Cooby

The removal test leaves the entire commercial product standing. Strip the models and what remains is a browser extension that organises a WhatsApp inbox into tabs, stores templates, sets reminders and syncs every message into HubSpot or Salesforce, which is the whole of what the published price list sells. The pricing matrix runs to eight feature groups across Starter, Growth and Custom and carries no AI line item of any kind.

The AI product, Cooby Sales Agent, is a separate managed offering routed to a pilot booking rather than a plan. Vendor packaging is the best available evidence on this axis, and here it places the models outside the purchasable tiers entirely.

Oversight takes an unusual shape here because the vendor operates the agent rather than shipping it. Cooby states that it builds, tunes and runs the qualification workflow while the customer takes the qualified meetings, so the buyer neither writes the instructions nor holds the controls. The agent answers an inbound lead in under six seconds with no approval gate, and a human enters only at handoff.

Held above the bottom of the band because the agent replies only to people who messaged first, the handoff to a rep is a designed stage rather than an exception, and the full transcript syncs to the customer's CRM in real time, so the record of what was said sits in a system the buyer owns. Approval mechanics, withholding guardrails, escalation criteria and any audit trail of agent decisions go undescribed.

Model provider, family, version and inference location go unnamed across every page read. The agent is described as trained on the customer's tone, offers and rules of engagement, with no mechanism, grounding source or update cadence given, and no accuracy or error rate is published for the qualification itself, which is the number that matters because a wrongly scored lead is deprioritised by a human who trusts the score.

The gap is sharpest in the trust centre: the subprocessor register, last updated 15 June 2026 and presented as complete, lists cloud, payments, authentication, analytics, support and monitoring providers with a processing location beside each, and carries no AI or model provider. Either inference runs inside the vendor's own AWS estate and nothing says so, or a provider handling live customer conversations is absent from the register. Recorded as observed rather than as a finding of either.

Ten named customer logos including GoStudent, Amenitiz, TransferRoom and Sleek, a dedicated case studies section and a testimonials page. The lead case study is attributed to a named person with a title, Chris Chia, General Manager at Boutir, and carries four figures: two hours saved per rep per day, more than twenty three times return, twice the revenue, and 700 US dollars saved per rep per month.

Off the top of the band because no method, period or sample sits behind any of the four, a doubling of revenue is attributed to a message syncing tool with no attribution model described, the same single customer quote carries both the homepage and the Sales Agent page, and the agent's own headline claims of a six second first response and ten times the throughput of a human sales development team rest on nothing published.

Two things earn the band. The managed agent sends on the official WhatsApp Business API, which the vendor names as its basis and which carries the platform's own template approval, opt in and session window rules, so the automated messaging runs through the sanctioned channel rather than around it.

And the product is sold in part as a record keeping control: one of four published personas is a compliance manager, with message capture into the CRM presented as protection against fines and against sales fraud. Retention of business messaging is a live regulatory problem and few vendors here engage it at all.

Held off the top of the band because no regime is named anywhere, neither the platform's own business messaging policy nor any statute, and because broadcasting ships on every tier including the entry plan with no consent, opt in or suppression position stated.

The published surface is among the deepest in the index. Navis One Lab, LLC is designated processor for customer uploaded data and controller for usage data, in writing. A data processing addendum incorporating the EU standard contractual clauses and the UK addendum is published rather than supplied on request, alongside a subprocessor register carrying a processing location for each entry, a cookie declaration, and privacy by design guidance encouraging customers to mask unnecessary fields.

The invalidation of Privacy Shield in July 2020 is named correctly and the clauses are identified as the operative mechanism, which is the second clean handling of that question in the index. Off the top of the band because the privacy policy itself went unread this pass, a data protection officer and an EU representative are absent from the pages read, and the people on the other end of a synced WhatsApp conversation have no notice or removal route on the vendor's own surface, the processor framing placing that duty with the customer.

The lightest posture available, and it is architectural: the vendor sells no data at all. There is no contact database, no enrichment, no third party sourcing and no marketplace, so every record in the system arrives because a customer's own rep held a conversation or because the customer imported their own list. Off the top of the band on two counts.

Contact import and export ship on every tier with no stated provenance obligation on the customer, and the counterparties in those conversations become CRM inventory for the customer's whole revenue organisation with no origin statement, notice or removal route described anywhere on the vendor's surface.

This vendor sells both routes to the same platform, which makes it the clearest case on the axis so far. The managed agent runs on the official WhatsApp Business API, named as such, which is the sanctioned commercial channel. The core product is a browser extension operating on WhatsApp Web against reps' own personal WhatsApp numbers, adding tabs, templates, broadcasting and chat with non contacts, and copying message content to the vendor's servers.

Custody stays with the user throughout: the extension runs in the rep's own browser under the rep's own session, and rotation, proxies, multi account stacking and undetectability marketing are all absent. Off the top of the band because a conformance position for the extension half is never stated, and because bulk broadcasting from a personal WhatsApp account is the exposure the buyer carries: the account at risk of restriction belongs to the rep, on the number they keep when they leave.

The cross tenant training question goes unanswered on every page read, and the corpus makes it a pointed one. What accumulates is the complete message history of sales conversations, copied from personal WhatsApp accounts, with media files stored on the vendor's own infrastructure, and the managed agent is described as trained on each customer's tone, offers and rules of engagement.

A statement that customer content is not used to train or improve models serving other accounts appears nowhere. The privacy by design guidance in the GDPR page, encouraging customers to mask unnecessary data, is a minimisation position rather than a training one. Held at the top of the band because the processor designation and a published processing addendum together constrain purpose contractually, which is more than most here offer.

Two disclosure gaps sit inside one product, and only one of them is the kind anyone writes regulations about yet. The managed agent answers inbound WhatsApp messages in an on brand voice described as sounding like the customer's team, and whether it identifies itself as artificial at first contact goes unstated.

Article 50 is squarely engaged, since contact with a person is certain rather than merely foreseeable and the marking duty rests principally on the provider, which here is Cooby itself because it builds and runs the agent. The regulation is unmentioned. The quieter gap belongs to the older half of the product: a rep's WhatsApp conversations are copied into their employer's CRM, and the person on the other end is never told their messages are retained in a corporate system.

Held at the middle of the band because contact is recipient initiated, the correspondent is the business's own number rather than an invented human, no persona name is published, and the handoff to a real person is the designed endpoint.

Two way sync into HubSpot and Salesforce, a listed HubSpot marketplace app, a Creatio marketplace partnership, Zapier, a custom webhook route offered explicitly for in house CRMs, a help centre and a published service level guideline. Off the top of the band on gating and on absence. Salesforce, Zapier and webhook integration all sit above the two published tiers, so entry and mid tier customers reach exactly one CRM, and the sole authentication option at any tier is Google OAuth.

A public API and developer portal were not located, and no agent facing endpoint or model context protocol server exists, which is a conspicuous shape for a product whose entire function is moving conversation data between systems.

The residency answer is complete, and the unusual part is that it is assembled from three separate documents rather than stated in one place. The subprocessor register names AWS as the infrastructure and gives a processing location for every entry, including AWS itself at United States and EU. The transfer impact assessment states that primary processing occurs in the United States and offers the option to store data in an EU region data centre.

The same document names the standard contractual clauses and the UK addendum as the transfer mechanism, records encryption at rest and in transit alongside access controls and regular security testing as the supplementary measures, and adds a government access position almost nobody publishes: the vendor states it has received no United States intelligence or security agency requests for customer personal data, and commits to redirecting any such request to the customer and notifying them unless legally prohibited.

Two gaps worth naming and not enough to move the grade: the EU region is identified no more precisely than the continent, and no route to select it is documented, so a buyer cannot tell whether it arrives with a tier, a contract or a conversation.

SOC 2 Type II is claimed with the type stated, which is the distinction several vendors here fail, and the pricing matrix places it on every tier including the entry plan rather than treating attestation as an upgrade. A real trust centre publishes seven documents covering subprocessors, the processing addendum, GDPR and the transfer assessment, cookies, privacy, the master service agreement and terms.

Encryption at rest and in transit, access controls and regular security testing are named in the transfer assessment. Off the top of the band because the audit period, the auditor and any route to the report are all absent, no penetration testing is attributed, no control set is enumerated on a dedicated security page, no status page was located, and the only single sign on at any tier is Google OAuth, with no enterprise federation even on the custom plan.

Two published tiers carry real numbers on both billing cycles, 15.99 and 25.49 US dollars per user per month annually against 20.99 and 31.99 monthly, with a complete tick and cross matrix across eight feature groups. The metered unit is published and defined, synced messages per seat per month at 6,000, 10,000 and unlimited, and the overage behaviour is stated in the FAQ: reach the cap and syncing stops until renewal, which tells a buyer exactly what the ceiling does.

Free trial with no card, Stripe checkout. Three things keep it off the top of the band. The Sales Agent line carries no price at all and routes to a pilot booking, on a page that quantifies the in house alternative at 300,000 to 580,000 US dollars a year, which is the load bearing unpriced add on that has held other vendors here at this band. The annual toggle advertises savings up to 50 percent while its own figures show roughly 24 and 20 percent.

And a second, older price list still sits lower on the same page, offering a free extension, a 9.99 tier and a team plan at 17.99 for up to three users with CRM integration included, terms the current tiers do not offer, so one page presents two incompatible pricing systems.

Contact export ships on every tier including the entry plan, unmetered, alongside import. The stronger part is architectural: the product's whole purpose is to write conversation history into a CRM the customer already owns, and the underlying messages remain in the rep's own WhatsApp account regardless, so a departing customer keeps both copies of the thing they bought without needing the vendor's cooperation.

A master service agreement is published rather than supplied on request, which is where termination terms belong. Off the top of the band because a post termination retention period, a deletion timeline and any deletion artefact were not located on the pages read, and the agreement itself went unread this pass.

The axis bites differently on a product that sends no email. What is knowable: messages leave either through a rep's own WhatsApp account or through the official Business API, so the reputation at stake is the customer's own number and the quality rating the platform maintains against it, rather than a shared pool the vendor controls.

Broadcasting ships on every tier including the entry plan, while pacing, volume governance, opt out handling, template quality monitoring and any response to a degraded rating are all undescribed. The sending architecture is therefore sound and the discipline around it is unstated.

Four named personas carry distinct value statements, sales lead, revenue operations, sales rep and compliance manager, and the integration pages name verticals with specific problems rather than a list: wholesale distribution, education advising, software sales, and on the agent page residential property.

The logo set is consistent with mid market European and Asian scale ups, the site publishes English, Portuguese and Spanish, and a payment FAQ addresses Reserve Bank of India rules for locally issued cards, all of which corroborates a messaging first geography rather than a United States one. Off the top of the band because a headcount band, a customer count and any distribution across sizes go unpublished, and no ceiling is named.