Proposify

A document product of long standing with a generator bolted on the side. The platform has been sold since 2013 as proposal creation, and everything that makes it work is deterministic: a template renders, a content library block is inserted, a quote table computes from quantities and optional extras, a variable is replaced with a value pulled from the connected customer record, an approval condition fires on deal size or discount size. Remove every model and all of that continues.

The model layer is a separate marketing surface, a proposal generator sold as its own capability and an automation description that lists templates, artificial intelligence and collaboration as three items in a list, which is the shape of an accessory rather than a foundation. The vendor's own argument for itself supports the reading: the reasons it gives a buyer are speed, brand consistency and stopping representatives sending the wrong price, none of which is a model claim. Ask which capabilities stop working without the generator, and what the generator is used for in a typical document.

Five named controls over what leaves the building, and one of them is specific in a way that is rare. Approval workflows are described as conditions that trigger a manager approval when met, with deal size and discount size named as the triggers, which is a concrete rule rather than a general promise of governance.

Around it sit content locking so that important elements cannot be edited by a representative, standardised pre approved content so the default is the approved version, roles and permissions that constrain what each user can do, and workspaces that give multi unit businesses separate instances an administrator manages.

Collaborator seats are a sixth and subtler control: they admit a person who can edit or approve a document but cannot create or send one, which is the right shape for a client or an internal reviewer. For a product whose failure mode is a representative sending the wrong price to a prospect, these are the controls that matter and the vendor has built them. Held below the top band because the newer capability is uncovered.

A proposal generator produces document content, and nothing published states whether generated content passes through the same approval conditions, whether it can populate a locked element, or what a person reviews before it reaches a prospect. Ask whether generated content is subject to approval workflows and content locking.

Two dedicated surfaces exist for the subject and neither was reachable on this pass. The vendor publishes a proposal generator as a named product page and a separate page addressed to artificial intelligence assistants, both linked from the main navigation, so material almost certainly exists behind them. Neither was retrieved here, and that is a limit on this pass rather than a finding that nothing is published.

What could be established from the pages read is only that the workflow automation description lists artificial intelligence among templates and collaboration tools. No model provider, family or version is named, no model card was found, and no accuracy, quality or evaluation figure appears for generated document content.

The question matters more than it would for generated marketing copy, because the output here becomes the commercial terms of a document a prospect may sign, and an error in a generated price or scope is a contractual problem rather than an embarrassing one. Ask which model generates document content, what evaluation covers it before a representative sends it, and what the artificial intelligence information page states.

Three headline performance figures, a precise customer count, and no method behind any of it. The vendor states that its customers close at twice the industry average, that the average document is built in seventeen minutes or less, and that forty three percent of documents sent are won within twenty four hours of being opened.

The third is the most interesting because it is the kind of figure a platform genuinely can compute from its own data, and the vendor separately publishes an annual report built from exactly that dataset. Neither the population, the period, the definition of a win, nor the source of the industry average is stated for any of the three. The customer count of 8,976 is unusually precise and is a count rather than an outcome.

Named case studies exist and carry real figures, including a two hundred percent revenue increase at one customer and a franchise operator running fifty nine locations, and those at least identify the company. Set against them, the testimonials on the main page use first names and initials with job titles and no company, which is the weakest attribution on the site. Ask whether the three headline figures come from the vendor's own published dataset, what population and period they cover, and what counts as a win.

The recipients are counterparties in an active deal, so most of this axis applies by scope rather than in substance, and the grade records that rather than a shortfall. Documents go to a named prospect the customer is already selling to, and the correspondence around them is a notification that a document is ready or has been viewed.

There is no campaign capability, no sequence, no contact database and no bulk dispatch visible anywhere in the product, so the volume patterns that make this axis bite do not arise. What is not published is the small amount that would still apply: nothing states what notification correspondence a prospect receives and whether they can stop it, what sender identity appears on a document delivered through a customer's own mapped domain, or which obligations the vendor considers to transfer to the customer. Ask what correspondence a prospect receives automatically and whether they can decline it.

A privacy policy and terms are published and nothing beyond them was reached on this pass. No processing agreement, subprocessor list, retention period, transfer mechanism or data protection contact was located on the pages read, and a dedicated security page exists in the navigation that was not retrieved, so material may sit behind it.

The corpus is worth stating plainly because it is more sensitive than the product's positioning suggests: executed agreements, the commercial terms and pricing inside them, the identity and contact details of the people who signed, and behavioural analytics recording which sections a named prospect read and for how long. That last one is unusual.

Section by section reading analytics on an identified individual is a form of behavioural tracking that the recipient is unlikely to expect from a document, and nothing published addresses what is retained about them or for how long. One further point applies to this vendor specifically: it operates from Canada, so its home privacy regime is not the one most of its published material would be written against, and nothing addressing it was found. Ask for the processing agreement and subprocessor list, the retention period for documents and reading analytics, and what a document recipient is told about being tracked.

Very little third party data enters this product and the grade records the scope. The vendor supplies no contact database, no firmographic data, no intent signal and no enrichment. Content in a document comes from the customer's own template library, their own pricing, and variables pulled from their own connected customer record system, so there is no purchased corpus whose origin a buyer needs to trace.

That is a favourable position and it removes most of what this axis exists to capture. Two smaller questions are open rather than absent. The vendor publishes a large library of ready made templates organised by trade, and nothing states who authored them, whether any professional review sits behind the commercial or contractual language in them, or what a customer is relying on when they send one as the basis of a binding agreement.

And the generator produces document text whose training basis is undescribed. For a product whose output is a signed commitment, the provenance of the words matters in a way it would not for a marketing asset. Ask who writes and reviews the template library, and what the generator draws on.

Every route into and out of this product runs through a sanctioned interface. Named connections cover four customer record platforms, a conversation intelligence product, a video platform, a payment processor, a messaging product, an automation service and a field service management system, and the connection to the largest record platform is delivered as a managed package, which is that platform's own reviewed distribution mechanism rather than an arrangement the vendor built unilaterally.

On its own side the vendor publishes developer documentation on a dedicated subdomain, so other software builds on it through a documented route as well. Nothing scrapes a professional network, no browser extension pulls data off one, and no social automation exists anywhere in the product, so the exposures that most often surface on this axis do not arise at all.

Held below the top band because no conformance position is stated in the vendor's own words for any connected platform, and nothing describes what happens to a deployment if a platform changes its interface terms or withdraws a connector. Ask for the stated position on each connected platform and what the contingency is if a connector is withdrawn.

Proposify's terms of service, last updated 15 October 2025, say it does not use customer data, including user inputs, activity and content, to train, refine or improve its AI models; its AI systems run on a non learning basis with respect to customer data, and data an AI feature processes serves only the immediate request and is not kept for model development.

The AI writing widget, the AI proposal generator and the MCP server are optional, nothing is processed by a feature a customer does not use, and the customer remains owner of its inputs. The terms do not name the providers that process prompts, how long prompts and generated text are kept, or when documents and signature records are deleted after a subscription ends.

The recipient expects the document and is watched while reading it. Documents reach a named prospect in an active deal, electronic signatures are offered on every plan and described as legally binding, and no agent, persona or synthetic voice exists anywhere in the product, so the impersonation questions that dominate this axis elsewhere do not arise.

What is thin is identity assurance on the signature itself: no signature certificate, knowledge based authentication, identity verification step or qualified signature standard was located on the pages read, so what proves the signer is who they claim could not be established. The disclosure gap runs the other way.

The vendor markets detailed engagement analytics that report when a prospect opened a document and how long they spent on each section, and a customer is encouraged to tailor follow up on that basis. Nothing published states whether the person reading is told their reading is being measured at that granularity. A generator also drafts document content and nothing indicates whether any part of an agreement is marked as machine written. Ask what verifies a signer's identity, what a recipient is told about section level reading analytics, and whether generated content is disclosed.

Build includes integrations and automations, AI and an MCP server for creating and updating documents from AI tools, Grow adds API access with developer documentation on its own subdomain, and Scale adds premium integrations. Named integrations span four CRMs, with a managed package for Salesforce, plus conversation intelligence, video, payments, messaging, an automation service and a field service management system, collected in a separate integration library, and a public status page reports availability.

The comparison table names the Salesforce managed package and Aspire as the premium integrations and marks them as an add on purchase, and an older table lower on the same page prices each at $9 a user a month.

Nothing on hosting, region, tenancy or recovery was reached on the pages read, and a dedicated security page exists that was not retrieved, so this records the limit of the pass rather than a finding of absence. What can be said is that the question is live for this vendor's own buyers in a way the marketing does not acknowledge.

The company operates from Canada, several of its named target industries are locally regulated trades, and a Canadian buyer with a residency obligation has nothing published to answer it with, in either direction. Nor does a buyer elsewhere know whether documents are held in one jurisdiction or several. The material at stake is executed agreements and the commercial terms inside them, which organisations routinely need to produce years later and often need to keep within a jurisdiction.

A public status page exists and reports availability, which is the one operational commitment visible. Ask which provider and regions host documents and signature records, whether any regional option exists, and what the recovery objectives are.

Proposify states SOC 2 Type 2 certification against the AICPA trust services criteria for security, availability and confidentiality, names 360 Advanced, Inc. as the independent audit firm, and shares the report on request through its privacy address.

The security page adds hosting on Amazon Web Services with all customer data stored in Northern Virginia, a virtual private cloud, nightly off site backups tested monthly, encrypted transport on every application and API endpoint, one way password hashing, two factor access for staff to the hosting provider, 99.9% uptime and a public status page. Card payments run through Stripe, and signed documents are locked against change with the signer's IP address and time recorded. There is no self service trust center and no audit period on the page, penetration testing is not mentioned, and security reports go to the support address.

Proposify publishes every plan: Build at $35 per user a month on annual billing, $49 monthly or $147 a quarter; Grow at $3,900 a year with 5 users; Scale at $12,800 a year with 10 users; extra users on Grow and Scale at $780 a year; custom template design at $1,500 and a launch kit at $2,000; and a 14 day trial with no card. Custom pricing is offered for high volume accounts.

The page contradicts itself on sending: Build lists unlimited documents and signatures, and a table lower down still sets monthly send limits of 10, 30 and 75 with overage charges for plans named Basic, Team and Business.

Two export mechanisms on every plan, and nothing about the assets that would actually be hard to replace. Document export to a portable format is available on all three tiers and is described as matching the digital version, and reporting is described as a full exportable table of all documents with filtering, so a customer can retrieve both their agreements and an index of them at any point without asking.

Offering both at the entry tier rather than reserving them for larger buyers is worth crediting. What is not addressed is everything that makes leaving expensive. A mature deployment is a template library, a content library of reusable approved sections, custom fields and variables, approval conditions and brand configuration, all built over time, and nothing published states whether any of it exports or in what form.

Nothing covers post termination access, how long documents remain retrievable after a subscription ends, or any deletion timeline, which matters for signature records a business may be required to keep for years. Ask whether templates and the content library export, what happens to documents and signature records after termination, and for how long they remain accessible.

The product delivers documents and notifications by electronic mail on every plan and publishes nothing about how. A document that reaches a spam folder is a deal that stalls for a reason the customer will attribute to the prospect rather than to their tooling, so the mechanics matter even at low volume.

Nothing published describes which infrastructure sends, whether correspondence leaves from vendor domains or the customer's own, what bounce or complaint handling applies, or whether any delivery failure is surfaced to the sender.

One published capability sharpens the question rather than answering it: custom domain mapping lets documents be served from the customer's own subdomain so the vendor's name does not appear in the address, and nothing states whether that extends to the correspondence, who configures the sender authentication records if it does, or what happens to delivery when it is misconfigured.

Volume is low and the correspondence is transactional, which keeps the exposure smaller than it would be for a campaign product. Ask which infrastructure delivers documents and notifications, whether custom domains extend to correspondence, and who configures authentication.

Proposify names its industries as consulting and professional services, landscaping, cleaning and janitorial services and construction, organizes its template library by trade, and connects to field service management software. Plans run from a single Build seat to Grow with 5 users and Scale with 10, so a solo operator and a mid sized team both have a published route in. Customer stories include a franchise operator running 59 locations. The countries and languages it serves are not stated.