Bardeen

The headline integrations fail the threshold clause outright: they hand a result back to a person rather than letting the agent take authenticated action. The vendor's integrations page displays Salesforce, HubSpot, Pipedrive, Apollo, Outreach, Salesloft, Lemlist, Monday.com, SmartSuite, ClickUp and Zoho, but the copy says data is pushed to those tools or any platform that supports CSV, and every how-to link beside the logos points at the destination vendor's own CSV import documentation.

That is a file export the customer imports by hand. What remains is authenticated but short and fixed: export into Google Sheets, Airtable and Notion, and OAuth connections to Gmail, Google Drive, Google Calendar, Google Sheets, Zoom and Slack, with no custom connector or user-defined action documented. Downgraded from an April Full that carried no vendor evidence and claimed over a hundred apps.

Sourcebardeen.ai/integrations and bardeen.ai/securityread 2026-09-01

Multi-step automation is real but shallow. Playbooks chain actions and are built in Bardeen Studio, where AI actions such as the Qualifier and the Text Generator are wired in alongside scraping and export steps, and Autobooks run the same chains on a schedule or trigger.

Held at Partial because the composition surface is thin against this axis: no branching or conditional logic, no error handling or retry behaviour, no sub-workflow composition and nothing multi-agent was documented on any page reached.

The pipeline the vendor markets is a fixed shape, scrape then qualify or generate then export, rather than an orchestration layer the customer designs freely.

Sourcebardeen.ai/ai, bardeen.ai/integrations and bardeen.ai/securityread 2026-09-01

Grounding runs on the public web rather than on the customer's own knowledge. Web Scraper extracts from live pages, Web Search replaces manual lookups, and Enrichment resolves contact details against external providers. Import from Google Sheets, Notion and Airtable is data movement into a scraping run, not a maintained retrieval structure the agent grounds on.

No knowledge base, no document or file ingestion, no vector store and no persistent corpus of customer material was reached across the product pages, integrations catalogue or security page. Qualification criteria the customer types into the AI Qualifier are per-run instructions rather than a grounding source. Confidence normalised from a non-canonical value; the grade is unchanged.

Sourcebardeen.ai/ai, bardeen.ai/scraper and bardeen.ai/integrationsread 2026-09-01

No shipped approval or guardrail mechanism is documented. Oversight here is structural rather than gated: automations are invoked by the user from the page they are on and most run in the user's own open browser, so a person is present by architecture. That is the operating mode, not a mechanism the vendor ships. No per-action approval step, no run-confirmation gate, no permission scoping over what an automation may touch and no configurable guardrail was reached across the product pages, integrations catalogue, security page or site FAQ.

Notably the same company's separate product does advertise pause-for-review checkpoints and escalation paths as differentiators, which cannot be credited to this record. Graded from a pass that reached first-party material and returned empty on this axis rather than from a failed pass; the help centre at support.bardeen.ai was not opened and would settle it. Downgraded from an April Full that carried no vendor evidence.

Sourcebardeen.ai, bardeen.ai/integrations and bardeen.ai/securityread 2026-09-01

Attestation is strong and the control surface is absent, which is the opposite failure to most records at this grade. Certified: AICPA SOC 2 Type 2 since 1 April 2024, CASA Tier 2 and Tier 3 against the App Defense Alliance assessment built on OWASP ASVS, and GDPR adherence, all badged on the site.

Engineering practice is documented in unusual detail: TLS 1.2 in transit, 256-bit AES at rest, infrastructure as code with versioned changes, peer review on all code changes, automated vulnerability scanning, and a published security contact for vulnerability disclosure.

What is not documented anywhere on the security page, the FAQ or the product pages is a customer-facing identity or governance control: no SSO, no SAML, no role-based access, no audit log and no permission model, on a product the pricing describes as including unlimited users.

One defect on the governance surface itself: the security page links its privacy policy and contact address to a different domain, getwiq.ai, while the site footer links to bardeen.ai/privacy-policy, so the two routes a buyer would take to the same policy disagree. Partial because the convention requires attestation plus at least one named customer-facing control for Full. Downgraded from an April Full that carried no vendor evidence.

Sourcebardeen.ai/securityread 2026-09-01

The AI Qualifier is documented as showing its work when it scores a lead against the customer's criteria, which is per-run explainability over the one decision the product makes autonomously, and that is what holds this cell above the floor.

Held at Partial because nothing wider is documented: no run history, no execution log across Playbooks and Autobooks, no audit trail over who ran what, and no failure or error surface the customer inspects was reached on either pass.

The extensive logging the security page describes is vendor-side telemetry through Amplitude, Statsig and Sentry, collected explicitly without user data, and is not a customer surface.

Sourcebardeen.ai/ai and bardeen.ai/securityread 2026-09-01

State persists on the customer's own machine: scraped and connected-app data is held in local browser storage across sessions, with the extension declaring the unlimitedStorage permission because the default cap is too small for the data volumes involved, and browser history and bookmarks are read locally to suggest relevant automations. Held at Partial because the persistence is a cache and a configuration store rather than agent memory.

Playbook and Autobook definitions held server-side are customer-authored configuration, which this axis excludes, and the vendor states explicitly that a cloud instance running an automation with the browser closed has no storage capability and erases all data once the run finishes. No accumulation across runs and no memory the agent writes to and reads back is documented.

Sourcebardeen.ai/securityread 2026-09-01

Execution happens on the customer's own machine and the vendor documents the data path in detail. App data from connected applications is persisted only in local browser storage and never on vendor cloud servers, with the exchange running directly between the customer's browser and the third-party application.

Where automations are set to run with the browser closed, a cloud instance is created per trigger and the vendor states it has no storage capability, so all data is erased once the run completes. Only connected-app configurations and playbook definitions are held server-side. Graded Full on customer-environment execution, the browser-extension form of on-premises. The limitation, stated plainly: there is no region selection for the metadata that is stored, no VPC option and no self-hosted backend.

Sourcebardeen.ai/securityread 2026-09-01

A browsable template catalogue is published at bardeen.ai/templates, carries a top-level slot in the site navigation, and is filterable by target website, with GitHub, YouTube, Crunchbase, Monster, Upwork, Product Hunt, Realtor, Facebook, Instagram and Zillow surfaced directly in the footer and a show-all view behind them.

These are packaged scrapers and automations a customer adopts and runs rather than configurations the vendor assembles for them. Six packaged vertical solution sets sit alongside the catalogue for solopreneurs, music, real estate, recruiting, private equity and event services. This is the browsable catalogue the Pack bar treats as evidence, and it is the thing the two GTM records reviewed before this one lacked.

Sourcebardeen.ai/templatesread 2026-09-01

The agent starts without a person prompting it. Autobooks run on a schedule or when a condition is met, with the vendor giving an inbound email as the worked example, and on paid plans those runs continue with the browser closed by spawning a cloud instance each time the condition fires. Both a schedule and an inbox rule are named trigger types.

On the channel side the agent meets the user in the browser where the work is already happening, overlaying its interface on the page in view, with browser notifications for time-sensitive prompts and a custom context-menu entry, and it reaches into Gmail, Google Calendar and Slack through OAuth. Manual invocation from the page sits alongside those rather than replacing them. The published Partial marker, one surface with no event triggers and no way into email or a team channel, does not apply here.

Sourcebardeen.ai/security and bardeen.ai/integrationsread 2026-09-01

The AI Tools page states that large language models are used to categorise leads and compose outreach, which confirms models are in the product but names none of them. No provider is disclosed anywhere on the product pages, the integrations catalogue or the security page, and no model selector, per-automation model choice, bring-your-own-key or routing control is offered to the customer.

The security page enumerates the third-party services the vendor uses for telemetry, A/B testing and crash reporting but lists no model provider, so even the sub-processor route gives nothing. Not documented as first-class, with the absence inferred from silence rather than from a stated single provider. Confidence normalised from a non-canonical value; the grade is unchanged.

Sourcebardeen.ai/ai and bardeen.ai/securityread 2026-09-01

No API, SDK, MCP server or webhook is documented. The product pages, the integrations catalogue, the security page and the site FAQ were all read: the only routes in or out are the Chrome extension itself, OAuth connections to a short list of apps, and CSV export. The extension is a distribution surface rather than an interface the customer's own systems can call, and CSV is a file format.

Worth recording that the same company's separate product does ship an MCP server and advertises being callable from Claude, Workato and Copilot, which belongs to that product and not to this record. Graded from a pass that reached first-party material and returned empty on this axis rather than from a failed pass; the help centre at support.bardeen.ai was not opened. Downgraded from an April Partial that carried no vendor evidence.

Sourcebardeen.ai/integrations, bardeen.ai/ai and bardeen.ai/securityread 2026-09-01

Nothing the customer can test, debug or optimise is documented. No evaluation surface, scored run, comparison between two versions of a scraper or automation, dry-run or preview mode before an Autobook goes live, and no accuracy measurement over extracted or qualified data was reached across the product pages, integrations catalogue, security page or FAQ.

The nearest thing is the AI Qualifier stating that it shows its work, which is per-run explainability credited on Observability rather than a test the customer runs, and it is spent there. Graded from a pass that reached first-party material and returned empty on this axis rather than from a failed pass; the help centre at support.bardeen.ai was not opened. Downgraded from an April Partial that carried no vendor evidence.

Sourcebardeen.ai/ai and bardeen.ai/scraperread 2026-09-01

The clearest positive case for this axis in the lane.

The product is a Chrome extension that operates sites the vendor does not control and that expose no programmatic interface, and the vendor documents exactly how: host permission to lay its own interface over whatever page the user is browsing, activeTab and tabs permissions to open, close and switch browser tabs and to run background scraping, capture page snapshots, and webNavigation to drive OAuth flows.

Point-and-click selection extracts structured data from any page, and the vendor positions this as its defining design choice, since running inside the browser lets it act on web apps that publish no API. Sourcing runs against live sites rather than a static database.

Sourcebardeen.ai/security and bardeen.ai/scraperread 2026-09-01