Common Room

Identity resolution is the product and it cannot be done without models. The platform's value proposition is that the same person appears as a code repository handle, a community forum member, a social commenter, a product user and an anonymous website visitor, and that these are one buyer. Deciding that is probabilistic matching across systems with no shared key, which is what the resolution engine does, and it runs waterfall enrichment across dozens of providers on top.

Remove that layer and what remains is fifty channels of unresolved activity, which is the problem the customer already had rather than a smaller version of the product. The acquirer described the company as AI native in its own announcement.

Held below the top band because the origin is narrower than the current positioning: the company began in 2020 as a community intelligence tool aggregating engagement across developer platforms, and the agent layer performing research, message drafting and record maintenance is a recent addition on top of that graph rather than the thing that was built first. Ask what match rate the resolution engine achieves and how it degrades on individuals with no public footprint.

Autonomous enrolment into outreach is described by the vendor in its own words, and no boundary around it is published. A published playbook describes website pricing page activity flowing into the platform, the resolution engine filtering to economic buyers, and qualifying individuals being added to outreach sequences personalised to their behaviour, stated explicitly as happening without human intervention.

That is a system deciding on its own that a specific named person should begin receiving sales messages. An agent layer separately maintains customer records and executes pipeline plays. What is absent is everything that would bound it: no published statement on what an operator can constrain, whether enrolment can require approval, what volume ceiling applies, or what stops a workflow mid run.

One structural mitigation exists and is worth recording, in that the platform enrols into a connected sequencer rather than sending itself, so the customer's own sending controls apply downstream. Ask whether automated sequence enrolment can be set to require human approval, and what caps apply per workflow.

The agent surface is named in detail and what sits underneath it is not. Individual agents are identified by function, covering research briefs, a natural language query interface, record maintenance and play execution, and the platform is exposed through a command line interface and a model context protocol server so a customer can reach it from their own tooling. That is architectural disclosure of a useful kind.

What is missing is the model layer itself: no provider, family or version is named anywhere, no model card exists, and no evaluation or error rate is published for either the resolution engine or the generated messaging. The resolution accuracy gap matters most, because a wrong merge attributes one person's activity to another and every downstream action inherits that error, and the only figures offered are relative comparisons against unnamed competitors. Ask which models generate research and messaging, and for measured precision and recall on identity resolution.

Named enterprise customers in quantity, comparative claims without method. The customer roster is unusually strong for a company of this age, spanning large software, security, design and data platform businesses, with more than four hundred customers reported, and one published enterprise reference states the platform was the only one to pass that customer's security and privacy review. That is a specific and checkable claim rather than a generic endorsement.

The performance claims are the weak half: match rates asserted as thirty to fifty percent higher than competitors and duplicate reduction of up to seventy nine percent, both stated without naming the competitors, the comparison method, the sample or the period. For an identity resolution product those are the central claims and they carry no methodology. Nothing published measures pipeline or conversion effect against a holdout. Ask how the match rate comparison was run, against which competitors and on what sample, and for conversion lift on signal sourced accounts against a matched control.

The platform decides who gets contacted and hands the sending to someone else, which splits the obligation without resolving it. Qualifying individuals are enrolled automatically into sequences running in a connected engagement tool, so consent capture, suppression and unsubscribe handling execute on the customer's own estate under their own configuration. That is the right architectural place for those controls.

What is unaddressed is the handoff: nothing published states whether an objection recorded in the connected system prevents re enrolment by a workflow, whether suppression state is read before enrolment, or what governs contacting a person identified through community or open source activity who has no relationship with the customer. That last case is specific to this product, since signal is drawn from developer platforms and forums where participation is not a commercial approach. Ask whether suppression state in the connected sequencer is checked before automated enrolment, and what governs outreach to people identified through community activity.

A concrete remedy rather than a policy statement, and a default that limits collection at source. The vendor publishes a programmatic integration for removing all personally identifiable information, which is an interface a customer can call rather than a request form, and that is a materially more useful control than a written commitment for a platform holding resolved person profiles.

Documentation states the tracking default plainly: website visitor tracking collects no personal information by default and identifies only the company, and linking a visit to a named individual occurs only where that person voluntarily submitted their details through a form or signup, governed by the customer's own terms. Stating where the person level line sits, and that crossing it requires the individual's own action, is a precise answer to the question this category usually evades.

Around it sit adherence to the European and California regimes, encryption in transit and at rest, and customer controls over access, retention and deletion. Held below the top band because several instruments were not located: no subprocessor list, no transfer mechanism, no stated retention period and no data protection officer. Ask for the subprocessor list, the retention schedule for resolved profiles, and the transfer mechanism.

One supplier is named and the rest of the supply chain is described only by count. Waterfall enrichment is stated to run across dozens of providers with no per lookup charge, and a prospecting database of more than two hundred million business contacts is offered, and neither the enrichment providers nor the source of that contact database is identified anywhere.

The one exception is creditable and worth recording: intent topics are explicitly licensed from a named cooperative and the allocation is published per tier, so a buyer knows which upstream vendor supplies that signal and how much of it they get. That single disclosure demonstrates the vendor can name a supplier when it chooses to.

Signals collected from social, community and open source channels raise a further provenance question about what basis supports collecting and retaining public activity for commercial profiling, which the published surface does not address. Ask which providers the enrichment waterfall draws on, where the prospecting database originates, and on what basis community and open source activity is collected and retained.

A stated conformance position exists and covers the whole estate, which is the right form of commitment for this axis. The security page states that all integrations use official interfaces and conform to the terms of service of third party providers, which is a general undertaking rather than a platform by platform one but is stated plainly and applies across the connector set.

That matters here more than for most vendors because of what is collected: signal spans social platforms, community forums and code hosting services, each governing programmatic access under its own rules, and a vendor collecting across all of them without such a statement would sit lower by default. Held below the top band because breadth is doing the work of specificity.

The claim names no individual platform, states no method, and sits alongside a browser extension whose collection behaviour is not described, which is the exact pattern the grading convention treats cautiously. A blanket assurance covering dozens of third parties is harder to verify than a named commitment covering one. Ask what the browser extension collects, and whether the conformance commitment appears in the customer agreement rather than only on the security page.

Common Room merges a person's product usage, community participation, open source contribution, social engagement and website behavior into one enriched profile, which its RoomieAI agents read to research accounts and draft messaging.

Its subscription services agreement lets Common Room derive aggregate data in deidentified form from customer content and usage on a perpetual basis and counts that aggregate data as its own intellectual property, but neither the agreement nor the security page says whether customer content or resolved profiles train or tune any model, or which AI providers process them. The data processing addendum deletes or returns customer personal data at the customer's option when the agreement ends, with backups deleted on Common Room's own retention schedule.

A careful architectural line on identification, and silence on machine authorship. The documentation states that website tracking identifies the company rather than the person by default, and that linking activity to a named individual happens only where that person voluntarily submitted their details, which is a more restrained position than the person level identification several competitors in this lane market as a headline. Bot and cloud provider traffic is filtered.

A programmatic route exists to purge personal information. Against that, once a person is resolved the platform generates personalised messaging about them and enrols them into sequences automatically, and nothing published states whether the resulting message carries any indication that a machine composed it or that the trigger was their browsing and community activity.

A recipient receives what reads as a personal approach, prompted by behaviour they did not know was observed and written by a system. Ask whether agent generated messaging is marked as such for the sender or the recipient, and what a person is told about the signals that triggered the approach.

Unusually open delivery for a data product, with the platform exposed as infrastructure rather than only as an application. A model context protocol server and a command line interface are available across all plans, not gated to an enterprise tier, so the intelligence can be queried from a customer's own agents and scripts rather than only through a dashboard, and an official application for a major conversational assistant lets non technical users query signals in natural language.

That is a deliberate headless posture and it is rare in this category. Signal collection spans more than fifty channels, and the published integration list names specific partners across review platforms, spreadsheets, community tooling, data activation, support systems, marketing automation and publishing. Documentation and an academy are maintained publicly.

Held below the top band because gating shapes what a buyer receives: product signal integration and recurring data exports sit at the enterprise tier, record maintenance actions are an add on, and no interface rate limits or authentication documentation were verified on this pass. Ask which integrations and export capabilities exist at the tier quoted.

Nothing published locates the data. No hosting provider or region is named, no European or United Kingdom residency election is described, no tenancy model is stated, and no recovery time or recovery point objective appears. The gap carries more weight here than for a conventional application because of what accumulates: resolved person level profiles built from community, social and open source activity of individuals across jurisdictions, including people who never transacted with the customer.

A European buyer cannot establish from the published surface where profiles of European individuals are processed or stored, and the acquisition adds a further question the surface does not answer, since the acquirer operates its own global infrastructure and nothing states whether that changes the hosting position. Ask which regions resolved profiles are stored in, whether regional residency is available, and whether the acquisition changes the hosting arrangement.

A real attestation with an enumerated control set, and a customer willing to say the review was passed. A service organisation control report is held and referenced directly, security documentation is described as accessible, and the security page enumerates controls rather than gesturing at them: single sign on, role based access control, security assertion markup and directory provisioning through named identity providers, encryption in transit and at rest, and customer controls over access, retention and deletion.

A published enterprise reference from a security company states that this was the only platform to pass their security and privacy review, which is an unusually specific third party endorsement of exactly this axis. Held below the top band on three counts. No certificate, report or audit period is published openly and no auditor is named. No international information security standard is claimed alongside the attestation.

And the vendor's own pricing material describes itself as certified for an attestation that is a report rather than a certification, a small imprecision on the page a buyer reads first. Ask for the report with its audit period and auditor, and whether any certification is held alongside it.

Common Room publishes its entry price and the allowances that size every plan. Essential costs $2,500 a month, billed annually, with 5 seats, up to 100,000 contacts, 5,000 RoomieAI research credits and 2,500 Prospector credits. Advanced and Enterprise are custom priced, at 15 and 30 seats, up to 250,000 and 750,000 contacts, 7,500 and 10,000 research credits, and 7,500 and 15,000 Prospector credits.

Website activity runs to 240,000, 480,000 and 960,000 events a year, deanonymization to 1,000 visitors a month on the first two plans and unlimited on Enterprise, and Bombora intent topics to 6, 12 and 25. Premium phone enrichment carries 100, 100 and 200 credits. DataAgent actions, extra Prospector credits, product signals and data exports are add ons on some plans, with no published add on prices.

Export exists as a product feature and sits behind the top tier, which is the finding. Automatically recurring data exports are listed as an enterprise capability rather than a baseline one, so a customer on either lower tier does not have a documented bulk route out as part of what they bought.

A command line interface and a protocol server are available on all plans and would let a technically capable customer extract data programmatically, which is a genuine alternative path though it requires engineering rather than a setting. Beyond that the surface is silent: no statement of export scope or format, no retention period after termination, no deletion timeline and no renewal or notice terms.

The asset at stake is specific and hard to rebuild, being a resolved identity graph assembled over the contract term from signals across dozens of channels, where the raw sources remain with the customer but the resolution does not. Ask whether the resolved graph and enrichment exports in usable form on the tier quoted, and what the deletion timeline is after termination.

No sending infrastructure exists and the platform still decides what gets sent. Messages leave through a connected engagement tool on the customer's own domains and sending estate, so reputation, warmup, bounce handling and complaint thresholds all belong to that system and to the customer, and there is no shared pool where one customer's behaviour affects another.

What this platform contributes upstream is both the recipient list and, through the agent layer, the message content, and both of those drive deliverability outcomes downstream. Nothing published describes address validation before automated enrolment, which is the control that matters given enrichment supplies the addresses, nor whether a workflow responds to bounces by suppressing further enrolment. Ask whether addresses are validated before automated sequence enrolment, and whether bounce feedback from the connected sequencer suppresses further enrolment.

The served motion is named with unusual precision, which is more useful than an industry list. Rather than segmenting by company size or vertical, the vendor publishes use case pages for the specific go to market motions it serves, naming commercial open source, product led sales, community led growth, account based sales and job change tracking, alongside team pages for account based marketing, demand generation, revenue operations, account executives and sales development.

A buyer running one of those motions can identify themselves immediately, and a buyer running none of them learns something too. The customer roster corroborates the claim, concentrating in software companies with developer audiences and community or open source distribution.

Held below the top band by a boundary the vendor does not state and independent analysis does: the signal coverage is community and product oriented, which fits companies whose pipeline starts with free tier signups, repository activity or forum participation, and fits poorly for enterprise account teams whose deals turn on earnings commentary, leadership change and strategic initiatives. The entry commitment also sits well above what a small team would spend. Ask what the smallest viable deployment is and what proportion of signal coverage applies outside developer oriented markets.