Navattic

Copilot is sold in three versions that follow the plans. Starter Copilot generates a demo and takes custom context; Base Copilot adds prompt and review editing, uploads, media and capture edits, custom use cases, premium voiceovers and 100 avatar minutes; Growth Copilot adds MCP suggested demos, avatar cloning and 300 minutes.

Take all of it away and the core product still stands: HTML capture, interactive demos, embeds, custom domains, account identification, CRM write back and the Launchpad sending workflow. Navattic Agents, which hold autonomous conversations with prospects, are a separate line priced by conversation volume.

Real oversight machinery is published, and none of it reaches the surface that needs it most. On the control side the pricing matrix names features rather than promising governance: a request and approval workflow for demos, assistant output offered as prompt and review rather than direct generation, custom permissions, audit logs, single sign on with directory synchronisation, and a domain block list.

Naming approval and audit as purchasable capabilities is more than most vendors in this category do. The gap is the agent line, which the vendor itself describes as running fully autonomous conversations that qualify prospects, answer questions and demonstrate workflows in real time. Nothing published states what such an agent may assert about the product, when it escalates to a person, whether conversations are reviewable, or who is accountable for a wrong answer given to a buyer. The approval and audit controls also gate at the upper tiers. Ask what bounds the agent's answers, whether transcripts are reviewable, and at which tier approval workflows become available.

The interface is documented and the models behind it are not. The MCP server gives AI clients such as Claude, ChatGPT, Cursor and Codex workspace scoped access to read analytics, browse and build demos, manage Launchpad share links and query personalization data, and Growth adds suggested demos. AI avatar minutes are stated for each plan and avatar cloning is a named feature.

The subprocessor list names OpenAI for AI features and the terms say AI features rely on third party models, yet no model or version is given for Copilot, voiceovers, avatars, translation or Agents, and nothing says whether a viewer is told a presenter is synthetic.

Four quantified outcomes, each attached to a named company with its own case study behind it, which is the form this axis exists to reward and the strongest example graded in this batch. A payments company reports fifteen percent of its website leads, a training platform reports a four hundred and fifty percent rise in trial signups, a spend management vendor reports ten million dollars of influenced annual recurring revenue, and a fourth reports high intent leads in the thousands, each linking to a dedicated customer page rather than sitting as a floating banner statistic.

Around them sit a customer showcase, a highlights section, a customer advocacy programme, an annual published research report on the category, and independent review standing near the top of the scale across more than a thousand reviews. It is held below the top band by the measurement basis, which is absent in every case: no period, no baseline for the percentage increase, and no attribution model behind the word influenced. Ask over what period each figure was measured and how demo influence on revenue was attributed.

Nothing is sent from here, and one published control is better than the category norm. Demos travel through the customer's own channels, whether that is a sequencing tool, a mail client, an advertising campaign or an embed on their own website, so sending obligations sit with whatever platform the customer sends from. Graded in the middle of the band with that scope stated rather than at the floor, since the floor asserts an undisciplined sending product and this does not send.

The control worth crediting is a domain block list, published as a tier feature, which lets a customer prevent specified organisations from viewing their demos. That is the only exclusion mechanism found across the three demo platforms graded in this batch, though it protects the customer's competitive interest rather than a viewer's privacy. Against it sits viewer identification by company domain with no described route for an organisation to decline being identified. Ask whether the domain block list also suppresses identification, and what an identified organisation can do about it.

The instruments are separately published and none was read. Terms of use, a privacy policy and a data processing agreement each sit at their own addresses in the footer, and publishing the processing agreement as a document in its own right rather than folding it into the terms is better practice than several records graded this batch. A trust centre operates on its own subdomain.

None of those was retrievable on this pass, so retention periods, lawful bases and the rights exercise route are unestablished and nothing here asserts they are absent. What the product pages do establish is the scale of what is collected about people who are not customers: every demo view generates engagement data, viewers are resolved to their employer by domain, and colleagues a demo is forwarded to are identified and reported.

In product controls are named as tier features, covering custom permissions, audit logs and directory synchronisation. Ask for the retention period on viewer engagement records and the basis for resolving anonymous viewers to an organisation.

Clean provenance on the content and an unexplained dependency underneath one feature. Everything a customer publishes originates with them, captured from their own application's markup, so there is no third party corpus behind the demos and nothing brokered.

Account identification is the exception and it is the same gap recorded against the other viewer identification products in this index: resolving an anonymous demo viewer to a named employer requires a third party dataset mapping network addresses or device signals to organisations, and nothing published names the provider, states the licence, describes the method or gives a match accuracy or false attribution rate.

A buyer acting on that data is routing sales effort at named companies on the strength of a resolution they cannot inspect. Ask which provider supplies the company identification data, on what licence, and what its accuracy and false attribution rates are.

Nothing here depends on access to a platform the vendor does not control. Demos are captured from the customer's own application, hosted on the vendor's own infrastructure or served from the customer's own domain on higher tiers, and embedded on the customer's own properties, so there is no third party network being read and no permission that another company could withdraw.

The connected products are reached through each destination's documented route and the named list is long and tiered, running from messaging and marketing automation at the entry paid level through customer record and sales engagement platforms higher up, including two enablement platforms this product sits alongside rather than replaces. A browser extension, a script snippet and an outbound assistant interface extend the surface without changing who holds the permissions.

It stops below the top band for the usual reason: no conformance position of the vendor's own is stated against any connected platform, so the grade rests on architecture rather than a documented commitment.

A disclosure most vendors avoid, published without the boundary that should accompany it. The vendor states that its demo building assistant is trained on high performing demos built on the platform, which is a plain statement that learning crosses its customer base rather than staying inside each account. Saying so is creditable and rare.

What is absent is every limit a buyer would want around it: whether the training uses structural patterns only or the captured content itself, whether a customer can decline to contribute, whether anything captured from a live application can surface in another customer's suggestions, and how the boundary is enforced.

Alongside that sits the one genuine stewardship control here, the ability to remove or blur text and charts during capture, which matters because demos are recordings of a working application that can contain real records. The assistant interface adds a second open question about what a connected external client may retain. Ask for a written opt out from cross customer training and a statement of what the training consumes.

The most complete identification apparatus of the three demo platforms graded here, and the only one with an exclusion control. On the identification side the vendor is explicit: viewers are resolved to their employer by domain, colleagues a demo is forwarded to are surfaced as newly identified stakeholders, and a named feature discovers the buying circle around a deal, so people who never received an approach are mapped and reported to a seller.

On the presentation side, synthetic presenters are metered by the minute and voice and likeness cloning is a named tier feature, meaning a prospect may be addressed by a synthetic copy of a real employee with nothing published about whether they are told. Against both sits a domain block list, published as a tier feature, which is the only mechanism found across these three records by which an organisation can be kept out.

The vendor describes all of this openly in its own commercial material, which is why it sits in the middle of the band. Ask what a forwarded viewer is told, and whether cloned presenters are disclosed as synthetic.

Integrations are listed by plan and documented. Base carries Salesforce, Marketo and 25 more, and Growth adds Gong, Salesloft, Outreach, Gmail, Outlook, Seismic and Highspot. The Salesforce integration sends demo engagement to opportunity, lead, contact and account records through a playbook with field mapping, and a managed package covers orgs that restrict external apps; the documentation also covers HubSpot, Marketo, Pardot, Segment, ZoomInfo and Slack.

The MCP server lets AI clients read analytics, build demos and manage share links within the workspace, authenticated by OAuth or a personal access token. No general public API reference sits beside it.

Nothing on this question was reachable. No hosting provider, region, processing location, residency election, subprocessor list or cross border transfer mechanism appears in any material retrieved on either pass. The trust centre resolves on its own subdomain but its body did not render to a machine, and the security page and processing agreement were not retrieved either, so this reflects what was retrievable rather than an established absence of disclosure.

The one adjacent fact is that the top tier is positioned for teams deploying across multiple product lines and regions, which describes market reach rather than where data sits. The question matters here because the platform hosts demos serving viewers worldwide and accumulates engagement records identifying individuals and organisations across whatever markets its customers sell into. Single tenant and self hosted delivery are neither offered nor expected for a product of this shape. Ask where demo content and viewer records are processed and stored, and whether a region can be elected.

Navattic's trust center lists SOC 2 and GDPR, with the SOC 2 Type II report, an information security policy, a data management policy and a penetration test released on request, and enumerated controls across infrastructure, organizational and product security, continuity and data handling, including deletion of customer data on departure.

Its security page states encryption at rest with application level encryption for sensitive fields, TLS 1.3 in transit, backups every few hours to daily kept from a week to two months, and a responsible disclosure program. SSO and directory sync arrive with Growth, and custom permissions and audit logs with Enterprise.

The pricing page sets out how Navattic packages the product and prints no number for any paid plan. Starter is free with one seat and one demo. Base and Growth are billed annually with five and ten seats, Enterprise is custom, and a Startup plan for bootstrapped and seed stage teams of 30 or fewer people is priced on request.

A full feature comparison shows what each plan adds, including 100 AI avatar minutes on Base and 300 on Growth, and Navattic Agents are priced by conversations and agents with the Base plan included. Every paid plan leads to a sales conversation, and the terms cap a renewal increase at 5%.

Several technical routes out exist and none is described as one. The source material belongs to the customer, since demos are captures of their own application, and higher tiers allow demos to be served from the customer's own domain, so a published demo need not disappear from a customer's web presence if the relationship ends, though nothing states what happens to it.

Webhooks, a script snippet and an assistant interface capable of querying demo performance and account activity together form a plausible extraction path, but they are sold as integration and analysis features rather than documented as portability, and the assistant interface gates above the free tier.

What is absent entirely is any statement about the engagement record: viewer analytics, company identification history, buying circle maps and split test results accumulate over the life of an account and are the reason the reporting has value, and nothing describes exporting them or states what happens after termination. Ask what happens to published demos and viewer analytics when an account closes, and over what window they can be retrieved.

No sending apparatus here, and one published feature that addresses the adjacent risk better than its peers. The platform operates no mailbox, no sending domain, no warmup and no throttling, because demos reach prospects as links, embeds, downloadable images or calls to action placed by the customer in their own mail, sequences, advertising and website.

Graded in the middle of the band with that scope stated rather than at the floor, since the floor asserts a sending product without discipline and this does not send. The feature worth crediting is custom domains, published as a tier entitlement, which lets demos be served from the customer's own domain rather than a shared vendor domain.

That matters because a hosting domain shared across every customer carries pooled reputation with mail security and corporate network filtering, and custom domains come with the Growth plan. Ask what happens to demo links on lower tiers if the shared hosting domain is filtered.

Six buying roles are addressed with their own pages, more than any comparable record graded here, spanning marketing leadership, sales and solutions engineering leadership, growth and demand marketing, individual sellers, product marketing and solutions engineers, and each tier states the buyer it is built for rather than leaving it implied.

One tier carries an actual eligibility test rather than a size hint, restricted to companies of thirty or fewer people that are bootstrapped or seed stage, which is unusually precise segmentation and tells a buyer immediately whether they qualify. The plans run from a free Starter plan through Base and Growth, with five and ten seats, to a quoted Enterprise plan, and the Startup plan sits beside them.

Named customers span payments, developer tools, analytics, human resources, real estate and file storage, evidencing the breadth rather than asserting it, and demo and capture translation support an international claim concretely. It stops below the top band because no geographic coverage is published at all, with no regions, no market list and no statement of where the vendor sells or supports.