Vector

A matching and distribution product with a model layer bolted above it. The identification step is deterministic rather than inferred: the vendor states it reads a device fingerprint and looks for a match in a pre existing identity graph, which is a lookup against a table, and a lookup does not become inference because the company describes itself as an artificial intelligence platform.

Audience construction is rule driven from behaviour, and syncing to advertising platforms is integration work. Strip the model layer and the whole product remains: identification, audience building and activation all continue to function.

The vendor's own positioning supports this reading rather than contradicting it, since it frames the artificial intelligence as augmenting marketers through orchestration and infrastructure reliability rather than replacing campaign work, which is a claim about workflow rather than about a model doing the job.

The one genuinely modelled component is intent scoring, and the vendor simplified that during 2025 from a numeric output to three bands, which is a reduction in modelled sophistication rather than an increase. Founded 2022, which sits at the boundary of the vintage split, and the product shape rather than the founding year decides it here. Ask what the intent bands are computed from, and which capabilities depend on a model at all.

Audiences assemble and refresh themselves, and nothing published describes what governs that. The vendor states that audiences update dynamically as buyer interest changes rather than requiring rebuilds, that visitor feeds and audience syncing are automated, and that reporting refreshes on a short cycle, so the system adds and removes named individuals from live advertising campaigns without a person approving each change.

That is a lower blast radius than an agent that writes and sends, because the output is an advertising impression rather than a message purporting to come from a colleague, and it is not zero: a named person is being placed into a targeting pool by an automated decision.

Nothing published describes a review step before a person enters an audience, a ceiling on audience size or spend, an exclusion mechanism for individuals a customer does not want targeted, a suppression route for someone who objects, or what halts a sync already running. Segment construction is operator configured, which is a real control over the input, and it is the only one described. Ask whether an individual can be excluded from all audiences, what stops a sync, and whether audience changes can be reviewed before they reach the advertising platform.

One honest simplification and no disclosure underneath it. The vendor moved its intent scoring during 2025 from a finer output to three bands of high, medium and low, and reducing a score to the precision it can actually support is better practice than the spurious two decimal confidence figures common in this category, so the change is worth recording as a positive. Beyond that nothing is published.

No model provider, family or version is named, no model card exists, no evaluation or accuracy figure appears for the scoring or for identity matching, and nothing describes what inputs produce a high band rather than a medium one. The consequence is specific rather than abstract: the band determines whether a named individual enters an advertising audience and how a customer spends against them, so an unexplained score is directly deciding who gets targeted and at what cost.

A protocol server shipped during 2026 pushes the platform's data into general purpose assistants, which discloses a distribution route rather than anything about the models inside the product. Ask what inputs and weights produce each intent band, how often the banding is recalibrated, and what evaluation covers identity match accuracy.

The vendor publishes its own ceiling, which is rare, and publishes nothing about how the number was reached, which is the usual problem. Stated on its own product pages is that the platform surfaces fifteen to thirty percent of traffic at contact level, so a buyer is told upfront that seventy to eighty five percent of their visitors will not be identified. Almost no vendor in this category volunteers its miss rate, and this index should say so.

Reported alongside it are advertising audience match rates of fifty five to seventy percent, rising to ninety on one platform for certain profile fits. What is missing is everything that would make those figures assessable: no population, no period, no method, no definition of what counts as an identification, and no statement of how traffic composition affects the range, which matters because the range doubles from its floor to its ceiling and a buyer at the bottom of it is buying a materially different product from one at the top.

Customer evidence is testimonial with one named marketing leader reporting a click through rate on a single channel. Independent review aggregation is thin, which reviewers themselves note. Ask how the identification rate is measured and across what population, what drives the difference between fifteen and thirty percent, and what the rate is for traffic matching the buyer's own geography and profile.

Three named compliance mechanisms, one of them architectural, which is more than any comparable identification product in this index publishes. The strongest is a jurisdictional restriction: the vendor states it geofences the technology to jurisdictions operating on an implied opt in basis, so territories requiring express prior consent are excluded from identification by design rather than by policy.

A control that prevents the collection cannot be forgotten by an operator, and independent reviewers describe the resulting coverage limitation in Europe as a real constraint on the product, which corroborates that the geofence is operating rather than merely stated. Second, the vendor states that a customer may place the technology behind a consent management platform to gate it further, giving the customer a second lever over their own visitors.

Third, it states plainly that it requires customers to update their own privacy policy and consent platform, which allocates an obligation rather than leaving it ambiguous. Held below the top band because the specifics are not published: no list of the jurisdictions the geofence admits, no statement of the legal analysis behind the implied opt in characterisation, no description of what happens to a visitor whose location cannot be determined, and no regulatory or counsel opinion referenced. Ask which jurisdictions are included, how location is determined, and what the vendor requires a customer's privacy policy to say.

The collection method is described concretely enough to be argued with, which on this axis is worth more than a page of assurances. The vendor states that it operates a network of publishers who disclose, collect and share their own first party data in the form of hashed email addresses and associated device fingerprints, that on a visit it examines only the device fingerprint to seek a match in a pre existing identity graph, and that a customer's own visitors are not contributed back into that shared pool.

Each of those is a checkable design claim rather than a sentiment, and the last is a real commitment because it means using the product does not make the customer a supplier to it. One tension belongs on the record and is stated here without inference about intent.

The vendor's marketing describes privacy safe data sources and notes that it uses neither form fills nor third party cookies, while the method it describes elsewhere rests on device fingerprinting, which is the technique that identifies a browser without a cookie and which a person cannot clear or reset in the way they can clear a cookie. Both statements are true and a reader should hold them together.

Held below the top band on instruments rather than method: no processing agreement, subprocessor list, transfer mechanism, retention period or data protection contact was located on this pass. Ask for the processing agreement and subprocessor list, the retention period for identity graph records and identified visitor history, and how an identified individual exercises rights over data held about them.

A described supply chain and an apparent warranty of rights, which together put this above a cohort that mostly names nothing. The vendor states that the identity graph is built from a proprietary network of publishers who properly disclose, collect and share their own first party data, names the data types as hashed email addresses and device fingerprints, and describes the graph as compliantly sourced and pre existing rather than assembled from the customer's traffic.

It also states that it warrants the rights for the data it supplies, which is a contractual position rather than a marketing assertion and is the second strongest form of evidence this index recognises. Very few records here carry any warranty on provenance at all. Three things hold it below the top band. No publisher, aggregator or data partner is named anywhere, so the chain is described in shape but not in fact and cannot be independently evaluated.

The warranty language was truncated in the retrieved page so its scope, exclusions and remedy are unestablished. And a second supply route is mentioned only in passing, where audiences are matched against verified contacts from data partners, with those partners unnamed and their basis undescribed. Ask which publishers and data partners supply the graph, for the full text and scope of the rights warranty, and what indemnity attaches to it.

Activation runs through the advertising platforms' own audience interfaces, which is the sanctioned route by construction, and that is where this convention places the middle band. Identified contacts are synced as audiences into several major advertising and social platforms, each of which provides a documented interface for exactly this purpose, so nothing here scrapes a professional network, drives a browser extension against one, automates a user's account or operates multiple identities.

The exposures that separate this category fastest do not arise. Identification itself runs on the vendor's own publisher network rather than on any platform's data, which removes a second common exposure. Held below the top band because a real question sits unaddressed.

Uploading a custom audience to these platforms generally requires the advertiser to represent that they collected the data lawfully and gave appropriate notice, and here the advertiser is supplying individuals they never collected and never contacted, identified by a third party. Nothing published states what representation the customer is making when they sync, whether the vendor's rights warranty extends to that use, or what happens if a platform challenges an audience. Ask what the customer represents to each advertising platform on upload, and whether the vendor indemnifies that representation.

A new route was built for identified people's data to leave the platform into general purpose models, and nothing published governs it. During 2026 the vendor shipped a protocol server that brings its data into widely used assistants, which means records identifying named individuals, their employer, their role and their browsing behaviour can flow into third party model providers through a customer's own assistant.

That is a genuine stewardship question created by a deliberate product decision, and no accompanying material states what may be sent, whether any field is withheld, what the customer's provider does with it, or whether the vendor takes any position on the practice.

Around it the ordinary gaps: nothing states whether identified visitor data or intent signals train or tune any model, no provider is named, no retention applies to model inputs and outputs as distinct from stored records, and no governance document, evaluation record or red teaming artifact was located. The corpus is people who never contacted anyone and do not know the platform exists. Ask what data the protocol server exposes, whether any field is excluded, whether identified visitor data trains any model, and what retention applies.

The identified person is not told, and what reaches them is an advertisement rather than a message pretending to be a colleague, which is the distinction that separates this from the bottom of the scale. A visitor is resolved to a named individual without their knowledge and placed into targeting pools, and nothing published states what they would be told if they asked how they came to be targeted. Set against that are three things.

The output is an advertising impression on platforms that operate their own advertising preference and opt out controls, so the person retains a route to limit targeting that exists independently of this vendor. The vendor requires its customers to update their own privacy policy and consent platform, which is a disclosure obligation placed on the party that has the relationship.

And the jurisdictional geofence removes the territories where identification without express consent would be least defensible. This is where the comparison to the other deanonymization record in this index matters, because that one resolved visitors and then engaged them directly with automated chat, machine written follow up and outbound sequences with no disclosure position at all, which is why it sits a band lower. Ask what a person is told if they ask why they are seeing these advertisements, and whether an identified individual can be suppressed on request.

Deep where the product needs to be and narrow everywhere else. Activation covers several major advertising and social platforms with audience syncing described as one click and continuously refreshed, which is the product working rather than an ecosystem, since an advertising platform is the destination this tool exists to reach.

Genuine integration sits in two customer record platforms with contact level syncing, a real time visitor feed, channel notifications when a matching visitor is identified, and a protocol server shipped during 2026 that exposes the data to external assistants, which is a forward looking route few competitors have built. Held at the middle band on what is absent around those.

Only two record platforms are supported and an independent reviewer describes one of the two integrations as awkward in practice, no public interface documentation was located on this pass, no automation connector service or warehouse destination appears, and reviewers note the absence of any attribution layer, so a customer cannot close the loop between an audience and revenue inside the platform. Advanced security is listed as a capability of the quoted tier rather than as standard. Ask whether a documented public interface exists, which record platform integrations are considered production quality, and what is available to a customer wanting the data in a warehouse.

Collection scope is stated and the storage question is not answered anywhere reached. The vendor is unusually clear about which jurisdictions it will operate in, restricting identification to territories with an implied opt in basis, so a buyer knows where the technology runs. Where the resulting data then lives is a separate question and nothing published addresses it. No hosting provider, region, tenancy model, residency election or recovery objective was located on this pass.

That gap carries weight in proportion to the corpus rather than the company size, because the platform stores an identity graph assembled from a publisher network, identified visitor histories tied to named individuals, and the audiences built from them, none of which belongs to the customer or to the people in it. A buyer whose own regulator asks where their site visitors' identities are held cannot answer from anything published. Ask which provider and regions host the identity graph and the identified visitor records, whether any regional processing option exists, and what the tenancy and recovery position is.

A security page exists and it is about privacy method rather than security posture. The vendor publishes a page addressed explicitly to security and legal reviewers, which is the right instinct and better than the marketing page most vendors offer, and its content is a clear account of how identification works, where it is geofenced, and what the customer must do about their own policy. What a security review actually asks for is not there.

No attestation or certification is named, no audit period, auditor or report is offered, no penetration testing statement appears, no enumerated control description covers encryption, access management or monitoring, and no vulnerability disclosure route was located on this pass.

Advanced security appears instead as a differentiator of the quoted upper tier, which makes at least part of the security posture a function of what the customer spends, a pattern this project has now recorded on three separate records. Nothing here asserts that no programme exists; it records what a buyer can establish before contacting sales. Ask which attestations are held with their audit periods and auditors, what advanced security comprises at the upper tier and what the standard tier omits, and for a completed security questionnaire.

The entry product is priced properly and the product the company is built around is not. For identification the vendor publishes a range of three hundred and ninety nine to nine hundred and ninety nine dollars a month, states plainly that it scales with the volume of identified visitors, bills month to month with no commitment, and offers a fourteen day free trial, so a buyer can size, try and leave without a conversation.

It also removes a common trap by stating outright that the upper product includes everything in the lower one so a customer does not need both, and that upgrades and volume levels can be adjusted at any time. That is genuine clarity and it is why this is not a lower grade.

The problem is that the advertising product carries the positioning and publishes only a floor: three thousand dollars a month on an annual commitment, with no ladder, no statement of what audience count or spend moves the price, and no upper bound. Third party accounts put a combined deployment at four to five thousand dollars a month, and one competitor states an entry commitment above forty thousand dollars a year paid in advance, none of which the vendor confirms or contradicts.

So a buyer can budget the part that costs hundreds and cannot budget the part that costs tens of thousands. Ask what drives the advertising tier above its floor, what the annual commitment terms are, and what advanced security adds at the quoted tier.

Leaving the entry product is easy and leaving the platform is undescribed. Identification is sold month to month with no commitment and a free trial, so there is no contractual lock at that level, and identified contacts sync continuously into the customer's own record platform, which means the most operationally useful output already sits somewhere the customer owns and keeps. Both are real and neither is the whole picture.

The advertising product carries a twelve month commitment reported as payable in advance, which is a materially different exit position from the one the entry price implies. Nothing published states what a departing customer receives for identified visitor history, segments, audience definitions, intent bands or the visitor feed, in what format, or over what period, and no post termination retention or deletion timeline appears for records about the individuals identified.

One question is specific to this architecture: audiences that were synced live inside the advertising platforms, so what persists there after the subscription ends, and whether the customer may continue targeting people identified during the term, is a licensing question the published material does not reach. Ask what exports at termination and in what format, what happens to synced audiences already in the advertising platforms, and what is deleted and when.

The platform operates no sending infrastructure, so this axis applies by scope rather than in substance, and the grade records that honestly rather than penalising the vendor for a capability it does not claim. No email or message leaves the product. Identified contacts are pushed into advertising platforms and into the customer's record platform, and any sending that follows is performed by tools the customer buys separately and configures themselves.

Two adjacent points are worth a buyer's attention even so. Contacts arrive in the record platform having been identified rather than having opted in or supplied an address, so if they are subsequently swept into a sequence the sending reputation risk transfers entirely to the customer, and nothing in the product flags an identified contact as such once it lands.

And no address validation step is described in the identification path, so whether a contact identified through a hashed email match carries a currently deliverable address is unstated. Ask whether identified contacts are marked in the record platform to distinguish them from opted in contacts, and whether any address validation occurs before sync.

A vendor that narrowed its own stated market is unusual enough to note, and the constraints here are mostly published rather than discovered. During late 2025 the vendor dropped sales and outbound use cases and repackaged around demand generation, which is a company telling buyers what it has stopped doing, and it saves an evaluation cycle for anyone arriving with an outbound problem.

The two product structure maps to two distinct buyers, marketing teams wanting visibility at the lower price and performance teams running paid campaigns at the higher one, and the vendor states which is for whom. Coverage boundaries follow from the architecture and are traceable: the identification rate of fifteen to thirty percent implies that low traffic sites will not generate workable volume, and the jurisdictional geofence means European traffic is materially less well served, which independent reviewers describe as a real limitation for buyers with European pipelines.

Held below the top band because the vendor states neither boundary as a threshold. No minimum monthly traffic figure is published, though third parties suggest one, and the geofence is described as a principle without the territory list that would let a buyer calculate their own coverage. Ask what monthly traffic the entry tier assumes to be worth deploying, and for the list of jurisdictions where identification operates.