The Stack, and where each tool keeps your data

• InstantlyHealthy-looking warm-up signals and real inbox placement are not the same thing, and at volume that gap is where campaigns quietly fail.
• HeyReachThe weak point is LinkedIn itself: throttling and restrictions interrupt campaigns even when you stay inside what the tool considers safe limits.
• ClayOnce a table carries several enrichments, waterfalls and AI steps, working out why one row failed and what burned the credits becomes a job of its own.
• ApolloCoverage is not the problem, freshness is. Job changes and titles go stale, so treat it as a starting layer and never as the final verification layer.
• SmartleadOpen rate is the number to ignore here: privacy protection invents opens, image blocking hides real ones, and scanners fire their own.
• LemlistPersonalisation is only worth it when it serves a purpose. On wrong data a merge field does more damage than no personalisation at all.
• ExpandiOrganic reach falling while outreach rises is the earliest warning we have found, and it shows up well before LinkedIn says anything.
• AirscaleThe cost risk is not the first list build, it is the refreshing afterwards. An unwatched refresh schedule is where the spend quietly goes.
• ProspeoMatching the filter is not matching the ICP. A list can satisfy every firmographic and still be the wrong companies entirely.
• FullEnrichThe misses are at the edges, not in mainstream B2B data: very local businesses, recent job changes, blue-collar roles, markets with a thin digital footprint.
• LeadMagicA provider's place in the waterfall is not fixed. Cost, hit rate and the market decide where it sits, and sometimes its job is to validate rather than find.
• AttioNotes are kept short on purpose, because the AI layer reads the CRM too and a wall of prose serves it no better than it serves a person.
• ResendThis is not an outreach tool and we do not treat it like one. No warm-up, no sequences, only the automated messages a system owes someone.
• GrainNothing from a call becomes content until the other person and their company are anonymised and the case is checked for whether it can be used.
• RB2BIt only pays for itself above a certain amount of traffic and intent. Below that the economics do not work, however good the matching is.
• ApifyWe tap it rather than let it run. A scraper pointed at a large database on a schedule is where the cost arrives, usually unnoticed.
• Gojiberry.aiThe signal can be automated. Deciding what it means and whether it deserves an action cannot, and that is still the whole job.

The rest of the market, hosting only

These are tools we do not run, so there is no opinion here and no page for each one. What there is, is the answer to the one question every other directory leaves out: where the vendor itself says your data sits. Each row links to the page we read it on. A tool only appears here if its vendor actually publishes an answer, which is why this list is shorter than it could be.

Of the 22 tools below, 5 keep customer data in the EU according to the vendor's own documents. Every one of those was checked by reading the vendor's page, not a roundup.

Cold email sending

• Woodpecker Part EU France (OVH), backups outside the EU Woodpecker: safety and security
• Mailshake US United States Mailshake: privacy policy
• Reply.io US United States (Microsoft Azure) Reply.io: data processing agreement
• Saleshandy US United States Saleshandy: privacy policy

Deliverability and warm-up

• GlockApps US United States (AWS N. Virginia) GlockApps: data processing agreement

LinkedIn outreach

• La Growth Machine Part EU France and Ireland, some US La Growth Machine: data processing agreement
• PhantomBuster Part EU EEA by default, some US processors PhantomBuster: sub-processors
• Dux-Soup EU European Union, host not named Dux-Soup: GDPR compliance
• Skylead US United Kingdom and United States Skylead: privacy policy
• Closely US United States Closely: privacy policy

Contact data and enrichment

• Dropcontact EU Ireland, France and Germany Dropcontact: data protection agreement
• Kaspr Part EU France (OVH, AWS), US processors Kaspr: personal data charter
• Cognism EU Ireland (AWS eu-west-1) Cognism: sub-processors
• Datagma Part EU EU hosting, US data brokers The hosting is European and the enrichment is not. Datagma's own agreement says enrichment data may go to the United States. Datagma: data processing agreement
• Findymail EU Finland (Hetzner) Findymail: data processing agreement
• Hunter.io EU Belgium (Google Cloud) Hunter.io: data processing agreement
• Lusha Part EU Their own two pages disagree The privacy notice says data is stored on AWS in the United States. The sub-processor page says AWS, Ireland, for hosting. Both are Lusha's pages, and if EU residency is the reason you are buying, this is a question to put in writing before you sign. Lusha: privacy notice Lusha: sub-processors

Sales databases

• ZoomInfo US United States (AWS, Google Cloud) ZoomInfo: sub-processors
• Seamless.ai US United States, region not published Seamless.AI: privacy policy
• RocketReach US United States, region not published RocketReach: privacy policy

CRM

• HubSpot Part EU EU region available (Germany) The region is assigned from your IP address at sign-up rather than chosen, and moving it needs a paid plan. Worth checking which one you actually landed in. HubSpot: cloud infrastructure and data hosting
• Pipedrive Part EU EU region available (DE, IE) Pipedrive says an account can end up in a different data centre than its region suggests, and tells customers to ask support which one they are in. Pipedrive: how secure is my data