Sherloq

Seven named agents are the product, and there is nothing underneath them.

Each has a name, an animal mascot and its own page: signal tracking that watches posts, comments, likes, shares and job changes then ranks by urgency; profile scoring against the customer's ideal buyer; lead discovery that mines post reactors and runs discovery feeds daily; meeting research producing call scripts, openers and buying signals; content generation in the user's own voice based on what target accounts engage with; and competitor engagement tracking.

Strip the agents out and a browser sidebar remains with nothing in it. There is no database, no sequencer, no record system and no messaging layer to fall back on.

What distinguishes this from most agentic records in this index is where the agents stop. They produce judgements and preparation rather than actions, and the vendor is explicit that the output terminates at the person. The intelligence is entirely upstream of contact.

The branding commits fully: the vendor calls itself a go to market engine and organises its whole site around the seven.

Ask what each agent runs on and how often signal tracking refreshes.

The oversight is architectural rather than configured, which is why it earns the top band.

Every other record in this index that scores well here does so through a setting: an approval queue, a review step, a confirmation tap. Settings can be turned off. This vendor has built a product with no sending capability at all, so there is nothing to approve because nothing can happen without a person writing and sending it themselves.

The vendor states it plainly and repeatedly. None of the agents sends a message on your behalf. None automates outreach. None pretends to be you. They research, watch and prepare, and you decide. Human in the loop and no automated outreach appear as product attributes alongside the positioning rather than as configuration options.

The lead agent shows the same shape in miniature: it finds and scores candidates daily, and the user decides who gets admitted and who does not.

What is absent: no audit trail, no permission or role model, and no description of what an administrator can govern across a team.

The one output that reaches anyone is generated content posted to the user's own feed, which they publish deliberately.

Ask what controls exist when several sellers share watchlists.

Seven agents, each named and illustrated, and no technology disclosed behind any of them.

Two passes across the home page, the agent descriptions, the mission statement and the footer located no model provider, no model name, no version, no statement of what prospect data is transmitted for inference, no training or retention position and no accuracy figure.

Two capabilities carry the weight and neither is explained. The profile scoring decides in seconds whether a prospect is worth an hour, which means a low score removes that person from consideration and nobody revisits the decision. And the urgency ranking determines what a seller sees first each morning, so what falls below the fold is effectively invisible.

Both are judgements about identifiable individuals, derived from their public activity, with no published basis and no error rate.

The content agent adds a third question. It writes in the user's own voice, which requires a model conditioned on how that person writes, and nothing describes what it is given or what is kept.

The careful data protection positioning elsewhere makes the silence here more conspicuous.

Ask which provider processes prospect activity and what the scoring weights are.

Four headline figures with no methodology, and a conversion claim in a graphic that needs treating carefully.

The figures are two and a half hours of research time saved per account per week, a reply rate increase written as plus or minus forty three percent, meeting preparation three times faster, and zero missed signals. That third one is a relative claim with no baseline and the fourth is a definitional statement rather than a measurement. The plus or minus notation on the reply rate is unusual and reads as imprecision rather than a confidence interval.

A comparison graphic contrasts sub one percent conversion from mass outreach against roughly thirty percent from signal based selling. Thirty percent conversion is an extraordinary figure and nothing supports it.

Five portrait images appear under a line about teams closing high value deals. Two passes found no company, no title and no quotation attached to any of them, and the filenames are personal names, so they read as illustrative rather than as named customers.

Two passes located no customer logo, no case study, no attributed testimonial and no review presence anywhere. The product launched publicly around a month before this record was made.

Ask what the forty three percent was measured against and across how many teams.

The compliance surface most vendors here fail on does not exist, because nothing is sent.

There is no sequencer, no connected mailbox, no connection request automation and no messaging capability of any kind. No unsubscribe question arises because no campaign runs. No suppression list is needed because no list is worked. The seller writes and sends through whatever channel they already use, carrying their own obligations with them.

The vendor states the underlying principle directly: it only wants a message sent when there is real engagement, and it built the product to end mass outreach.

Data protection compliance and German hosting are asserted on the home page as badges.

What that claim does not address is the collection side, and it is the more interesting question here. Continuously monitoring identifiable individuals' posts, comments, likes, shares and job changes, then scoring and profiling them, is processing personal data about people who never consented to being watched. Under the regime the vendor invokes, that requires a lawful basis and, ordinarily, a route for the monitored person to object. Two passes located neither.

Ask what lawful basis covers monitoring individuals who are not customers.

German hosting stated on the home page, which almost nothing in this index does.

It appears as a badge beside a data protection compliance claim, directly under the hero, rather than buried in a policy. For a European buyer that is the first question and it is answered before they scroll. Across two hundred and thirty six records only a handful state a hosting jurisdiction at all.

An imprint page is published, which is a statutory disclosure obligation in German speaking jurisdictions and identifies the operating entity, its address and its responsible persons. That is more corporate transparency than most vendors here offer voluntarily. A privacy page and an accessibility statement sit alongside.

The accessibility statement is itself a signal, since European accessibility legislation now reaches many digital services and publishing one indicates the vendor is tracking obligations rather than ignoring them.

Deductions: none of the pages was opened in this pass, and two passes located no processing agreement, subprocessor list, retention schedule or rights request route.

The holdings deserve naming: continuous activity histories, scores and research dossiers about identifiable people who are not customers.

Ask how long signal histories about monitored individuals are retained.

Nothing is purchased, and what is collected is collected about people who do not know.

The clean half first. Two passes located no contact database, no record count, no enrichment supplier and no purchased list anywhere in the product. Signals come from activity the prospect published themselves on a public professional platform: posts, comments, likes, shares, job changes and promotions. Lead discovery works by mining people who reacted to posts and by running discovery feeds. That is observation of visible behaviour rather than acquisition of a list from an unnamed source, and it is a cleaner starting position than most records here.

The complication is what observation at this scale amounts to. A person liking a post has published an action; they have not agreed to that action being captured, stored, scored against a stranger's ideal customer definition, ranked by urgency and filed alongside a research dossier. The vendor describes watching fifty accounts continuously.

Two passes located no retention position for signal data, no lawful basis and no route for a monitored person to see or object to what is held.

Integrations with two named data platforms suggest enrichment runs through the customer's own subscriptions.

Ask what is stored about a monitored individual and for how long.

The architecture genuinely reduces exposure on two counts, and observation at scale remains.

The favourable half is specific and unusual. The tool does not inject code into the network's pages: it runs in the browser's own side panel, which the vendor describes as always beside the platform and never inside it. And it automates no action on the platform at all, so there are no connection requests, no messages, no profile visits and no likes originating from software. Almost every professional network record in this index does the opposite on both counts, and several sell account rental on top.

What remains is collection. Watching fifty accounts continuously, mining post reactors and running discovery feeds is systematic gathering of data from a platform whose terms restrict exactly that, however the interface is delivered. Not injecting into the page changes the detection profile rather than the permission position.

The vendor's own framing gives that away: it writes that the platform does not see it and that the customer's account stays safe. That is detection language.

The footer disclaims any association with or endorsement by the network.

Ask how signal data is obtained if no code runs inside the platform's pages.

A European regulatory posture on the stewardship side, and nothing published on either the model or the security side.

Stewardship first. German hosting stated openly, data protection compliance claimed, a statutory imprint identifying the operating entity, a privacy page and an accessibility statement. That combination indicates a company operating under European obligations and tracking them, which is a different starting point from most records in this sweep.

On models, two passes located no provider, no evaluation, no accuracy figure and no constraint description across seven agents. The scoring that decides which prospects receive attention and the ranking that decides what a seller sees first both operate unexplained.

On security, two passes located no security page, no certification, no audit, no encryption statement, no access control description, no incident response process, no named security contact, no vulnerability disclosure route and no status page.

The custody is worth stating. The platform holds continuous behavioural histories about named individuals who are not its customers, along with scores and research dossiers about them, and the safety of that store is undescribed.

Ask what protects stored signal and dossier data.

The prospect is never contacted by software, and that is the vendor's stated purpose rather than a side effect.

Two passes located no automated message, no synthetic sender, no persona, no cloned voice, no rented account, no automated profile visit and no automated like manufacturing the appearance of human interest. When a message eventually arrives, a person wrote it, having read the research themselves.

The vendor argues the point directly: the message that closes a six figure deal is not written by an algorithm, it is written by someone who understood the moment and showed up. Its mission statement frames the product as putting humans back in control in a world where generated content floods inboxes.

That is the second top grade on this axis in this index, and it arrives by the same route as the first: a product that declines to imitate a person.

One asymmetry is real and belongs on the record. The prospect is under continuous observation and does not know it, so while nothing about the eventual contact is false, the context behind it is invisible to them.

The content agent writes in the user's own voice for the user's own feed, which is publication rather than impersonation.

Ask whether a monitored person can find out they are on a watchlist.

Eight named integrations, and the selection tells you who this is built for.

Two major record systems and one lighter one cover where the pipeline lives. Two data platforms cover enrichment the vendor does not supply itself. An enrichment browser tool and a workflow automation platform cover the operator's own stack. A sequencing platform covers the sending this product deliberately does not do, which is a sensible admission: the vendor points at where the message should be composed and sent rather than building it.

That last choice is consistent with the whole positioning and it is the integration that makes the product usable rather than merely interesting.

A browser extension is published in the official store, which imposes independent review and is a meaningful check for a tool that reads a third party site.

What two passes could not locate: any interface documentation, any authentication scheme, any webhooks, any protocol server, and any statement of whether these connections are two way or export only.

An affiliate programme is published.

Ask whether scores and signals write back into the record system automatically.

German hosting is stated on the home page as a badge, which resolves the question most records leave open.

It sits directly under the hero beside the data protection claim, before any feature is described. That placement is a decision about audience: a European enterprise buyer asks where the data sits before they ask what the product does, and this vendor answers first. Across this index the overwhelming majority of records state no jurisdiction at all, and several state none despite handling considerably more sensitive material.

An imprint page identifies the operating entity under statutory obligation, which further establishes where accountability lies.

The product is delivered as a hosted application plus a browser side panel extension distributed through the official store.

Deductions: no hosting provider is named, no data centre, no tenancy or isolation model, no encryption statement, no backup or continuity position and no status page. One third party storage service is visible in the page assets and its own region is unstated, which slightly complicates the German hosting claim.

Ask which provider hosts the platform and whether all subprocessors are within the same jurisdiction.

A European compliance posture without any independent attestation behind it.

What is published: a data protection compliance claim, a German hosting statement, a statutory imprint identifying the operating entity, a privacy page and an accessibility statement. The accessibility statement is the unusual one and worth noting, since European accessibility requirements now reach many digital services and publishing a statement indicates a vendor tracking its obligations rather than discovering them later.

Together those establish that this is a company operating deliberately under a European regulatory framework.

What two passes could not locate: any certification, any audit report, any examination, any penetration test, any trust portal, any dedicated security page, any encryption or access control statement, any subprocessor list, any vulnerability disclosure route, any named security contact and any status page.

The enterprise positioning makes the gap consequential. This vendor targets teams selling high value contracts on long cycles, and those buyers run supplier assurance reviews as a matter of course. A product installed as a browser extension that reads a professional network alongside the seller will attract particular scrutiny from a security function.

Ask what the browser extension can access and whether any assessment exists.

Self serve entry with no sales conversation, and no figure captured.

What is clear: registration is free and immediate, with a start for free control appearing throughout the site alongside a demonstration option, so a buyer can evaluate without engaging anyone. For a product this new that is the right posture and it removes the usual friction.

A pricing page exists and was not reached in this pass, so no tier, rate, seat definition or usage allowance is recorded here.

The metering question is the interesting one and it is unanswered. This product watches accounts continuously, discovers leads daily and generates research on demand, which means cost could reasonably scale with the number of accounts watched, the number of users, the volume of signals processed or the number of research dossiers produced. Those are materially different arrangements for a team weighing whether to put five sellers or fifty on it, and nothing on the surfaces examined indicates which applies.

What the free tier includes and where it ends is likewise unstated.

An affiliate programme is published.

Ask how the product is metered and what the free tier covers.

Eight integrations carry the output outward and nothing describes leaving.

The favourable reading is that this product is designed to feed other systems rather than to hold anything. Scores, signals and research are meant to reach the record system where the deal is tracked and the sequencing tool where the message is written, and two record systems plus a sequencer are named among the integrations. Output that lands in a customer owned system as the work happens is the strongest form of portability.

What two passes could not locate: any export mechanism, any format, any interface, any deletion commitment, any retention position after cancellation and any account closure process.

The accumulated asset here is unusual and worth naming. Over months a customer builds watchlists of named accounts, an encoded definition of their ideal buyer, a signal history showing how each prospect behaved over time, and research dossiers. The signal history in particular cannot be reconstructed after leaving, because it is a record of past activity that would have to be observed again from the beginning.

Ask whether watchlists, profile definitions and signal history export.

Nothing is sent, so nothing can fail to arrive, and the absence is design rather than omission.

Two passes located no mailbox connection, no sequencer, no warm up, no rotation, no authentication guidance and no sending infrastructure of any kind. That is not a gap on this axis: the vendor has deliberately built a product that stops before the message, and the seller sends through whatever channel they already operate, carrying its deliverability characteristics with them.

What does belong here is the behavioural discipline, and it is the version that actually determines reply rates. The vendor's stated principle is that a message goes only when there is real engagement, and the entire product exists to establish when that moment has arrived. Timing and relevance protect a reply rate more reliably than any warm up pool, because the failure this addresses is not landing in a spam folder but being ignored by someone who had no reason to care.

The published claim, a forty three percent reply rate improvement over cold outreach, is the measure of that discipline and is unsupported.

One adjacent capability is real: the content agent works out what target accounts actually engage with before anything is written.

Ask what proportion of watched signals result in a message being sent.

The buyer is defined by deal shape rather than company size, and the argument follows from it.

The stated segment is enterprise teams selling high value contracts on long cycles, where a prospect decides over months rather than in a click. Everything in the product follows from that premise: if a decision takes months, the buyer reveals their thinking publicly during it, and the advantage lies in noticing rather than in sending more.

The vendor also declines the opposite market explicitly, arguing that more automation, more sequences and more volume are precisely wrong for this segment. Refusing the volume buyer is unusual positioning and it is consistent across every part of the site.

Geography is implied rather than claimed: German hosting, a statutory imprint, an accessibility statement and a language path indicate a European primary market with English served alongside.

What two passes could not locate: any industry vertical, any company size band, any named customer to corroborate the segment, and any statement of which markets the signal coverage works best in.

That last one matters, since signal density depends on how actively a given market's buyers use the platform.

Ask which markets and languages the signal tracking covers well.