DealDrive CRM

The vendor answers this axis in its own description of the architecture, calling the product a full classic CRM with the agentic layer on top. That is an explicit statement that the layer sits above something complete: leads, deals, pipelines, custom modules, territory management, product catalogue and configure price quote, contracts and e-signature all stand without a model, and the products it names itself against are HubSpot, Pipedrive and Zoho.

The AI features are real and shipped on every tier rather than gated, and they are metered separately as enrichment credits, which is the packaging tell. A layer described as a layer is the cleanest version of the removal test this index has recorded.

The oversight claim is the product's headline and the newest module contradicts it, one month apart and both in the vendor's own words. The site promises the next move drafted by an agent with a human on the last click, and states plainly that agents draft and the operator approves.

The BDR agent announced in August 2026 for the top tier then lists among its capabilities the ability to auto approve and send within configured caps and a send window, on an agent that reaches prospects across email, messaging and social. Caps and windows are throttles rather than oversight.

What is missing on both sides of the contradiction is the same: no description of what approval actually gates, no withholding guardrail, no escalation criteria, and no audit trail of what an agent drafted against what was sent.

One disclosure here is better than most vendors manage and it sits in an unusual place. The lead discovery announcement names its crawling supplier outright, stating that the agent auto discovers leads from social and the web via Firecrawl, so a buyer can see one named component of the AI supply chain rather than a generic claim. The answer surface also promises responses with receipts, which implies grounded citation.

Everything else is absent: model provider, family, version and inference location go unnamed, AI credits are metered with no consumption table published, and no accuracy rate is given for intent scoring, lead scoring or the memory retrieval that the whole product now rests on.

The evidence that exists is independent and thin. Nine verified purchaser reviews on a marketplace with a 60 day refund guarantee average 4.8, and the founder posts under a verified profile with dated product announcements running from July to August 2026, which is a real and checkable release cadence.

Against that: no named customer, no case study, no quantified outcome claim of any kind, and a company profile listing 51 to 200 employees for a seed stage vendor running a lifetime licence promotion, recorded as observed. The evidence is early stage rather than concealed, and a buyer weighing a pipeline of record has almost nothing to reason from.

The regulated surface is as wide as any vendor graded at this size and nothing addresses it. The BDR agent reaches prospects across email, WhatsApp, SMS and a professional network, which engages messaging consent rules, telephone consumer protection law on the SMS leg, the platform's business messaging policy on WhatsApp, and commercial email rules on the first. The only controls named are sending caps and a send window, which govern pace rather than permission. No regime is named on any surface read, and no consent, suppression or opt out mechanism is described.

The privacy question is unusually consequential here and the documents were not located on the surfaces read. AI Memory indexes full email bodies synced from Gmail and Outlook, automatically parses email attachments, ingests uploaded contracts and proposals, and indexes WhatsApp and SMS conversations, so the platform holds correspondence rather than contact records.

A privacy policy, a processing addendum, a retention position and any data subject request route were all absent from what could be read, and the vendor's own site renders client side so its footer and legal surface could not be enumerated this pass. Re verify at dealdrive.tech directly before treating any of this as absent.

Naming the crawler is the creditable part and it stops there. Lead discovery is described as auto discovering prospects from a professional network and the wider web through a named third party crawling service, and contact and company enrichment is metered in AI credits on every tier.

No data provider is named for the enrichment itself, no licence or collection basis is stated for the crawled material, and the people discovered this way have no notification, lookup or removal route described anywhere. Held at the top of the band because naming a supplier at all is more than most enrichment products here disclose.

The BDR agent both harvests from and sends into a professional network, discovering leads there through a third party crawler and then reaching prospects on the same platform alongside email and messaging. That is action on a platform under the operator's own account with no conformance position, rate limit statement or account risk allocation published anywhere.

Held at the middle of the band because the tells that take this axis lower are all absent: no account rotation, no proxies, no multi account stacking, no session custody claim and no marketing built on avoiding detection.

The vendor raises the training question itself in the clearest terms of any vendor graded this session. The BDR agent is described as learning the operator's voice from every edit they make and training on their pitch decks, documents and market research, and AI Memory indexes the full correspondence record including email bodies, attachments, contracts and messaging threads.

A statement on whether any of that material trains or improves models serving other tenants appears nowhere, and no retention period, tenancy boundary or deletion position accompanies the memory feature. The corpus is the customer's entire commercial conversation history and the stewardship position covering it is undescribed.

Manufactured effort runs through the outbound module by design: the agent researches the prospect, scores intent, drafts the message and, on the vendor's own account, learns the operator's writing voice from their edits so the output reads as the operator wrote it. Messages reach people across four channels including two that are ordinarily personal. Article 50 goes unmentioned.

Held at the middle of the band because sending happens under the operator's own identity and mailbox, no invented persona or synthetic voice appears anywhere, and the product's stated design places a human at the approval step even though the newest module allows that step to be automated.

The agent era surface is ahead of the conventional one, which is unusual at this size. An MCP server went live in July 2026 with OAuth, and the vendor names Claude, ChatGPT and Cursor as clients that can connect to the CRM directly, making this one of a small number of vendors in the index building for agent access rather than only for people.

Beneath it sits a tiered API running from read only through read and write to full access with webhooks, two way email sync with Gmail and Outlook, WhatsApp and SMS channels, and e signature. Off the top of the band because the conventional connector catalogue is thin, no marketplace listing or integration directory was located, and API capability is gated by tier so the entry plan can read but not write.

The residency question goes unanswered on every surface read. Hosting provider, processing region, storage location and sub processor list are all absent. The gap carries more weight than usual because of what the platform stores: full email bodies, parsed attachments, executed contracts and messaging history for buyers the vendor itself describes as global, held by a company operating from India. The vendor's own site renders client side and its footer could not be enumerated this pass, so re verify before treating a residency statement as absent.

A security question appears by name in the vendor's published frequently asked questions, so the topic is addressed somewhere, and the answer text did not render on the surfaces read. No certification, audit, penetration test, control set, trust centre or status page was located. The access the product holds is broad: connected Gmail and Outlook mailboxes with full body sync, parsed attachments, contracts under e signature, and messaging threads. Recorded as a retrieval limit as much as a finding, with the vendor's own security answer and site footer as the first things to re verify.

The published limit matrix is one of the most quantified in the index. Three lifetime licence tiers at 69, 149 and 249 US dollars each publish nine separate numbers: user seats at 3, 5 and 15, storage at 5, 25 and 50 gigabytes, monthly API calls at 2,500, 5,000 and 15,000, workflows at 5, 25 and unlimited, AI enrichment credits at 100, 500 and 1,000 a month, custom fields at 10, 30 and 50 per module, pipelines at 1, 5 and unlimited, contracts and signatures at 25, 125 and 250, and API access as read only, read and write, or full with webhooks.

A 60 day refund applies. Two things hold it off the top. This is promotional lifetime pricing on a marketplace and the vendor's ordinary recurring price was not located, so the figures describe one purchase path rather than the buyer's. And a deal term states that access to future AI models may come at a discounted rate or may require an add on, which is a stated future charge with no figure attached to a licence sold as lifetime.

Two partial routes out are published. Deal data can be exported and imported from the pipeline view, and the top tier carries full API access with webhooks, which in practice lets a technical customer pull records continuously into a system they own. Both are features rather than commitments, and the entry tier's API is read only, which weakens the second route exactly where the smallest customers sit. A post termination retention period, a deletion timeline, a deletion artefact and any statement covering the correspondence and contracts held in memory were all absent from the surfaces read.

Sending appears to run through the operator's own connected Gmail or Outlook mailbox, since email sync is a core feature, which puts the reputation at risk with the buyer rather than in a vendor pool. The only discipline described is a pair of throttles on the outbound agent, a sending cap and a send window.

Warmup, authentication named by protocol, bounce or complaint thresholds, blocklist monitoring, placement testing and suppression handling are all absent from the surfaces read, on a product whose newest module drafts and sends at machine speed across four channels.

The market is stated plainly and corroborated by the shape of the product. Small and medium businesses are named as the buyer, the alternatives are named as HubSpot, Pipedrive and Zoho, the best fit is published as freelancers, sales managers and small businesses, and the search metadata names a specific competitor product and a home market.

Seat allowances running 3, 5 and 15 act as a practical ceiling, and the partner portal, deal registration and whitelabelling with a custom domain point at a second identifiable buyer in agencies and resellers. Off the top of the band because no headcount band, customer count or size distribution is published, and no ceiling is stated in the vendor's own words.