Cognism

A database business from 2015 with AI features added on top of it. The platform ships company research, a persona builder and natural language search under an AI label, and machine learning models are described as monitoring corporate digital infrastructure to derive technology usage, which is a real modelled inference rather than a lookup.

Remove all of it and the product still sells: a contact and company database, human verified mobile numbers, preference register screening, enrichment and delivery by interface or file. Those are what the case studies and the independent testing describe buyers paying for, and none of them is a model. The verification asset that differentiates the vendor is the opposite of automated, since it depends on researchers placing calls. Ask which AI features are included in each package and whether any of them alter the underlying record rather than the interface to it.

Nothing here acts without a person asking it to. The AI features are a research assistant, a persona builder and a search interface, all invoked by a user against a query they compose, and the output is a list or a summary rather than an action taken in the world. No agent sends, contacts anyone, or writes into a downstream system unattended, so the autonomy questions this axis exists to ask have limited purchase.

The verification service is the reverse of autonomous, using human researchers by design. What is absent is any published description of bounds on the research feature: what sources it consults, whether it can be constrained, and what happens when it returns a confident inference about a company that a rep then repeats on a call. Ask what the AI research feature draws on, and whether its output is marked as inferred rather than verified when it appears beside verified fields.

Four AI branded features and nothing published about what is behind any of them. Company research, a persona builder, natural language search and the machine learning models deriving technology usage all appear as capabilities without a model provider, family or version named anywhere, and no model card or evaluation exists.

For the technographic inference specifically, the vendor describes monitoring digital infrastructure with proprietary models and cross referencing against job postings, which is a method sketch rather than a disclosure, and no accuracy figure accompanies it even though the resulting technology field is a filter buyers segment on.

That matters more than the generative features here: a wrong inference about which software a company runs produces a targeted list that is wrong in a way the buyer cannot see. Ask what accuracy the technology usage inference achieves and against what ground truth, and which providers sit behind the generative features.

Measured accuracy exists from an independent party with a stated sample, and the vendor's own case studies quote comparative benchmarks rather than bare percentages. An independent enrichment test across a two hundred account sample reported European email accuracy near ninety one percent and mobile connect rates near eighty seven percent, both leading the cohort tested.

The vendor's strongest published case study is better than most because the customer supplies its own baseline: a revenue operations lead states a bounce rate benchmark of seven percent against six percent achieved, and a conversion benchmark of fourteen percent against twenty nine percent achieved. A named comparison against the buyer's own prior benchmark is a more meaningful claim than an unanchored improvement figure. The weakness is consistency.

The headline accuracy of the verified mobile asset appears as eighty seven percent in the vendor's own customer quote and as ninety eight percent in third party write ups attributing the figure to the vendor, an eleven point spread on the product's central claim. Ask which accuracy figure the vendor stands behind for verified mobiles, measured how and over what sample.

Suppression is performed on the database before delivery rather than left to the buyer, and the registries are named. The vendor screens its telephone data against preference services in twelve named jurisdictions, covering both United Kingdom registers for consumer and corporate numbers plus the United States, Australia, New Zealand, Germany, France, Ireland, Spain, Portugal, Croatia, Sweden and Belgium, and states it is registering in further territories.

That is architectural rather than contractual: a number carrying a preference registration does not reach the customer to be dialled. Alongside it the vendor notifies business contacts that it holds their data within the statutory timeframe, screens under a stated lawful basis, and operates a dedicated opt out route. The most creditable part is what it declines to claim.

The compliance material states plainly that each party acts as an independent controller, that the customer's own processing and use happen outside the vendor's control and visibility, and that customers should take legal advice before processing. A data vendor that markets compliance as its differentiator and still tells buyers its screening does not make their outreach lawful is describing the limit of its own product accurately. One inconsistency: the page summary cites fifteen preference lists while the detailed answer names twelve jurisdictions.

The lawful basis is named to the article, and the obligation that follows from it is operated rather than asserted. The vendor states it collects, processes and shares under legitimate interest, cites the specific provision, and says the assessments supporting that basis have been carried out.

Crucially it then does the thing that basis requires and almost nobody in this category does: it notifies people that it holds their data, within the statutory timeframe, so they can exercise their rights, and it explains on the same page why a notified database matters. Around that sits a coherent set. European data is kept inside the European Economic Area by default, with transfers minimised, anonymised where possible and covered by standard contractual clauses.

Breach notification is committed at seventy two hours. The privacy management standard is certified. In the United States the vendor is registered as a data broker with the state regulator, publishes a dedicated opt out route through a third party portal, and operates a toll free number for rights requests with identity verification procedures. The controller position is stated candidly rather than blurred. Ask for the legitimate interest assessment and the notification cadence in practice.

Four sourcing layers described and named partners for two of them, with the vaguest description attached to the most sensitive layer. Publicly available collection is specified as corporate websites, job postings, news feeds and company registries. Technographics come from the vendor's own modelling. Intent and corporate event triggers come from two named third party providers rather than being claimed as proprietary, which is honest and lets a buyer evaluate those separately.

The gap is the first layer, described as community sourced data from members of a community who allow the vendor to match contact information to professionals in the database. That is contributed data, it is listed first among the sources, and it is the only one where the collection mechanism, the consent obtained and the relationship between the contributor and the person whose details are contributed all go undescribed. It is also the layer most likely to attract scrutiny. No indemnification position is stated anywhere. Ask what the community data capture mechanism actually collects, what those members consent to, and whether provenance is indemnified.

Delivery and integration run through owned and sanctioned channels. The database is the vendor's own, so the primary data flow is from vendor to customer rather than through a platform whose terms govern access, and enrichment runs on records the customer supplies under a processing agreement incorporated into the standard terms. Customer record integrations, an interface and bulk delivery are all first party routes.

Named third party feeds arrive through commercial partnerships rather than extraction. Nothing on the surface describes browser automation or scraping of a professional network by this product. Two things hold it below the top band. The community sourced layer is a data capture mechanism operating through members rather than through a published interface, and what it touches is not described, which is precisely where platform terms would bite if it touched a network.

And the vendor owns a separate browser extension product that is not part of this record, so a buyer evaluating the group rather than the product should ask about it directly. Ask what the community capture mechanism accesses and under whose terms.

The privacy programme is strong and the model specific stewardship position is missing from it. Nothing published states whether customer data submitted for enrichment is used to train or tune any model, whether the AI research and search features route customer queries to third party model providers, who those providers are, or what retention applies to prompts and generated output.

No artificial intelligence subprocessor list was located and no governance document for model use was found, while the certifications held cover information security and privacy management rather than model governance. The gap is specific rather than general: a customer using enrichment sends its own contact records into the platform, and the enrichment terms explain the processing relationship without addressing whether that material touches a model. Ask whether customer supplied enrichment data trains or tunes any model, which model providers process queries from the AI features, and what retention applies.

The person in the database is told they are in it, which is the strongest form this axis takes for a data vendor. Rather than relying on a buried privacy notice that a data subject would have to already know to look for, the vendor states that it actively notifies business contacts of their inclusion so they can exercise their rights, and pairs that with a dedicated opt out portal operated through a third party privacy service and a toll free rights line.

It also commits to actioning opt outs without undue delay. For someone who never chose to be in a sales database, being told and given a working route out is the substance of what disclosure means here. Held below the top band because the notification is described without specifics a buyer or a data subject could check: no cadence, no channel, no volume and no statistics on notifications sent or opt outs honoured, where the vendors at the top of comparable axes publish request counts and response times. Ask how notification is delivered, on what cadence, and how many opt outs were received and actioned in the last year.

Three delivery models rather than one, which is the substance here. The same data reaches a customer through a prospecting interface, through automatic customer record enrichment that maintains records rather than filling them once, and through a data as a service route by interface or bulk file for teams loading into a warehouse.

That maintenance behaviour is a genuine architectural distinction: the vendor states a record enriched once is kept current and only reconsumes credit when a material detail such as a job move changes, which is a different product shape from a one time lookup. Credits are stated to work across all three surfaces without additional cost, so the routes share an economy rather than being separately metered. Named integrations and a help centre are published.

Held below the top band because interface access requires a prospecting seat rather than standing alone, no developer documentation was reached on the routes taken this pass so interface depth is unverified, and the integration inventory was not counted. Ask for the interface documentation and whether bulk delivery can run without a seat.

An actual residency answer, which is rare enough on this axis to carry the grade. The vendor states that data collected is generally kept inside the European Economic Area, and that where transfer outside it is necessary the minimum amount is moved, anonymised where possible, under agreements incorporating standard data protection clauses.

That is a default position stated in the customer's favour rather than a capability sold as an upgrade, and for a European buyer it answers the first question a procurement team asks. It is also consistent with the company being domiciled in the United Kingdom and selling primarily into European markets.

What is missing is the operational layer beneath the commitment: no hosting provider or region is named, no tenancy model is stated, no recovery time or recovery point objective is published, and the word generally is not defined. Ask which regions and provider host the platform, what generally excludes, and what the recovery objectives are.

Two certifications and an attestation, delivered through a live trust site, with a contradiction about the attestation on the vendor's own page. The information security standard and the privacy information management standard are both certified, a service organisation control type two attestation is held, and a dedicated trust site is published and linked from the main navigation.

Supporting detail is specific rather than gestural: breach notification committed at seventy two hours from occurrence, mandatory information security and data protection training at onboarding and annually thereafter, and a stated policy of sourcing from vendors screened for compliance practices. The contradiction sits on a single page.

Near the top it states that the attestation demonstrates security, availability, processing integrity, confidentiality and privacy, which is all five criteria. Near the bottom the same page states the vendor is attested in security and availability, which is two. Those cannot both describe the same report, and the difference is material to a security reviewer relying on the scope. Ask which criteria the current report actually covers, with its audit period and auditor.

A page that promises clear pricing and contains no price. The pricing page is headed with a claim of clear pricing built around how a team uses data, names two prospecting packages, states that five seats are included in each, publishes a full feature comparison table across roughly twenty capabilities, and explains the credit mechanic precisely: one credit reveals one contact, previously revealed contacts cost nothing to view again, credits are consumed again only when a contact changes job, and the same credits work across the prospecting platform, enrichment and the interface.

That is more structural disclosure than most vendors at this grade manage and it makes the omission conspicuous rather than accidental, because every element of the model is explained except the number. No seat rate, package price, credit price, minimum or contract term appears, and both packages plus both add on products route to a sales conversation.

Third party procurement reporting places the entry package near fifteen hundred dollars per user annually plus a platform fee, with five user teams commonly quoted between fifteen and twenty two thousand dollars and larger deployments reported to fifty thousand. Ask for the per seat rate at each package, the platform fee, the credit price and the credit allocation per seat.

One clause points directly at the exit question and stops short of answering it. The pricing material states that once a contact has been redeemed a team can continue using that record throughout the contract, which is a clear statement about the term and a conspicuous silence about what follows it.

For a data product that phrasing is load bearing, because the asset a customer accumulates is a stock of revealed records that were licensed rather than owned, and whether those records may lawfully be retained and used after the subscription ends is the single most consequential exit question in this category. Nothing published addresses it, and nothing states export scope or format, deletion timelines, or what happens to enriched customer records that were matched against the database.

Export by file is offered as a working feature, so getting data out is mechanically possible; what is unstated is what a customer is permitted to keep. Ask in writing what licence attaches to revealed and enriched records after termination, and whether continued use is permitted or prohibited.

The platform sends nothing, and its contribution to deliverability is upstream and real. There is no campaign infrastructure, no sending estate and no shared reputation, so the machinery this axis normally examines does not exist here. What the vendor does affect is the input: email records are verified before delivery and telephone records are screened against preference registers, both of which move a customer's bounce and complaint rates before a single message is sent.

One customer case study quantifies exactly that, reporting a six percent bounce rate against an internal benchmark of seven. What is absent is any published verification standard: no statement of the method used, how recently a record was verified before it is served, or what proportion of the database has been verified within a stated window. Freshness is the variable that decides bounce rate and it is the one not disclosed. Ask what verification method is used, how recently records are reverified, and what share of the database falls inside that window.

Coverage is addressed at both ends of the market and in the languages of the region the vendor actually serves. Dedicated pages exist for small business, mid market and enterprise buyers alongside three functional pages for sales, marketing and revenue operations, so the smaller buyer is addressed by name rather than left to infer they are too small.

The site is published in English, German and French, which matches the stated European specialisation with real localisation rather than a claim, and the reported base is more than four thousand companies with named enterprise references. The vendor also publishes direct comparison pages against three named competitors and a vendor selection guide, which is an unusually direct statement of the frame it accepts.

What holds it below the top band is a limitation the independent evidence states clearly and the vendor never does: coverage and accuracy are strongest in the United Kingdom, Germany, the Nordics and adjacent markets, and outside Europe the data is competitive rather than differentiated, with reported gaps in some regions. A buyer selling only into North America would learn that from reviewers rather than from the vendor. Ask for coverage and accuracy broken out by region.