is jurisdictional, that the operating entity is Sales Led Oy, a Finnish company, and the product is bilingual English and Finnish with a Nordic customer base.

A third party review platform reports that data is processed in the EU and handled in line with GDPR, which is consistent with everything else about the vendor and is very likely true, but it is a third party's account of the vendor's claim rather than a statement read on the vendor's own page, and this index grades what is published. Re verify at the privacy policy.

Recorded as observed rather than concluded: no security page, trust centre, certification claim, penetration test or vulnerability disclosure route was located, and the footer's Legal section contains exactly three items, terms and conditions, privacy policy and cookie policy, with no security entry alongside them.

For a company founded in 2023 the absence of a SOC 2 or ISO audit is stage appropriate rather than negligent, and the honest reading is that certification has not yet happened rather than that it is being concealed. What is at stake meanwhile is worth stating: the platform holds write access into the buyer's CRM, pushing records automatically into HubSpot, Pipedrive or Salesforce, and it holds sending access for sequences.

The second pricing page with no price graded in this session, and this one is sharper than Clari's because the vendor labels it transparent. The page carries the eyebrow transparent pricing above the headline Pricing built for growth, and its meta description promises simple, transparent pricing. Both plans, the Finnish database and the European database, display the words ask for pricing where the number belongs, each followed by a Book a meeting button.

There is no tier, no seat rate, no unit, no floor, no range and no currency anywhere on it. Third party reviews from mid 2026 record a homepage line placing list building from 199 EUR per month and report earlier figures between 49 and 99 USD; none of those reconcile with each other or appear on the current page, which indicates repackaging rather than disclosure.

What the page does do well is describe precisely what each plan contains, seven itemised inclusions each, with API and MCP access in both. A buyer can therefore establish exactly what they would get and nothing at all about what it costs.

Recorded as observed rather than concluded: terms and conditions are published but were not read, and no post termination data right, retention window, deletion timeline or export path was located. Two structural points cut in the buyer's favour and neither is claimed by the vendor as a commitment. The product's whole purpose is to write records into the customer's own CRM, so the operative output already lives in a system the buyer owns and would survive the relationship ending.

And both plans include REST API and MCP access as standard, which is a working extraction route rather than a support ticket. Against that, the mapped market, coverage history and target market radar analytics are the vendor's, and continuously refreshed data stops being refreshed the day the contract does.

Recorded as observed rather than concluded: multichannel sequences send email and nothing published addresses mailbox warmup, domain authentication, inbox placement, bounce or complaint thresholds, volume governance or sender reputation.

The vendor's argument on this axis is indirect and made through data quality rather than sending discipline, that continuously verified records against official registers mean fewer sends to dead addresses, which is a real contributor to deliverability and not a substitute for the controls themselves. The phone side is the larger channel here in any case, since the product is explicitly built to get reps on the phone, and telephony discipline is likewise unaddressed.

Unusually precise in both directions. The geography is stated market by market rather than as a region: Finland as a dedicated product, and a European product covering the Nordics, Baltics, DACH, Benelux, Poland and the UK, each mapped from its own local business register. The buyer is segmented into four seats with a page each, CSOs and sales leaders, sales reps, marketing teams and RevOps, and the site runs in English and Finnish.

Roughly 500 B2B sales teams, twelve named customer logos, and a positioning that is explicit about being a poor fit for anyone whose pipeline sits outside the covered markets, which is the anti ICP candour Boomerang was credited for.

Not A because the coverage is deliberately regional, because the evidenced customer base is concentrated in Finland and the Nordics rather than spread across the European footprint the pricing page claims, and because there is no enterprise apparatus described.