Evaluating · Eleven questions · 16 August 2026

How to evaluate a B2B data platform

Finding customers is usually the hardest part of building anything, so the market for helping you do it is crowded and the demos all look the same. Here are eleven questions that separate them. Each one is answerable with a number or a yes, each is uncomfortable for most vendors to answer, and we have answered all eleven about ourselves below — including the two where our answer is worse than we would like.

Take this list to whoever you are evaluating, including us.

1. Where did this record come from? Not the category — this one.

Almost every vendor lists sources in the abstract: “registries, public web, licensed providers”. The real question is whether they can tell you, for a specific person in front of you, which of those it was. If they cannot, they cannot answer a subject access request, and neither can you once you have used it.

Forgeby: recorded per record, 98.9% coverage. The four categories are named on the privacy policy. Roughly half is licensed, and we say so rather than claiming everything is public.

2. Have the people in the database been told they are in it?

This is Article 14, and it is where most B2B data vendors are exposed. The exemption for disproportionate effort applies only if the information is published instead. The penalties in this area landed on companies that had neither route.

Forgeby: published in seven languages, each naming the local supervisory authority alongside Sweden's IMY. Measured 15 August 2026: 336,295 of 338,265 covered. The remaining 1,970 have no resolved country, so no language can be chosen for them, and we would rather report that than round it away.

3. Is the technology signal measured, or inferred from a homepage?

“Runs AWS” can mean the vendor resolved the infrastructure, or that a model read the website and guessed. The two are not close, and only one survives a conversation with the prospect's own engineer.

Forgeby: measured from the outside. When we cannot measure it, the record says unknown rather than guessing. A homepage-grounded guess is never allowed to overwrite a measured verdict.

4. Does an opt-out survive the next import?

The common failure is not ignoring an objection. It is honouring it, then re-importing the same person from the same supplier six weeks later and starting again. Ask what happens on the next load.

Forgeby: enforced in the database, not in a process. The contact details are stripped and the objection is recorded, so a later import cannot resurrect the person. ⛔ We suppress rather than delete on purpose: erasing the row would erase the fact that they objected. If you would rather have full erasure, ask and we will explain exactly what remains.

5. Is the headcount a real number or a model's opinion?

Size drives every segmentation you will build. Some vendors report a confident employee count that is a language model's estimate with a “reasoning” field attached.

Forgeby: derived from payroll against official statistics, per country, or absent. We would rather show a gap than a plausible number.

6. Which channel is lawful in which country — and does the product know?

Consent and objection rules differ by market. A platform that treats Denmark like Sweden will eventually have you doing something you should not, at scale, politely.

Forgeby: lawful channel is a field on the record, per country. Some markets are call-first and the product will not offer you email there. National advertising opt-out registers are honoured as suppression.

7. Who is the data controller — really?

Several vendors declare themselves a processor for the database itself and hand every obligation to the customer. Read their policy for the word “processor”. If they are not the controller of the library, you are, for data you never collected.

Forgeby: we are the controller for the library, we published the Article 14 notice for it, and we answer the requests that come to us. You are the controller of your own outreach: the message is yours. Where we process your own data on your behalf, we act as your processor. The split is written into the data processing agreement (section 1) and in section 6 of our compliance answers.

8. Whose name is on the email?

Ask to see a real send. Some platforms deliver from pre-warmed mailboxes under invented names, so the first thing your prospect reads is a colleague of yours who does not exist. That fails the identification requirement in Swedish marketing law, and it puts your logo on it.

Forgeby: every email leaves from your own mailbox, signed by a real person at your company. We keep the receipt, never the identity. This one is not a setting.

9. What does the platform admit it does not have?

A vendor that reports only coverage is reporting half a number. Ask for the denominator, and for the count of records that failed whatever bar they just quoted.

Forgeby: the counts on this site carry the date they were measured and degrade to a floor when the live read fails, rather than showing a remembered figure. The gaps above are published with the wins.

10. Where does the data rest, and what AI touches it?

“EU hosted” often means the database. Ask separately about the model calls, which are where your prospect list actually travels.

Forgeby: data at rest in the EU, Stockholm. AI on EU inference profiles. One model path runs in the United States under standard contractual clauses, for tasks needing live web search; it carries the company being researched and business contact details, and is not used to train models. That is in the privacy policy because it is the kind of thing that should not be discovered later.

11. What are they certified for — today, not soon?

“Preparing for SOC 2” is not a certification. Ask for the report and the date.

Forgeby: none. We hold no security certification and will not imply one is imminent. ISO 27001 is what we design against, and designing against a standard is not being audited to it. If that changes this page will say so, with a date and an auditor.

The two we would rather not print

Question 11 is one: no certification. Question 2 is the other — 1,970 people we cannot reach with a notice in a language we are confident they read. Both are on this page because a framework that only flatters its author is marketing, and you would be right to discount it.

Comparisons are only useful if the same questions go to everyone. Take these to whoever else you are considering. If a vendor cannot answer one of them with a number, that is the answer. Questions about ours: privacy@forgeby.com, or the compliance page for the detail behind each figure.