Dripify

The removal test leaves a complete and saleable product. Dripify launched as a LinkedIn automation engine and the models surface at exactly one point in it: an AI powered Icebreaker that writes an opening line from the lead's LinkedIn profile and website, offered as one of 20 plus personalisation variables. Strip it out and the sequences, daily quotas, email finder, verifier, unified inbox, analytics and team management all remain intact and sellable.

The vendor's own packaging settles it, which is the reference test on this axis: the pricing page carries no AI line item on any of the four tiers, no AI credit allowance and no AI gate. The meter on the price list is email finder credits, and the plan differences are campaign counts, daily action limits and team features.

Oversight here is throttling rather than approval, which is the recurring shape in this category. The published controls are all pace controls: per plan daily caps across seven action types, a working hours window, randomised delays between actions, and an adaptive activity control that raises and lowers the rate in response to signals it reads back from LinkedIn.

Sequences otherwise run unattended on the vendor's servers, which is the product's headline promise, and campaigns continue with the operator's machine switched off. No approval gate, withholding guardrail, escalation path or audit trail of what the system did under the operator's name is described anywhere. Third party reviews report that a sequence halts once a lead replies, which would be a genuine handover point, and that behaviour was not located on the vendor's own pages this pass.

One AI feature exists and almost nothing about it is disclosed. The Icebreaker reads a prospect's LinkedIn profile and website and generates the opening line of a message that will arrive under the operator's own name, and the vendor publishes no model provider, family, version, inference location, retention position or accuracy rate for it.

Nor is there any statement of what happens when the generation is wrong about the prospect, and no review step is described between generation and send. The gap matters more than usual because the output is the first sentence a stranger reads and its entire purpose is to look researched.

The strongest evidence record in the LinkedIn automation cohort by a wide margin, and the one axis that separates this vendor from its peers. Six customer stories are published, each attributed to a named individual with title and employer and each carrying a quantified pair with a linked full write up: CVS Health at five times network growth and a 35 percent reply rate, HighRadius at twenty times more meetings per event, Zycus at eight times more booked meetings across 40 users, EverHelp at 40 percent more monthly meetings within 30 days, Pearl Lemon at 45 meetings a month and 80 thousand dollars, One Click Marketing at three times acceptance and 100 thousand dollars.

Logos include Okta, Zoom, Paylocity, Canonical, Genpact and Fingerprint, and several reviewer quotes link out to the reviewer's own review page. Held off the top band on three counts. Methodology accompanies none of the figures. A block headed as the average each user achieves mixes measurable rates with promotional multipliers, giving 98 percent delivery, 34 percent open and 19 percent response beside ten times productivity and 1000 percent more return. And the customer count is inconsistent across the vendor's own pages, reading 40,000 plus companies on the feature pages and over 50 thousand in the pricing page metadata.

Two regimes are named, which is more than most of this cohort manages, and the naming sits in general category education rather than in any position about the product. The cold email FAQ answers whether cold email is legal by saying it depends on compliance with laws such as GDPR and CAN SPAM, and that business sending is lawful where proper consent and opt out options are provided.

That obligation is described as the sender's, and the product offers nothing published to discharge it: no unsubscribe insertion, no suppression list, no opt out detection, no consent record and no regional filtering. Set against Clickback in this index, which detects European and Canadian recipients and removes them from the send.

On the LinkedIn side safety is used exclusively to mean account restriction and never to mean law, and the seven capped action types include endorsements, likes and follows that carry no consent concept at all.

A thorough rights enumeration sitting on top of a carve out that decides the grade. Eight data subject rights are set out by name, including portability, objection to profiling, and a right not to be subject to entirely automatic profiling, and an access request is promised to return the source of the data and the logic of any automated decision making. The policy also states plainly that personal information is never sold.

Against that, it scopes itself out of the population the product exists to act upon, stating that the prospect lists customers build belong to the customer and are not subject to this privacy policy. The people whose profiles are pulled into those lists, whose work emails are found and verified, and who receive the automated messages are therefore covered by no notice at all from the party operating the infrastructure.

Third occurrence of that shape in this index after Boomerang and CallSine, and the most explicit wording of it yet. Also missing: any legal entity name or address, a data protection officer, an Article 27 representative, a sub processor list and a residency statement.

Two data products ship and neither carries a sourcing statement. The email finder reveals pre verified corporate email addresses for a prospect, and a separate enrichment feature offers 30 plus real time attributes per lead, both metered by credits. The provider, method and lawful basis behind either are unpublished.

The nearest thing to provenance in the legal surface is a line saying personal information may include information available on the internet such as from Facebook, LinkedIn, Twitter and Google, or publicly available information acquired from service providers, and those service providers go unnamed. No Article 14 notice, self service lookup or removal route exists for the person whose address is being resolved and charged as a credit.

Held above the band below because the operator supplies the target list themselves from LinkedIn search or a file upload, so this is a resolution service over a list the buyer chose rather than a harvested audience sold on as inventory.

The fullest version of this band in the index, and the deciding evidence is a training curriculum the vendor publishes on its own pricing page. Dripify offers a five module masterclass. The module headed Best Practices and Hacks lists among its topics expanding reach with multiple LinkedIn accounts, a step by step guide to creating a bot account on LinkedIn, and minimising the number of premium LinkedIn accounts to just one while still giving an entire team the premium features.

The module headed How to Stay Safe on LinkedIn opens with the main LinkedIn rules that you need to follow and closes with the weekly invite limit on LinkedIn and safe ways to bypass it. The rules and the bypass appear in the same five item list.

Around that sits the conventional exposure: server side execution from the vendor's cloud so campaigns run with the browser closed, a dedicated IP per account sold under a heading of Safety, human behaviour simulation listed as a purchasable feature, and an activity control that reads the platform's own enforcement feedback and backs off until the account returns to what the vendor calls the safe zone. A conformance position, terms of service reference or risk allocation appears nowhere.

Every other vendor in this band sells a product that evades detection. This one also teaches the buyer to create a fictitious account and step around a stated platform limit, and the account that gets restricted belongs to the buyer.

The Google boundary is published in real detail and stops one clause short of the question that matters. The policy adopts the Google API Services User Data Policy limited use requirements and spells them out: minimum necessary scopes, no advertising use of Google data including Gmail content, no sale or sharing for unrelated purposes, human access restricted to consent, legal compliance or debugging under stated access controls, and no offline storage or export beyond the authorised service.

Set that against CallSine in this index, whose equivalent clause states outright that Google Workspace data is not used to train or improve generalised models. This one covers advertising and sharing and says nothing about training.

The same silence runs elsewhere: the Icebreaker sends a prospect's profile and website content to a model with no stated provider, inference location, retention or tenancy boundary, and customer prospect lists sit on unnamed service provider servers with nothing published on whether one account's data informs anything served to another.

Undetectability is sold as a feature, and this vendor goes a step past the rest of the band by publishing a guide to fabricating the sender. Human behaviour simulation appears as a line item in the safety feature group, so the stated design goal is that neither the recipient nor the platform can tell an action was automated.

The Icebreaker composes an opening line from the prospect's own profile and website, delivered from the operator's real account, so the recipient reads what looks like evidence that a person studied them. Profile views, endorsements at up to 50 plus a day, likes at up to 50 plus a day and follows are automated social signals whose entire communicative value is that a human chose to perform them.

And the published masterclass includes a step by step guide to creating a bot account on LinkedIn, which is the inverse of disclosure: an invented person as the correspondent. Article 50 of the European AI Act goes unmentioned by a vendor selling into European markets and naming European employers in its own testimonials.

A broad conventional connector surface with nothing built for agents. Native integrations to HubSpot and Salesforce, Zapier and Make, Google and Google Sheets, plus webhooks, with a claimed reach of 1000 plus applications through the automation platforms. The supporting furniture is real: a public help centre, an integrations directory, a suggest an integration flow, seven written competitor comparison pages and a video tutorial library.

Held off the top band because the developer surface is thin where it counts. Public API documentation was not located, third party reporting places API access in the top tier only, and webhook and Zapier access is gated above the entry plan, so the cheapest tier cannot reach a CRM at all. There is no MCP server and no agent facing endpoint, which is now a visible gap in a corpus where ten vendors have shipped one.

A residency answer does not appear on any page read. The privacy policy places customer data on our service providers' servers and names no provider, region or country, while the enterprise tier advertises enterprise grade security as a bullet with nothing behind it. The observation worth carrying is the asymmetry. This vendor is precise about one geography and silent about the other.

Every paid plan publishes a dedicated IP address tied to the account and located in the operator's own region, because where the automation appears to originate governs whether the platform restricts the account. Where the customer's prospect records, message content and connected mailbox data are stored is nowhere stated. The geography that protects the account is a published feature; the geography that protects the data is unaddressed.

The platform holds live authenticated sessions for its customers' LinkedIn profiles together with connected Gmail and Outlook mailboxes, which is the most sensitive access any category in this index requests, and a certification, audit, trust centre or enumerated control set was not located on any page.

The security paragraph in the privacy policy asserts a variety of security technologies and procedures and appropriate physical, technical and organisational measures, which enumerates nothing. Enterprise grade security appears only as an unpriced tier bullet, presenting protection as a purchasable feature rather than a property of the platform.

Graded at the top of this band rather than lower because one real access commitment is published: the Google limited use section restricts human access to customer Google data to consent, legal compliance or debugging under stated controls. That covers one integration, not the platform.

Consistent with Alsona, which took this band on the same combination of session custody and an absent control record, while cubforge was held a band higher for enumerating a genuine control set behind a badge it had not yet earned. This vendor is older and larger than either and publishes less.

Among the clearest pricing pages in the index, and the third time in this cohort that the vendor answering recipient and platform questions worst publishes the best price. Four tiers, three of them priced on both cycles at 59, 79 and 99 US dollars per user per month monthly against 39, 59 and 79 billed annually, self serve signup on each and no demo gate below enterprise. The piece almost nobody publishes is here: the unit is defined.

A seat connects one LinkedIn account and a team of five reps needs five seats, stated plainly in the pricing FAQ. Beyond that, a full daily quota table with real numbers per tier across seven action types, and complete credit economics for the email finder at 100 included monthly, valid 30 days, no rollover, one credit deducted only on a successful verified find so failed lookups cost nothing, and four priced top up packs at 29, 49, 69 and 99 dollars.

Sending itself is stated to be unmetered on every plan. Upgrade and downgrade mechanics, cancellation terms and the consolidation route above ten seats are all published, and the seven day trial takes no card and grants top tier features. Recorded as a retrieval limit rather than a vendor defect: the tick and cross marks in the feature comparison matrix did not survive extraction, so per tier availability of those rows could not be read. One item to re verify, reported by a third party: the pricing table marking activity control on every plan while a help article restricts it to the top tier.

Export exists and the entry plan cannot reach it. Export of leads to a file appears on the Pro plan card as an upgrade over Basic, so the cheapest paying customer has no route to take their own prospect records, notes and campaign results out. That is the inverse of Bindago and Bigin in this index, both of which put unmetered export on the entry tier.

On the personal data side the privacy policy does better than the product: erasure and portability are both published as self service through the account profile, which is a mechanism rather than a promise. Held at this band by what surrounds it.

A post termination retention period, deletion timeline or deletion artefact is stated nowhere, retention runs on an open ended ongoing legitimate business need test, and cancellation is described as ending access at the close of the paid period with nothing said about the data left behind.

Recorded as observed: the portability right routes to a support address on the vendor's older dripify.io domain while every other contact route on the same page uses dripify.com, so the one statutory right given its own address points at a domain the company no longer runs its site on.

The asymmetry between the two channels is the finding. On LinkedIn this vendor publishes a precise volume governor: a table of daily caps per tier across seven action types, a working hours window, randomised pacing and adaptive throttling. On email it publishes the opposite, stating in its own pricing FAQ that sending is not metered on any plan, and advertising an average of 4,400 emails sent per user per month with no cap, ramp or warmup described.

Genuine controls exist on the list side and they are why this sits above the band below: an email verifier ships as a product, a credit is spent only when an address is successfully found and verified, and a deliverability index is reported in campaign analytics. The sending side is where everything is missing. No warmup, no sender authentication check, no blocklist monitoring, no bounce or complaint threshold, no placement testing and no degradation response.

A 98 percent delivery rate is asserted as a user average with no measurement basis, and advice about warming, verified sender domains and list cleaning appears in the FAQ as category education rather than as anything the product performs.

Better defined than most at the tier level and unbounded at the top. Each plan card carries a one line buyer description, moving from a solo seller running one campaign at light volume, through sellers running LinkedIn and email campaigns, to sales professionals wanting stronger account safety and continuous lead flow solo or as a team, to large teams wanting onboarding and a customer success manager.

Three use case pages cover founders, sales and recruiting, and seven named competitor comparison pages place the product against Dux Soup, Expandi, Meet Alfred, Phantombuster, Linked Helper, Waalaxy and HeyReach. The seat definition and the stated consolidation route above ten seats make the team size ladder legible, and the customer record corroborates the range, running from solo consultants to a 40 user deployment at Zycus.

Held off the top band for the usual reason: no headcount band, no named vertical, no distribution and no ceiling, with founders, sales teams and recruiters all claimed at once across a stated 40,000 plus companies.