SAP Sales Cloud

Model capability is included in the base package rather than sold as an upgrade, which is the clearest signal a vendor can give about where it sits.

The embedded set is specific and enumerated: lead scoring, opportunity scoring, text intelligence, case categorisation, summarisation and topic analysis, all described as available in the base packages both functionally and commercially. Guided selling adds next best action recommendations, account insights and relationship intelligence, with deal strength and close likelihood assessed against live data. The assistant layer supplies conversational access and action execution, and the pricing page now opens with agentic assistance rather than mentioning it late.

What keeps this out of the top band is that the product underneath is a system of record and works without any of it. Accounts, contacts, activities, quotations, forecasting, territory management, contract storage and revenue recognition are deterministic business logic, and a customer running the product with every model capability disabled still has a functioning sales system. The model improves prioritisation and reduces typing; it is not the reason the product exists.

That is the honest position for enterprise resource planning adjacent software and the vendor does not overstate it in the documentation, though the marketing surface runs ahead of the feature scope description.

Ask which scoring models are active by default and what a customer sees if they are turned off.

One architectural control here is better than anything else in this index, and the capability being marketed hardest sits outside it.

The control is authorisation inheritance. The assistant operates under the invoking user's own permissions and respects application level access controls, which means it cannot surface a record the user could not already open. That is a structural answer to the question every enterprise security review asks about a conversational layer, and it is architecture rather than policy, so it does not depend on a configuration being correct.

Around it sits real institutional oversight. Administrators configure role based access permissions. The vendor names human agency and oversight as one of four artificial intelligence ethics requirements and describes a human in the loop or human on the loop approach. An ethics office, a steering committee reviewing processes and product capabilities, and an external advisory panel are named as standing bodies. An orchestration layer applies data masking and prompt templating before a model is reached. Record change history is retained.

The gap is agentic execution. The pricing page leads with agentic assistance and two passes located no enumeration of what an agent may do unattended in this product, no approval gate description for agent initiated writes, and no statement of whether agent actions are logged the way user actions are.

Ask which agent actions execute without confirmation, and whether they appear in the change history.

The question a buyer actually needs answered is what happens to their data when it reaches a model, and this vendor answers it in writing.

The published position has four parts. Customer data is not shared with other vendors for the purpose of training or improving their language or image models. Where a capability uses a third party hosted foundation model, customer data is sent to that provider for processing only and is not stored or otherwise retained by the provider. At the end of the agreement the vendor deletes remaining customer data from the servers hosting the service unless law requires retention, with retained data subject to the confidentiality provisions of the processing agreement. Customers can export their data before the subscription term expires.

Separately the vendor requires that all of its user interfaces display a short notice where artificial intelligence is in use, which is a disclosure obligation imposed on itself across a portfolio rather than a feature.

All of it sits under certification to the international artificial intelligence management system standard, which is independently audited rather than asserted.

The ceiling is identity. The vendor describes drawing models from a partner ecosystem through its own generative hub and names no provider and no version for any capability, so a buyer knows the contractual position precisely and the technical composition not at all. A silent provider change would not be visible.

Ask which providers and versions serve scoring and summarisation in this product today.

The independent review base is the largest recorded in this index, and the vendor's own outcome claims are the thinnest part of the record.

The principal enterprise review platform carries 978 reviews at 4.2, with a published segment breakdown showing enterprise at 44.4 percent of reviewers, which lets a buyer weight the ratings against their own size rather than reading an undifferentiated average. Coverage extends across every major software directory with verified provider data.

The operational transparency around releases is better still and rarely credited. SAP publishes a quarterly release cadence with dated feature lists, a what is new portal filterable by functional area, and a feature scope description the vendor states is legally binding, explicitly warning that help portal pages may describe features beyond the licensed scope. Deprecations are announced with dates. Named customer stories are published on the vendor's own site.

Quantified outcomes for this product are what is missing. Two passes located no published win rate, cycle time, forecast accuracy or pipeline improvement figure attributable to Sales Cloud with a stated method. Efficiency claims attached to the assistant layer are corporate marketing figures with no basis given.

Ask for a customer reference with forecast accuracy before and after, with the measurement method.

The corporate compliance apparatus is substantial and almost none of it addresses outbound contact.

What exists is real. A public data processing agreement with a version and date governs processing across the cloud portfolio, including subprocessor authorisation and audit rights. Data protection regulation is addressed at length through a trust centre. Regulatory alignment is stated against the European artificial intelligence regulation and a United States cybersecurity framework. Revenue recognition compliance is handled to named accounting standards, which shows the vendor knows how to build to a regulation when it decides to.

What is absent is the outreach layer. The product sends workflow email, integrates with groupware for individual sending, and gained a new email editor in a recent release. Two passes located no unsubscribe handling, no suppression list, no consent capture or basis described for this product, no do not contact enforcement and no jurisdictional guidance for prospecting.

The partial defence is architectural: this is a system of record whose contacts are the customer's existing relationships, and the vendor sells separate products for campaign scale outbound where those controls live. A buyer running prospecting from Sales Cloud alone is nonetheless running it without a described consent or suppression mechanism.

Ask how a contact level marketing consent flag propagates into workflow email and visit planning.

The governing document is public, versioned and specific, which is the thing this axis exists to reward.

A global data processing agreement for cloud services is published as a document rather than summarised in marketing copy. It addresses the substance: a general authorisation to subcontract processing to subprocessors under stated conditions, customer audit rights including where an audit is formally requested by a supervisory authority or required by law, provision of certification against the information security standard as evidence of technical and organisational measures, and coordination provisions where multiple controllers are involved.

Around it, deletion and export are committed in plain terms. Remaining customer data is deleted from the hosting servers at the end of the agreement unless law requires retention, retained data stays under the confidentiality provisions, and customers may export before the term expires.

The certification estate reaches privacy specifically rather than security alone, including the cloud standard for protecting personally identifiable information, and a portfolio audit report covering the confidentiality and privacy criteria in addition to security.

Two limits belong in the record. The published audit report states its own scope excludes the controls of subservice organisations. And a schedule governing use of customer data for general product research and development exists at the trust centre, which a buyer should read rather than assume.

Ask for the current subprocessor list scoped to this service and its notification terms.

The vendor supplies no prospect data with this product, and it publishes terms covering what it does with the customer's.

The records in Sales Cloud are the customer's own, replicated from their back office systems through a documented integration that synchronises master data, code lists and pricing configuration. There is no bundled contact database, no enrichment pool, no credit model and no record count, so there is no third party data provenance question to answer and no unlicensed pool a buyer inherits. Enrichment, where wanted, is a separate purchase.

What lifts this above a bare absence is that the vendor addresses its own use of customer data explicitly rather than leaving it to inference. It states that customer data is not shared with other vendors for training or improving their models, and it maintains a published schedule at its trust centre governing the use of customer data for general product research and development. The existence of that document is itself the disclosure, and it is a more honest position than silence.

The ceiling is that the research and development schedule sets terms a buyer has to go and read, and that the embedded scoring models are trained on something the vendor does not characterise, so whether aggregate customer signal informs them is unstated.

Ask what data trains the lead and opportunity scoring models shipped in the base package.

The vendor owns its platform, so the exposure runs in the unusual direction of vendor toward buyer rather than vendor toward a third party.

On the conventional reading the record is clean. Two passes located no scraping, no social network automation, no browser extension operating a site the vendor does not own and no unofficial interface use. Groupware connectivity runs through the sanctioned client side integrations. Extension is through the vendor's own published platform and low code tooling. Distribution is direct.

The finding worth recording runs the other way. Trade reporting from May 2026 describes the vendor moving to restrict third party artificial intelligence agents from accessing its application interfaces directly, requiring that such access route through its own assistant, and contrasts this with competitors that permit direct access alongside their own intelligence layers. That is a platform owner using terms to shape what its customers may build against their own data, and it is the exposure a buyer of this product actually carries.

A recent release added open authorisation for inbound interfaces, which improves the technical access story without addressing the policy question.

This finding rests on trade press rather than a vendor statement and should be confirmed against current licensing terms before it is relied on.

Ask whether a third party agent may query this product's interfaces directly under current terms.

An independently audited management system stands behind the claims, which moves this from stated intent to examined practice.

The vendor holds certification to the international standard for artificial intelligence management systems, the first such standard, and describes it as a structured and independently audited system rather than a badge. Governance is institutional and named: an ethics office, a steering committee reviewing approaches, processes and product capabilities against internal policy, and an external advisory panel providing outside perspective. The ethics policy is stated to follow an intergovernmental recommendation on the ethics of artificial intelligence, with four published requirements covering transparency and explainability, fairness and non discrimination, human agency and oversight, and privacy and data governance. Training programmes for developers and data scientists are described.

Technical mitigations are architectural rather than promissory. An orchestration layer applies data masking and prompt templating before a model is reached and presents a harmonised interface across models. Document grounding anchors responses in retrieved business records rather than general model knowledge. Access inherits the user's own authorisations. Contractual prohibitions bind providers against training on customer data.

The ceiling is measurement. Two passes located no published evaluation, no accuracy figure for the scoring models, no bias audit result and no error rate, so the process is examined while the output is not.

Ask for accuracy and bias testing results for lead and opportunity scoring.

Contact runs under the customer's own identity and the vendor imposes a disclosure rule on itself, though the rule points at the wrong person for this axis.

The rule is worth stating precisely because it is rare. The vendor requires that all of its user interfaces display a short notice where artificial intelligence is in use. That is a portfolio wide obligation rather than a product feature, and it means a seller working in this product is told when a recommendation, score or draft came from a model. Very few vendors in this index commit to telling anyone that.

Its limit is that the notice is shown to the user, not to the person who receives the resulting email. Nothing described requires or offers disclosure to an external recipient that a message was model drafted, and message generation is a marketed capability.

On the conventional reading the record is clean. Email leaves through the customer's own configured channels and groupware, workflow messages honour the recipient's preferred language over the account language when configured, and two passes located no persona, no synthetic sender, no automated reply handling under a human's name and no undetectability marketing of any kind.

A prospect contacted here is contacted by a real person at a real company using their own address.

Ask whether a model drafted email can be sent without the sender seeing that it was drafted.

Integration depth into the vendor's own estate is documented at a level no other record in this index approaches.

The back office integration is published as a guide rather than claimed as a capability. It covers master data replication, synchronisation of code lists and pricing configuration initiated from this product, extension mappings, single sign on through a configured identity provider enabling navigation from a sales quote here to the sales order in the enterprise system, and message monitoring on both sides. Lifecycle and maintenance activities for the integration are enumerated as ongoing obligations, which is the part most vendors omit.

Extension is layered and documented. In app extensibility carries its own published course. Side by side extension runs on the vendor's own platform. Low code build tooling and an embedded analytics product are included in the licence rather than sold separately. A recent release added open authorisation for inbound interfaces, transportable configuration and improved custom logic operators. Add-ons extend into service, field sales and named industries.

Groupware integration covers the dominant mail client on the client side.

The honest ceiling is that this depth is inside one estate. A buyer not standardised on the vendor's back office gets a competent connector story and forfeits the reason to choose this product, and the reported restriction on third party agent access narrows what can be built alongside.

Ask what the integration costs to maintain across quarterly releases.

The infrastructure is described down to the certificate, with scope statements and dates attached.

The current version is a cloud native rebuild on hyperscaler infrastructure with a microservice architecture on the vendor's own platform, which is a materially different deployment from the previous generation and the vendor says so plainly rather than presenting an upgrade.

The data centre position is documented rather than asserted. Certification to the information security standard is published with statement of applicability versions and dates, covering delivery and operations of the cloud services and the hosting of customer data including personal data. Encryption is stated for data at rest and in transit, with continuous monitoring, restricted personnel access and regular audits. Continuity is specific: redundant power, networking and storage to avoid single points of failure, regular backups, replication across multiple locations with restoration from an alternate site, automatic failover, and certification to the business continuity management standard.

A sovereign offering exists for government and public sector customers, scoped in its certificate to named countries and extended with the cloud security and personally identifiable information control sets.

The ceiling is tenant level specificity. Which region a given subscription runs in is a matter for the contract rather than the published material, and no region selector appears in the pricing configuration.

Ask which region this tenant will run in and whether it can be contractually fixed.

This is the strongest security record in the index, and the detail that earns the top band is a disclosed limitation rather than a certificate.

The published audit report covering the Cloud for Customer lineage states that its own examination scope does not include the controls of any subservice organisations. Naming your own scope exclusion, in the document, is the disclosure a review team most needs and least often receives.

Around it the apparatus is complete. The audit report is prepared under the named attestation section and the international assurance standard, and covers all five trust services criteria: security, availability, processing integrity, confidentiality and privacy. Information security certification carries statement of applicability versions and dates. Business continuity, cloud security controls, protection of personally identifiable information, quality management and the artificial intelligence management system are separately certified.

Retrieval is engineered rather than promised. A compliance document finder filters by offering type, compliance entity and assessment period, with a glossary explaining the filters. The vendor documents the request route, including which customer identifier to supply, and publishes a typical delivery time of two to three weeks with advice to request in advance of an audit. Bridge letters covering the gap between report periods are available.

Ask which compliance entity in the finder covers this product's current version.

The vendor publishes the exact price of every accessory and withholds the price of the product.

On its own pricing page the service add-on is 22 dollars monthly and the field sales add-on is 47 dollars monthly, both in blocks of one user, and a visit planning add-on is priced in euros. The base plan for the current version says price upon request, with pricing structure and contract duration available on request. A buyer can therefore cost the extras precisely and not the thing they extend.

What is published around it is genuinely useful and often buried by others. Contract durations run from three to thirty six months. Auto renewal applies and is stated rather than hidden. Yearly price and quantity are pro rated per month for terms shorter than a year. Invoice is supported in all countries with card availability varying by country. Partner test and demonstration tenants are marked non productive and non commercial with use rights linked.

Third party figures do not reconcile, which is the ordinary signature of negotiated pricing. One directory cites 134 dollars per user per month sourced to the vendor's own store; an implementation partner puts real deals at 60 to 80 depending on volume and term; other commentary cites annual uplifts near five percent, overage charges and mid term licence purchases as recurring surprises.

Ask for the base list rate, the uplift cap and the notice period to prevent auto renewal.

The commitments are published and the hard part is moving between the vendor's own two versions.

What is committed: customers may export their data before the subscription term expires, and at the end of the agreement remaining customer data is deleted from the servers hosting the service unless law requires retention, with anything retained subject to the confidentiality provisions of the processing agreement. Documented interfaces exist and a recent release added open authorisation for inbound access. That is a clearer exit position than most records here manage.

The finding that matters is internal. Implementation partners describe the move from the previous version to the current one as a migration rather than an upgrade, with data transferring through a supplied tool while business logic does not, and in core extensions requiring rebuild as side by side extensions on the vendor's platform. Standard scope is put at four to eight weeks and heavily customised estates at eight to twelve, with extension rebuild and migration validation on the critical path rather than configuration. A customer's accumulated customisation is therefore the part that does not travel, inside the same product line.

No end of maintenance date for the previous version has been announced, while partner release commentary reports it receiving no new business capability, which leaves customers deciding without a deadline.

Auto renewal on terms up to thirty six months is the commercial exit friction.

Ask what the supplied migration tool moves and what has to be rebuilt.

Sending exists, sits well outside the product's centre of gravity, and carries no described discipline.

What ships: workflow email triggered from business events, client side groupware integration so individual messages leave through the seller's own mail system, a new email editor added in a recent release, and language handling that prioritises the contact's preferred language over the account language when the contact is linked and the setting is enabled. That last detail is a genuine piece of care about how a message lands, and it is the only one located.

Two passes found no sender authentication guidance, no warmup, no throttling or rate control, no bounce handling policy, no address verification, no reputation guidance and no deliverability measurement for this product.

The mitigating reading is real and worth stating so the grade is not misread. This is a system of record contacting a customer's existing relationships at transactional volume, not a campaign engine, and messages sent through client side groupware leave under the mail provider's own limits and reputation. The vendor sells separate products where campaign scale sending and its controls live.

The distinction from records graded lower on this axis is that this vendor makes no volume claim at all, rather than marketing the absence of limits.

Ask what volume of workflow email a tenant may generate and through which sending path.

The reach is enormous and the targeting inside it is drawn loosely.

Scale is established rather than claimed: a vendor serving more than 425,000 customers across more than 180 countries, with this product documented for retail, financial services and information technology among others, and industry specific add-ons shipping on the quarterly cadence including one for utilities announced recently. Public sector and government coverage exists through a sovereign offering whose certificate names the countries in scope. The independent review platform's own segmentation puts enterprise at 44.4 percent of reviewers, which corroborates where the product actually lands rather than where it is aimed.

Commercial structure does not exclude smaller buyers on its face, since licensing runs in blocks of one user with terms from three months. Compatibility is stated across the vendor's public and private cloud back office editions.

What is not stated is the practical floor. The gating factor is implementation rather than licence, with partner ranges running from around twenty thousand dollars for smaller deployments to well beyond a hundred thousand for large ones, and the vendor publishes no guidance on the smallest sensible deployment. A buyer under a certain size discovers the constraint in a scoping call.

The real prerequisite goes unstated too: the product's advantage is native alignment with the vendor's own back office, and without that estate the case for it weakens considerably.

Ask what the smallest supported deployment looks like and what it costs to implement.