Vector

A matching and distribution product with a model layer bolted above it. The identification step is deterministic rather than inferred: the vendor states it reads a device fingerprint and looks for a match in a pre existing identity graph, which is a lookup against a table, and a lookup does not become inference because the company describes itself as an artificial intelligence platform.

Audience construction is rule driven from behaviour, and syncing to advertising platforms is integration work. Strip the model layer and the whole product remains: identification, audience building and activation all continue to function.

The vendor's own positioning supports this reading rather than contradicting it, since it frames the artificial intelligence as augmenting marketers through orchestration and infrastructure reliability rather than replacing campaign work, which is a claim about workflow rather than about a model doing the job.

The one genuinely modelled component is intent scoring, and the vendor simplified that during 2025 from a numeric output to three bands, which is a reduction in modelled sophistication rather than an increase. Founded 2022, which sits at the boundary of the vintage split, and the product shape rather than the founding year decides it here. Ask what the intent bands are computed from, and which capabilities depend on a model at all.

Audiences assemble and refresh themselves, and nothing published describes what governs that. The vendor states that audiences update dynamically as buyer interest changes rather than requiring rebuilds, that visitor feeds and audience syncing are automated, and that reporting refreshes on a short cycle, so the system adds and removes named individuals from live advertising campaigns without a person approving each change.

That is a lower blast radius than an agent that writes and sends, because the output is an advertising impression rather than a message purporting to come from a colleague, and it is not zero: a named person is being placed into a targeting pool by an automated decision.

Nothing published describes a review step before a person enters an audience, a ceiling on audience size or spend, an exclusion mechanism for individuals a customer does not want targeted, a suppression route for someone who objects, or what halts a sync already running. Segment construction is operator configured, which is a real control over the input, and it is the only one described. Ask whether an individual can be excluded from all audiences, what stops a sync, and whether audience changes can be reviewed before they reach the advertising platform.

One honest simplification and no disclosure underneath it. The vendor moved its intent scoring during 2025 from a finer output to three bands of high, medium and low, and reducing a score to the precision it can actually support is better practice than the spurious two decimal confidence figures common in this category, so the change is worth recording as a positive. Beyond that nothing is published.

No model provider, family or version is named, no model card exists, no evaluation or accuracy figure appears for the scoring or for identity matching, and nothing describes what inputs produce a high band rather than a medium one. The consequence is specific rather than abstract: the band determines whether a named individual enters an advertising audience and how a customer spends against them, so an unexplained score is directly deciding who gets targeted and at what cost.

A protocol server shipped during 2026 pushes the platform's data into general purpose assistants, which discloses a distribution route rather than anything about the models inside the product. Ask what inputs and weights produce each intent band, how often the banding is recalibrated, and what evaluation covers identity match accuracy.

The vendor publishes its own ceiling, which is rare, and publishes nothing about how the number was reached, which is the usual problem. Stated on its own product pages is that the platform surfaces fifteen to thirty percent of traffic at contact level, so a buyer is told upfront that seventy to eighty five percent of their visitors will not be identified. Almost no vendor in this category volunteers its miss rate, and this index should say so.

Reported alongside it are advertising audience match rates of fifty five to seventy percent, rising to ninety on one platform for certain profile fits. What is missing is everything that would make those figures assessable: no population, no period, no method, no definition of what counts as an identification, and no statement of how traffic composition affects the range, which matters because the range doubles from its floor to its ceiling and a buyer at the bottom of it is buying a materially different product from one at the top.

Customer evidence is testimonial with one named marketing leader reporting a click through rate on a single channel. Independent review aggregation is thin, which reviewers themselves note. Ask how the identification rate is measured and across what population, what drives the difference between fifteen and thirty percent, and what the rate is for traffic matching the buyer's own geography and profile.

Three named compliance mechanisms, one of them architectural, which is more than any comparable identification product in this index publishes. The strongest is a jurisdictional restriction: the vendor states it geofences the technology to jurisdictions operating on an implied opt in basis, so territories requiring express prior consent are excluded from identification by design rather than by policy.

A control that prevents the collection cannot be forgotten by an operator, and independent reviewers describe the resulting coverage limitation in Europe as a real constraint on the product, which corroborates that the geofence is operating rather than merely stated. Second, the vendor states that a customer may place the technology behind a consent management platform to gate it further, giving the customer a second lever over their own visitors.

Third, it states plainly that it requires customers to update their own privacy policy and consent platform, which allocates an obligation rather than leaving it ambiguous. Held below the top band because the specifics are not published: no list of the jurisdictions the geofence admits, no statement of the legal analysis behind the implied opt in characterisation, no description of what happens to a visitor whose location cannot be determined, and no regulatory or counsel opinion referenced. Ask which jurisdictions are included, how location is determined, and what the vendor requires a customer's privacy policy to say.

The collection method is described concretely enough to be argued with, which on this axis is worth more than a page of assurances. The vendor states that it operates a network of publishers who disclose, collect and share their own first party data in the form of hashed email addresses and associated device fingerprints, that on a visit it examines only the device fingerprint to seek a match in a pre existing identity graph, and that a customer's own visitors are not contributed back into that shared pool.

Each of those is a checkable design claim rather than a sentiment, and the last is a real commitment because it means using the product does not make the customer a supplier to it. One tension belongs on the record and is stated here without inference about intent.

The vendor's marketing describes privacy safe data sources and notes that it uses neither form fills nor third party cookies, while the method it describes elsewhere rests on device fingerprinting, which is the technique that identifies a browser without a cookie and which a person cannot clear or reset in the way they can clear a cookie. Both statements are true and a reader should hold them together.

Held below the top band on instruments rather than method: no processing agreement, subprocessor list, transfer mechanism, retention period or data protection contact was located on this pass. Ask for the processing agreement and subprocessor list, the retention period for identity graph records and identified visitor history, and how an identified individual exercises rights over data held about them.

A described supply chain and an apparent warranty of rights, which together put this above a cohort that mostly names nothing. The vendor states that the identity graph is built from a proprietary network of publishers who properly disclose, collect and share their own first party data, names the data types as hashed email addresses and device fingerprints, and describes the graph as compliantly sourced and pre existing rather than assembled from the customer's traffic.

It also states that it warrants the rights for the data it supplies, which is a contractual position rather than a marketing assertion and is the second strongest form of evidence this index recognises. Very few records here carry any warranty on provenance at all. Three things hold it below the top band. No publisher, aggregator or data partner is named anywhere, so the chain is described in shape but not in fact and cannot be independently evaluated.

The warranty language was truncated in the retrieved page so its scope, exclusions and remedy are unestablished. And a second supply route is mentioned only in passing, where audiences are matched against verified contacts from data partners, with those partners unnamed and their basis undescribed. Ask which publishers and data partners supply the graph, for the full text and scope of the rights warranty, and what indemnity attaches to it.

Activation runs through the advertising platforms' own audience interfaces, which is the sanctioned route by construction, and that is where this convention places the middle band. Identified contacts are synced as audiences into several major advertising and social platforms, each of which provides a documented interface for exactly this purpose, so nothing here scrapes a professional network, drives a browser extension against one, automates a user's account or operates multiple identities.

The exposures that separate this category fastest do not arise. Identification itself runs on the vendor's own publisher network rather than on any platform's data, which removes a second common exposure. Held below the top band because a real question sits unaddressed.

Uploading a custom audience to these platforms generally requires the advertiser to represent that they collected the data lawfully and gave appropriate notice, and here the advertiser is supplying individuals they never collected and never contacted, identified by a third party. Nothing published states what representation the customer is making when they sync, whether the vendor's rights warranty extends to that use, or what happens if a platform challenges an audience. Ask what the customer represents to each advertising platform on upload, and whether the vendor indemnifies that representation.

A new route was built for identified people's data to leave the platform into general purpose models, and nothing published governs it. During 2026 the vendor shipped a protocol server that brings its data into widely used assistants, which means records identifying named individuals, their employer, their role and their browsing behaviour can flow into third party model providers through a customer's own assistant.

That is a genuine stewardship question created by a deliberate product decision, and no accompanying material states what may be sent, whether any field is withheld, what the customer's provider does with it, or whether the vendor takes any position on the practice.

Around it the ordinary gaps: nothing states whether identified visitor data or intent signals train or tune any model, no provider is named, no retention applies to model inputs and outputs as distinct from stored records, and no governance document, evaluation record or red teaming artifact was located. The corpus is people who never contacted anyone and do not know the platform exists. Ask what data the protocol server exposes, whether any field is excluded, whether identified visitor data trains any model, and what retention applies.

The identified person is not told, and what reaches them is an advertisement rather than a message pretending to be a colleague, which is the distinction that separates this from the bottom of the scale. A visitor is resolved to a named individual without their knowledge and placed into targeting pools, and nothing published states what they would be told if they asked how they came to be targeted. Set against that are three things.

The output is an advertising impression on platforms that operate their own advertising preference and opt out controls, so the person retains a route to limit targeting that exists independently of this vendor. The vendor requires its customers to update their own privacy policy and consent platform, which is a disclosure obligation placed on the party that has the relationship.

And the jurisdictional geofence removes the territories where identification without express consent would be least defensible. This is where the comparison to the other deanonymization record in this index matters, because that one resolved visitors and then engaged them directly with automated chat, machine written follow up and outbound sequences with no disclosure position at all, which is why it sits a band lower. Ask what a person is told if they ask why they are seeing these advertisements, and whether an identified individual can be suppressed on request.

Contacts and in market signals sync to Salesforce and HubSpot, each with setup documentation, and Slack receives alerts when an ideal visitor lands or a tracked account fires a signal. Audiences push to LinkedIn Ads, Google Ads and Meta Ads. Vector MCP connects the data to Claude and ChatGPT, and a partner API delivers identity events by webhook within a second, keyed to a partner tenant so a platform can route each of its own customers' data separately. Sync direction, object mapping and failure handling for the CRM integrations are not described on the integrations page.

Collection scope is stated and the storage question is not answered anywhere reached. The vendor is unusually clear about which jurisdictions it will operate in, restricting identification to territories with an implied opt in basis, so a buyer knows where the technology runs. Where the resulting data then lives is a separate question and nothing published addresses it. No hosting provider, region, tenancy model, residency election or recovery objective was located on this pass.

That gap carries weight in proportion to the corpus rather than the company size, because the platform stores an identity graph assembled from a publisher network, identified visitor histories tied to named individuals, and the audiences built from them, none of which belongs to the customer or to the people in it. A buyer whose own regulator asks where their site visitors' identities are held cannot answer from anything published. Ask which provider and regions host the identity graph and the identified visitor records, whether any regional processing option exists, and what the tenancy and recovery position is.

A security page exists and it is about privacy method rather than security posture. The vendor publishes a page addressed explicitly to security and legal reviewers, which is the right instinct and better than the marketing page most vendors offer, and its content is a clear account of how identification works, where it is geofenced, and what the customer must do about their own policy. What a security review actually asks for is not there.

No attestation or certification is named, no audit period, auditor or report is offered, no penetration testing statement appears, no enumerated control description covers encryption, access management or monitoring, and no vulnerability disclosure route was located on this pass.

Advanced security appears instead as a differentiator of the quoted upper tier, which makes at least part of the security posture a function of what the customer spends, a pattern this project has now recorded on three separate records. Nothing here asserts that no programme exists; it records what a buyer can establish before contacting sales. Ask which attestations are held with their audit periods and auditors, what advanced security comprises at the upper tier and what the standard tier omits, and for a completed security questionnaire.

Vector prices the whole platform as one annual contract and publishes three presets: Starter at $36,000 a year for a team running account based marketing on a few hundred target accounts, Growth at $60,000 for a team working a full territory with sales and ads in play, and Scale at $96,000 for a revenue organization covering thousands of accounts across regions. Seats are unlimited, and journeys, Stories attribution, sales notifications, integrations and SSO carry no extra charge.

Signals, scoring and advertising are priced by usage, measured in target accounts scored, signal volume and audience size, and the rates behind that usage are not published; the contract is sized from the buyer's own account list and traffic in a demo.

Vector is sold on an annual contract, so there is no month to month exit. Identified contacts sync into the customer's Salesforce or HubSpot and alerts land in Slack, which leaves the most used output in systems the customer owns. Nothing published states what a departing customer receives of identified visitor history, account scores, journeys or audience definitions, in what format or for how long, or what is deleted after termination. Audiences already synced to LinkedIn, Google and Meta sit inside those platforms, and the terms for using people identified during the contract after it ends are not described.

The platform operates no sending infrastructure, so this axis applies by scope rather than in substance, and the grade records that honestly rather than penalising the vendor for a capability it does not claim. No email or message leaves the product. Identified contacts are pushed into advertising platforms and into the customer's record platform, and any sending that follows is performed by tools the customer buys separately and configures themselves.

Two adjacent points are worth a buyer's attention even so. Contacts arrive in the record platform having been identified rather than having opted in or supplied an address, so if they are subsequently swept into a sequence the sending reputation risk transfers entirely to the customer, and nothing in the product flags an identified contact as such once it lands.

And no address validation step is described in the identification path, so whether a contact identified through a hashed email match carries a currently deliverable address is unstated. Ask whether identified contacts are marked in the record platform to distinguish them from opted in contacts, and whether any address validation occurs before sync.

Vector states who each preset is for: a team running account based marketing on a few hundred target accounts, a team working a full territory with sales and advertising in play, and a revenue organization covering thousands of accounts across regions. Its solution pages address account based marketing, demand generation, operations and marketing leaders, and sales notifications keep reps in the loop on tracked accounts.

Identification runs only where an implied opt in basis applies, so European traffic is served less fully, and the list of covered jurisdictions is not published. The entry contract starts at $36,000 a year.