HeyReach

Models sit at the edges of a product whose engine is scheduling and account management. Two model uses are documented, both in the sub processor schedule rather than in marketing: sentiment analysis of conversation content to classify lead replies, and assisted triage of support tickets. Alongside them the vendor ships a connector for assistant tooling and a command line client, both marketed on the strength of letting external agents create campaigns and act on results.

Strip every one of those out and the customer still has the product they bought: multiple connected accounts, automatic rotation of sending between them, sequences with conditional branching, a shared inbox across accounts, workspaces and permissions, cross account analytics and a documented interface. What they lose is automatic tagging of which replies looked interested and the ability to drive the platform from a chat window.

The vendor's own packaging settles it, which is the reference test on this axis: no tier carries a model line item, no tier meters model usage, and the credits on the price list buy email address lookups rather than inference. Ask which product capabilities stop working if the sentiment classifier is removed.

Two distinct autonomy questions, and the product answers the organisational one much better than the operational one. Oversight of people is well built: workspaces separate one client from another, permissions are role based, a master view shows every workspace from one screen, a manager role exists for external client organisations, and seats can be reassigned across a shared pool. The operational gaps are two.

Sender rotation means the platform decides which person's account sends a given message, and nothing published describes how that allocation is made, whether an account can be excluded, or what happens when one account in the pool stops performing.

And the assistant connector is marketed on letting agents make decisions, split lead lists, create campaigns with custom messages and tag replies by sentiment, with no approval gate described between an agent composing a campaign and messages reaching real people, and no statement of what an agent is not permitted to do.

The terms add a wrinkle a buyer should notice: pre release features are defined as not for production use and are excluded from the security commitments, while the connector and the command line client are promoted on the home page as available capabilities. Ask how rotation chooses a sending account, and whether campaigns created through the assistant connector require human approval before they send.

The model providers are named in a binding instrument, which almost nothing else in this index does. The sub processor schedule attached to the data processing addendum identifies OpenAI by legal entity and registered address and states its function precisely, being sentiment analysis of conversation content to classify lead replies within the product, and identifies Anthropic on the same basis for assisted triage of support requests including review of campaign, sender, conversation and log data.

That schedule is contractual rather than promotional, and it comes with machinery: the vendor must give at least ten days notice before adding or replacing a sub processor, and a customer objecting on reasonable data protection grounds may terminate at no additional cost if no alternative is found. A buyer therefore knows which companies see prospect conversation content and has a route to object when that list changes. Held below the top band on three counts.

No model, family or version is named for the classifier, no accuracy figure or evaluation is published for a component that decides which replies a sales team treats as interested, and a misclassification has a direct commercial cost that goes unquantified. The customer facing marketing describes sentiment analysis and auto tagged warm leads without anywhere disclosing that message content leaves for an external provider, so the disclosure exists only for a reader who opens the addendum. Ask for the classifier's accuracy and the model behind it, and for the error rate on replies marked as not interested.

Real published data on one side, and a contract that stops anyone else publishing any on the other. The vendor runs an original benchmark study across a stated 96,051 campaigns and puts the figure in its site banner, which is first party evidence at a volume worth crediting.

Customer stories are attributed to named individuals with their titles and employers and carry paired acceptance and reply rates of 57 and 48 percent, 45 and 26 percent, and 35 and 20 percent, and one customer states his own attribution carefully, describing the product as an important part of a system that generated a larger figure rather than as its cause. Two clauses reframe all of it.

The general restrictions bar the customer from publicly disseminating information regarding the performance of the Services, so independent performance reporting by the people best placed to produce it is contractually prohibited, and what a buyer can read is therefore only what the vendor elected to publish.

The publicity section then has the customer agree in advance to a joint press release, to participate in marketing activities, and to the use of their name and logo on the vendor's website, which is the basis on which the recognisable brand marks on the home page may appear. Recorded as a retrieval limit rather than a vendor omission: the aggregate performance counters on the home page are populated by script and returned as zeros to a machine, so those figures were not read. Ask what population and period the benchmark study covers, and whether the performance restriction is waived for customers who wish to publish their own results.

This vendor publishes more outreach compliance material than anything else in this lane, and the central clause of it prohibits what the product does. The terms of service require the customer to comply with all applicable laws and then state, without limiting that generality, that the customer will not engage in any unsolicited advertising, marketing, or other activities using the Services.

Breach of that section is grounds for suspension and is carved out of the liability cap, so it is an operative term rather than a recital. The product it governs is sold on importing purchased and enriched lead lists and sending more than a thousand connection requests and messages a week to people who did not ask to hear from anyone.

A separate anti spam policy runs the same way and is more explicit still, prohibiting the use of scraped or harvested lists, prohibiting unsolicited promotional messages through the professional network by name, naming the United States, Canadian and European anti spam regimes, and promising immediate account closure without notice for violations.

That policy governs affiliates and partners promoting the vendor, and the reason given for it is protection of the vendor's own domain reputation. The enrichment clause is the one place where customer outreach is addressed constructively, stating that the customer is controller for all outreach involving enriched data, must establish a lawful basis, and must honour opt out and unsubscribe obligations.

What the product provides to help is undescribed: no suppression list, consent record, opt out handling or complaint route appears on any surface reached. The abuse reporting address in the anti spam policy is also inconsistent, with the visible text and the underlying link giving two different mailboxes. The interface for external assistants adds a question none of that material answers.

Agents connected through it are described as splitting lead lists and creating campaigns, so the segmentation decision determining who receives outreach can be taken outside the product by a system the vendor does not operate. The unsolicited activity clause binds anything done using the Services and so binds that route, and the controller obligation to establish a lawful basis rests with the customer however a list was assembled, and nothing describes how either is surfaced or enforced at the point an agent builds a segment.

Ask which of the vendor's own marketed use cases the unsolicited activity clause permits, what suppression and opt out machinery the product provides, and how the lawful basis obligation is evidenced when a list was segmented by a connected agent.

A complete and openly published processing instrument, and the completeness is the finding rather than the existence. The data processing addendum is a full document rather than a gesture: it separates the vendor's processor role over customer data from its independent controller role over account data, sets out the permitted purposes, and gives the customer an audit right that includes access to compliance documentation at no cost and an on site audit once a year.

Sub processors are named individually in a schedule with legal entity names, registered addresses and a description of what each one does, covering hosting, enrichment and two model providers, with at least ten days notice before the list changes and a right to terminate at no cost if an objection cannot be resolved.

Transfers are handled properly rather than waved at: restricted transfers are defined against the European, United Kingdom and Swiss regimes separately, the standard contractual clauses are incorporated with the module, docking, notice, governing law and forum options each specified, the United Kingdom addendum is attached in full, and the competent supervisory authorities are named.

Retention appears as a tiered schedule with numbers, giving dormant accounts up to thirty six months, deletion or anonymisation within thirty days of closure, fraud identifiers twenty four months, and log retention of at least twelve months. On termination the customer elects deletion or return within thirty days.

Data subject rights are supported by self service functions inside the product at no additional cost rather than by a support queue, and the addendum prohibits selling customer data, sharing it for cross behavioural advertising, or combining it with data from other sources.

Two things a buyer should still weigh, neither of which is concealed: primary processing is in the United States for a vendor registered in the union, with the measures schedule stating that customers cannot select their storage region, and the transfer section offers a United States certification scheme as its first mechanism, which cannot apply to an Estonian importer, so the standard clauses are what actually carry the transfer.

The supplier is named and the warranty is a disclaimer. Enrichment is a metered feature, sold as an allowance of credits on every tier and used to find business email addresses for people identified on the professional network, and the vendor names the enrichment company in its sub processor schedule with a registered address, which is more than most vendors in this category disclose.

The terms then describe what the customer is actually buying: enriched data is supplied as is, may be incomplete, inaccurate, outdated or derived from public sources, the vendor does not verify or guarantee its accuracy, completeness or suitability, and it accepts no liability arising from its use or from the practices of the enrichment provider.

Responsibility passes wholesale to the customer, who acts as controller for all outreach involving enriched data and must establish a lawful basis for it. Nothing describes where the enrichment provider's underlying data originates, under what licence it is held, or what rights pass to a customer who receives a contact record.

The same gap runs through the imported lists that feed campaigns, which arrive from the network's own sales search, from workflow and enrichment tools and from files, with the customer warranting that it holds all necessary rights and that the data breaches no third party platform's terms. A buyer is therefore warranting the provenance of data the product supplies to them. Ask where the enrichment provider sources its records and under what licence, and what the vendor warrants about a contact record it charges a credit for.

Rotating a campaign across many accounts is the product, and it is the mechanic this band exists to record. The vendor's own framing is unambiguous: connect unlimited accounts for one flat fee, rotate sending between them automatically, and reach more than a thousand leads a week, under a page title promising scale without limits.

The professional network enforces its constraints per account, so distributing a single campaign across twenty five or fifty accounts is a means of achieving a volume that no one account is permitted to send, and the pricing structure is built directly on that logic, with the flat rate tiers becoming economic precisely as the account count rises.

Third party accounts consistently report that the agency and unlimited tiers require the customer to supply their own residential addresses for each connected account, which was not confirmed on a vendor surface and is recorded as reported rather than established. The contract makes the exposure explicit in three places. The customer warrants that no data it submits will violate the terms of service or other agreements governing its accounts with any third party platform.

The customer is made responsible for complying with the relevant terms of any third party platform and for maintaining accounts in good standing. And the liability section states in capitals that the vendor is not responsible for any adverse action taken against the customer by a third party platform, with a site wide footer disclaiming any association with or endorsement by the network.

Those clauses are clearer than either other record in this lane manages, and every one of them allocates the risk to the buyer rather than reducing it. What is absent is any statement of conformance, any account of the method by which the platform interacts with the network, or any description of what the vendor does when a customer's accounts are restricted. Ask for a stated position on the network's user agreement, and what happens commercially when connected accounts are restricted mid term.

The providers are disclosed and the commitments that would make the disclosure reassuring are the generic ones. Conversation content from the professional network, which the processing schedule lists explicitly as personal data belonging to third parties rather than to the customer, is sent to an external model provider for sentiment classification during ordinary use.

The protections that apply to it are the addendum's general sub processor terms: access restricted to what is strictly necessary, processing for any other purpose prohibited, contractual security obligations imposed downstream, and the vendor remaining liable for its sub processors. Those are real and they are contractual, and they are also the same terms that cover the hosting provider. What is missing is anything specific to models.

No retention period is stated for content sent to a model provider, no commitment appears that customer or prospect content will not be used to train or improve a model, no governance document or evaluation record exists, and no management standard for artificial intelligence is claimed.

The people most affected are the ones with no relationship to anybody in the chain, since a prospect who replies to a message has their words classified by a third party without notice from either the customer or the vendor. The one adjacent commitment worth crediting sits in the main agreement, where aggregated usage data may be used for benchmark and best practice reporting on the express condition that the vendor may not identify the customer as its source, which is the term the benchmark study rests on. Ask whether content sent to model providers is retained or used for training, and for how long it is held.

The identity a recipient sees is decoupled from the person who wrote to them, in two separate ways, and neither is disclosed to that recipient. Sender rotation distributes one campaign across many connected accounts, so which real person appears to have reached out is determined by the platform's allocation rather than by any decision that person made about that prospect.

The shared inbox then allows a team member to reply on behalf of a colleague, so the person composing a reply need not be the person whose name and photograph sit above it. A recipient reading a message and its follow up is therefore looking at an account that may have originated neither.

The vendor's framing acknowledges what is at stake in its own phrasing, offering scale across accounts without losing the personal touch, and no indication is described anywhere that would tell a recipient the outreach was scheduled and sent by software. Their reply is then classified for sentiment by an external model, again without notice.

One point keeps this from the floor of the band: each connected account is a real person's account rather than a fabrication, and the vendor neither sells nor teaches the creation of invented profiles. A second point that would have supported the same conclusion does not survive examination and is recorded as failing rather than omitted.

Message text is composed by the operator on the standard path, which would place duties attaching specifically to machine generated content outside this record, except that the vendor also ships a command line client marketed on writing relevant messages from inside an assistant, and an interface through which connected agents create campaigns carrying custom messages.

On that path the copy is generated rather than written, and nothing distinguishes an agent composed message from an operator composed one at the moment a recipient reads it. The issue is therefore broader than first stated: the sender shown is not reliably the sender, the author may not be a person at all, and nothing tells the recipient either.

Ask whether a recipient is given any indication that a message was automated, whether an agent composed message is distinguishable from an operator composed one, and how a reply sent on behalf of a colleague is presented to the person receiving it.

The deepest integration surface graded in this lane, and it is documented rather than asserted. A public interface reference and a separate webhook reference are both published without a login, a connector for assistant tooling has its own product page and is included on every paid tier, and a command line client is offered for running campaigns outside the interface.

Named connections cover workflow and automation platforms, a data enrichment and orchestration tool, a customer record system where the vendor states the integration is verified by that platform's own programme, three electronic mail sending platforms, and a website visitor identification product, several of which are separately recorded in this index so a buyer can evaluate the components independently.

Ready made templates are published for three automation platforms, which is a practical form of integration depth rather than a logo list. Two limits hold it below the top band. The reference documentation is hosted on a third party interface catalogue and a third party notes platform rather than on a maintained developer portal, which makes versioning and change history hard for a buyer to assess.

And the agreement reserves the right to disable any third party integration at any time with or without notice, and separately to rate limit interface usage at the vendor's discretion, so every named connection above is contractually disclaimed. No status page reporting availability was located. Ask what notice is given before an integration is withdrawn, and what the published interface rate limits are.

An unusually specific deployment description that answers the residency question with a clear no. The measures schedule names the hosting provider, states that infrastructure is containerised and not tightly dependent on any single provider or availability zone, and describes daily automated backups replicated across multiple availability zones, encrypted to production standard and retained for fifteen days, with a documented recovery plan that the vendor states has been tested.

Separate development, testing and production environments are maintained, deployments run through pipelines with rollback and a blue green method for critical services, and monitoring runs through the hosting provider's own audit and log services feeding security monitoring. Tenancy is addressed directly, with customer data segregated by organisation at the application layer and no cross access between tenants. Against that, the residency position is weak and stated without hedging.

Primary processing facilities are in the United States, the schedule says customers cannot select the region in which their data is stored, no region list is published beyond that, and the vendor states that it does not currently offer committed recovery time or recovery point objectives.

For a vendor incorporated in the union selling to European and United Kingdom buyers, a customer with a residency requirement gets an unambiguous answer, which is more useful than a vague one, and it is still a no. Ask whether regional hosting is on the roadmap and what recovery objectives are achieved in practice.

No certification of any kind, and the most candid control disclosure in this lane by a wide margin. The measures schedule states four times over what the vendor does not have: no audited control report, no information security management certification, no payment card or health data certification, no regular penetration testing schedule and no dedicated internal information security team.

Those statements are volunteered in a contractual annex rather than extracted, and they sit beside a control set described with enough specificity to be checked. Transport is encrypted to a stated minimum version, credentials and sensitive values are encrypted at rest with a 256 bit cipher in an authenticated mode, passwords are hashed and salted through a named key derivation function with random salts of stated length, and keys are held in a restricted key store.

The schedule then states, against the vendor's own interest, that not all data at rest is encrypted and that the protection covers authentication and sensitive data only. Access controls are enumerated: least privilege throughout, production access restricted, audited and monitored, privileged actions logged automatically, background checks and confidentiality agreements for staff, and a control this index rarely sees, requiring prior customer authorisation with identity verification before internal staff may access that customer's data.

Logs are retained a minimum of twelve months and audit logs are available to customers on request. Optional multi factor authentication is offered and single sign on is stated as not supported. Held in this band rather than higher because none of it has been examined by anyone outside the company, and the vendor says so. Both other records in this lane sit a band lower on the same absence of certification, without publishing anything approaching this. Ask when an external audit is planned, and what the third party security assessments conducted on a project basis have covered.

One of the most complete published price structures in the index, undone for the top band by the top tier's own name. Five plans are laid out in full tables across four billing cycles. The per account tier is published at seventy nine dollars monthly, seventy one quarterly and sixty three annually below ten accounts, dropping to fifty nine, fifty three and forty seven at ten and above, so the volume break is visible rather than negotiated.

Two agency tiers bundle twenty five accounts at nine hundred and ninety nine, eight hundred and ninety nine or seven hundred and ninety nine, and fifty accounts at one thousand three hundred and ninety nine, one thousand two hundred and fifty nine or one thousand one hundred and nineteen. The flat tier runs at two thousand nine hundred and ninety nine, two thousand six hundred and ninety nine or two thousand three hundred and ninety nine.

Enrichment allowances are stated per tier, seat proration is explained in both directions, the trial is fourteen days with no card and an explicit statement that it does not convert automatically, and the tax treatment is set out by buyer jurisdiction. A discounted programme for early stage companies publishes its qualification thresholds. Three things hold it below the top band.

The tier sold as unlimited, and described in its own feature list as having no per seat charges, is stated in the same help article to be capped at a shared pool of three hundred seats, so the headline term of the most expensive plan is contradicted on the page that explains it.

Multichannel outreach is listed as included on every tier and is delivered by handing leads to one of three separate sending platforms the customer buys elsewhere, so the advertised capability carries an unstated third party cost. And no overage or top up rate is published for enrichment credits, which is the one metered resource in the product.

Third party accounts consistently report that the two larger tiers require the customer to supply their own residential addresses per account at further cost, which no vendor surface reached mentions in either direction. Ask what the unlimited tier's actual seat ceiling is, and what enrichment credits cost once the allowance is spent.

Departure is addressed in the contract with dates attached, which is more than most records here manage. On termination the customer elects whether personal data is deleted or returned, and the vendor commits to completing that within a maximum of thirty days, with anything held in backup isolated and protected from further processing.

The main agreement separately states that access to customer data continues for thirty days following termination, which gives a departing customer a defined window rather than an immediate cut off. The measures schedule adds that personal data is deleted or anonymised within thirty days of account closure and that deletion can be requested outside the standard schedule.

Extraction routes exist in the product rather than only on paper, since the addendum states that self service functions allow customers to delete, obtain a copy of, or restrict use of personal data at no additional cost, and a documented interface and webhooks provide a programmatic path for campaign and reply data. Three limits keep it below the top band. No export format or bulk export route is documented anywhere, so the practical shape of leaving is unproven.

The agreement expressly disclaims all storage obligations beyond not deleting data during the term and states that no archiving service is provided. And renewal is automatic unless either party gives thirty days written notice before the end of the current term, with fees non refundable, so a customer who misses that window pays for a further term.

One drafting matter a buyer should verify: the clause listing which sections survive termination refers to section numbers that do not match the sections actually bearing those titles in the body, and the same mismatch appears in the clause defining which claims fall outside the liability cap. Ask what format a full export takes and whether it includes conversation history, and confirm which numbered clauses the survival and liability provisions are intended to reference.

The answer to a per account limit is another account, and the pacing discipline that would sit underneath that is published nowhere. No daily or weekly cap, no ramp or warm up schedule, no throttling description, no working hours window and no per action rate appears on the pricing tables, the plan help article, the home page or any legal instrument reached.

The closest comparable record in this lane publishes a full quota table across seven action types per tier, and the other publishes a named warm up phase with an adjustable rate of increase and a stated enforcement ceiling, so the disclosure is available in this category and this vendor has not made it.

What the product offers instead is horizontal distribution, marketed as more than a thousand leads a week across a rotating pool, which raises aggregate volume without any published statement about what each account in that pool is doing. Third party accounts report a dedicated residential address per account on the entry tier and a requirement that customers supply their own on the larger tiers, which was not confirmed on a vendor surface.

The interface for external assistants extends the same silence to a faster actor. A connected agent can create campaigns and distribute lead lists across the rotating pool, and no rate limit on that interface is published any more than a per account limit is, so an agent initiated campaign is governed by exactly as much stated pacing as a human one, which is none.

The accounts that absorb any resulting restriction belong to the customer's own staff or to their clients rather than to the vendor. The electronic mail side is not a gap but an absence by design: the product sends no mail at all, and multichannel means passing leads to one of three separate platforms, so warm up, authentication, bounce handling, complaint thresholds and list hygiene all belong to a vendor the buyer contracts with separately.

Verified email addresses supplied through the enrichment feature are covered by an explicit contractual statement that the vendor does not verify or guarantee their accuracy, which is the one place list quality is addressed and it is addressed as a disclaimer. Ask for the daily and weekly action limits applied per connected account, whether campaigns created through the assistant interface are subject to those same limits, and what the platform does when an account begins to be restricted.

The coverage map is drawn deliberately and the pricing follows it rather than contradicting it. Three buyer types each have their own surface, covering agencies running outreach for clients, sales teams, and growth teams, with a fourth route offering the vendor running the motion on the customer's behalf.

The five plan structure maps onto those segments cleanly, moving from a per account charge for a single workspace, through two bundled agency tiers, to a flat rate for high volume operators, to a tailored arrangement for enterprises, and the vendor publishes guidance on which situation each plan suits.

The agency case is served with features rather than a label, through separate client workspaces with controlled access, a master view across them, a reassignable seat pool, a manager role for external client organisations and white labelling under the customer's own brand, and team members, contractors and clients can be invited without further per user charges.

A discounted programme for early stage companies publishes real qualification thresholds at under a quarter of a million in annual revenue, fewer than five people, and not an existing customer, which is a more concrete statement of intended market than most vendors offer. Tax handling is documented for European, United Kingdom and United States buyers. Two limits hold it below the top band.

Coverage is bounded entirely by one professional network, so a team whose motion is not centred there is buying a component rather than a system. And segmentation stops at role and company stage without reaching industry, region or a stated account size beyond the seat bands. Ask which regions the vendor supports for buyers outside its own jurisdiction, and what the practical account ceiling is on the flat rate tier.