RightBound

The model does the work that defines the product rather than decorating it. Sourcing decides which people inside a target account match a persona, matching resolves an incomplete record to the right company and the right human, and discovery generates look alike accounts from an existing customer set. Those are inference tasks, not a rules engine wearing a label, and the vendor describes an aggregation layer it calls a data waterfall that arbitrates between more than thirty upstream sources to pick a winning value per field. Arbitration across conflicting sources is the hard part of contact data and it is where the intelligence has to live.

An independent party paid for that judgement. Gong acquired the company and its stated reason was the team's expertise in aggregating, synthesising and verifying complex data and signals from dozens of third party sources, which it folded into the data layer beneath its own platform. An acquirer buying the capability specifically is stronger evidence of centrality than any product page, because it is a priced decision rather than a claim.

What holds this off the top of the band is that the vendor never says what is learned and what is coded. No description of the arbitration method, no statement of which functions are machine learned, no model or provider named anywhere. Ask which decisions in the waterfall are model driven, what the model was trained on, and what happens to the ranking when two paid sources disagree on a mobile number.

The autonomy claim is explicit and unhedged. The middle tier is sold on the line that list building stops entirely, the system sources new prospects on its own and learns from past activity and closed opportunities sitting in the customer's own system of record. The top tier adds autonomous prospect sourcing with intent and account scoring and look alike accounts. This is a system that decides who enters a sales sequence without a human choosing each name.

Oversight appears as a named, tiered control rather than a reassurance, which is the reason this clears the bottom of the band. Administrator controlled rules and assignment sit in the middle tier and revenue operations rules in the top, and the routing decision, which sequence in Outreach or Salesloft a sourced prospect lands in, is governed by those rules rather than by the model alone. A named control that a buyer pays for is a real artefact.

What is missing is the shape of the human checkpoint. Nothing describes whether a sourced contact can be held for approval before it enters a sequence, whether a rule can block a segment outright, what audit trail records why a person was selected, or what recourse exists when the system sources someone who should never have been contacted. For an autonomous sourcing product the last question is the one that carries risk. Ask whether prospects can be staged for review before sequence entry, and what log shows the reason a given contact was selected.

Artificial intelligence is named on nearly every surface as the mechanism and described on none of them. Across the home page, the pricing page, the about page and the privacy policy, retrieved in full, there is no model card, no architecture description, no statement of which functions are machine learned rather than rule based, no model provider or foundation model named, no version identifier, and no evaluation methodology.

The single quantified performance claim reaches the buyer through the wrong channel. The 90 percent email and phone accuracy figure appears as a customer testimonial rather than a vendor methodology statement. That placement matters beyond presentation: a number the vendor states in its own voice is a representation it can be held to, while the same number in a customer's mouth is an anecdote the vendor has not underwritten. Buyers routinely read the two as equivalent and they are not.

A generative prospecting capability is promoted with its own video, which raises the disclosure obligation rather than lowering it, because generated text carries a failure mode that verified data does not. Ask which model generates outreach content, whether customer data reaches it, and for the accuracy measurement stated by the vendor in writing rather than quoted from a customer.

The outcome claims carry names, which is worth more than the anonymised norm in this lane. Three are attributed to a named individual with a title and an employer: 90 percent email and phone accuracy from a vice president of outbound strategy, a 3x increase in meetings booked stated as a direct comparison against Apollo and other data providers from a head of business development, and 30 percent of representative time saved while a team scaled from four to eighteen from a business development manager. A fourth names a director of global sales development at Moveworks describing a connect rate above 15 percent sustained across three years. Naming the comparator in the 3x claim is unusual and puts a checkable assertion on the record.

The method behind every number is absent. No baseline period, no cohort size, no definition of a booked meeting or an accurate contact, no statement of who measured. These are curated testimonials, and a testimonial selected by the vendor from its own customer base carries survivorship bias that no amount of attribution removes.

The independent base is thin. Twenty one reviews on the main enterprise review site, a smaller count elsewhere, and no analyst evaluation, no benchmark participation and no published study were located across two retrieval passes. Ask for the measurement window and the denominator behind the accuracy figure, and for a reference in your own segment rather than a quotation.

This axis is squarely applicable, because the product's entire output is human beings loaded into a sequencer for contact they did not request, including mobile numbers.

One real act sits on the record. The vendor appointed VeraSafe as its representative in the European Union under Article 27 of the General Data Protection Regulation, named in the privacy policy with a full Cork address and a telephone number. Appointing and publishing a representative is a filing with a cost attached, not a badge, and it is the strongest compliance artefact the company published.

Everything downstream of it is absent. Two dedicated retrieval passes located no discussion of the United States telephone consumer protection regime, no do not call list screening, no commercial email statute, no suppression list handling, no honouring of an opt out across the sourced contact base, and no statement of the lawful basis on which a sourced prospect is contacted. The mobile phone product sharpens this: a human verified mobile number routed into an outbound cadence is the highest exposure output in this category, and it is sold by the credit with no screening commitment attached to it.

Ask whether sourced numbers are screened against national do not call registries before delivery, how an opt out recorded in your system propagates back, and what contractual indemnity covers a claim arising from a contact the vendor supplied.

The privacy policy was retrieved in full and the finding is what it does not govern. It covers website visitors, inquiry contacts, marketing event attendees, platform users and business partners, each with a stated purpose, recipient list and retention period laid out in a table. The people whose personal data constitutes the product, the sourced prospects whose names, work emails and mobile numbers are sold by the credit, appear nowhere in it. A prospect in the database has no described lawful basis, no notice, no retention period and no rights route in the only privacy document the company publishes. For a contact data vendor that is not a gap at the edge of the policy, it is the centre of the business sitting outside the policy.

One defect is dated and checkable. The policy states that data is stored on Amazon Web Services in North Virginia subject to the Privacy Shield of that provider. The European Union framework of that name was invalidated in July 2020, and the policy carries a stated update date of 1 April 2024, so an invalidated transfer mechanism was cited as current nearly four years after it fell. A company that appointed an Article 27 representative also left an invalid transfer basis in the same document.

The California do not sell route is a public form hosted on a third party document service rather than an authenticated request path. Ask for the prospect facing privacy notice and the lawful basis relied on for the sourced contact database.

Provenance is reduced to a count. The vendor's central claim is more than thirty B2B data sources feeding an arbitration layer, and the count is the entire disclosure. One upstream is named anywhere on the published surface: PhoneReadyLeads, credited for human verified telephone numbers requested as a premium credit tier. One named source out of thirty plus is a real partial and it is why this does not sit lower, because a named upstream can at least be diligenced.

The remainder is the buyer's problem to inherit blind. Which aggregators, which scrapers, which co operative contribution networks, which licences permit resale, which permit only internal use, and whether any upstream carries a restriction that follows the record into the customer's own system of record. A contact that arrives in your instance under a licence you cannot see is a liability you have accepted without reading.

No licence terms, no redistribution rights statement, no representation of the vendor's right to supply, and no indemnity were located across two passes. The acquisition raises rather than settles the question, because upstream data agreements do not automatically survive a change of control and the counterparty is now a different company. Ask for the source list under a confidentiality agreement, for the redistribution warranty in the contract, and for the indemnity that answers an upstream licence claim.

The favourable finding here is a structural absence and it should be stated plainly rather than assumed. Two retrieval passes across the vendor's own surfaces located no browser extension, no scraping utility, no social network export tool and no product that lifts a search result into a file. That is the usual locus of exposure in this category and several records in this lane are held lower for exactly such a surface. The architecture instead routes through licensed aggregation and writes into systems the customer already owns, which is the lower risk design.

What keeps this mid band is an undescribed boundary. A third party review site records an integration with a professional network's sales navigator product alongside the customer relationship and sequencing integrations, and the vendor never describes what crosses it. An integration with that platform can mean reading a saved account list through a sanctioned route or it can mean something the platform's terms forbid, and the two are indistinguishable from a logo in a list. The vendor's own integration page names only the two customer relationship management systems, so the wider claim is a third party assertion the vendor has not confirmed.

Ask what data moves across the sales navigator boundary, in which direction, and under which of that platform's programmes.

The stewardship burden here is unusually heavy, because the company holds personal data on people who never became its customers and runs models over its customers' commercial history to decide who gets approached.

The published position is a single paragraph. The privacy policy states that appropriate technical, organisational and security measures have been implemented, then immediately disclaims any guarantee against compromise of the servers. Boilerplate followed by a disclaimer is the weakest form this axis takes.

The central unanswered question is created by the vendor's own strongest feature claim. The product is sold on learning from past activity and closed opportunities inside the customer's system of record, and nothing states whether that learning is confined to the tenant it came from or pooled across the customer base. Those two architectures have opposite consequences: one improves your results using your history, the other exports your closed won pattern into a model that also serves your competitor. A buyer cannot tell which they are purchasing.

No acceptable use policy, no tenant isolation statement, no training data commitment, no responsible disclosure route, no published incident history, and no named security contact were located across two passes. Ask in writing whether customer opportunity data trains models serving other tenants, and require the answer in the agreement rather than in a call.

Part of this axis genuinely sits downstream of the record and that is stated in the vendor's favour: sequences execute in Outreach or Salesloft, so sender identity, signature and footer are configured in another vendor's product and the disclosure decision belongs to the customer.

The rest of it does not sit downstream, because the vendor generates the content. Generative prospecting is promoted with a dedicated product video, and the platform is described as customising the communication track of each prospect across channel, content, timing and frequency. Where a system composes the message a person receives, whether that person is told a machine wrote it is a question for the composer and not only for the sender.

Nothing on any retrieved surface addresses it. No position on disclosing automated authorship, no policy on writing in the voice of a named representative, no guidance to customers on where disclosure is required, and no constraint on generating claims about a prospect's employer that the model inferred rather than verified. The last is the sharpest risk in generated outbound: personalisation drawn from an inference reads as research and lands as a false statement about the recipient's own company.

Ask whether generated copy can be reviewed before send, and what prevents the generator asserting an unverified fact about the recipient.

The integration story is described as behaviour rather than displayed as a logo wall, which is the distinction this axis exists to reward. Two way synchronisation with HubSpot and Salesforce is named at a specific price tier rather than in general marketing. Prospects are assigned into the correct Outreach or Salesloft sequence under administrator controlled rules, so the handoff carries routing logic and not merely a record push. The refresh module operates on records the customer already holds, verifying whether a contact is still in the stated role and completing missing fields in place.

That last capability is the strongest part. Writing corrections back into the buyer's system of record is a harder and more valuable integration than reading from it, because it requires field level mapping, conflict handling and write permissions in production, and it improves assets the customer owns rather than only the vendor's output. A dedicated integrations page and a distinct agency motion with its own page indicate the surface was built for more than one deployment pattern.

The ceiling is developer surface. No public application programming interface documentation, no self serve credentials, no webhook description and no marketplace listing were located across two passes, so anything outside the four named systems requires the vendor. A third party review site records connections to a wider set including a chat platform, an email client and a rival data provider, and the vendor confirms none of them. Ask whether an interface exists for systems outside the named four, and which fields the refresh module is permitted to overwrite.

The vendor states its storage location with a precision most records in this lane never reach: Amazon Web Services, North Virginia, United States. Naming the region rather than gesturing at a cloud is a genuine disclosure and it is credited here.

It is also the entire posture. One region, one country, no European or other regional option described, no single tenant deployment, no private cloud, no customer managed encryption key, and no data processing addendum, subprocessor list or transfer mechanism published beyond the invalidated framework cited in the privacy policy.

The combination is the finding rather than any single element. This company sourced and sold personal data on European data subjects, took the trouble to appoint a representative in the European Union under Article 27, and stored the resulting personal data in a single United States region with no residency alternative and a transfer basis that had been struck down four years before the policy's own stated update date. A buyer subject to European supervision inherits that arrangement whole, and the invalid citation means the vendor's published answer to the transfer question is worse than silence, because silence at least does not misstate the position.

Ask whether any European hosting option existed, and for the current subprocessor list and transfer mechanism from the acquiring entity.

Three credentials are claimed and not one of them clears the test this index applies, which requires a verb and a scope boundary before a certification counts. The pricing page carries a bare feature bullet reading GDPR, SOC2, ISO 27701. The home page shows three badge images under a privacy and security heading. Neither surface states who audited, over what period, against which trust services criteria, or covering which systems.

The two surfaces also contradict each other, and the contradiction is substantive rather than cosmetic. The home page badge asset is named for ISO 27001, the information security management standard, while the pricing page text says ISO 27701, the privacy extension that sits on top of it. These are different certifications with different scopes and a buyer cannot determine from the vendor which is actually held. A company that holds a credential does not usually misname it on its own price list.

One detail runs the other way and is credited: the badge asset carries a Type 2 designation, which is a period of operating effectiveness rather than a point in time snapshot, and that is the more demanding form.

No trust centre, no auditor name, no report period, no bridge letter and no request route were located across two passes. Ask for the report itself with its scope section, and for clarification of which ISO standard is certified.

This is the vendor's strongest axis by a wide margin and it earns the top band on published specifics rather than on tone. Three tiers carry exact figures: 600 dollars per month billed annually at entry, 1000 dollars per month at the middle tier including two users and 150,000 credits per year, and 2800 dollars per month at the top including up to eight users and 600,000 credits per year. The incremental user price is published at 99 dollars per month. The entry tier states 12,000 credits per month.

The consumption table is what lifts this above a published price list. The vendor defines what a credit buys, at one credit for a verified contact rising to nine credits for a record including up to two mobile numbers and a direct line. In a metered category the unit definition is the price, because a headline figure without it is unmodellable, and most vendors in this lane publish neither. A buyer could estimate annual cost for a named team size before speaking to anyone, which is the outcome this axis measures.

The gaps are real but secondary: implementation fees are not addressed, no overage rate is published for exhausted credits, no contract term or auto renewal language appears, and one row of the credit table carries a figure without its label on the retrieved page.

The figures are historical and the site is frozen, which is recorded against the pricing record rather than discounted here. A vendor that published its unit economics is not marked down because the business later changed hands.

Two passes across every retrieved surface located no export format, no bulk retrieval route, no termination assistance period, no notice provision and no statement of what happens to sourced records in the customer's own systems when the agreement ends.

The only termination adjacent language points the wrong way. The privacy policy commits to retaining customer business contact and financial details for seven years following termination for tax purposes. That is a retention floor on the vendor's side, which is the opposite of a portability right on the buyer's side, and publishing the former while omitting the latter describes the asymmetry precisely.

Circumstance converts this from a theoretical gap into an active one, and the conversion is the finding. The company has been absorbed, the product is no longer sold under its own name, the marketing site is frozen at a 2024 copyright and it serves a noindex directive that removes it from search results. A customer who needs to extract their sourced contact history now faces a vendor that has stopped presenting itself to the market, and the ordinary first move of searching for a support or documentation page fails by design.

The privacy policy does contemplate transfer of personal data on acquisition, so the legal path for the data existed. The operational path for the customer did not. Ask the acquiring entity for the retrieval route and the retention period applying to migrated records.

Sending mechanics sit largely outside this record, since cadences execute in Outreach or Salesloft, and domain warm up, throttling and authentication are configured there. That scoping is stated in the vendor's favour rather than held against it.

What remains inside the record is the input side, and for a contact data supplier that is the part that governs whether the customer's sending domain survives. Every address this vendor delivers is an address a sequencer will attempt, so verification quality is a deliverability control even though the vendor never sends anything. The vendor claims contact verification and job change alerting, both real controls, and the tiering separates a merely verified contact from a human verified telephone number, which shows the company understood that verification has grades.

The quantification cuts against it. The accuracy figure carried anywhere on the site is 90 percent, and it comes from a customer rather than the vendor. Ten percent of a delivered list failing is a bounce rate that will damage a sending domain within a single campaign at volume, and the vendor publishes no bounce rate of its own, no verification method, no catch all domain policy, no statement of whether an address that fails verification is withheld or delivered flagged, and no credit refund for an undeliverable record.

Ask what bounce rate the vendor stands behind contractually, and whether failed verifications are suppressed or shipped.

Two independent review platforms describe the installed base and they disagree, which is itself the most useful signal available. One places 83 percent of reviewers in small business against 17 percent in midsize, concentrated in computer software at 42 percent and marketing and advertising at 33 percent with financial services at 8 percent. The other reports mid market at 65 percent of its reviews. Both cannot be right about the centre of gravity, and the discrepancy is best explained by review bases too small to be stable, roughly twenty one reviews on one platform. A buyer should treat either figure as indicative rather than as a distribution.

One segment is served deliberately and stated by the vendor: agencies, with a dedicated page and a distinct motion. An agency running outbound for many clients is a genuinely different buyer from an in house team, and building for it is a positioning choice rather than an accident of who signed up. Named reference customers skew to technology, including an enterprise software vendor cited on a three year relationship.

The absence that matters most is coverage itself. For a data vendor, which geographies and industries the database actually covers is the product question, and no total contact count, no regional breakdown, no industry coverage statement and no international versus United States split were located across two passes. Ask for coverage and accuracy broken out for your specific territory and job titles, not the blended figure.