LeadsRocket

The marketed intelligence resolves, on the vendor's own description, to a delay timer. Artificial intelligence is claimed four times as the central differentiator, appearing in the meta description, the lead product paragraph, a feature line and a workflow line, always in the same construction about human like behaviour.

The only mechanism the vendor attributes to it is stated plainly in the same paragraph: the system mimics human behaviour by waiting for page loads and other actions to produce a natural interaction flow. The one other function credited to it, ensuring personalised message delivery and safeguarding against overuse, describes template substitution and rate limiting.

Strip the label and nothing is removed, because a browser automation routine with randomised pauses is precisely what remains and precisely what was described. This is the bottom band applied as the convention intends, to a marketed claim that fails the removal test, and specifically not to a competent product that makes no claim.

The autonomy claim is stated without hedging: activate the software and let the bot autonomously execute instructions for hours, or within predetermined limits. Actions taken unattended include connection requests, bulk messages to first, second and third degree connections, comments on other people's posts, profile visits and automatic job applications, all under the buyer's own identity and inside their own session. Two controls are published and both are thin.

Predetermined limits are referenced but never specified anywhere, and a daily report is delivered in spreadsheet format at the completion of tasks, which is a record after the fact rather than oversight during. Deduplication of connection requests and messages is offered on a paid tier and is a genuine restraint.

Absent entirely: any approval step, review queue, escalation path, per action audit trail, kill switch or stated ceiling, and the tier volumes that do exist exceed the limit the vendor itself publishes.

Artificial intelligence is claimed four times and nothing about it is disclosed: no model, provider, version, hosting location or processing boundary appears anywhere, and no documentation describes how a generated connection note or message is produced or reviewed.

Graded at the middle band to match how this index treats undisclosed model claims generally, with the more serious problem, that the described mechanism contradicts the label, carried on the centrality axis rather than counted twice here.

One artefact is recorded as observed because it bears on how the published material was produced: one answer in the frequently asked questions retains the name of a general purpose chat assistant as a stray line immediately before the answer text, indicating the copy was pasted from such a tool without editing.

Nothing offered as evidence survives inspection. Six testimonials carry a first name and surname with no job title, no company, no link and placeholder avatar images. Four review badges sit at the top of the page carrying counts of one hundred and seven, two hundred and sixty three, ninety six and one hundred and thirty five reviews, and not one of them names the platform the reviews are on, with the badge images themselves rendering as blank placeholders in the served markup.

The user count contradicts itself on the same page, given as more than fifty thousand at the top and more than forty thousand at the bottom. The only independently hosted review located anywhere is a single one on a major software marketplace, and that platform labels it as both incentivised and solicited by invitation. No case study exists for the product. The parent company's own work section lists a globally recognised automotive manufacturer as a client alongside two unknown names, unlinked and unsupported.

Held off the bottom band by a single genuine section, and the contradiction around it is the finding. The guidance carries a dedicated block on platform protocols that does real work: it publishes a concrete ceiling of one hundred connection requests per week, tells the buyer to adhere to the platform's terms and usage policies, names mass messaging and aggressive connection requests as violations to refrain from, advises spacing outreach to avoid suspension, and instructs proactive monitoring of account activity and any warnings received.

Very few vendors in this category publish a numeric limit at all. The same page then sells plans that scrape five hundred profiles, automate messages and comments across four hundred profiles at a time and apply automatically to a hundred job postings, and the company blog is titled around overcoming those same weekly limits. Outside that block, nothing addresses consent, no statute is named anywhere, no acceptable use or anti spam policy exists, and spam prevention appears as a purchasable upgrade rather than a default.

No privacy policy, terms of service, cookie policy or data processing statement was located anywhere on the product page or in the site footer, which carries only navigation and contact details. Zero legal instruments of any kind are published.

The gap is not academic given what the product does: it harvests profile data on named individuals from a professional network and exports it to a spreadsheet, it operates inside the buyer's authenticated session, and it maintains a login of its own implying a backend that holds account data. Nobody whose profile is captured has any notice, any basis stated, or any route to object, and neither does the buyer.

Two further items are recorded as observed: the site carries advertising network and monetisation tags in its page metadata, and no legal contact of any kind is published beyond a shared support address. Recorded honestly as not located from the pages read rather than as proven absent across the whole domain.

The provenance of the data is that it is taken. Extraction is sold as a named tier feature covering five hundred profiles, the export path to a spreadsheet is described twice as a headline capability, and the target is a professional network whose terms the vendor's own guidance acknowledges prohibit the behaviour.

No licence, permission, lawful basis, notice, retention position or removal route is published for the individuals whose names, titles, employers and profile details are captured, because no policy of any kind is published at all.

This sits below the common failure in this category, which is naming no supplier for an acquired database: here there is no supplier relationship to name, only a mechanism for taking records from a platform that forbids it, handed to the buyer to run on their own machine under their own account.

Detection avoidance is the headline promise, stated four separate ways in the vendor's own copy. The product is billed as the safest automation tool available, working through advanced human like behaviour that ensures outreach without compromising the account, with the mechanism described as mimicking human behaviour by waiting for page loads and other actions to produce a natural interaction flow, and a feature line instructing the buyer to use that behaviour to ensure account safety and avoid blocks.

Extraction is sold openly as a tier feature, with one plan including the scraping of five hundred profiles and the sending of connection requests, and another including message and comment automation across four hundred profiles at a time, plus automatic application to a hundred job postings at a time. A company blog post is titled around overcoming the platform's weekly messaging limits.

The self contradiction settles it: the same page's own guidance states that the weekly ceiling is one hundred connection requests and that mass messaging and aggressive connection requests violate the platform's terms, while the plans above sell volumes several times that ceiling. The buyer holds the account that gets restricted.

Nothing published addresses stewardship in any form, and there is no policy anywhere in which it could be addressed. No training position, cross tenant boundary, retention statement or model provider appears. The specific exposure follows from the architecture rather than from a model: an unsigned executable runs on the buyer's own machine, operates inside their authenticated professional network session, captures profile data on named third parties, and maintains its own login implying that something is transmitted to a backend.

Nothing states what leaves the machine, what is retained there or centrally, or for how long. Graded at the middle band rather than lower only because the privacy and security failures carrying the same evidence are already recorded at the bottom band on their own axes.

Five manufactured authenticity surfaces stack under one real identity, and the fifth is sold as the product's core value. Connection requests carry generated notes presented as the sender's own words. Comments are posted automatically on other people's content under the sender's name. Profile visits are performed in bulk, manufacturing a signal of individual interest where none exists. Job applications are submitted automatically at up to a hundred at a time under the person's identity.

And the whole is engineered so that no recipient can tell a machine is acting, which the vendor states as a benefit rather than concealing. The accumulation ground established elsewhere in this index applies squarely: no single one of these would carry the bottom band alone, and the deliberate combination of all five, with indistinguishability marketed as the feature, does. Nothing anywhere discloses to a recipient that the connection request, message, comment or profile view was automated.

Two real exchange paths exist and both are file based: profile lists can be imported from a spreadsheet and captured data exported back out to one, with activity reports generated in spreadsheet format. That is minimal but it works and it is unmetered. Nothing else connects: there is no programmatic access, no developer documentation, no webhook surface, no system of record integration, no automation connector, no marketplace and no agent protocol server.

The finding worth recording is a direct contradiction between two parts of the same page. The upper tier's feature list sells direct integration with the professional network's paid prospecting product alongside spreadsheet import, while the frequently asked questions answer the question of whether that product is needed with a plain statement that the vendor does not support it. A paid tier feature that the vendor's own guidance denies supporting is a commercial representation problem as much as an integration one.

One architectural fact is genuinely published and worth crediting: this is locally installed software rather than a hosted service, distributed as an archive the buyer extracts and runs on their own machine, with compatibility stated for Windows, Mac and Linux. Local execution means the harvested profile data can in principle rest on the buyer's own hardware, which is an unusual and not unfavourable posture. Everything else is unstated.

A manual login into the vendor's software is described, which implies a backend, and nothing identifies where that sits, what it holds, which jurisdiction governs it or what the software transmits to it. No hosting provider, region, data centre or residency option appears anywhere, and no policy exists in which any of it could be described.

The distribution mechanism is itself the security posture and it is the weakest in this index. The buyer is instructed to download a setup archive, extract it, run the installer, choose a location and launch an executable, with no code signing, checksum, publisher verification or provenance statement mentioned anywhere. That binary then operates inside the buyer's authenticated professional network session on their own machine.

There is no certification of any kind, no trust centre, no audit, no penetration test, no dedicated security page, no vulnerability disclosure route and no status page. The sharpest item is a contradiction the vendor publishes itself: its guidance advises enabling two factor authentication and avoiding sharing network credentials with third party applications, while the product is a third party application that drives that very session, and a separate part of the same page describes a manual login step into the vendor's own software.

Real figures exist and a buyer can pay them, which keeps this off the bottom band: ten dollars a month for one plan, one hundred dollars a month for another, a free trial requiring no registration or card, a fourteen day money back guarantee on both paid plans, no setup fees, upgrade or downgrade at any time, and an enumerated list of accepted payment methods. Everything above that is incoherent. The three plans display out of price order with the hundred dollar plan in the middle.

The hundred dollar plan is named as customised and aimed at enterprises while carrying a fixed price. Its contents are described as everything in the starter plan, while the starter plan describes itself as everything in the basic plan, and no basic plan exists anywhere on the page. The two purchase links resolve to product pages named differently again, as a business plan and a personal plan. A buyer cannot determine what either paid tier actually contains relative to the other.

Extraction is not merely available, it is the point of the product: captured profile data exports to a spreadsheet, activity reports generate in spreadsheet format, and lists import the same way, all unmetered and described as core capability rather than as a paid unlock. Cancellation is stated as available at any time, a refund policy is referenced, and a fourteen day money back guarantee applies to both paid plans. What is missing is everything that would govern it.

No terms of service are published, so there is no instrument stating who owns the captured data, what happens to it or to any account record after cancellation, what retention applies, or what deletion the buyer can require. The precedent this index has set applies exactly: a working export path without governing terms sits at the middle band, and neither an export path nor terms sits lower.

Three real restraints are published. Connection requests and messages are stated not to be duplicated, which is genuine list hygiene rather than a marketing line. The free tier carries concrete published caps of one hundred connection requests per week and roughly four hundred per month. And the guidance advises spacing outreach and monitoring account activity for warnings. Against that sit two adverse facts.

Spam prevention is sold as a feature of a paid tier rather than shipping as a default, which places a protective control behind an upgrade in the same way this index has criticised elsewhere. And the paid tier volumes, five hundred profiles scraped with requests sent and four hundred profiles messaged at a time, run several times past the weekly ceiling the vendor's own guidance publishes, so the discipline described and the throughput sold do not reconcile.

Four buyer types are named with their own section, covering business owners and founders, marketing teams, recruiters and sales teams, and the three plans are labelled by size as individuals and small teams, growing businesses, and enterprises. That is real segmentation shape. It is then undone from several directions. The size labels do not track the prices, since the plan aimed at enterprises costs one hundred dollars a month and the plan aimed at growing businesses costs ten.

The guidance answers the fit question with a statement that the product suits businesses of all sizes including small businesses, startups, freelancers and large enterprises alike, which removes every boundary just established. And one headline capability, automatic application to job postings, serves a job seeker rather than any of the four named buyers, placing part of the product outside the go to market stack entirely. No ceiling and no disqualifying condition is stated.