HotHawk

The domain ends in a two letter suffix associated with artificial intelligence and the product underneath it is a cold email sequencer. Apply the removal test and effectively everything survives: multi step campaigns with copy variants, mailbox rotation, warmup, the master inbox that captures forwarded and copied replies, round robin routing, workspace separation, white labelling, reporting, the interface and the webhooks.

The models do two things at the margin, applying labels to incoming replies and triggering a follow up sequence once a label lands. The packaging evidence settles it decisively and is worth stating because it is so clean: the entire tier ladder contains no line item for any model driven capability, and the only two features not included on every plan are white labelling and dedicated sending hardware. A vendor whose price list gates infrastructure and branding rather than intelligence is telling a buyer what the product actually is.

Most of the automation here is deterministic routing rather than an agent composing outbound, which is a materially lighter posture than the generative products elsewhere in this index. Round robin rules assign replies as they land, mailbox groups direct them to owners, out of office notices trigger re enrolment at a chosen date, and evergreen campaigns accept new contacts continuously through the interface or programmatically.

One flow is genuinely autonomous and generative in its trigger: a model applies a label to an incoming reply and that label can start a follow up sequence to a real prospect. Nothing published describes a review step on that path, a confidence threshold on the labelling, a statement of what may not be triggered automatically, or an action level audit trail.

The protocol server adds a second route to autonomy, since an external assistant can launch campaigns and triage replies in plain language, and no permission model or approval boundary for that surface is described either.

One half of the picture is documented unusually well and the other is blank. On the customer supplied side the architecture is explicit: a protocol server lets an external assistant drive the platform, the vendor names the specific assistant it expects buyers to use, and a guide article explains the pattern, so a buyer knows exactly which model is doing that work because they are bringing it themselves. On the built in side nothing is disclosed.

The reply labelling that classifies incoming messages and can trigger automated follow up has no named provider, no named model, no version, no stated inference location and no accuracy figure. That last omission matters most, because a misapplied label does not merely produce a poor summary, it sends an unintended email to a prospect. The processor agreement would name any model provider in its list of other parties and was not read on this pass.

This is the weakest row on an otherwise exceptional record. Six customer logos are displayed and all six are small outbound agencies and consultancies rather than recognisable businesses, which is consistent with the stated market and is not a criticism in itself. The claim placed above them is: the line describes them as some of the world's top go to market teams, and nothing supports that characterisation.

Beyond the logos there is no case study, no named testimonial, no customer quotation with an employer attached, no customer count, no review platform rating and no outcome figure of any kind on the pages read. What does exist is real and checkable: a named accelerator backer with its logo linked, a company registration number, a regulator registration reference, a founder who is publicly identifiable and posts under his own name, and a stated team size in third party company records. Verifiable existence is established thoroughly. Verifiable results are not established at all.

The product exists to send unsolicited email at volumes reaching hundreds of thousands of messages a month, and no sending regulation is named on the pages read. There is no reference to the United States commercial email statute, no consent standard, no unsubscribe mechanism described, no suppression list handling and no statement of the lawful basis for contacting a business address in Europe.

What is published sits adjacent rather than on point: scheduled sending breaks around national holidays, warmup and pacing discipline, and a statement in the terms that the service is a business tool intended for businesses rather than consumers, which matters because the European rules for unsolicited electronic mail turn substantially on that distinction.

This vendor is better placed than most to have a published position, being domiciled in the United Kingdom, registered with its data protection regulator and maintaining a complete legal estate, which makes the silence on the product surface the more conspicuous. The terms and any acceptable use section were not read in full and are where a position would sit.

A three person company has produced a more complete privacy record than most enterprise vendors in this index, which is the clearest possible demonstration that careful drafting costs nothing. The controller is named with its company registration number and registered office. The registration reference with the national data protection regulator is published in the site footer on every page, which makes the registration independently checkable and which no other vendor here does.

Storage is committed to the United Kingdom and the European Economic Area. Three commitments are stated as headline positions rather than buried: data is never sold, email opens and link clicks are never tracked, and customer data is permanently deleted from the servers on cancellation.

A separate processor side agreement covers processing on the customer's behalf including security measures and the other parties involved, and platform data use commitments for both major mail providers are published alongside. The cookie policy enumerates each cookie with its provider, purpose, lifespan and opt out, and the vendor names its own analytics and advertising suppliers rather than describing them generically, including disclosing that session replays are recorded with typed text masked by default. Written, in the vendor's words, in plain English. Full policy text was not read on this pass.

The vendor operates no contact database, sells no prospect data and supplies no leads, which removes the entire class of provenance problem this axis usually grades. The customer brings their own mailboxes and their own contacts, and the terms state that division explicitly.

The role is formalised rather than merely implied: a processor side agreement is published covering processing on the customer's behalf, naming security measures and the other parties in the chain, so a buyer can see where their uploaded contact data goes. Data is never sold, stated as a headline commitment. Contact storage is unmetered with no per lead fee, so the vendor has no commercial incentive to retain more than the customer needs.

Held off the top band for the reason absence usually is: there is no positive provenance disclosure to make because there is no data business to disclose, and an absent problem is not the same as an excellently solved one. The Article 14 obligation toward the people in an uploaded list correctly sits with the customer as controller, and nothing here helps that customer discharge it.

The architecture puts the exposure in the right place and the vendor documents it. Connection to the two major business mail providers runs through single click delegated authorisation, and the vendor states that it never sees a password, that the customer grants the access and that the customer can revoke it at any time from the provider rather than needing the vendor to act.

Anything else connects over the standard mail transfer and access protocols, including a customer's own third party sending infrastructure. Data use commitments for both major providers are published in the legal hub, which is a stated conformance position rather than an assumption. There is no scraping, no social platform automation, no browser extension operating under the buyer's session and no account rotation sold as a way past a contractual limit.

Held off the top band because no position is published on the bulk sender requirements the major mail providers introduced for high volume senders, which is the conformance question that bites hardest on a product metered in hundreds of thousands of sends a month, and because rotation is framed once as keeping volume under the radar.

The adjacent commitments are strong and the specific question is unanswered. In the vendor's favour: a statement that it is not in the business of reading customer email, delegated authorisation so no password is ever held, customer data described as the customer's alone while the account is active and permanently deleted on cancellation, storage confined to the United Kingdom and the European Economic Area, and an explicit commitment never to sell data.

Against that, nothing states whether the content of customer mailboxes, campaign copy or replies is used to train or improve any model, or whether processing crosses tenants. The gap is specific rather than general: the reply labelling feature necessarily reads the body of messages sent by third parties who are not customers of anyone here, and no boundary is drawn around what happens to that text afterwards. The published processor agreement names the other parties in the chain and would resolve this in either direction; it was not read on this pass and is the single item most likely to move this row.

The first top band on this axis in the index, and it is earned by a deliberate refusal rather than by a feature. Open tracking and link tracking are not available in the product at all, stated as a product decision on the feature page and repeated as a headline commitment on the legal hub.

That single choice removes the entire surveillance half of this axis: no invisible pixel reports that a recipient opened a message, no rewritten links record what they clicked, and no behavioural profile accumulates on a person who never asked to be contacted. Every other cold email tool graded here ships both by default. Around it the authenticity record is equally clean.

Messages go out from real mailboxes belonging to real named people, there is no persona, no synthetic voice, no avatar, no manufactured location and no manufactured effort. The vendor operates no contact database, so no inventory of people exists to be resold.

Two gaps remain and are recorded honestly: the contact is still unsolicited and nothing reaches the recipient explaining how they were found, and the product applies models to replies and triggers automated follow up sequences with no published position on the European transparency obligations effective August 2026.

The programmatic surface is deep and the connector catalogue is thin, and the first is the more interesting half. A documented interface, webhooks that fire in real time on events from a new reply to a bounce, and a model context protocol server all ship on every plan including the entry tier rather than being gated to enterprise.

The protocol server has its own page, its own footer entry, and a guide article about it, and the vendor markets it by naming a specific assistant three separate times, promising campaign launch, reply triage and reporting in plain language. A developer section in the main navigation displays a live command line example against the interface. For a three person company this is the most committed agent era positioning graded at any size in this index.

Against it, the integration catalogue proper is two systems of record reached through a single named third party partner, with no marketplace, no partner programme and no breadth beyond that. White labelling under the customer's own brand and domain is a real extension surface for agencies. The depth is in the pipes rather than in the catalogue.

A residency commitment is published as a headline statement rather than buried in a policy: data is stored in the United Kingdom and the European Economic Area. For a European buyer that is a direct answer to the first question procurement asks, and it is stated by a vendor domiciled in that jurisdiction and registered with its regulator.

The top tier goes further and offers a dedicated, isolated sending environment with its own server, addresses and sending lanes, so a buyer who needs separation can purchase it rather than negotiate for it, and the vendor states plainly that the lower tiers run on shared infrastructure. Held off the top band on three points. No data centre, region or hosting provider is named. No explicit commitment against transfer outside those territories accompanies the storage statement.

And the legal hub discloses that the operating company is a wholly owned subsidiary of a United States holding company, which raises precisely the transfer and access question the residency statement does not close.

Architecture carries this row and certification is entirely absent. On the credit side the credential model is disclosed properly: delegated authorisation for both major providers with no password held, revocable by the customer at the provider, full data separation between workspaces for agencies running multiple clients, and a purchasable dedicated environment with isolated server, addresses and sending lanes on the top tier.

Storage location is committed, a processor agreement naming security measures and other processing parties is published, and platform data use commitments for both mail providers are set out. Against that, no certification of any kind was located, with no service organisation report, no international standards certification, no trust centre, no penetration test statement, no status page, no encryption description and no vulnerability disclosure route.

This is a young and very small company, so absence here is stage appropriate in a way it is not for the eleven year old vendors in this index, and it is recorded as a fact for a buyer rather than as a failure of care. The security section of the processor agreement was not read and should be re verified.

This is the most complete commercial record in the index and it is the small details that make it so. Three tiers carry real prices at 97, 247 and 497 dollars a month with the included sending volume against each. The metered unit is then defined with a precision nobody else attempts: a send is one email that goes out and every step of a campaign counts, so a four step campaign to one prospect is four sends rather than one, and the vendor explains why it meters sends rather than contacts.

The overage rate is published at 70 dollars for an extra hundred thousand sends, stackable on any plan, with a statement that there is no hard stop at the limit and that unused volume does not roll over. Per seat, per user and per client fees are ruled out explicitly with the reasoning given. Exactly two features sit outside the base plans and both are named.

Most unusual of all, the vendor publishes the limit on its own unlimited claim, stating a fair use cap of twenty five thousand mailboxes connected at once, and publishes what it will not do, stating plainly that partial month refunds are not offered and pointing to the free trial as the reason. A seven day trial without a card, and cancellation with no calls, no fees and no lock in, complete it.

Two commitments here are unusually direct. On termination the vendor states that customer data is permanently deleted from its servers, without hedging or a retention carve out. And the migration path is published for the customer leaving rather than only for the one arriving: because sending runs through mailboxes the buyer already owns, there is nothing to migrate at the infrastructure level, warmup and reputation live on the buyer's own domains and travel with them, and the vendor goes as far as suggesting the customer keep their previous tool running during a switchover for a clean overlap.

Access itself is revocable by the customer at the mail provider rather than requiring the vendor to act. Cancellation carries no calls, no fees and no lock in, with the effective timing of upgrades, downgrades and cancellations each stated.

Held off the top band on the mechanics: no deletion timeline or confirmation artefact accompanies the deletion promise, and no export path is described for the two things the product actually accumulates, which are campaign history and the reply record in the master inbox.

The most complete sending posture in the index, and it is architectural before it is procedural. Email leaves through the customer's own mailboxes and domains rather than a shared platform pool, and the vendor states the consequence plainly: the reputation built is the buyer's to keep, and no other sender can drag it down.

The warmup pool is described with a stated exclusion, which is the disclosure that matters, admitting only mailboxes on the two major business providers and never accounts on the standard mail transfer protocol, on the reasoning that reputation should build against inboxes that count and without bad actors in the pool. Its size is published at more than fifty thousand mailboxes. Rotation spreads sends automatically so no single account sends too much too fast.

Scheduled sending breaks can be attached to campaigns against local or target market national holidays, which no other vendor here offers. Volume, sending capacity, deliverability and bounce rates are monitored per campaign and per mailbox, out of office replies are handled and re enrolled, and dedicated servers, dedicated addresses and isolated sending lanes are purchasable on the top tier. Refusing to ship tracking removes the two mechanisms that most damage placement.

Recorded as observed: one line frames rotation as keeping volume under the radar, which is the same phrasing other vendors use for evasion, though everything around it describes pacing rather than circumvention.

The segmentation is the pricing axis and the vendor says so, which makes it more falsifiable than most. Five buyer types each carry their own page covering business to business sales teams, cold email agencies, founders running their own outbound, sales development teams and automated development representatives.

The tiers map onto them explicitly, described as being for solo senders and lean teams, teams scaling outbound, and high volume senders, with monthly sending volume as the dividing line. The workspace model is explained differently for each: one workspace covers one company's outreach, so a business needs one and an agency wants one per client.

Agency specific capability, meaning white labelling, client portals and full data separation, is a real commitment to a named segment rather than a landing page. Held off the top band because the vendor publishes no headcount band, no revenue band, no geography and no ceiling, so a buyer learns which shape of team they are and never learns whether they are too small or too large to be served well.