FlowUp

The product is marketed as an artificially intelligent omnichannel platform in the navigation and again on the homepage, and no model driven feature is described anywhere on the site. Across the four channel pages, the seven solution pages, the platform page and the trust page, nothing is generated, scored, predicted, ranked or classified by a model.

What is described is a workflow builder with timed delays and branching triggers, a voice broadcast engine, a message sender, an inbound module and a call tracking report, all of which are deterministic and all of which predate the claim.

The lowest band on this axis is reserved for a marketed claim that fails the removal test rather than for a competent product that makes no claim, and this is the clearest instance of that in the index so far: remove the model and nothing at all is missing, because no function was ever attached to it.

The operator configures a workflow once and the platform then runs it without further intervention, launching campaigns on a schedule, inserting delays, branching on recipient behaviour and answering inbound contact through auto responders that the vendor describes as working while you sleep.

One real oversight mechanism is published and it deserves credit: live and hot leads are transferred to a person, so the escalation path from machine to human is a designed part of the product rather than an afterthought. Against that, no approval step, review queue, campaign audit trail, kill switch or supervisor monitoring is described for the automated portion, and the sibling contact centre product does publish call monitoring while this one does not.

The claim to be artificially intelligent is made twice in prominent positions and carries no referent at all. No provider, model, version, function, input, accuracy figure or fallback behaviour is stated, and no page identifies which part of the product the claim describes. This is graded at the middle band rather than lower to avoid counting one adjective twice, since the absence of any underlying function is already recorded on the centrality axis. Read the two rows together: the disclosure gap here is not a vendor declining to name a supplier, it is a vendor with nothing to name.

No customer is named anywhere, and there is no logo wall, no testimonial, no case study, no review reference and no quantified product result across the homepage, the trust page, the platform page, the pricing page or any of the seven solution pages. In the slot where product proof normally sits, the homepage runs six statistics about the value of follow up in general, attributed to Yankee Group, Aberdeen, DemandGen, SiriusDecisions, Forrester and YesWare.

Those are category claims about the problem rather than evidence about the product, and the substitution is the finding: a buyer finishes the page persuaded that follow up matters and knowing nothing about whether this vendor delivers it.

Two real controls are published and they keep this off the bottom band. Opt out and closed lead lists can be uploaded so a workflow ends appropriately, and mobile numbers can be separated from landlines, which is the distinction American telephone consumer protection rules turn on. Everything else is missing.

No regulation is named anywhere on the site, and that includes the section of the trust page headed with a claim of always being compliant and never negligent, which names no law, no standard and no certifying body. For a product shipping pre recorded voice broadcast, Press 1 campaigns, local presence numbers and text message campaigns, the absent items are consequential: no consent standard, no calling hour enforcement, no registry scrubbing, no carrier registration for messaging, no call authentication and no abandoned call limit.

The sharpest evidence that this is a choice rather than a capability gap is that the same company's contact centre product publishes a full telemarketing compliance page naming the governing statute and regulator, registry scrubbing across national and state lists, and enforced calling windows. The capability exists in the family and the product that needs it most does not claim it.

The published policy is scoped entirely to the marketing website. It speaks of the online audience, of visitors to the web page and of people subscribing to the site, and it says nothing whatever about the lead lists a customer uploads, the third party phone numbers dialled, the call recordings produced, the message content sent or the recipients contacted.

On a product whose whole function is calling and texting people whose numbers were uploaded by somebody else, that is the material half of the document missing. The transfer basis compounds it: the policy rests on the Safe Harbor principles, a framework invalidated in 2015 and superseded twice since, first by Privacy Shield and then by the current data protection framework, with no standard contractual clauses or alternative mechanism named alongside.

There is no rights section of any kind, no access, deletion, correction or portability route, no retention period, no processor list and no contact channel beyond a generic mailbox. The policy also permits sharing anonymised aggregate information with partners, advertisers and other third parties, while the page description tells a search engine that data is not shared with other parties. Passages of the document are grammatically incoherent, which suggests it was never reviewed.

No contact database is sold, built or resold, and the vendor supplies no leads: every record dialled or messaged arrives from the customer, uploaded or synced from their own system of record, so provenance sits with the buyer rather than the platform. The upload of opt out and closed lead lists is a genuine and published control over who does not get contacted. What is unaddressed is the position of the person on the receiving end.

Nothing published names a lawful basis for processing an uploaded phone number, nothing describes a notice to that person, and no lookup, correction or removal route exists for someone who wants to know why an automated voice message reached them. On a voice and messaging product carrying third party personal data at volume, that omission is the whole of the axis.

This vendor operates its own voice and messaging infrastructure and automates no third party platform on the customer's behalf, so the exposure pattern that drives this axis down elsewhere in the index is absent. No account credential is held for another service, no session is borrowed, nothing is rotated or paced to slip past another company's enforcement, and integration runs through a published programming interface and a webhook into whichever system of record the buyer chooses.

Off the top band because the vendor states no conformance position of its own. For a messaging and voice product the analogous surface is carrier and messaging registration and call authentication attestation, and nothing about either is published, so a buyer cannot tell what happens to their traffic when a carrier tightens its rules.

No training commitment, model boundary or cross customer statement exists, which is unsurprising given that no model function is described anywhere in the product. The stewardship question still bites, because the platform holds uploaded contact lists, call recordings and message content, and the published policy addresses none of it.

What the policy does grant is an open right to collect anonymised aggregate statistics and use them to improve products and services, together with a right to share that aggregated material with partners, advertisers and other third parties. Applied to website analytics that is ordinary, and its application to platform derived call and campaign data is never ruled in or out. A buyer recording customer conversations on this platform has no published answer about what may be derived from them.

Three separate mechanisms here work against the recipient knowing who or what is contacting them, and no disclosure position offsets any of them. Local presence assigns a number matching the area the recipient lives in, so the call appears local when it is not, and it is sold alongside toll free as a way to lift answer rates.

Pre recorded voice announcements are marketed in the language of dialogue, described as bringing the audience into conversation and as adding a personal touch through interactive voice response, when the caller is a recording. The vendor's own writing goes furthest, describing an auto responder that answers out of hours with a personalised reply that emulates human connection.

Nothing published states that a recipient is told the contact is automated, and the European transparency obligations that took effect in August 2026 are not mentioned. The comparison inside this category is instructive: the dialer already graded at the top of this index sells local presence too, but pairs it with branded calling that puts the real company name on the recipient's screen, and takes the middle band for the tension. Here there is no counterweight.

A published programming interface with its own documentation path is the substance of this grade, and it is more of a developer surface than most vendors of this size expose. It is paired with a real time webhook that pushes updates back as a campaign runs, a dedicated integration page promising connection without code, and the claim that any system of record can be connected.

Call tracking data and campaign state are therefore reachable programmatically rather than only through the interface. Off the top band because breadth is asserted rather than shown: not one system of record is named anywhere, there is no integration catalogue or directory listing, no marketplace presence, and no object level description of which fields move in which direction. A buyer is told that anything connects and given no example of something that does.

The infrastructure provider is named, which is more than many vendors offer, and the architecture is described as serverless and running on that provider's managed services. That is where specificity stops. No region, availability zone or data centre location is stated, no residency option is offered, no processor or sub processor list is published, and no private or self hosted path exists.

The company publishes offices in the United States, Canada and India, so support and administrative access plausibly spans three jurisdictions, and nothing addresses where customer data sits or who can reach it from where. For a platform holding call recordings and third party contact lists, naming the cloud vendor answers the smaller half of the question.

A dedicated trust page exists in the primary navigation, which normally signals a vendor that has done the work, and this one contains no security evidence at all. There is no certification, no audit or audit period, no encryption standard, no access control model, no penetration test, no vulnerability disclosure route, no incident or breach notification process, no status page and no processor list. The one concrete fact on the page is the name of the cloud provider.

In place of evidence the page makes three absolute promises. It states that there is zero risk of hacks or data breaches and that the architecture means the customer need not worry about either, which is a claim no operator of any system can make. It states that there is no downtime and no outages and that the customer will never have to worry about server crashes, with no service level commitment or uptime history behind it.

And it heads a section with a claim of always being compliant and never negligent while naming no regulation, standard or auditor. This band is usually reached by omission. Here it is reached by what the page actually says.

The pricing page explains the commercial model in unusual detail and then withholds the only number that matters. A buyer is told there is no platform fee, no cost per user, no setup charge and no monthly commitment, and that billing is by the minute for what is used. Where the per minute rate belongs the page says to ask for pricing.

The page also states plainly that no free trial is offered and that the only route to seeing the product is a scheduled demonstration, so there is no self serve path around the gap either. For a vendor priced purely on usage this is the most complete form of the omission, because the rate is not one variable among several, it is the entire commercial proposition. No range, floor, minimum, currency or example campaign cost is published anywhere.

Terms of service are published and linked from every page, so a governing document exists and this stays off the bottom band, which is reserved for vendors whose only legal text is a website notice. The contents were not read in this pass and no post termination window, deletion timeline, retention position or export format has been established from any published source.

One genuine route out is visible in the product itself: the programming interface and the real time webhook mean campaign records, call tracking data and engagement history can be pulled out or streamed into the buyer's own system of record continuously rather than requested at the end, which is a stronger practical position than a promised export button. Re verify the terms of service for the contractual half.

For a voice and messaging product the relevant discipline is pacing, registration and reputation across carriers rather than inbox placement, and the published position is partial. On the credit side, campaign level call tracking and analytics let an operator see performance degrade, opt out and closed lists remove people from a running workflow, and separating mobile numbers from landlines is a real routing control.

Missing on the voice side: any abandoned call rate, retry logic, calling window enforcement, call authentication attestation or spam label monitoring. Missing on the messaging side: carrier registration for application to person traffic, which is the single largest determinant of whether campaign texts arrive at all.

Missing on the email side: everything, despite email being one of the four channels sold, with no warmup, authentication guidance, bounce handling, complaint threshold or unsubscribe mechanism described.

The buyer is addressed only in the broadest terms, as a person in charge of business development and elsewhere as marketers and sales teams, and no headcount band, revenue band, region or company stage is named. No vertical pages exist on the main site, and the two industries the vendor writes about most, residential property and insurance, appear only inside blog posts rather than anywhere a buyer would find them while evaluating.

The pricing page cannot carry segmentation either, since no tiers or numbers are published, so there is no packaging signal to read the target market from. Offices are published in three countries across three continents, which describes where the company is rather than who it sells to.