Ontraport

Established platform where the removal test leaves a complete product standing. Strip the model layer and the contact database, the visual automation builder, the sales pipeline, payment processing, the page and site builder, and two decades of internally operated sending infrastructure all remain intact and saleable.

The vendor's own roadmap concedes the staging: content generation and an assistant embedded in automation are marked available now, conversational access to account data is marked for the summer, and generative campaign building is marked as coming next. This is the established platform convention applied rather than a harsh read, and the vendor's positioning supports it, since the pitch is consolidation of tools onto one database rather than a model doing work no database could.

Administrative rather than agentic, and described rather than gestured at. An automation log records every action and change made in the account, and the vendor cites that log in its data protection section as its record of processing activities under article 30, so the audit trail does double duty as a compliance instrument.

Permission management is granular by record type, blocking a role from adding, viewing or updating specific sections, and includes the ability to block exports outright. Multi factor authentication offers three levels. Off the top band because the assistant layer is described as living inside automations, accessing customer data and taking action on the customer's behalf, and no approval step, escalation threshold, review queue, guardrail or published constraint on what it may do appears anywhere on the site or in the terms.

The model providers are named, and they are named in the governing terms rather than in marketing copy. The published sub processor list identifies two named providers scoped to three named features, an assistant, a copywriter and an intelligence product, with the scoping made explicit by a conditional clause covering customers who use them. Disclosing the model estate inside a contractual document a buyer can hold the vendor to is rarer than a marketing page naming a partner.

Off the top band on three counts: the conditional wording leaves which provider serves which feature undetermined, no model family, version or hosting arrangement is stated anywhere, and the three artificial intelligence features named in the terms are not described consistently on the product pages, so a buyer cannot map the disclosure onto what they are actually buying.

Substantial volume of social proof and not one quantified customer result. Four independent review platforms are badged sitewide, one of them carrying a rating above four and a half across more than two hundred reviews, alongside a case study library, a gallery of businesses built on the platform and a live customer portal demonstration. Two named customers appear with employer attached on interior pages.

Against that, the three homepage testimonials carry a first name and a last initial only with no employer, and every figure on the site measures the vendor rather than a customer, covering years in business, review counts, emails sent annually and customer totals. The uptime figures also disagree with each other: the homepage claims an average of 99.99 percent while the contractual commitment in the same site's terms is 99.95 percent and is available on the top tier only.

One of the broader published compliance positions in this category. The anti spam policy names the United States commercial email statute by title and year, the telephone consumer protection guidelines, the wireless industry association messaging principles, the underlying carrier's own messaging policy, individual carrier policies and country specific guidelines.

It requires fully opt in lists, requires explicit consent before text messages, enumerates the restricted content categories covering adult material, hate, alcohol, firearms and tobacco, and prohibits rented, purchased or scraped addresses by name with a worked example. Responsibility transfer is stated plainly through the controller and processor split and an indemnity.

Off the top band because enforcement is asserted rather than described, with immediate termination and a discretionary right to shut down sending but no automatic unsubscribe insertion, physical address enforcement, complaint rate threshold or account review trigger published. Note also that the abuse desk link, the single published route for reporting a violation of the zero tolerance policy, is a dead script anchor that resolves to nothing.

Genuinely thorough where it counts. European and United Kingdom article 27 representatives are named with full postal addresses at an independent firm. The vendor is certified to the European Union to United States data privacy framework, its United Kingdom extension and the Swiss equivalent, with the government certification directory linked. All six data subject rights are addressed with the mechanics for honouring each.

The sub processor list is enumerated by name rather than described in the abstract, running to a dozen named parties. Breach notification is committed by article, a dedicated mailbox handles requests, and a route to the local supervisory authority is published. Off the top band on three defects.

The footer badge on every page still reads that the vendor is certified under the predecessor framework invalidated by the European court in July 2020, six years stale, sitting beside a policy body that correctly names the successor, and the section anchor still carries the old name.

The cookie paragraph claims only session information is recorded and no permanent cookies are used, while the same policy describes data partners associating website activity with personal information across visits. And a flat statement that sensitive data is not collected sits against dedicated healthcare and financial services industry pages.

Sells no data and the records originate with the customer, which is the clean baseline for this category, and the geolocation database used for approximate location is named outright, which is more than most disclose. One practice sits outside that and it is on the vendor's own website rather than in the product: the privacy policy discloses that for United States visitors, cookies may be used by online data partners to associate site activity with other personal information those parties hold, including by association with an email address, after which the vendor may send marketing to those addresses.

Anonymous visitor identity resolution on its own traffic. The partner is not named in the policy text, no lawful basis is stated for the resolution, and the opt out is hosted on a third party domain rather than the vendor's own.

Conservative architecture and a cooperative posture toward connected platforms. Sending runs on wholly internal infrastructure rather than a rented relay, which removes an entire class of intermediary term. Use of one major provider's interfaces is governed by that provider's user data policy including its limited use requirements, and the calendar permissions are enumerated one by one, each with the reason it is requested.

A conferencing integration section states plainly that no user data is collected or stored, that no personally identifiable information is taken from the connected account, and that the customer may disconnect at any time. Applications ship through both official mobile stores, a developer sandbox has published terms, and nothing rotates identities, rents accounts or advertises evasion.

Off the top band because no conformance position is stated for any professional network or social platform, and the advertising audience feature pushes contact records out of the database into an advertising platform for retargeting with no consent position or terms position stated for that transfer.

A real non use commitment exists and the training question is still never answered. The terms state that the vendor will not rent, sell, access or in any way use the client's customer database information, and the model providers are named in the sub processor list, which together are more than most vendors at this scale publish.

But nothing anywhere states whether prompts, account content or contact records sent to those providers are retained, whether zero retention terms are in place, or whether any customer content contributes to a model serving another account. The question is live rather than theoretical, because the assistant is explicitly marketed as running on the same unified database as everything else and having the full picture of every contact's history.

Note also that the governing confidentiality clause is rendered twice on the single legal page in two materially different forms, once absolute and once carrying an exception for what is required to render the service, so the strength of the commitment depends on which rendering a reader reaches.

No position on article 50 of the European artificial intelligence regulation appears anywhere. The assistant drafts personalised messages that reference a contact's past activity and routes incoming messages by automated tagging, and nothing states whether a person receiving a model drafted message is told, or whether a person whose message is machine routed is told.

Tracking is extensive and undisclosed to the tracked party, covering page visits, link clicks, form completions, purchases, opens and attribution from advertisement click through to revenue. The sharpest instance sits on the vendor's own website rather than in the product, where United States visitors are resolved to email addresses by data partners and then marketed to. Two points in the vendor's favour: text messaging carries a stated stop instruction and a stated maximum frequency, and the anti spam policy requires explicit consent before any message is sent.

Broad and unusually open at the developer layer. A documented open interface is published with its own documentation subdomain and a live interactive endpoint a developer can exercise in the browser. A protocol server for connecting external assistants is claimed live on the homepage, with a brokered route through a major workflow platform independently verifiable and carrying scoped permissions and a typed software development kit.

Native applications ship in both official mobile stores, a content management system integration serves the most common website platform, payment gateways connect directly, and a developer sandbox carries no time limit for anyone building a public integration. A certified expert directory, an agency partner programme and a setup wizard library round it out.

Off the top band because the first party protocol server is asserted on the homepage with no dedicated page, tool list or documentation located, no webhook documentation was found, and neither federated sign on nor directory synchronisation appears at any tier, which is a conspicuous gap at a platform actively selling to mid sized businesses.

A residency posture with no options in it, disclosed clearly, which beats silence and matches the treatment given to comparable single region vendors in this index. The privacy policy commits in plain terms to storing and processing data in databases and servers located in the United States, and the transfer mechanism for European and United Kingdom personal data is named and certified rather than left to inference.

Three named infrastructure providers appear in the sub processor list, covering the hosting, colocation and edge layers, which is more architectural disclosure than most vendors of this size offer. Dedicated infrastructure is offered for large accounts.

Off the top band because there is no region choice, no country option, no residency commitment available to a European customer beyond the transfer framework itself, and the dedicated infrastructure offer carries no geographic content at all, answering tenancy rather than location.

One real certification, correctly scoped, and no platform level assurance at all. The payment card industry standard at its highest level is held, and the terms scope it honestly to the extent that cardholder data is possessed, stored, processed or transmitted, with the card system stated to be independent of the application.

A genuine control set is published covering daily offsite backups with redundancy, role based permissions with export blocking, multi factor authentication, automatic certificates on hosted pages, automation logs, continuous monitoring and encryption. A public status page exists and a security mailbox is published for vulnerability reports.

Against all that, no service organisation control audit, no international standard certification, no independent audit, no penetration test report and no trust centre exists anywhere, at a twenty year old platform holding the customer's contact database, mailbox sending credentials, website, course content and payment records. The assurance that security is regularly tested carries no auditor, scope or date. Note also that the multi factor options offered are text message or email, both weak factors, with no authenticator application or hardware key named, and no federated sign on at any tier.

Two disclosures well above the category norm and a pricing page that returns nothing to a machine. To the vendor's credit, the fee agreement publishes an automatic three percent increase to total account fees on every anniversary of the signup date, which is a renewal escalator most vendors conceal entirely, and it states the overage mechanics plainly, including that exceeding a contact, seat or email ceiling triggers either an automatic upgrade to the next tier or overage billing at the vendor's election.

A fourteen day trial requires no card, cancellation is self service, annual billing carries two months free, and a nonprofit discount is published with its qualification. Against that, the pricing page returns not one tier name, contact ceiling, seat rate or figure of any kind to a fetcher, so the machine readable price surface of this vendor consists of the escalator and a ten dollar minimum text messaging charge.

The independent listings filling that vacuum disagree by a factor of three on the entry tier, with four different figures published across four directories and three different top tier figures. And the billable unit list in the terms names seats, contact blocks, email blocks, message credits, model credits and four content management levels, with no rate attached to any of them on any retrievable surface.

The harshest termination language read in this session, published in plain terms, alongside a functioning export path. Against the vendor: all content is stated to be immediately deleted from the service upon cancellation and cannot be recovered once the account is cancelled, with no grace period, wind down window or post termination retrieval right anywhere.

Vendor initiated termination is reserved for any reason at any time and produces forfeiture and relinquishment of all account content. The warranties clause states the vendor is under no obligation to export, extract or retrieve the database outside the export function. The permission model separately allows an administrator to block exports.

What matters is what is stored: this platform holds the customer's website, landing pages, courses, membership sites and payment records as well as the contact database, so the content deleted at cancellation is the business's public presence rather than a list.

Held above the floor because an export function exists, is named in the terms as the one route the vendor is obliged to provide, is described in the data protection section as the mechanism for portability requests via a comma separated file, because the customer is stated to retain all rights to their data, and because the sending path is explicitly not locked, with a third party relay available on request.

The deepest genuine capability on the site and the closest this vendor comes to a top band. Sending runs on wholly internal infrastructure that the vendor has operated across the whole delivery chain for more than two decades rather than relaying through a third party, and it names that contrast directly. An in house postmaster team is available to review a customer's programme and coach them through problems.

Sender authentication records and custom sending domains are available at every plan level with the vendor stating explicitly that it does not reserve them for some users, which is a real differentiator in an index where privacy and deliverability primitives are routinely sold as upgrades. Dedicated addresses and private pools isolate a large sender's reputation. An automated list hygiene campaign re engages ageing contacts and quarantines dead ones so they cannot damage reputation.

The five factors of the reputation chain are named and explained, and the page distinguishes delivery from deliverability precisely where most vendors conflate them. Off the top band because no complaint rate threshold, warmup ramp, bounce handling policy, volume governance or one click unsubscribe header commitment is published, and the marketing carries an industry leading delivery rate claim with no figure behind it.

More segmentation than almost anything at this scale attempts. Six buyer roles each carry their own page, covering owners, marketing, sales, operations, developers and support. Two company stage bands each carry a page, one for startups and small businesses and one for mid sized businesses, with the latter branching into high volume sending, priority support, delivered services and platform scale.

Nine industries each carry a page, including public sector, nonprofit, healthcare, financial services and education. A nonprofit programme publishes both its qualification requirement and its discount schedule. Independent listing data agrees on the centre of gravity, placing roughly ninety five percent of reviews in the small business band across more than two hundred reviews.

Off the top band because no customer count, seat band, region, country coverage or language coverage appears anywhere, and there is no statement of who this is wrong for, which sits awkwardly beside an active push toward mid sized enterprise at a platform carrying no federated sign on and no independent security audit.