How This Briefing Works
This report opens with key findings, then maps the gaps between what SalesIntel discloses and what BLACKOUT observed at runtime. From there: what it means for your organization, what to do about it, and the detection data and evidence underneath.
Key Findings
Analysis pending. Findings will appear here once intelligence collection is complete.
Claims vs. Observed Behavior
accuracy
“95% data accuracy guaranteed with human verification”
Accuracy claim applies at point of verification — 90-day refresh cycle means data can be stale for up to three months between checks
compliance
“Full GDPR, CCPA, and APEC CBPR compliance”
Crowdsourced collection model creates inherent tension with GDPR consent requirements — individuals never interact with SalesIntel directly
transparency
“Personal information is never shared”
The entire product is built on sharing professional contact information; the line between personal and professional data is increasingly contested by regulators
pending
“Every data source tracked since inception”
Awaiting scanner verification of RevDriver runtime behavior, data transmission patterns, and third-party network requests
What This Means For You
What To Do About It
Role-specific actions based on observed behavior
Recommended Actions for SalesIntel
- →- Audit your organization's SalesIntel data usage to understand which contacts were sourced through crowdsourcing versus direct research - Review RevDriver deployment across your sales team and assess whether contributing data back to SalesIntel's shared pool aligns with your data governance policies - Request SalesIntel's data provenance documentation for contacts you've purchased to verify consent chain integrity - Implement a suppression list workflow to honor opt-out requests from individuals whose data was obtained through SalesIntel - Evaluate whether your GDPR legitimate interest basis is defensible for outreach to contacts who never consented to being in SalesIntel's database
Negotiation Leverage
- →SalesIntel's value proposition depends on data freshness and accuracy, so negotiate for contractual accuracy guarantees with financial remedies (not just credit refunds) for data quality failures. Request written data provenance attestations for any contacts your organization uses — SalesIntel claims to track every source since inception, so they should be able to provide this documentation.
- →Insist on contractual indemnification for regulatory actions resulting from SalesIntel-sourced data. The crowdsourced collection model places the initial consent burden on SalesIntel, and your contract should reflect that. Negotiate for explicit exclusion of your organization's data from the shared contributor pool if you deploy RevDriver — the default bidirectional data flow may not align with your data governance requirements. Push for annual compliance audit results and SOC 2 Type 2 (not just Type 1) certification as a condition of renewal.
Runtime Detections
BLACKOUT observed this vendor's JavaScript executing in a live browser and classified each hostile behavior using our BTI-C (Behavioral Threat Intelligence — Capability) taxonomy. These are not theoretical risks — each code below was triggered by something we watched this vendor's code actually do.
Keystroke/mouse tracking
Impact: SalesIntel operates as a data broker, aggregating contact information from crowdsourced contributors, third-party partnerships, and public sources, then redistributing enriched records to subscribing organizations. This creates a multi-party data sharing ecosystem.
Full session replay
Identity stitching
Ignoring CMP signals
Impact: Individuals whose data appears in SalesIntel's database never consented to being cataloged or contacted. The consent chain relies on contributor agreement terms, not data subject consent, creating a structural gap in consent provenance.
PII deanonymization
Container/loader (neutral)
IOC Manifest
Indicators of compromise across 4 categories. Use for detection rules, CSP policies, or Pi-hole blocklists.
Ecosystem & Supply Chain
Evidence Artifacts
Artifacts collected during analysis, available with evidence-tier access.
Complete network capture with all requests and responses
68 detection signatures across scripts, domains, cookies, and network endpoints