Meetime Flow

A competent product carrying no model claim on any surface read, which the convention places at C rather than D. The one capability that sounds like scoring is explicitly rules based: leads are classified and ranked according to criteria the customer defines, not by a learned model. Cadences are pre programmed sequences, templates are written by the team, and the fast execution mode is a workflow arrangement rather than an inference.

That is worth recording as a contrast: this is a category leading vendor in its market, running its own research programme, and it markets productivity and process discipline where every alphabetical neighbour markets model driven personalisation. Whether any model capability exists in the product beyond what is published is flagged as unverified.

The design keeps a person in the loop by construction rather than by policy: a representative works a prioritised activity list one item at a time, performs each call, email and social touch, and the platform sequences and records rather than acts. Manager oversight is real and specific, with dashboards covering daily progress per representative, activity volume, conversion indicators and month on month results, and access management appears among the ten named internal policies.

What is undescribed is the one autonomous element the product does ship, the automatic email flow inside a cadence, where no approval step, hold, exception path or send review is published. Audit records, escalation thresholds and role definitions are absent from every surface read.

The product markets no model surface, so there is no provider, version or hosting arrangement to name. That places this at C on the same basis applied to Meet Drake one build earlier: a transparency test about models cannot be failed by a product that publishes none.

The lead fit score, which is the closest thing to an inference in the feature set, is described plainly as classification against criteria the customer sets, and describing a scoring mechanism accurately rather than dressing it as intelligence is itself a small piece of transparency worth recording.

Among the best evidenced vendors in this alphabetical block. Case studies name the customer, the individual and the number together: a data company moving list fit from 18 percent to 84 percent with a sixfold improvement in lead utilisation per representative, a fleet software company tripling booked meetings in the first month, an automotive systems company moving from 35 to 60 meetings a month and raising bookings 70 percent, and a partner at an investment firm quantifying an operation at over 100 activities a day.

Named individuals carry a role and an employer in every quoted case. Around them sits a logo wall of roughly two dozen recognisable enterprises across energy, education, health, facilities, payments and technology services. The distinguishing asset is a published annual industry benchmark study cited by year, alongside a research lab and a public return on investment calculator, which gives the vendor a measurement basis very few in this index have.

Held off the top band because the three figures leading the homepage, 50 percent more daily activities, 75 percent more contact attempts and 50 percent more leads approached monthly, carry no method, denominator or period, and the same claim appears in a garbled form on a partner page.

A real allocation position, grounded in a statute the vendor names and cites by number rather than gestures at. The privacy centre states that under the Brazilian data protection law the vendor is the operator and the customer is the controller, and that determining the purposes and the lawfulness of the data collected falls to the customer.

Naming a statute, stating the role split and assigning lawfulness is a compliance position rather than a disclaimer, the same reasoning applied to Mailshake. Around it sit eight enumerated data subject rights including elimination, a dedicated data protection contact address a recipient could actually use, an outsourced named data protection officer, and an acceptable use of assets policy among ten named internal policies.

Held off the top band by three gaps that matter for an outbound product. An unsubscribe mechanism, suppression list and complaint threshold appear nowhere. Messaging platform outreach is sold as a channel with nothing said about that platform's own business messaging consent requirements. And the dialer records calls, which engages a notice question this index would expect a position on and finds none.

The deepest privacy disclosure in this alphabetical block and it closes the exact gap every neighbour left open. A dedicated privacy centre, operated by a named external specialist firm serving as outsourced data protection officer with its own corporate registration number and contact address, alongside an internal channel. The statute is named and cited by number with its enactment and effective dates.

Eight data subject rights are enumerated individually, including portability, anonymisation and information about onward sharing. A record of processing activities is stated as maintained, and ten internal policies are named individually covering backup, incident management, information security, personal data disposal, human resources security, personal device use, data subject response, corporate data protection, vulnerability management and acceptable use of assets.

The finding that separates this from everything graded near it: the data categories are enumerated for two populations, the customer and separately the leads the customer loads, with the second list covering name, social profiles, address, job title, website, city, conversations, telephone conversations and number. Every other vendor in this block treats only the customer as a data subject. Retention is numeric, with lead data deleted within six months of contract end.

Held off the top band on execution rather than substance: no processing agreement is published, no independent audit or certification covers the programme, prospects are enumerated but never notified, and two load bearing links are broken, with the platform privacy notice resolving to a dead anchor and the terms of use link pointing at an unrelated training course document.

The supply chain question is answered by stating there is no supply chain, and stating it in a legal document rather than leaving it to be inferred: leads are inserted into the platform by the customer according to the customer's own criteria, either manually or by file import. The vendor sells no database, no credits, no enrichment waterfall and no purchased list.

Beside that absence the privacy centre enumerates exactly what the platform holds about a lead, and how long, which is more than any data supplying vendor in this index publishes about its own records. Held off the top band because the platform integrates with marketing automation and customer relationship systems that may themselves carry acquired records into it, and nothing addresses what the vendor expects of a customer loading a list whose origin it never sees.

The architecture appears to carry materially less exposure than anything else in this stretch of the runway, and the absence of a stated position is what holds it at C. Professional network and messaging touches read as prompted human activities inside a cadence, with the platform supplying a template and logging the outcome rather than driving another company's interface, and no proxy, rotation, extension, rented identity or behaviour simulation language appears anywhere on any page read.

That is a genuinely clean posture next to two vendors graded immediately before it. What is missing is any conformance statement at all, for either the professional network or the messaging platform, and the messaging channel is the sharper of the two because business messaging there carries its own opt in and template approval regime that the vendor never mentions while selling the channel.

The processor framing does most of the work a training statement would do, and it stops short of the question this axis actually asks. The privacy centre states that the vendor will use the data it can reach only for contractually admitted purposes, with the customer determining purposes as controller, which is a purpose limitation covering all customer data and grounded in a named statute rather than a marketing page.

Retention is bounded, disposal has its own named policy, and a security and data protection committee is stated as constituted. What is never addressed: whether anything learned in one customer's account informs another, and whether any content passes to a model. The second question is lighter here than at the neighbours because the product publishes no model layer, and that reduces the exposure without answering the point.

Structurally the cleanest vendor on this axis in the current stretch of the runway, and still holding at C for an absence rather than a practice. Nothing manufactures an identity, nothing rents an account, no model authors a message, and not one line of detection avoidance language appears on any page read, which is a sharp break from the two builds immediately before it. A person writes the template and a person performs the activity.

The gap sits at the one point where a recipient's expectation is genuinely engaged: the dialer records calls, and no position on informing the person on the other end appears anywhere, in a jurisdiction whose data protection law would expect one. The automatic email flow inside a cadence is likewise silent on how it identifies itself.

Named connectors are real and well chosen for the market served: the dominant local marketing automation platform, a local customer relationship platform, and full integration with the parent group's business management suite connecting prospecting through to sales and service. The dialer is described as integrated with the customer relationship layer so call activity lands where the pipeline lives.

Beyond those three names the integration wall is roughly eleven unlabelled partner icons with no per connector page, and no programmatic interface, webhook surface, developer reference or marketplace listing was located on any page read. An integrations page exists and was read only through its homepage summary, which is flagged.

A plain and slightly uncomfortable residency disclosure, published rather than avoided, which is what this axis rewards. The privacy centre states the platform is hosted in the cloud across two named providers and that those environments are located in the United States.

The vendor is Brazilian, serves Brazilian customers, publishes a street address in Florianopolis and is regulated under Brazilian data protection law, so the disclosure amounts to saying that locally regulated personal data is processed abroad, and the vendor says it anyway. The database engine is named, network isolation and address based access control are described, and the corporate seat is published in full.

Held off the top band because the customer has no region choice, no transfer mechanism or safeguard instrument is named for the cross border flow, and no processing agreement is published that would carry one.

An enumerated control set with unusual technical specificity for a vendor of this size, published inside the privacy centre. Named individually: two cloud hosting providers, the database engine, an internal network reachable only by services inside it, address based access control to the database, a 256 bit encryption standard with a named password hashing scheme and salting, daily full backups with a stated seven day retention, encryption in transit and at rest, vulnerability analysis, access management, firewalls and certificates, a web application firewall, and production environment monitoring logs.

Behind those sit named policies for information security, incident management, vulnerability management and backup, plus a standing security and data protection committee. Held off the top band because every control above is self described with nothing independent behind it: no certification, audit report, penetration test summary, sub processor list, trust centre or status page was located.

One published detail cuts against the vendor and belongs in a buyer's evaluation rather than being smoothed over: the stated password requirement is a minimum of eight characters with letters and numbers, and multi factor authentication appears nowhere, at a platform holding connected mailboxes and recorded calls.

The navigation carries an item labelled Prices and it links to a talk to a consultant landing page. That is the sharpest form of this failure recorded in the index so far, sharper than silence, because the label promises the thing the destination withholds. Across the homepage, the platform pages, the partner listing and every page read, no price, tier name, seat rate, unit of pricing, range, floor or example appears anywhere, and every path converges on a booked call or a quote request.

The compounding detail is that the vendor publishes a return on investment calculator inviting a buyer to compute what the platform is worth to them, while withholding the only number that would let them finish the calculation. A buyer cannot budget any part of this purchase without entering a sales conversation.

Two published commitments put this above most of the index. Portability is an enumerated data subject right, framed as the ability to obtain a copy of personal data specifically to ease migration to another supplier, which is the rare case of a vendor naming competitor migration as the purpose of a right it grants.

And the deletion window is numeric and post termination: lead data is deleted within six months of the contract ending, with remaining data held only as long as needed for the contract, legal obligations and defence of rights. A personal data disposal policy is named among the ten internal policies. Held off the top band on three points.

No export function, format or scope is published for campaign history, prospecting metrics or call recordings, which are the accumulating operational asset. The platform terms of use are not reachable, since the link intended to serve them resolves to an unrelated training course document. And the six month window cuts both ways, since prospect records outlive the contract by half a year, which is disclosed and should still be priced in.

One genuine structural governor and no published mechanism anywhere. The governor is the design: a cadence is a list of activities a person executes one at a time, so volume is bounded by human throughput rather than by a send button, and the vendor's own benchmark research frames a top performing day at under a hundred activities across all channels combined. What is absent is every instrument this axis looks for on either channel the platform actually operates.

For the automatic email flow: warming, authentication guidance, bounce categorisation, complaint thresholds, suppression and reputation monitoring are all missing. For the dialer, which is a first party telephony product with call recording: caller identity treatment, abandonment rate, calling window and registry scrubbing are equally missing, and a dialer opens a regulatory surface that the sequencing product alone does not.

The buyer is defined with unusual precision and the definition is built on an exclusion, which is rare and useful: the product is for pre sales representatives and the commercial leaders managing them, and the vendor argues repeatedly and specifically that prospecting inside a customer relationship system fails those people because that system was built for closers. Naming the workflow you are not is a clearer segment statement than most vendors manage.

The coverage half is where this holds at C. The market is Brazil, evident from the language, the address, the local integrations and the national benchmark study, and the vendor never states it. No company size band, seat floor or ceiling appears on any product page, with the only size qualifier surfacing as an aside in a blog post. A statement of who should not buy is absent, and the customer count is never quantified, so the two dozen named logos evidence outcomes rather than coverage.