Mailshake

The writing assistant is a named, branded feature on a platform that predates the current wave by most of a decade, and the removal test settles it quickly: sequences, the connected mailbox, throttling, the lead surfacing view, the dialer, social touches, the contact finder and the customer relationship synchronisation all survive intact without it.

This is the established platform pattern the convention was written for, applied to a 2017 vendor rather than to an enterprise suite, and it is not a harsh read. The tier structure agrees, since the assistant sits inside the middle plan as one line item among many rather than as the reason the plan exists.

Nothing here acts unsupervised. Sequences execute on a schedule the buyer sets, the writing assistant proposes copy a human sends, and the lead surfacing view exists specifically to route engaged replies to a person rather than to answer them. That is a comparatively restrained design and it is worth crediting against the several vendors in this session that sell unsupervised reply handling.

What is absent is any published control around the assistive layer itself: whether generated copy passes a review step before it enters a live sequence, and whether any record is kept of what was generated and sent, are both unstated.

The writing assistant carries a brand name and that is the extent of what is disclosed about it. Model, provider, version, hosting location and boundary are unstated everywhere read, including in the privacy policy, which discusses model training in one narrow respect without ever identifying what models are involved. The gap is more conspicuous here than at a smaller vendor, because the same privacy policy demonstrates that this company is willing to write precisely about technical matters when it chooses to.

One testimonial appears on the pricing page and its attribution is better than almost anything graded in this session: a named individual, a stated job title, a named employer and a quantified claim of more than 100,000 dollars in revenue from a single campaign. A reader can look that person up.

What keeps the row at the middle band is that it is one data point with no measurement basis, no time period and no method, standing alone where a vendor nine years into its market would be expected to have case studies. Independent directory ratings are strong and are reported by third parties rather than displayed with a linked source in the material read.

Three named statutes appear in the terms, the European regulation, the California act and the Virginia act, and the terms then allocate responsibility with a specificity most peers avoid. The customer bears sole responsibility for the accuracy, quality and legality of the personal information it loads, for the means by which that information was acquired, for ensuring the contractual terms required by applicable privacy law exist, and for ensuring any required consent of a data subject has been obtained and any necessary disclosures made.

Naming consent as a requirement and assigning it is a compliance position, not a disclaimer. A recipient facing deletion route exists and works two ways: an individual can email to have their data removed, and a customer can raise the same request on behalf of one of their own recipients. Off the top band because the posture is allocative rather than enforced.

The vendor requires the customer to warrant lawful use where the highest graded vendors in this index make lawful use a condition they police, and no unsubscribe mechanism, suppression policy, acceptable use policy or complaint threshold was located.

The privacy policy is specific in places most are vague, and two disclosures in it are candid enough to be worth a buyer's attention. The first is a plain statement that in rare cases engineers may use an internal tool to locate emails belonging to a customer's campaigns in order to resolve a support request, fix a defect or investigate a security concern, done so as to view the least information possible. Very few vendors admit that human access to customer email content exists at all.

The second is a disclosed product limitation stated inside the privacy policy rather than buried, that warming is not provided for accounts on the largest mailbox platform. Around those sit adherence to the limited use requirements of that platform's data policy, a documented deletion route reachable by email, and encryption stated for data at rest and in transit.

Off the top band because no sub processor list was located, no pre signed data processing addendum was found, no supervisory authority or protection officer route is published, and the terms place essentially the entire data protection burden on the customer.

Two data flows exist and only one is explained. Contacts the buyer uploads are their own and the terms are explicit that the buyer owns the question of how they were acquired. The contact finding module is the unexplained one: it is sold as a separate subscription at four published credit tiers, searches by job title, company, industry and location, and returns names and email addresses, and no supplier, database, coverage figure, refresh cadence, matching method or licence appears anywhere read. A buyer paying 249 dollars a month for 12,500 records has no published basis for knowing where any of them came from.

The email side carries little exposure by design, since sending runs through a mailbox the buyer already owns on the major providers, with no relay, proxy or rented identity in the path. Two things keep this at the middle band rather than higher. Social automation ships on the top tier with no conformance position stated regarding the platform it automates, which is the same silence graded repeatedly across this alphabetical block.

And address rotation is described on the pricing page as improving deliverability and allowing a higher number of emails to be sent daily, which is the second half of that sentence doing something different from the first: the index has consistently held that multiplication framed as a way past a limit is not the same as sending discipline.

A training statement exists and is precisely limited, which is the pattern this index has now recorded three times: the vendor states it does not use data acquired from the largest mailbox platform's interfaces to develop, improve or train generalised models. Read carefully, that commitment covers one source of data and one class of model.

It leaves untouched campaign content, uploaded prospect records, replies, and mailbox data from every other provider, and it says nothing about models that are not generalised. The narrower scope is why this sits a band below the vendors whose equivalent statement covers customer data as a whole. A plain sentence about customer data generally would move it.

Messages leave under the buyer's own name from the buyer's own mailbox, nothing manufactures a persona and no account belongs to somebody else, so the authenticity failures graded repeatedly earlier in this session do not arise. The recipient also has a real route: an individual can email to have their data deleted, and their sender can raise it for them. What is missing is any position on artificial authorship.

Copy is generated and tested by a branded assistant and sent as the buyer's own writing, and the European obligation to disclose that a message is machine generated goes unaddressed on every surface read.

Integration depth is the capability independent reviewers most consistently single out, and the published surface supports them: native connections to three named customer relationship platforms with two way synchronisation described by outside reviewers as handling custom objects and account matching where newer competitors break, more than a thousand further destinations through a general automation connector, a browser extension, an interface key documented in the help centre, and a substantial documentation site.

Off the top band on two counts. No public developer documentation or endpoint reference was located, only an article describing where to find a key. And the browser extension for the contact finding module is marked as coming soon in all four of its tiers, including the 249 dollar one, so a feature is listed as included at every price point without yet existing.

The privacy policy gives an unusually clear view of the architecture without giving a location: a private cloud network with restricted entry points, enforced multi factor authentication on the infrastructure identity accounts, and a named payment processor holding card data so the vendor stores only the last four digits. Every one of those describes how rather than where.

Processing region, storage location, transfer mechanism and any customer choice of residency are all unstated, which for a vendor naming the European regulation in its own terms is the gap most likely to matter to a buyer with European recipients.

A documented control set exists and is specific rather than asserted as a category: restricted access to the private cloud network limited to what serving the product requires, full time staff access limited by role and function, contractors given minimal temporary production access only when needed, multi factor authentication enforced both on infrastructure identity accounts and across company mailboxes, encryption stated at rest and in transit, and card data held by a named processor rather than by the vendor.

A help centre article gathers the privacy policy, a security policy and an information security policy in one place, so the documents are findable rather than scattered. Off the top band on the thing procurement actually asks for: no certification, audit report, penetration test summary or trust centre was located, so every one of these controls is the vendor's own description of itself with no third party attestation behind it.

Prices are published, which keeps this out of the bottom band, and a buyer still cannot reconcile them. The vendor's own pricing page as retrieved shows the entry tier as free with one email address, while its own answers immediately below state that no free trial exists and that payment is collected up front, and every independent review places that same tier at 29 dollars a month.

Mailbox allowances are reported as one, two and five per user on the vendor's page and in its help centre, as two and ten by a capture of the same page three months earlier, and as five doubling to ten by one reviewer describing a 2026 change. Billing cadence is described by different reviewers as monthly by default with no annual discount, as annual only with no monthly option, and as annual with roughly a quarter off. Two structural points hold regardless of which figures are current.

Per minute rates for the dialer bundled into the top tier are not published anywhere, which is a load bearing usage cost on the plan that exists to include it. And the contact finding module is a separate subscription on top of the seat price. The one part of this that is exemplary is that module's own card, which publishes four tiers with monthly credit volumes and the effective cost per credit at each, from five cents down to two.

The account lifecycle is documented in the help centre rather than left to inference, with published articles covering cancellation, the refund position, account deletion and mid cycle subscription changes, which are prorated to a charge or a credit. Deletion of an individual's data on request is committed to in writing. Cancellation works by ending before the renewal date.

What is absent is the portability half of the axis: no export function, file format, download path or scope is described anywhere read, and no post termination right over campaign history, prospect lists or reply data is stated. The practical exit route appears to be the customer relationship synchronisation, which means the buyers best placed to leave cleanly are the ones who connected a system of record on the way in.

The guidance layer is genuinely strong and specific in a way marketing copy rarely is. The help centre publishes step by step authentication setup articles for both major mailbox providers covering sender policy, key signing and the reporting policy on top of them, a standalone article on the reporting policy alone, and a separate article on sending cadence and copywriting practices for deliverability.

Alongside that sit scheduling and throttling controls, list cleaning, verification, warming, a domain setup assistant that walks a non technical buyer through configuration, and deliverability training offered as part of onboarding rather than sold. Three things hold it below the top band and a buyer should weigh all of them. The vendor discloses in its own privacy policy that warming is not provided for accounts on the largest mailbox platform, which is where most customers send from.

Address rotation is described partly as a way to send a higher number of emails daily. And an independent external scanning service reports that the vendor's own sending domain runs a permissive reporting policy and a lenient sender policy, which is the configuration its own help articles instruct customers to tighten. No complaint rate threshold and no published daily sending ceiling were located.

The ladder is legible and each rung names its buyer, from an entry tier for individuals through a mid tier for teams scaling an email programme to a top tier for multichannel programmes, with mailbox allowances, channels and included credits all stepping up together, and a custom agency arrangement above that.

The agency case is documented concretely rather than gestured at: the vendor advises that the client should create their own team and be the billed party, with the agency added as a user across as many teams as it needs, which is a real operating model with a real billing consequence. Off the top band because region coverage, size bands and industry fit are all unstated, and because the structural boundary that independent reviewers uniformly identify goes unmentioned by the vendor.

Seats are billed per user with mailboxes capped per user, so an operator running many mailboxes behind one person pays for seats they do not staff, and that is the point at which this product stops fitting.