Flocurve

At the top of the band. There is one plan and its differentiating line items are all model driven: the ideal customer profile is generated by reading the buyer's own website, the signal monitoring decides who is worth contacting, the messages are written per prospect from that context, and lead scoring ranks the result. Nothing in the packaging separates a cheaper mechanical tier from a model tier, because no mechanical tier is offered.

Held off the top for a structural reason the vendor discloses itself: the execution layer that performs the network actions is a commodity automation service supplied by a third party, so what remains after the model is removed is precisely the competitor product this vendor compares itself against.

At the bottom of the band. The product is sold on the absence of oversight rather than its presence, with campaigns described as running on autopilot around the clock, follow ups continuing automatically until a meeting appears on the calendar, and the setup framed as sixty seconds from a web address to live outreach. No approval gate, review step, escalation path, audit trail, withholding guardrail or containment mechanism is described anywhere across the pages read.

One contradiction is worth recording because it is internal: the vendor's own comparison writing criticises a competing agent for promising set and forget operation, and claims this platform keeps humans in control, while the homepage sells exactly the promise it criticises.

Rare in this category and earned on a specific disclosure: the privacy policy names the model provider outright, states the three jobs it is used for, being profile generation, message generation and lead scoring, and draws a boundary on what is sent to it, describing anonymised lead context of job title, company and industry and stating that network credentials are never transmitted. Naming the provider and the data boundary is more than most vendors here manage.

Held off the top because no model or version is identified, no accuracy, confidence or fallback behaviour is published for the scoring that decides who gets contacted, and the word anonymised carries more weight than it can bear, since a job title plus a named company usually resolves to one person.

The product interface shown on the homepage is populated with invented people at invented companies, presented as a live activity feed rather than as an illustration. Named prospects with titles and employers appear alongside quoted replies agreeing to a call and a meeting booked on a specific date, none of which happened.

Around it sit figures with no source and no method: a reply rate, a total leads found, a claimed threefold improvement in replies, a first reply within forty eight hours, and a comparison to template based tools of two to three times better. Against all of that, no named customer, logo, case study or attributed testimonial from a real person appears anywhere across the pages read, and the one review platform listing located carries no reviewer feedback at all. Fabricated telemetry is a heavier version of the invented illustration problem, because it asserts results rather than showing a layout.

At the bottom of the band. The platform sends connection requests and messages on a professional network and also sends cold electronic mail against an allowance of verified addresses, and across the pages read no consent standard, unsubscribe mechanic, suppression list, sender identification requirement or regulation of any kind is named for any of it.

The asymmetry recurs here as it does elsewhere in this category: the vendor commits to letting its own subscribers unsubscribe from its own product emails, and places no equivalent obligation on the buyer messaging strangers. The published resource library includes a guide to scraping the network the product operates on, which sits oddly beside the absence of any compliance position.

At the bottom of the band and genuinely better than most of this category. Current at March 2026 and unusually specific. Every processor is named with its function, covering authentication and database hosting, payments, the automation execution service, the model provider, two optional systems of record and a messaging platform. Retention is stated with a real number, being removal of personal data within thirty days of account deletion, with session material deleted on disconnect.

Rights are enumerated under both major regimes including portability in a machine readable format, a working contact address is published, and the vendor states it uses essential cookies only with no advertising or analytics trackers and no third party tracking scripts. The extension section describes what is read and adds a list of what is not.

Held at the bottom because no legal basis, transfer mechanism, supervisory authority, officer or processing agreement is offered, no company entity or address appears anywhere on the site, and nothing addresses the leads whose names, titles, employers and enriched addresses are stored without their knowledge.

No database is purchased or resold and the targets are generated from the buyer's own profile definition, which is the lower exposure side of this axis. Stored lead records are described precisely, covering name, title, company, profile address and an enriched electronic mail address. Two gaps hold the grade. There is no lawful basis, notice, lookup or removal route of any kind for the person whose record is created and messaged.

And there is one conspicuous omission in an otherwise complete supplier list: seven processors are named with their functions, and the supplier of the monthly allowance of verified addresses, which is the only genuinely purchased data in the product, is not among them.

The deepest credential custody graded on this axis, and the vendor documents all of it. Beyond the session token, which may be read by the extension or pasted in by hand, the platform stores the browser identifier from the session so that its requests match the operator's fingerprint, and it offers an optional reconnection feature under which it stores the operator's network login address, an encrypted password and the one time password secret key so it can refresh expired sessions unattended.

Holding the second factor seed means the platform can generate the operator's authentication codes at will until that seed is regenerated, which is durable account takeover capability rather than session borrowing. The session token is then passed to a third party automation service that performs the actions.

Purpose is stated plainly in the vendor's own answer to whether accounts get flagged: it mimics human behaviour, randomises timing, and personalises every message to avoid detection patterns. Execution is autonomous with no approval anywhere. The disclosure is exemplary and it does not cure the exposure.

At the top of the band on a minimisation posture rather than a commitment. The vendor states that only anonymised lead context reaches the model provider and that credentials never do, which is a real boundary and more than most of this category publishes. What is absent is the commitment itself.

Nothing states whether the provider may retain or train on what is sent, no reference to the provider's own retention terms appears, no tenant boundary is described between customers, and nothing addresses whether the accumulated corpus of messages, replies and outcomes is used to improve the platform's own models.

The deception here is aimed squarely at the recipient and the vendor names it as a design goal. Answering its own question about whether accounts get flagged, it states that it personalises every message to avoid detection patterns, which reframes personalisation itself as an evasion technique rather than a courtesy.

The marketing says the same thing from the other side, promising outreach that sounds like you rather than a bot and messages that read as though a human spent five minutes researching the prospect. No person approves anything before it sends, timing is randomised so the cadence does not read as machine driven, and the entire selling proposition is that the recipient cannot tell. The transparency provisions of the European artificial intelligence regulation go unmentioned. This is undetectability offered to the buyer as the product benefit, which is what this band exists for.

At the top of the band on a small but real integration set: two named systems of record receive lead data as an optional connection, a messaging platform receives notifications, and a browser extension handles the network connection. Electronic mail sending is native rather than delegated to a separate tool. What is absent is everything a technical buyer would check next: no public interface, documentation, webhook surface, marketplace listing or agent endpoint was located anywhere. The homepage comparison table marks connectors as a strength against rivals described as limited, which is a claim the site provides no material to substantiate.

Four infrastructure and service providers are named with their functions, which establishes roughly where the workload runs even though the vendor never says so directly. No country, region, provider region or residency option is stated for any of it, and no data processing agreement is offered.

The wider gap is corporate rather than technical: no company entity, registration number, address or jurisdiction appears anywhere on the site, and the only route to a human for the quote only tier is a plain electronic mail link. A buyer cannot identify who they would be contracting with, let alone where their material would sit.

This vendor stores, by its own account, network session tokens, browser fingerprints, encrypted account passwords and one time password secret keys for its customers' professional network accounts. That is the most sensitive credential material any vendor in this index admits to holding.

Against it, the published security position is four sentences: transport encryption, encrypted database columns, and a reference to industry standard practices for access control, logging and incident response with no standard named. No certification, auditor, report, audit period, trust portal, status page, penetration test or enumerated control set was located, and there is no security page.

Graded on the precedent already applied twice in this category for live session custody with no documented control set, and the credential depth here makes it the clearest instance rather than the most arguable.

At the bottom of the band. One published price at 299 dollars a month with the inclusions itemised as actual quantities rather than ticks, covering unlimited leads and campaigns, one connected account, the signal set, scoring, cold electronic mail with a stated monthly allowance of verified addresses, and analytics. A seven day trial with no card, self serve registration, cancel at any time, and the quote only tier is unusually candid in publishing its own additional seat price.

Two things hold it down and the first is checkable in a minute. The vendor's own comparison writing states that this plan covers five connected accounts, while its own pricing section states one, and the inflated figure appears precisely where it makes the cost comparison against a rival look favourable. Separately, no terms of service exist anywhere on the site, so there is no contract to read, no refund position, and no stated rate for exceeding the monthly address allowance.

At the top of the band on two real commitments. Personal data is removed within thirty days of account deletion, which is a stated outer bound rather than a vague assurance, and session material is deleted when the network account is disconnected. A portability right is granted explicitly in a machine readable format.

What holds it here is that all of it lives in a privacy policy rather than a contract: no terms of service exist on the site at all, so there is no notice period, no cancellation mechanics beyond an assurance that cancelling is possible, and no service commitment. No product level export function is named for leads, campaign configuration, message history or analytics, so the portability route is a manual request by electronic mail.

The platform sends cold electronic mail against a monthly allowance of verified addresses alongside its network messaging, so the buyer's sending reputation is genuinely at stake here. Across the pages read, nothing describes warmup, sender authentication, domain separation, ramp schedules, bounce or complaint thresholds, blocklist monitoring or placement testing.

On the network side one pacing statement exists and its framing is the finding: sending at a natural pace with randomised timing is presented as a way to avoid detection patterns rather than as protection for the recipient or the account, so the only discipline described is aimed at the platform's enforcement rather than at the health of the channel.

At the bottom of the band. Six named markets get their own treatment with a specific buyer described in each, running across software, agencies, early stage companies, financial technology, recruiting and manufacturing, and each names the roles it expects to reach.

The worked example on the homepage states roles, industries and a company size band, and the single price point with a named additional seat rate makes the intended buyer legible: a small team or agency without a development representative function.

Held at the bottom because the segmentation is expressed through content pages rather than through the product or the pricing, no headcount band, deal size or geography is stated for the buyer, and no ceiling is published to tell a larger team where this stops being the right purchase.