Säljmotorn

Brage is real, named, included everywhere and still not the engine.

The assistant is described as a personal sales manager whose purpose is to get the user to their target. He analyses the flow, prioritises the next step, helps draft personalised outreach and answers questions about the pipeline. He is present in every plan including the three day free trial, carries a dedicated page, and appears as the illustrated mascot on almost every surface of the site.

Marketing prominence runs well ahead of functional centrality, and the vendor's own sentence is the giveaway: Brage provides support at every step. The steps themselves are a company search over Swedish register data, sequences with configurable timing and conditions, a shared inbox, needs analysis, quoting and electronic signature. Strip the assistant out and a working platform remains. Strip out the Swedish company data and nothing works at all.

The honest reading is a competent workflow suite with a well integrated assistant layer on top, which is a defensible design and is described without inflation. The vendor does not claim autonomous agents, does not claim the model finds the prospects, and does not attribute the platform's results to inference.

Ask what Brage decides versus what he suggests, and whether any step proceeds on his output alone.

The human configures and the assistant advises, with a real usage ceiling on the model.

Sequences are built by the user, who sets the timing, the messaging and the conditions that govern branching across email and telephone. Brage analyses and prioritises rather than acting: the vendor describes him helping draft outreach and answering questions about the pipeline, never sending on his own initiative. The assistant carries daily usage caps, which is an actual quantified control rather than a policy sentence, though the cap itself is not published as a figure.

Team oversight is described concretely on the top plan: a shared workspace, shared lists and campaigns, role based collaboration, and a consolidated view of team activity and performance for the sales manager. Mailbox connections use delegated authorisation rather than shared credentials, and the vendor states plainly that it never sees the user's password.

The eIDAS signing flow carries a complete audit log, which is the one place where an audit trail is explicitly described.

What is missing sits on the sending side. Two passes located no approval step before a campaign goes live, no review of what a sequence actually sent, and no described audit trail covering outbound messages, which is the surface where an error reaches a stranger rather than a colleague.

Ask whether a campaign can be gated on approval before its first send, and what the send log records.

The model provider is named outright, on a dedicated page, alongside the legal mechanism governing the transfer.

The vendor states that Brage runs on Claude from Anthropic, and does so in the same place it names every other supplier the platform stands on rather than burying it in a footnote. Two further specifics accompany the naming: daily usage caps on the assistant, and contracted standard contractual clause handling for the data transfer, which is the instrument that actually governs sending European personal data to a provider outside the union.

That combination is the most complete artificial intelligence disclosure recorded in this index. Across nearly two hundred vendors, naming the provider at all is rare. Naming the provider, stating that transfers are covered by a specific legal mechanism, and publishing a usage constraint has no precedent here. A buyer can reason about where their input travels, under whose terms it is processed, and what contractual protection applies, before creating an account.

Three things are still absent and a careful buyer will want them. No model version is given, so the disclosure does not survive a silent upgrade. No statement describes what content is transmitted, so whether a prospect's details reach the provider or only the user's own text is unanswered. And no retention or training commitment appears from either party.

Ask which customer content reaches the provider, and whether any of it is retained.

The published measurement is the best of its kind in this index, and it is the only evidence there is.

The vendor maintains a page reporting a 6.6 percent reply rate across 5,504 cold business to business sends made by its customers between 8 June and 28 July 2026. What raises this above every comparable claim graded here is the apparatus around the number. The definition is stated: the share of sends receiving at least one reply in the inbox, counted once per unique recipient regardless of how many messages in the sequence went out. The sample is characterised as real commercial campaigns rather than test sends. The aggregation is described, with a statement that no individual customer, campaign or recipient is identifiable. Bounces are defined, separating hard failures from temporary ones. Segmentation is published: 25 percent of replies arrived only after a follow up, 46 percent of sends received a second message and 16 percent a third, and hard bounces ran at 2.1 percent. The vendor invites citation with attribution and commits to restating the measurement window on update.

The number itself is modest, which is the strongest signal available that it was not selected.

What holds this out of the top band is that it is entirely self measured and self published. Two passes located no meaningful independent review base, no named customer and no case study. A buyer has an unusually well documented claim and no outside party attesting to any of it.

Ask whether the underlying send data has ever been examined by anyone outside the company.

Compliance is described by naming the specific instruments rather than by claiming the outcome.

Every send carries one click unsubscribe implemented to RFC 8058, cited by number. The vendor states it meets the 2024 bulk sender requirements introduced by Gmail and Yahoo, covering authentication, unsubscribe and spam rate thresholds. Recipient addresses are verified before entering the send queue. A data processing agreement is executed with every customer rather than offered on request, and standard contractual clauses cover suppliers outside the European Union.

A dedicated page sets out the reasoning rather than the badge. It states that processing requires a legal basis and a defined purpose, that the platform is built for focused prospecting rather than broad uncontrolled mass handling of personal data, that data minimisation means teams work only with data relevant to their process, and that data subjects hold rights of access, rectification, restriction, objection and in some cases erasure.

The closing paragraph is what earns the top band. The vendor states outright that it does not guarantee that using the platform makes any customer compliant, that the customer always controls why and how their sales data is used, and that the vendor acts as processor and supplies the structure. Declining to sell compliance as a feature is the rarest thing on this page.

Telephone is the gap. Sequences dial, and two passes located nothing on calling hours, register screening or call recording consent.

Ask what governs the calling steps in a sequence, and whether calls are recorded.

The structural commitments are strong and the specifics a privacy review would request are not published.

What is committed: a processing agreement with every customer, standard contractual clauses covering suppliers outside the union, production data stored in Sweden, transport encryption throughout, and credentials and tokens held under field level encryption. The role split is stated clearly, with the customer controlling their lists, campaigns and legal basis while the vendor processes on documented instruction. Suppliers are named individually with the function each performs, which is materially better than the industry habit of referring to trusted partners.

A separate page addresses data subject rights and states that the vendor helps customers handle such requests in a structured way, and that it documents which categories of data are processed, why, and how long they are kept.

That last clause is where the record thins. The page says retention is documented; it does not say what the periods are. Two passes located no retention schedule, no stated period for prospect records after a campaign ends, no deletion timeline after cancellation, and no formal supplier register with locations and roles, the naming being marketing copy rather than a controlled document.

The legal basis for holding decision maker contact details before any relationship exists is discussed in principle and never named.

Ask for the retention periods and the stated legal basis for the prospect data supplied with the platform.

The company data has a stated lawful origin, and the person level data does not.

The vendor states that its business data comes from official Swedish registers, describing it as current, lawful and complete, and covers a stated 1.7 million Swedish companies filterable by industry, size and geography. Verification of email addresses is attributed to a named supplier, Bouncer, running before an address enters the send queue. The data is included in every plan with an explicit statement that no separate charge applies for a data service or for exporting lists.

Sourcing from a public register is a genuinely different position from the norm in this category, where a database of tens or hundreds of millions of records appears with no origin disclosed at all. A register has a legal basis for existing, a known publisher and a public mandate.

The gap sits precisely where the regulation bites. The registers are named as a class rather than individually, so a buyer cannot check which one. And the platform markets embedded Swedish decision maker data, meaning named individuals in roles, which is personal data whose source is never stated. Company registers carry some officer records and do not generally carry the working contact details of a sales prospect.

Ask which registers specifically, and where the decision maker records and their addresses come from.

Every platform relationship is a commercial one the vendor is authorised to hold, and several are independently verifiable.

The vendor holds Microsoft cloud solution provider indirect reseller status with verified standing in Microsoft Partner Center, and distributes Microsoft 365 licences through Pax8, whose regional sales director for the Nordics is quoted by name confirming the partnership. Mailboxes on both Microsoft 365 and Google Workspace connect by delegated authorisation, with the vendor stating explicitly that it never sees the user's password. Domains are registered through Loopia, one of Sweden's largest registrars. Payments run through Stripe. The model runs on a named provider under contracted transfer terms. Hosting is a named region of a named cloud.

Two passes located no scraping, no browser extension operating a site the vendor does not own, no social network automation, no unofficial interface use and no capability that depends on a platform failing to notice.

The treatment of the mailbox providers is the sharpest signal. Rather than working around the sender requirements Gmail and Yahoo imposed in 2024, the vendor builds to them and says so. A company that treats a platform's rules as a specification is not exposed to that platform changing its enforcement.

Concentration is the residual risk: the sending model depends on continued reseller standing and continued mailbox access.

Ask what happens to provisioned inboxes if the reseller relationship lapses.

The controls around the model are real and the questions about what it receives are unanswered.

On the stewardship side the record is solid. The provider is named, transfers are covered by standard contractual clauses, the assistant carries daily usage caps, production data sits in Sweden, traffic is encrypted in transit, and credentials and tokens are held under field level encryption rather than in the clear. Mailbox access is delegated rather than credential sharing. The vendor states it maintains routines for incidents, erasure and export.

A usage cap deserves specific credit. It is one of the few mechanisms that limits how much of a customer's data can flow to a model provider in a day, and almost no vendor in this index has one.

On the safety side the record is thin. Brage drafts outreach that goes to real people and prioritises what a seller does next, and two passes located no accuracy statement, no evaluation, no description of what happens when he is wrong, and no requirement that a human read a drafted message before it sends. Whether prompts or customer content are retained by the provider, and whether either party may use them for training, is unaddressed by both.

Routines are asserted rather than described, with no breach notification commitment and no security contact published.

Ask whether a Brage drafted message can reach a recipient without a human reading it.

The sender is a real authenticated identity and the recipient always has a way out.

Messages leave from the customer's own Microsoft 365 or Google Workspace mailbox connected by delegated authorisation, or from a domain the vendor registers and authenticates on the customer's behalf. Either way sender authentication records are configured and verified, so the receiving server can establish that the message came from who it claims. Every send carries one click unsubscribe to the published standard, which means a recipient can stop the contact in a single action rather than hunting for a link.

The assistant drafts, the human configures and the sequence sends under a named person's address. Nothing in the product adopts a persona, generates a fictitious sender or answers a reply automatically, and undetectability appears nowhere as a selling point, which distinguishes this record from several others built this week.

Two things keep it below the top band. There is no disclosure to the recipient that a message was drafted with model assistance, which is a defensible position and still an absence. And the option to send from a separate domain registered for outreach, while a recognised way to protect a primary domain's reputation, does mean the address a prospect sees may not be the company's main domain, and the vendor publishes no rule requiring that the sending domain be recognisably the customer's.

Ask whether a provisioned sending domain must resemble the customer's real one.

The integration surface is deliberately narrow, because the product is sold as the thing that replaces the stack.

The vendor states the position openly: instead of patching together a data service, a cold email tool, a warmup service, a booking tool and a quoting program, the buyer gets one connected flow where nothing is lost between systems. Judged against that intent the product delivers, since prospecting, sequencing, calling, inbox, needs analysis, quoting and electronic signature all sit in one place.

What exists outward is genuine but short. Microsoft 365 and Google Workspace connect for both mailbox and calendar under delegated authorisation. Stripe handles payment. That is the list.

Two passes located no documented interface, no authentication scheme, no webhooks, no automation platform connector, no model context protocol server and no connector to any customer relationship system. The last is the consequential one. A Swedish company running an established system of record has no described path for getting activity, opportunities or signed quotes out of this platform and into it, which turns the all in one promise into a second system of record rather than a replacement for the stack.

The absence is coherent with the strategy and it still constrains who can adopt the product without abandoning something.

Ask how activity and opportunity data reaches an existing system of record.

Residency is stated to the region, and the region is in the country the product is sold to.

The platform is multi tenant software as a service running in the Google Cloud Stockholm region, with the vendor stating that production data is stored in Sweden and all traffic is encrypted. Naming the cloud provider, the specific region and the resulting residency commitment in one sentence is a level of precision that a small number of records in this index reach, and the alignment matters commercially: a Swedish buyer with a domestic storage requirement gets an answer rather than an assurance.

The operating entity is identified with its Swedish company registration number and tax registration status, so the counterparty is a named domestic legal person rather than an offshore holding company.

Supporting detail is consistent. Credentials and tokens are field encrypted at rest. Payment card data never reaches the vendor's servers, handled instead by a processor certified at the highest level of the card industry standard. A system status indicator is published.

Two limits are worth recording. Data leaves Sweden for at least the assistant, which the vendor addresses through contractual transfer clauses rather than by keeping it in region, so the residency statement covers storage rather than all processing. And two passes located no statement on where backups are held or where failover would run.

Ask where backups are stored and whether processing can be kept in region.

The described practices are specific and the independent attestation is entirely borrowed.

What the vendor describes is concrete: transport layer encryption for all traffic, field level encryption using a named algorithm family for connection credentials and tokens, delegated authorisation rather than stored passwords for both supported mailbox providers, access control and authentication, and a published operational status indicator.

The certifications on the page belong to suppliers. The card industry certification at level one is Stripe's, earned by Stripe and relevant only to the payment path. The security posture of the Stockholm region is Google's. Neither says anything about how this vendor operates its own service, and the page's framing invites a reader to draw comfort from the chain without noticing that no link in it was audited for this company's controls.

Two passes located no audit of the vendor itself: no service organisation control report of either type, no international standard certification, no penetration test summary, no trust portal, no report request process, no vulnerability disclosure route and no named security contact.

A buyer running a supplier security review will find well chosen suppliers, sensible described practices and nothing they can verify. For a Swedish company selling to enterprises, an attestation is the ordinary next step.

Ask whether the company has been independently audited, and whether a report exists to request.

The prices are published, the terms are generous, and the one number that decides the purchase is missing.

Three tiers appear with exact figures in the local currency: 1,990 kronor monthly for the entry plan aimed at founders, consultants and small teams, 2,990 for the plan aimed at active sellers, and 1,490 per user monthly for the team plan with a stated minimum of ten users. A three day free trial covers the whole flow.

The surrounding terms are stated rather than implied. There is no minimum commitment, all plans run monthly, and upgrade, downgrade or cancellation can happen at any time with the change effective from the next period. Company data is included in every plan with an explicit statement that no separate charge applies. The vendor states outright that modules are not sold separately and that every feature appears in every plan.

That last statement creates the hole. If the tiers are identical in function and differ only in capacity, then capacity is the entire purchasing decision, and no capacity figure is published anywhere. Higher sending volume, support for more inboxes and increased outbound capacity are described in words with no numbers behind any of them, so a buyer cannot tell whether the entry plan covers their campaign or whether they will hit a ceiling in week two. A pricing page that names three prices and no limits has answered the easier question.

Domain provisioning appears as a pricing option with no figure attached.

Ask for the send volume, inbox count and contact limits on each tier.

Leaving is commercially easy and technically undescribed.

The commercial half is genuinely good. Plans run monthly with no minimum commitment, and the vendor states that a customer can upgrade, downgrade or cancel at any time with the change taking effect from the next period. A buyer is never locked into a term, which removes the most common exit obstacle in this category before it arises.

The technical half is a single clause. The data protection page states that the vendor maintains clear routines for incidents, erasure and export, and that is the whole of it. Two passes located no described export mechanism, no file format, no scope statement covering whether an export includes campaign history, replies, quotes and signed documents or only contact records, no interface to extract data programmatically, no timeline for fulfilling a request and no statement of what is deleted or retained after an account closes.

The absence compounds with the integration gap. A platform that holds the prospect list, the outreach history, the inbox, the quotes and the signed contracts, with no connector to a system of record and no documented export, is holding the whole commercial history of a sales motion behind a routine that has never been described.

Signed documents are the sharpest case, since those have evidentiary value beyond the subscription.

Ask what an export contains, in what format, and what happens to signed documents after cancellation.

This is the most complete sending discipline recorded in this index, and every element of it is named specifically.

Authentication records covering sender policy, key signing and reporting are configured and verified automatically for each sending domain, named individually rather than gestured at. The vendor provisions the whole path when asked: domain registration through a named Swedish registrar, automatic name server configuration, mailbox licensing through a named distributor, and a warmed inbox delivered ready to send with no manual setup. Every recipient address is verified through a named supplier before entering the send queue.

The scaling model is the part that separates this from vendors who advertise volume. Asked in its own pricing material how a customer increases sending, the vendor answers that it happens by adding inboxes rather than by pushing a single one harder, that additional inboxes are warmed and share the load, and that this is how deliverability is protected as a team scales. That is the correct answer, published where a buyer will actually read it, and it is the exact opposite of the no daily limits claim recorded against other vendors this week.

The outcome is published rather than promised: 2.1 percent hard bounces across 5,504 sends, with the reasoning that low bounce levels protect sender reputation and therefore the next campaign.

What is absent is inbox placement. Delivery, bounces and replies are measured; whether a delivered message reached the inbox or the spam folder is not, and no seed testing or placement monitoring is described. Warmup duration is also unstated.

Ask how inbox placement is monitored, and how long warmup runs before first send.

The market boundary is drawn with unusual honesty and the detail inside it is thin.

This is a Swedish product for the Swedish market and the vendor never pretends otherwise. The interface is Swedish, support is Swedish, prices are in kronor, the company data covers Swedish businesses, and the positioning line is built for Swedish teams. In a category where almost every vendor claims global reach it does not have, a vendor that names one country and stops is telling a buyer something true and immediately actionable.

Buyer type is drawn through the plan structure rather than a claim. The entry plan names founders, consultants and small teams. The middle plan names the active seller needing higher send capacity and more inboxes. The top plan names sales organisations working shared lists and campaigns, gated at a stated minimum of ten users, with manager visibility of team activity and performance. A third party listing adds consultancies and agencies.

What is not addressed keeps this out of the top band. No industry vertical is named, so a buyer cannot tell whether the register data and the sequences suit their sector. Company size of the target is filterable but never characterised. And despite a Nordic distribution relationship, whether a Swedish customer can prospect into Norway, Denmark or Finland is unanswered anywhere, which for a growing Swedish seller is the first question after signing.

Ask whether prospecting outside Sweden is supported, and which sectors the data covers best.