LinkedIn & Social Selling
F

FirstTouch

Execution layer that makes professional network outreach a native channel inside HubSpot. Connection requests, messages and profile visits fire from HubSpot workflow cards or lists rather than from a separate outreach tool, and every touch is logged back to the contact timeline so social activity carries the same attribution as email. Adds engagement signal sourcing that identifies people reacting to relevant posts and qualifies them against the buyer's ideal customer profile, plus enrichment, contact discovery and research and qualification agents. Publishes a public agent interface so external assistants can run governed actions against the same workspace.

One price at 99 dollars per seat per month with 500 credits included and overage at two cents a credit. First Touch Inc., founded 2024 by alumni of HubSpot and Klaviyo with backing from those companies' founders.

Last VerifiedAugust 19, 2026
Compare FirstTouch with other vendors
Founded
2024
Headquarters
Boston, Massachusetts, United States
Categories
linkedin-social-selling, sales-engagement, data-and-enrichment
Assessment

Capability Axes

AI Capability
AI CentralityAI CentralityWhether AI is the product or a feature veneer. The removal test: peel the AI label off, and does anything sellable remain?
CC on AI CentralityAI features on a conventional platform. Peel the AI label off and the product still works roughly as before.
Vendor Published

The removal test is settled by the vendor's own competitive positioning rather than by inference. Every comparison it publishes against rival tools turns on where the action fires and where it is logged, being triggered from a workflow inside the system of record and attributed on the contact timeline, rather than on the quality of anything a model produces.

Strip the research and qualification agents out and that orchestration and attribution layer remains, complete and saleable, and it is what the vendor argues is the difference between itself and a logging extension. The meter supports the same reading: the included credits are denominated in enrichment, contact discovery and engagement signals, not in generated messages.

Autonomy and Oversight ModelAutonomy and Oversight ModelWhat the system does without a human. Draft for review, auto send, or fully agentic, and what contains a bad run.
BB on Autonomy and Oversight ModelThe human in the loop posture is described substantively (draft versus auto send, approval flows) but the failure containment story is incomplete.
Vendor Published

At the very top of the band and the best articulated oversight position in this category. The vendor names four controls and describes them as enforced rather than advisory: human approval on every step before anything is sent, enforced pacing with automatic withdrawal, qualification gating so only profile matched prospects are contacted at all, and a full audit trail.

It adds a circuit breaker most products here lack, stating that any platform warning on any seat pauses that seat the same day with no exceptions, and a one tool policy requiring the buyer to disconnect other automation before starting. Its external agent interface is described as running actions with the operator's approval rather than freely.

One piece of this is architecturally real rather than asserted, and it is the important one: the audit trail is written into the customer's own system of record, so the log lives somewhere the vendor does not control and the customer can verify.

Held off the top because no configuration surface, rule syntax or numeric pacing limit is published, the safety checklist that would contain them sits on a documentation site that was not read, and the claim set is presented in a marketing article rather than in product documentation.

AI Disclosure and Model TransparencyAI Disclosure and Model TransparencyWhat models power the product, whether AI generated outreach discloses itself, and whether scoring and routing logic is explainable.
CC on AI Disclosure and Model TransparencyThe product is described as AI powered with the stack, the disclosure behavior, and the scoring logic all unstated.
Vendor Published

Research and qualification agents are central to how the product is sold and the system behind them is undisclosed. No model, provider, family or version is named anywhere located, and no accuracy, confidence treatment or fallback is published for the qualification judgement, which is consequential because that judgement decides which people get contacted at all. The nearest thing to a disclosure is a claim about output character rather than about the system, being that the messaging is crafted to read as more human than most.

Operational and Outcome EvidenceOperational and Outcome EvidenceMeasured outcomes with a stated basis: replies, meetings, pipeline, win rates. Logos are not evidence and prestige is not measurement.
BB on Operational and Outcome EvidenceReal outcome evidence published, with named customers and numbers, but the measurement basis is incomplete: population, period, or definition unstated.
Vendor Published

A linked case study names the customer and the figure, reporting forty percent more qualified opportunities in a single quarter with two named individuals quoted inside it. Beyond that, testimonials carry name, title and employer rather than initials, including representatives at three well known software companies, and one quantifies a personal result of three additional opportunities in a first month.

A marquee reference is named with a public figure attached, describing a social first motion behind a combined thirty million dollars of recurring revenue. Investors are named and checkable and include the founders of the two companies this team came from.

Held off the top because no methodology, baseline or period accompanies any figure, the headline counters on the site are animated elements that did not resolve on retrieval so the numbers could not be read, and no independent review platform record exists at all for a vendor claiming more than a thousand users.

Compliance and Risk
Outreach Compliance PostureOutreach Compliance PostureHow the product handles regulated outreach: consent, DNC scrubbing, opt out mechanics, caller ID conduct, and the public enforcement record.
CC on Outreach Compliance PostureCompliance is mentioned as the customer’s responsibility, with little or no product enforcement described. The tool can be run lawfully, and nothing about it helps.
Vendor Published

At the top of the band for one control that genuinely restrains who gets contacted rather than how fast. Qualification gating is described as ensuring only real profile fits are touched, which is a targeting discipline almost nothing else in this category offers, and the one tool policy plus the same day seat pause on a platform warning are real operating rules. What is absent is any obligation.

No consent standard, opt out mechanic, suppression capability or regulation of any kind is named for the messages the customer sends, and for a product whose whole proposition is putting social outreach on the same footing as email, the compliance machinery that surrounds email is not carried across with it.

Data Privacy PostureData Privacy PostureGDPR and CCPA posture: lawful basis, data subject rights handling, DPA availability, subprocessor disclosure.
CC on Data Privacy PostureA standard privacy policy exists and answers none of the questions this product category specifically raises.
Vendor Published

Strict data governance is claimed alongside the certification claim, and the architecture has a real privacy property worth crediting: because activity is logged into the customer's own system of record rather than accumulating solely in the vendor's platform, the customer retains visibility of what was done in their own environment.

Against that, the privacy policy and terms were not read this pass and are recorded as a retrieval limit rather than as an absence, so no legal basis, retention period, transfer mechanism, sub processor list, officer or supervisory authority could be verified.

The population that most needs addressing is the one the product identifies rather than the one that signs up: people surfaced by their public reactions to posts, enriched with work email and mobile number, and scored against a profile they never saw.

Data Licensing and ProvenanceData Licensing and ProvenanceWhere the data comes from and on what legal footing: licensed, contributed, public record, or scraped, and who stands behind the answer.
CC on Data Licensing and ProvenanceData is described by its size and coverage with its origin unstated. The provenance question is answerable only by asking the vendor.
Vendor Published

The published provenance is a class list rather than a supplier list: public social profiles, professional networks, market trends and industry reports, with data accuracy and relevance asserted. No vendor, licence, lawful basis or refresh position is named, and the credits that meter enrichment and contact discovery buy work email addresses and mobile numbers whose origin is unstated.

The mechanic worth naming separately is engagement signal sourcing, which takes the people who liked or commented on a relevant post and turns them into a qualified audience. That is a milder relative of the follower harvesting graded elsewhere in this category, since the reaction is public and a qualification step sits between collection and contact, and it still creates a record about a person on the basis of a gesture they made toward someone else's content. No notice, lookup or removal route exists for any of them.

Platform Terms ExposurePlatform Terms ExposureWhether the product operates inside the terms of the platforms it touches, and the restriction risk a buyer inherits when it does not.
DD on Platform Terms ExposureThe method visibly violates platform terms (headless automation of a prohibiting platform), or the vendor’s account restriction record is public and unacknowledged.
Vendor Published

At the top of the band, and the placement is uncomfortable precisely because the oversight around it is the best in this category. The vendor states that it uses dedicated agents to simulate human interaction and timing, with dedicated proxies, to keep the account safe.

Proxying the network origin of automated actions is a materially heavier exposure than the pacing and delay mechanisms graded elsewhere here, because it is aimed at making server side activity indistinguishable from a person at their own machine. It is paired with an unqualified promise that the buyer will not be banned if they follow the guide, supported by a claimed record of zero restrictions across more than two hundred connected accounts.

That guarantee is the opposite of what a peer vendor in this same session wrote into its terms, which is that it cannot guarantee any such thing and the customer accepts the risk. What holds this at the top of the band rather than lower is that the protective controls are real and specific: approval on every step, enforced pacing with automatic withdrawal, a same day seat pause on any platform warning, and a requirement to disconnect competing automation first. No account rotation or multiplication is sold.

AI Safety and Data StewardshipAI Safety and Data StewardshipThe cross client boundary: whether customer data trains models that serve competitors, plus retention and deletion posture.
CC on AI Safety and Data StewardshipSecurity language exists but the training question, the one this axis turns on, is unanswered: a buyer cannot tell whether their pipeline data improves a competitor’s instance.
Vendor Published

The training question is unaddressed in every direction. Nothing states whether approved message drafts, research output, enrichment records or the engagement graph feed any model, no tenant boundary is described, and no model provider is named to which such a commitment could attach.

This matters more than usual for a product with a published external agent interface, because assistants connected through it read and write against the same workspace, and the boundary between what an operator's agent sees and what the platform retains is not described anywhere located.

Recipient Disclosure and AuthenticityRecipient Disclosure and AuthenticityHow the product presents itself to the people it targets: whether automated outreach and AI agents disclose themselves, whether sender personas are real, and whether personalization is grounded in verifiable fact. Measured as known compliance with Article 50 of the EU AI Act, in force since August 2, 2026, which requires AI systems that interact with individuals to disclose that fact.
CC on Recipient Disclosure and AuthenticityNothing published on whether recipients are told they are dealing with software. For a product whose AI talks to prospects, silence here is now a regulatory posture, not a style choice.
Vendor Published

At the bottom of the band. Nothing adopts a false identity, the message arrives from the representative's own account under their own name, and a person reads and approves every item before it goes, so the words that reach the recipient have been endorsed by a human. Three things hold it low.

The vendor markets that its messaging is crafted to bypass filters that detect machine written content and to read as more human than most, which on the kinder reading is a claim about copy quality and on the plainer reading is undetectability offered as a benefit. Timing is simulated by design rather than chosen. And automated profile visits carry the recurring problem in this category, that the entire communicative value of a profile view is that somebody decided to look. Article 50 of the European artificial intelligence regulation goes unmentioned.

Integration and Deployment
Ecosystem and Integration DepthEcosystem and Integration DepthDocumented depth of CRM and stack integration: objects, sync direction, API surface, marketplace presence that matches the claims.
BB on Ecosystem and Integration DepthSolid primary CRM integration documented, with depth unstated at the edges (sync direction, custom objects, failure behavior).
Vendor Published

At the top of the band and the agent surface is among the strongest in this index. A public agent interface runs on its own subdomain and is stated to connect assistants from five named vendors to the same workspace so they can discover contacts, enrich profiles and run governed outreach.

Role based instruction packs are published as versioned releases on a public code repository, which is a distribution channel almost nothing else here uses, and the interface toolkit is included on every seat rather than sold as an upgrade. Inside the system of record it ships native workflow action cards rather than a webhook, plus a browser extension and list based execution for buyers on tiers without a workflow builder, and a public documentation site.

Held off the top for one deliberate limitation the vendor states plainly: this is a single system of record product, with no support for the other major platform, so the depth is exceptional and the breadth is one lane wide.

Deployment Model and Data ResidencyDeployment Model and Data ResidencyWhere the product runs and where customer data lives, including residency options for EU buyers.
CC on Deployment Model and Data ResidencyCloud hosted is the whole public answer. Region and residency questions require a sales conversation.
Vendor Published

No country, region, cloud provider, residency option or sub processor list was located anywhere on the pages read. The one architectural fact that bears on this axis runs in the customer's favour and is worth recording: the activity record is written into the buyer's own system of record, so the durable history of who was contacted and when sits in an environment whose residency the buyer already controls. What sits in the vendor's environment, being the enrichment records, the engagement graph, the qualification output and the connected account session, has no stated location at all.

Security Certifications and Trust CenterSecurity Certifications and Trust CenterVerifiable security posture: enumerated current certifications and a trust center an outsider can actually read.
CC on Security Certifications and Trust CenterSecurity is claimed in general terms. Asserting certifications without enumerating them is weaker than it looks, and this band is where that lands.
Vendor Published

At the top of the band, and it sits above the two peers graded in this category this session for the simple reason that a certification is claimed at all rather than nothing being claimed. The claim is made without its type, which is the recurring weakness this band was written for: an audited report named without saying whether it covers a point in time or a period tells a reviewer very little.

No auditor, audit period, report request route, trust portal, status page or penetration test was located, and no enumerated control set is published, though a documentation site carries an operational safety checklist that was not read. The platform holds connected account access for its users and runs proxied infrastructure on their behalf, which is what makes the missing detail consequential.

Commercial and Operational
Commercial TransparencyCommercial TransparencyWhether a buyer can budget without a sales call. Published pricing graded on completeness, not on the price itself.
AA on Commercial TransparencyReal prices published: plans, seat or usage economics, and the shape of enterprise pricing, sufficient for a buyer to budget without a call.
Vendor Published

One price, one unit, and every variable around it quantified. Ninety nine dollars per seat per month with five hundred credits included per seat, a single shared credit pool covering enrichment, contact discovery and engagement signals, and overage published at two cents a credit in packs of five hundred. No tiers, no setup fees, self serve signup with no card.

Two boundaries are published that most vendors leave for the call: five or more seats adds a named account manager, and above twenty five seats it becomes a sales conversation, so the buyer knows in advance where self serve stops. The piece that lifts this to the top is the treatment of the external dependency, which this index has penalised repeatedly when it is hidden.

The vendor states plainly that it works on every tier of the host platform including the free one, that the native workflow cards require a professional tier of one of three specific hubs, and that buyers below that tier run through the extension and lists instead. A load bearing prerequisite named with its exact threshold is the disclosure that separates a real price from a headline one.

Exit and Data PortabilityExit and Data PortabilityWhat happens when a customer leaves: completeness of data export, rights to enriched or licensed data after termination, deletion commitments, and auto renewal mechanics, graded from published terms and documentation.
CC on Exit and Data PortabilityExport exists as a feature claim while the terms that govern exit, data rights after termination, deletion, and auto renewal mechanics, are not published anywhere a buyer can read.
Vendor Published

At the top of the band on an architectural answer rather than a contractual one, and it is a genuine one. The product's entire purpose is writing every connection request, message and reply into the customer's own system of record with its trigger context attached, so the activity history, the attribution and the contact records already live outside this vendor before any exit conversation begins. A departing customer keeps the thing the product was bought to produce.

What is missing is everything the contract would say: no retention period, post termination window, deletion timeline, deletion artefact or export route for the enrichment records, engagement graph and qualification output that accumulate on the vendor's side. The terms of service were not read this pass and are where those would sit.

Deliverability and Sending DisciplineDeliverability and Sending DisciplineThe operational craft of sending: warmup, rotation, volume governance, spam rate monitoring, and what happens when reputation degrades.
CC on Deliverability and Sending DisciplineDeliverability is invoked as a benefit with no documented mechanism. For senders this is the axis where marketing most outruns evidence.
Vendor Published

At the top of the band. No electronic mail is sent by this product, since the host platform handles that side and this one fires social actions, so most of the axis is inapplicable and the grade records what is knowable with that context. Two controls are published and both are more than the category norm: pacing described as enforced rather than advised, with automatic withdrawal of outstanding requests, and a rule that any platform warning on any seat pauses that seat the same day.

A safety checklist covering account health, daily limits, targeting and operating hours is published on a documentation site. What is absent is a single number: no daily limit, ramp schedule, threshold or volume ceiling appears on any page read, so the enforcement is described without being specified.

Segment and Market CoverageSegment and Market CoverageWho the product actually serves, evidenced: segments, geographies, languages, and customers that match the claim.
BB on Segment and Market CoverageSegment focus is clear and evidenced with a gap in geographic or language specifics.
Vendor Published

The sharpest segment boundary in this category, and it is drawn by a prerequisite rather than by a slogan. The buyer is a business to business sales team already running a specific system of record, the vendor says so plainly, and it states equally plainly that it does not support the other major platform. Within that boundary the tiering of the host platform is mapped to what the buyer actually gets, with native workflow cards above one threshold and extension based execution below it.

Two size markers are published, being a named account manager from five seats and a sales conversation above twenty five, so a team can locate itself on the ladder before contact. Held off the top because no headcount band, vertical or geography is stated, and because the ceiling that is published is a service boundary rather than a statement of where the product stops being the right purchase.

Commercial

Pricing

Vendor-published figures are labeled as such. Figures labeled “Estimated” are derived from third-party sources and have not been confirmed by the vendor.

No pricing data has been verified for this vendor. Pricing information will be published here once confirmed through vendor disclosure or third-party estimation.

Contact us

Found a vendor we missed? Have feedback on the index? We’d love to hear from you.

GTM Tech Index

An independent reference for evaluating the software revenue teams use to find, win, and keep customers. No vendor pays for inclusion, placement, or rating.

Index Status
Last index update
August 20, 2026
The GTM Tech Index is an editorial reference, not a law firm or a regulator. Compliance postures are assessed from published sources and public records, and nothing on the index is legal advice. Figures labeled “Estimated” have not been confirmed by the vendor. See the Methodology page for evaluation standards and limitations.
© 2026 GTM Tech Index
3801 N Capital of Texas Hwy, Ste E240 · Austin, TX 78746