Leadfeeder

A matching and records business with an AI layer added recently on top. The core operation is resolving a website visitor's network address to an organisation and joining that organisation to a record sourced from an official register, which is deterministic lookup against authoritative data rather than inference, and it is what the product has done since 2012.

Register sourced company records, financial filings, ownership structures and industry classifications are retrieved rather than predicted. The vendor does market AI capabilities and maintains a dedicated page describing how they work, and enrichment and scoring layers use modelling, but stripping all of it leaves visitor identification, the register database, the browser extension and the customer record hygiene module intact and saleable.

That is the incumbent pattern rather than the model native one, and the accurate reading is that the data acquisition is the asset and the modelling assists it. Ask which capabilities stop working entirely without the AI layer, and whether any AI features carry separate cost.

Automation is triggered rather than agentic, and the boundary around it is not published. Workflows fire when a company matching defined criteria visits the site, pushing records into a customer record platform or notifying a team, which is rule based execution the customer configures rather than a system exercising judgement. The advertising module runs campaigns against identified audiences, which spends budget automatically once configured.

Neither contacts an individual directly on the vendor's own initiative. What is unaddressed is the surrounding governance: nothing published states what an administrator can constrain, whether spend on the campaign module carries a ceiling the operator sets, or what review applies to the AI features the vendor separately documents. The scope limits the exposure rather than the vendor's controls doing so. Ask what caps apply to automated campaign spend, and what an administrator can disable across the AI features.

A dedicated disclosure page exists and its contents were not reachable on this pass. The vendor publishes a page specifically covering how its AI features work, what data they process, how privacy is protected and how compliance with the European artificial intelligence regulation is ensured.

Maintaining a standing document that addresses that regulation by name is uncommon in this index and indicates the questions have been answered somewhere in writing, particularly for a vendor whose entire position rests on European regulatory posture.

What could not be established on the routes taken is any of the substance: no model provider, family or version is named in the material reached, no model card was located, and no accuracy figure appears for the visitor to company matching that the product depends on. That last gap matters because a mis-resolved visitor attributes one organisation's browsing to another, and every downstream action inherits the error.

This grade records what a buyer could establish on this pass rather than asserting the disclosure is absent. Ask for the AI features documentation, which models process customer data, and the measured accuracy of visitor to company resolution.

Scale is well evidenced and performance is not. More than fifteen thousand business customers are reported, including several recognisable software companies named on the vendor's own pages, and the customer base concentrates visibly in the European markets the product targets, which corroborates the positioning rather than merely asserting it. Independent review coverage is extensive across the visitor identification category.

What is absent is measurement of the thing the product does: no published match rate for visitor to company resolution, no coverage figure by country, no accuracy measure for register sourced records, and no study showing pipeline or conversion effect across a stated customer population and period. For a product whose value is entirely a function of how many visitors it can identify and how accurately, the match rate is the foundational number and it does not appear. Ask for the identification match rate by country, the accuracy of register sourced records, and conversion effect measured against a stated population.

The platform identifies and advertises rather than sending, which narrows this axis without emptying it. No email sequencer or dialer operates here, so consent capture, suppression and unsubscribe handling execute in whatever systems a customer uses downstream.

The advertising module places campaigns against identified audiences, where the applicable rules are the advertising industry's rather than the direct messaging statutes, and nothing published describes what conformance position governs that activation. The identification layer itself resolves to organisations rather than individuals, which limits what a customer receives to act on and is a real structural mitigation.

What is missing is the handoff statement: nothing describes what obligations the vendor considers to transfer to a customer that combines visitor identification with contact data and begins outreach, which for a vendor whose entire differentiation is compliance posture is a conspicuous omission. Ask what the vendor's stated position is on using visitor identification as a basis for outreach, and what governs the advertising module's audience activation.

Certification, contract and a named accountable person, with the documents published rather than described. The privacy information management standard is certified alongside the information security standard, which is the specific certification covering how privacy is managed rather than only how data is secured.

A processing agreement is published, and a second version incorporating the European standard contractual clauses is published separately for customers interacting with the vendor's United States entity, so the transfer question is answered with a document rather than a paragraph. A group data protection officer is named as an individual, identified as also holding the information security management role, and carrying a recognised European privacy practitioner credential.

Registration as a data broker in the United States is disclosed on the vendor's own privacy pages together with the rights of United States residents and how to exercise them, which is a disclosure many vendors in this category make only where a regulator compels it. A consolidated legal kit and a privacy contact address are published. Two limits are worth stating.

No published request metrics or response times were located, where the comparable records at this grade publish counts and median response times. And no notification practice is described for individuals whose details enter the contact database, which is the disclosure a peer vendor in this index does publish. Ask for request volumes and response times, and what notice reaches individuals added to the contact layer.

Provenance is traceable to the individual record and the sources are named institutions rather than categories. Company data originates in official national trade registers, with the German commercial register, the Austrian company register, Swiss commercial registries and the United Kingdom companies register all identified by name across more than thirty national sources, and the vendor states that each record carries traceability back to its public legal source.

That is a stronger claim than any aggregate description of sourcing, because it means a buyer challenged on where a record came from can answer for that record rather than for the corpus. The layering is described rather than blurred: registers form the foundation, public web data enriches, and directory records cross reference.

The lawful basis is stated as legitimate interest and the vendor's own framing is that this is built into the data model rather than added afterward, which is consistent with sourcing from records that are already public by law. The honest limits belong on the record.

Register sourcing covers company and officer information, so the personal contact layer rests on the enrichment tier rather than on the registers, and independent analysis notes the resulting trade off of thinner personal phone coverage than vendors collecting more aggressively. No indemnification position was located. Ask which sources supply the personal contact layer as distinct from the register sourced company layer, and whether provenance is indemnified.

Leadfeeder states that it runs one of the largest web crawlers in the world and collects data that is publicly available on the internet, and defines its public sources: websites, news portals, press and blog articles, publicly shared social media posts and profiles, specialist databases, job boards, forums, the commercial register, the Federal Gazette and Wikipedia. Licensed third party data providers and business partners are named as further sources. Activation into CRMs and ad platforms runs through those systems' integrations. Which social platforms' public profiles the crawler reads, and under what terms, is not set out.

The governing documents exist and their contents were not reachable. A dedicated page addresses the AI features and their compliance with the European artificial intelligence regulation, and the privacy information management certification covers how personal data is handled across the organisation, so the framework is in place.

What could not be established on this pass is the specific position: whether customer data or visitor records train or tune any model, which providers process material when AI features run, what retention applies to model inputs and outputs, and whether anything crosses a tenant boundary. The corpus is less sensitive than several vendors in this cohort, since the register foundation is public record and identification resolves to organisations, which limits the exposure inherently.

No independently audited management standard for artificial intelligence is claimed, where two vendors in this index hold one and publish the certificate. Ask whether customer or visitor data trains or tunes any model, which providers process it, and what retention applies.

The default resolves to a company rather than a person, and the rights route for individuals is published where a regulator can check it. Visitor identification returns the organisation behind the traffic rather than naming the individual browsing, which is a design choice that keeps most of the platform's operation outside the person level identification that competitors in this lane market as a headline capability.

Where individuals do appear, they largely appear as company officers whose details already sit in public legal registers, so the person has a materially different relationship to the data than someone profiled from behavioural observation.

On the disclosure side the vendor publishes its United States data broker registration alongside a statement of what personal information it collects, the rights of United States residents, and how to exercise them, which is an active disclosure rather than a buried notice.

Held below the top band because the enrichment tier does hold personal contact details sourced beyond the registers, and no notification practice is described for those individuals, where a peer vendor in this index states that it notifies people of their inclusion within the statutory window. Ask what notice reaches individuals in the contact layer who were not sourced from public registers.

A multi module platform with integration treated as the delivery mechanism rather than an accessory. Named connectors reach the major customer record platforms, a published interface is maintained with the previous generation retained as a legacy version so existing integrations did not break at the rebrand, and a free browser extension surfaces company profiles, contact details and customer record data inside whatever tab the user is working in.

A separate module handles ongoing customer record hygiene, deduplicating, flagging stale entries and enriching on a schedule within the same European hosted infrastructure, which is a genuine architectural claim rather than a connector count. Workflow triggers fire on visits from high intent companies.

Held below the top band on verification and gating: no interface documentation, authentication model or rate limits were reached on this pass, no integration inventory was counted, and the modules are separately licensed so the integration surface a buyer receives depends on which parts of the platform they bought. Ask for the interface documentation and which modules are included at the tier quoted.

An absolute residency commitment, without the architecture around it. The vendor makes a named promise that all data is stored and processed on servers within the European Union, applying across both the sales intelligence and visitor identification products and to data generated by customers within the platform.

That is a guarantee rather than an option, and it is the strongest form the answer can take for a European buyer, because there is no configuration to get wrong and no region to elect. Independent analysis treats it as the platform's defining procurement advantage over vendors headquartered elsewhere. Held below the top band because the commitment stands alone.

No specific country or data centre region within the Union is named, no tenancy or isolation model is described, no recovery time or recovery point objective is published, and no deployment options beyond the hosted service are offered. The record already holding the top band on this axis earned it with deployment optionality and two levels of tenant isolation including physical separation, which is a different and more detailed answer than a single jurisdictional guarantee. Ask which member states host the infrastructure, what the tenancy model is, and what the recovery objectives are.

The artifacts a security reviewer asks for are published as files rather than released on request. A downloadable security kit holds the certificate files for ISO 27001 in its 2022 revision and ISO 27701, the information security policy itself, an overview of the bug bounty program and a detailed question set, and Leadfeeder publishes its completed Cloud Security Alliance consensus assessment questionnaire of 261 questions.

Data is encrypted in transit and at rest with automated backups, a bug bounty program runs, a security manager is named, and customers can subscribe to updates on the subprocessors Leadfeeder uses. No SOC 2 report is claimed, in keeping with buyers who ask for the international standards.

Leadfeeder publishes four plans in euros. Lite is free with no end date, for unlimited users, 7 days of visitor history and the last 100 companies a month. Discover starts at €79 a month on annual billing for company identification, real time alerts, CRM sync and outreach and retargeting automation; Activate at €369 adds verified emails and phone numbers, intent filters, B2B display campaigns, CRM automations and AI built prospect lists; Scale at €599, billed annually only, adds unlimited data exports, automatic CRM data updates and a dedicated success manager.

Monthly billing costs more, with a 30% saving on annual, and every paid plan starts with a 14 day trial and no card. A shared monthly credit allowance covers enrichment, exports and CRM syncs, with the allowance per paid plan shown as tiered rather than numbered, and Enterprise is priced on request.

Accounts and contacts export to lists and sync to HubSpot, Salesforce or Pipedrive against a shared monthly credit allowance, a single company can be pushed to the CRM without credits, Scale includes unlimited data exports, and the API pulls Leadfeeder data into a customer's own systems. Enriched values written into the CRM during the term already sit in a system the customer owns. What a customer may keep using of licensed company and contact records after termination, and the deletion timeline for visitor history, are not stated in public terms.

No sending infrastructure exists. The platform identifies visitors, supplies company and contact data and runs advertising campaigns, and where a customer sends email or calls a prospect that happens in systems the customer operates on their own domains and estate. There is no pooled sending, no shared reputation and none of the warmup, rotation or bounce machinery this axis normally examines.

The nearest analogue is the advertising module, where the equivalent questions are inventory quality, viewability and invalid traffic filtering, and nothing published addresses any of them. On the data side the contribution to a customer's own deliverability is the accuracy of supplied contact details, and no verification method or freshness window is published for that layer, which is the variable that decides bounce rates downstream. Ask what verification applies to contact records and how recently they are reverified, and what invalid traffic filtering applies to the advertising module.

Leadfeeder positions itself on European data, publishing research on European markets such as a ranking of 14 markets for cross border selling and running its site in English and German. Marketing, sales and agency teams are the named buyers. The plan ladder serves the smallest buyer through a free plan with unlimited users, then Discover for company identification at €79 a month, Activate for contact data at €369 and Scale at €599, with Enterprise above. A team that needs people to contact, rather than companies to watch, starts at Activate.