Tuco AI

One model capability sits on top of an infrastructure business, and the infrastructure is what the customer is buying.

The model feature is real and well specified in behavioural terms. Trained on the customer's own knowledge base, it answers common questions, qualifies leads and books meetings without supervision, and the vendor makes a point about output style: natural, concise texts rather than the long blocks generated systems typically produce. In a channel where messages are short by convention, that constraint matters more than it would in email.

What the customer pays for is different. Pricing is per plan with per line volume allowances and explicitly no per message fees, so nothing meters inference. The hard part of this product is operating physical handsets, managed accounts and SIM provisioning at scale while keeping lines healthy, and none of that involves a model.

A customer who never enabled the automatic reply would still have the speed to lead sending, the sequences, the reactivation campaigns and the record system synchronisation.

The positioning reflects that: the vendor sells a channel, not an agent.

Ask what the automatic reply is trained on and whether it can be limited to specific hours or topics.

Volume limits are published as numbers, and the vendor enforces its own policy by withdrawing support.

The numbers first. Each line may contact twenty five new people per day and send one hundred and fifty messages per day. Scaling happens by adding lines rather than by working existing ones harder. Publishing a per line ceiling as a figure is rare in this index and it tells a buyer exactly what capacity they are buying.

The enforcement is more unusual. The vendor replaces flagged lines free of charge, then states plainly that it will do so only once or twice, because repeat flagging indicates the audience is wrong rather than the number. It adds that it will not keep rescuing lines messaging people who never opted in. That is a vendor imposing a consequence on its own paying customers, and it has the means to do it because it owns the lines.

Around those: automatic opt out handling with opt outs honoured instantly, consent management, message logging, and automatic detection of whether a recipient can receive the message with fallback to the regulated channel.

The gap is the automatic reply. It converses with prospects, qualifies them and books meetings unattended, and two passes located no approval gate, no review queue and no audit trail over what it says.

Ask what constrains the automatic reply and whether its messages can be reviewed.

A model holds conversations with prospects and nothing describes what it is.

Two passes across the home page, questions section, product pages and footer located no provider, no model name, no version, no statement of what customer or prospect data is transmitted for inference, no training or retention position and no accuracy figure.

The capability warrants more than most. It is trained on the customer's own knowledge base, answers questions unattended around the clock, qualifies leads and books meetings, all inside a conversational channel the vendor has deliberately engineered to feel personal. A prospect texting back believes they are talking to the named person whose photograph appears on the message.

One behavioural specification is given: output is described as natural and concise rather than the long blocks generated systems typically produce. That is a style commitment rather than a disclosure, and it is the only thing published about how the model behaves.

The training data point deserves a question too, since a knowledge base uploaded for this purpose leaves the customer's control and nothing states where it goes.

Ask which provider runs the automatic reply and where the knowledge base is processed.

Five named individuals with photographs, titles, employers and links, each carrying a measured figure, and one describes a controlled test.

That test is the strongest evidence type available on this axis. A go to market engineer at a named company ran one hundred prospects through both email and this channel with the same message, and reports forty two responses against fifteen. Same leads, same copy, one variable changed. Another customer reports meeting show up rising from fifty eight to sixty eight percent over two months, and separately confirmations from fifty two to eighty nine percent. A third reports sales cycle falling from thirty eight days to twenty six. A fourth reports open rates of forty one percent against eighteen. A fifth reports twenty three responses from fifty messages against a usual four to six.

Every one is attributed to a named person at a named company with a link to that company, which makes the claims checkable rather than decorative.

Six customer logos appear, several of them identifiable software companies in adjacent categories, including two that sell outbound tooling themselves.

Three case studies are published with named verticals and described outcomes, alongside a benchmarks page.

The deduction is that all of it is vendor published with no independent review base located.

Ask to speak to the customer who ran the hundred prospect test.

A stricter permission policy than most vendors here operate, marketed with language that undercuts it.

The policy first, because it is genuinely substantial. The published anti spam rules restrict the channel to people who responded to an advertisement, submitted a form, booked a demonstration, spoke to the company, bought from it, or gave their number. The vendor states directly that for first touch outreach to strangers a customer should use email or a professional network instead. Turning away a use case is not something this category does often. It claims compliance with United States telephone consumer legislation, with automatic opt out handling, consent management and message logging built in, and opt outs honoured instantly. It completes carrier registration for the fallback channel on the customer's behalf. And it enforces, withdrawing free line replacement from customers messaging people who never opted in.

The marketing runs the other way. A comparison table on the same site lists as advantages over regulated channels that no carrier registration is needed, that no opt out footer is required, and that carrier filtering does not apply. Those three mechanisms exist to protect the person receiving the message, and their absence is presented as a benefit of switching.

Both are the same vendor and both belong on the record.

Ask how opt outs are captured when no opt out footer is sent.

A deletion page that explains what deletion does not cover, which is the honest version.

Most vendors publish a rights statement. This one publishes a working process: how to request deletion, what removing an account actually removes, and a specific caution that data synchronised from connected third party services is not deleted by deleting this account and must be pursued with those services directly. It advises exporting a copy first, names an address for export requests, commits to responding within seven business days, and sets out escalation routes covering appeal to the vendor, complaint to a supervisory authority and legal remedies.

Alongside it sit a privacy policy, a data protection regulation page, an anti spam policy, terms of service and a security page. Independent summary reports a processing agreement available and controls aligned to a service organisation examination, worded as controls rather than certification.

The policy also handles jurisdiction carefully, addressing rights under European, Californian and Canadian regimes, and correctly stating that the customer remains responsible for their own messaging complying with Canadian requirements rather than claiming to absorb that obligation.

Deductions: none of the pages was opened, and no processing location is stated for a Delaware entity owned by an Indian parent.

Ask for the processing agreement and where message data is stored.

No data is supplied, and the vendor restricts by policy who a customer may contact.

Two passes located no contact database, no record count, no enrichment engine, no lead finder, no intent signals and no third party data supplier anywhere in the product. Contacts come from the customer's own record system, their own forms and their own advertising.

What lifts this above the usual clean by construction position is that the vendor goes further and defines the permitted audience by relationship. Its published rules limit messaging to people who responded to an advertisement, filled in a form, booked a demonstration, held a conversation, made a purchase, or handed over their number. It states that first touch outreach to strangers belongs on another channel entirely.

So the constraint is not merely that the vendor sells no list. It is that the vendor tells customers a purchased or scraped list is outside acceptable use, and backs that by withdrawing line replacement from those who ignore it.

Across this index that combination appears nowhere else. Several vendors supply databases of unknown origin; this one declines to supply any and polices what its customers bring.

Ask how the vendor detects that a customer is messaging non consenting contacts.

The entire product runs on a messaging platform that has not sanctioned it, and the physical infrastructure is the proof.

Because no commercial interface exists for this channel, the vendor operates racks of real handsets with managed accounts and provisioned SIM cards. It says so openly and presents it as a differentiator over competitors using virtual machines. That architecture exists solely because the platform operator provides no sanctioned route.

The vendor states it burned through roughly two hundred SIM cards mapping the platform's spam detection rules in order to learn where the limits sit. That is evasion research published as a credential, and it is the most explicit statement of its kind recorded anywhere in this index.

It replaces flagged numbers and accounts free of charge, which is a business model built around expecting to be caught.

The justification offered is that the platform's own automation feature encourages automation, and that more messages keep users on the device. Both may be true and neither constitutes permission.

The footer states plainly that the company is not affiliated with, endorsed by or sponsored by the platform operator, and that the messaging service is that company's trademark. That disclaimer is honest and it is also the admission.

Ask what happens to a customer's campaigns if the platform operator acts.

A published limitations page is the detail worth recording, because almost nobody writes one.

It sits in the company section of the footer alongside a security page, and a vendor documenting what its product cannot do is making a choice against its own marketing interest. Around it: a data protection regulation page, an anti spam policy, a privacy policy, terms of service and a deletion page carrying export, appeal and complaint routes with a named address and a seven business day commitment. End to end encryption and a ninety nine point nine percent availability commitment are stated on the home page.

Independent summary reports controls aligned to a service organisation examination and a processing agreement available, both worded as controls rather than certification, which is careful language and to the vendor's credit.

The model side is where the gap sits. An automatic reply trained on a customer's knowledge base converses with prospects, qualifies them and books meetings, and two passes located no provider, no evaluation, no accuracy figure and no statement of what it may not say. In a channel engineered to feel like a personal exchange, an unconstrained conversational model carries more consequence than in email.

Ask what the limitations page says and what bounds the automatic reply.

The channel is chosen because it does not look like marketing, and the vendor's own comparison table sets out exactly which signals are being removed.

It lists, as advantages over conventional messaging: the sender's real name showing instead of an unknown number, a profile photograph so it reads as a real person rather than a number, a blue bubble instead of grey, no carrier spam flag, and no opt out footer. Each of those is a cue a person uses to distinguish a personal message from a commercial one, and each is being deliberately eliminated.

The accompanying guidance completes it: use a real person's name and photograph rather than a brand, keep messages conversational, and send no links or images until the recipient replies. That last instruction serves line health and also strips the remaining markers that identify a message as commercial outreach.

The automatic reply then holds the resulting conversation, qualifying and booking, without disclosing that it is software.

Three mitigations are real and none of them is disclosure. Recipients are restricted by policy to people who already opted in and know the sender. Opt outs are honoured instantly. And the name and photograph belong to an actual person at the customer's company rather than a fabricated persona.

Ask whether the automatic reply identifies itself as automated.

A protocol server published as an installable package on the public registry, which is the first of its kind recorded in this sweep.

Ten or so vendors this sweep describe such a server. This one ships it as a package anyone can install, alongside a dedicated page for it. That is the difference between announcing an interface and distributing one.

The rest is equally substantial. A documented interface on its own subdomain, webhooks with their own integration page, and a developers section. Named integrations cover three record systems, two automation platforms, two data and enrichment platforms, a messaging bot, an email bridge and a vertical industry system.

The commercial handling of integration is the part that stands out. The vendor states it builds the integration during onboarding, included, with no upsells and no separate implementation fee, and that most teams are live within forty eight hours. Where most vendors reserve custom integration for an enterprise tier, this one absorbs it as onboarding.

A free public tool checks whether a number can receive messages on the channel, and a partnerships programme and comparison hub complete the estate.

Ask what the protocol server exposes and what the interface rate limits are.

The device layer is described in unusual physical detail and the platform layer is not described at all.

On devices the vendor is specific and uses the specificity as a differentiator: dedicated real handsets rather than virtual machines, managed accounts, SIM provisioning and continuous line monitoring, all operated by the vendor so the customer never touches device management. Numbers are targeted by region or postal code, with the vendor stating candidly that it cannot guarantee a number beginning with a particular area code and will provision the nearest available in that region. That is an honest limitation to publish.

One number is stated to work globally, reaching recipients in any country.

End to end encryption and a ninety nine point nine percent availability commitment are claimed on the home page, and a security page exists and was not opened.

What two passes could not locate: any hosting provider, region or data centre for the platform itself, any residency commitment, any tenancy or isolation model, any backup position and any status page.

The corporate structure sharpens the residency question. The operating entity is registered in Delaware and owned by an Indian parent, and nothing states where message content, contact data or knowledge bases are processed.

Ask where message content and contact data are processed.

A fuller published estate than most at this size, with nothing independently attested.

Published: a dedicated security page, a data protection regulation page, an anti spam policy, a limitations page, a privacy policy, terms of service, and a deletion page carrying export, appeal and complaint routes with a named privacy address and a seven business day response commitment. That is seven separate documents, and the limitations page in particular is a choice almost no vendor makes.

Independent summary of the privacy policy reports controls aligned to a service organisation examination and a processing agreement available. The wording is careful, describing controls rather than claiming certification, and that precision is to the vendor's credit rather than against it.

What two passes could not locate: any certification confirmed, any auditor, any scope statement, any audit report, any penetration test, any subprocessor list, any vulnerability disclosure route, any named security contact and any status page. None of the pages was opened in this pass.

The custody is worth naming. The vendor holds working access to physical devices sending under a customer's staff names, message content, contact data and uploaded knowledge bases.

Ask whether the examination is complete or the controls merely aligned.

Entry price, setup fee and refund policy all stated on the home page, including the one nobody volunteers.

That one is the refund position: no refunds or returns, printed plainly rather than buried in terms. Publishing an unfavourable policy where a buyer will see it before purchasing is unusual and it belongs on the record as a point in the vendor's favour, whatever a buyer makes of the policy itself.

The rest is clear. From one hundred and forty nine dollars monthly plus a three hundred and thirty five dollar one time setup charge, with no per message fees, no contracts and cancellation at any time. Three tiers named, with the entry level self serve and the middle tier by demonstration.

Capacity is quantified rather than described: twenty five new contacts and one hundred and fifty messages per line per day, scaling by adding lines.

Implementation is explicitly included, covering workflow setup, copywriting, record system integration, carrier registration for the fallback channel, account management and ongoing line monitoring, stated as no upsells and no separate fee.

A competitor is named with their price quoted against the vendor's own.

Two deductions: the tier structure above entry is not fully published, and a third party listing carries a stale figure well below the current entry price.

Ask what the middle and upper tiers cost and how many lines each includes.

Export is addressed inside the deletion process, which is where a customer actually needs it.

The deletion page advises exporting a copy of data before requesting removal, describes how to do it, and names an address for requesting an export directly. Pairing the two is sensible design, since the moment somebody decides to leave is the moment portability matters and most vendors document only the destruction half.

The same page is candid about a limit worth knowing: deleting an account here does not delete data synchronised into connected third party services, and the customer must approach those separately. That is accurate and it is the kind of caveat usually left for a customer to discover.

Three programmatic routes exist alongside: a documented interface on its own subdomain, webhooks, and a protocol server distributed as an installable package.

Commercially the exit is clean, with no contracts and cancellation at any time, though the stated no refunds position means any prepaid period is not recoverable.

What two passes could not locate: an export format, a scope statement covering whether full conversation history travels, or a retention position after closure. Conversation threads live on vendor operated devices.

Ask whether full message history exports and in what format.

The most quantified line health position in this index, and the vendor enforces it against its own customers.

Capacity is published as numbers rather than described: twenty five new contacts and one hundred and fifty messages per line per day, with scale achieved by adding lines rather than pushing existing ones. A buyer can calculate exactly what they can send before signing.

The infrastructure supports it. Dedicated physical handsets rather than virtual machines, managed accounts, SIM provisioning and continuous monitoring, with flagged numbers replaced free of charge, usually within hours. Delivery is tracked with confirmations and read receipts, and delivery rates are claimed above ninety five percent.

Recipients who cannot receive on the channel are detected automatically and routed to conventional messaging, with the vendor completing the carrier registration for that fallback so the regulated path is properly registered rather than avoided.

The sending guidance is real discipline: warm contacts only, a real person's name and photograph, conversational tone, and no links or images until the recipient replies.

And the enforcement closes it. Free replacement applies once or twice, after which the vendor states the audience has to change and that it will not keep rescuing lines messaging people who never opted in.

Ask how many lines a given volume requires.

Eleven use cases with their own pages, spanning two genuinely different markets.

One set is consumer facing lead response: roofing contractors, home services, medical spas, car dealerships, property agents, mortgage and loan officers, insurance agencies and webinar hosts. Those are local businesses replying fast to a member of the public who filled in a form.

The other is business software: the named customer logos are identifiable technology companies, two of which sell outbound tooling themselves, and there are dedicated paths for agencies operating on a particular record system, for teams building automated agents, and for developers building on the interface. The site metadata describes the product as built for business to business companies and modern go to market teams.

Both are real, and the record should say so rather than pick one. The evidence for the business side is the customer list; the evidence for the consumer side is the use case pages and the published case studies, which cover webinar attendance for property and education businesses.

Geographic reach is stated simply: one number works globally, reaching any recipient with a compatible device regardless of country, which removes the per country provisioning that constrains conventional messaging.

Ask which segment the customer base concentrates in.