# Leadfeeder

> Leadfeeder matches the addresses of website visitors against a database of corporate address ranges and shows sales which companies looked at which pages and how often they returned.

- Vendor: Dealfront Group GmbH, Karlsruhe (branded Leadfeeder since 24 March 2026, previously Dealfront)
- Canonical URL: https://www.convios.com/en/toolbox/leadfeeder
- Language version: https://www.convios.com/de/werkzeugkasten/leadfeeder
- Area: Go-to-market & sales · Cluster: visitor identification and buying signals
- Role: Off-the-shelf product · Origin: Established, AI retrofitted
- As of: 2026-08-20 · Reviewed: 2026-08-20 · Author: Dr. Oliver Gausmann, Convios GmbH
- Toolbox: https://www.convios.com/en/toolbox — Markdown: https://www.convios.com/en/toolbox.md

## Verdict

Efficiency only: What you buy is a mapping. Address range to company, plus the interface that turns it into a list of visits. That mapping saves work nobody else does, because it is too tedious. It does not amount to an edge: the same service starts at EUR 79 a month, at SalesViewer in Bochum from EUR 99, and the vendor's database grows for every customer alike, whoever happens to use it. Two things stay in house and decide the value. The first is the follow-through. A company name on a list is not yet a case, and anyone who has not settled what happens after a visit buys a list nobody reads. The second is the identification rate, which depends on conditions you do not control. The vendor writes itself that the number of companies identified sits considerably below the actual number once most visitors decline consent (as at 27 March 2026). Mobile networks, home connections and corporate networks routed through third-party data centres never arrive at all. Then there is the limit of the answer: what gets identified is the company. Who did the reading stays open. The person is still missing for outreach, and buying them in from a second data vendor brings the Article 14 GDPR notification duty and the consent question under Section 7(2) of the Act Against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb, UWG) into the house, neither of which this tool touches. It makes visible who was there. It does not move your position in the market.

## Suitability by company size

- Solo: suitable with caveats — The price works: Lite costs nothing and shows the last 100 identified companies with a seven-day history, Discover starts at EUR 79 a month on annual billing. Users are unlimited on every plan, so there is no per-seat price. The catch sits in your own traffic. At 300 visitors a month you get a handful of identified companies, and for that handful the setup effort with a consent banner, target filters and alerts rarely pays.
- Mid-market: suitable — The fit is right here. Activate sits at EUR 369 a month on annual billing, Scale at EUR 599 and annual only, both with unlimited users and a shared credit pool for enrichment, exports and CRM sync. The job in house is managing consumption, because credits expire at the end of the billing period, and agreeing in the sales team who picks up an identified company within what timeframe. Without that agreement the list drops out of view after six weeks.
- Enterprise: suitable with caveats — Three points hold up a procurement review. Sign-in through your own directory exists only for Microsoft Entra ID, and it can be enforced only once all users sit in the same Leadfeeder company; a SAML connection to Okta or another directory appears nowhere in the documentation (as at 27 March 2026). There is no public commitment on an auditable access log. And the sub-processor list names three US-based large language model providers, while the GDPR sales page promises processing entirely within the EU. That contradiction gets settled before the purchase.

## Vendor staying power

Established: The company is on the commercial register, is owned by a private equity firm and has been acquiring since 2022. For a procurement review one point weighs more than the funding position: the vendor has changed its name twice in four years. Echobot and Leadfeeder became Dealfront in 2022, and Dealfront became Leadfeeder again on 24 March 2026. The legal entity stayed the same, the addresses of the legal documents moved along, and the data processing agreement in its February 2026 version still points to an address under the old brand for the sub-processor list. Anyone archiving contract documents checks after a change like that what their copies still point to.

- Legal entity and seat: Dealfront Group GmbH, Durlacher Allee 73, 76131 Karlsruhe, District Court (Amtsgericht) of Mannheim HRB 744853, share capital EUR 32,734; registered on 6 September 2022, renamed to the current company name on 11 May 2023 (source: https://www.northdata.com/Dealfront%20Group%20GmbH,%20Karlsruhe/Amtsgericht%20Mannheim%20HRB%20744853, as of 2026-08-20)
- Ownership and capital: Great Hill Partners announced a EUR 180m investment on 21 June 2022 to merge Echobot and Leadfeeder, plus a further EUR 50m committed for acquisitions (source: https://www.greathillpartners.com/media/great-hill-partners-invests-180-million-to-merge-echobot-and-leadfeeder-creating-an-innovative-ai-powered-sales-intelligence-and-go-to-market-platform, as of 2026-08-20)
- Acquisition in the market: acquisition of WiredMinds GmbH of Stuttgart, reported on 11 March 2025 by the advising law firm; purchase price not disclosed. The same release mentions EUR 30m in funding raised shortly before, without naming the type of capital (source: https://www.ypog.law/en/press/ypog-advises-dealfront-on-acquisition-of-wiredminds, as of 2026-08-20)
- Management: Kevin McIntyre has been registered as sole managing director since 29 October 2025; the previous managing director Bastian B. Karweg was removed on the same day (source: https://www.northdata.com/Dealfront%20Group%20GmbH,%20Karlsruhe/Amtsgericht%20Mannheim%20HRB%20744853, as of 2026-08-20)
- Brand change: on 24 March 2026 Dealfront became Leadfeeder again; contracting entities, plans and contracts stayed unchanged per the vendor, while the login moved from app.dealfront.com to app.leadfeeder.com. Addresses under dealfront.com answer with a permanent redirect (source: https://www.leadfeeder.com/product-updates/dealfront-is-rebranding-as-leadfeeder-faq/, as of 2026-08-20)
- Security audit evidence: transition to ISO/IEC 27001:2022 announced on 30 July 2025, ahead of the 2013 version being retired; the security page additionally names ISO 27701. Neither page states the certification body or the scope (source: https://www.leadfeeder.com/resources/press-releases/iso-iec-27001-2022-certification/, as of 2026-08-20)

## Cost of leaving

Moderate: The data comes out. Company and visit data can be exported as a feed, on a schedule if wanted, and the CRM sync runs anyway. What is missing after the export is the mapping itself: the list holds company names, while the database of address ranges behind it belongs to the vendor. A successor starts from zero and identifies different companies in the first weeks, because every vendor maintains its own mapping. Then there is the contract: terms of one year or longer renew automatically for the same duration unless notice arrives 30 days before the last day. The work on switching day is manageable, one script out, one in, plus the change in the consent banner.

## Regulation and data

| Point | Finding | Evidence | As of |
|---|---|---|---|
| Data processing agreement | publicly available in full text and incorporated through Section 3.2 of the terms, without signature and without a request — The agreement sits openly available as a document in its February 2026 version and applies under Section 3.2 of the terms without further action. A mutually signed version is available on request. The vendor names itself when it bites: for visitor identification on the customer's website and for connecting a CRM. For its own company database the same vendor acts as controller, and there the agreement expressly does not apply. | evidenced | 2026-08-20 |
| Storage location | Amazon Web Services in the European Union, in Ireland per the vendor, with no plan tied to it — The GDPR page names Amazon Web Services in Ireland as the place of processing, and the privacy notice in its June 2026 version states that data provided by users is stored and processed exclusively on servers within the European Union. The data processing agreement is more careful and speaks of processing primarily in Germany or a member state of the European Union. There is no region to choose, nor is one needed, because no other location is offered. | evidenced | 2026-08-20 |
| Subprocessors | public list with purpose and country per entry, six entries, as at 14 November 2025 — The list is on the open web without a login and names purpose and country per entry: Amazon Web Services for operations in the EU, the two sister companies in Finland and Germany for infrastructure and security, plus Google Cloud EMEA, OpenAI Ireland and Perplexity AI for the language models, those three with the United States as their location. The data processing agreement promises notice before every change, but requires registering on the privacy page to receive it, and grants a 30-day right of termination where a reasoned objection reaches no agreement. Two places carry the same list: the agreement still points to an address under the old brand, the website carries it under the new one. Both respond, yet comparing them before procuring is worth the minute. | evidenced | 2026-08-20 |
| Third-country transfer | transfers to three US language model providers, each based on standard contractual clauses; the vendor's own sales page simultaneously promises processing entirely within the EU — The sub-processor list assigns the United States as the location for Google Cloud EMEA, OpenAI Ireland and Perplexity AI, naming standard contractual clauses as the basis for each. The AI features notice puts it plainly: data is processed primarily within the EU, but with the language model providers in use it may leave the EU. The GDPR page in the same web presence advertises 100 per cent processing within the EU. Both statements have stood side by side since the AI features arrived. The privacy notice additionally names Article 46 GDPR and adequacy decisions as the framework. | partially evidenced | 2026-08-20 |
| Training on customer data | training of the language models on prompts and outputs contractually excluded with all model providers per the vendor; the commitment sits on a notice page — The AI features notice states that all language model providers have contractually agreed that neither the prompts nor the generated outputs are used for training. On customer content it says that, with one feature excepted, it is not passed to the model, and that prompts are deleted or anonymised once the result has been delivered. No period is given. The commitment sits on a vendor notice page; it appears neither in the data processing agreement nor in the terms. | partially evidenced | 2026-08-20 |
| Retention and deletion | return and deletion after termination promised, without a deadline; for MCP server data a maximum of six months after the account is closed — The data processing agreement obliges the vendor to hand over and delete all personal data, documents and work results after the principal agreement ends, with back-up copies and statutory retention duties excepted. It names no deadline. Section 6.3 of the terms promises only reasonable effort to delete on request. Exactly one period is quantified, and it covers a side area: data processed through the MCP server is kept for at most six months after the account is closed, per the privacy notice. | partially evidenced | 2026-08-20 |
| Certifications | ISO/IEC 27001:2022 and ISO 27701 per the vendor, without a certification body and without a scope — The vendor announced the move to the 2022 version of ISO/IEC 27001 on 30 July 2025, and the security page additionally names ISO 27701. Which body audited, which scope is covered and how long the certificates run appears on none of the publicly reachable pages. Named are a private vulnerability reporting programme on HackerOne, encryption in transit and at rest, and a compliance section in the help centre. | partially evidenced | 2026-08-20 |
| EU AI Act, Article 50 | self-classification as not high-risk, with no evidence named and no statement on Article 50 — The AI features notice declares that the features are fully aligned with the principles of the AI Regulation and do not fall under high-risk systems. The vendor names no model documentation, no certification to ISO/IEC 42001 and no commitment on the transparency duties in Article 50 of Regulation (EU) 2024/1689. In practice that is bearable, because the disclosure sits with the deployer anyway: whoever approaches customers off the back of a machine-generated summary decides on the notice themselves. A decision written into your own process replaces the missing commitment. | partially evidenced | 2026-08-20 |
| Audit logging | unclear — Checked were the pricing page with its full plan comparison, the security page, the settings and user management sections of the help centre, and the data processing agreement. Nowhere does it say whether the customer receives an auditable log of access, exports and changes, how long it is kept or whether it can be exported. The agreement obliges the vendor to assist with evidentiary duties and to report breaches, which is not a log inside the product. Anyone planning for evidentiary duties settles this point before signing. | not evidenced | 2026-08-20 |

## Cost

- Entry: Lite costs nothing and shows the last 100 identified companies per month with seven days of history and 20 credits. Discover sits at EUR 79 a month on annual billing and EUR 113 on monthly billing, Activate at EUR 369 and EUR 527 respectively, Scale at EUR 599 and annual only. Enterprise is quoted on request. Users are unlimited on every plan, while the number of identified companies and the credits are tiered within the plans. (as of 2026-08-20)
- Where it gets expensive: Two quantities drive the price, and neither depends on the team. The first is the number of companies identified per month; as site traffic grows, the plan grows with it. The second is the credits for enrichment, exports and CRM sync, a shared pool across all users. Standard credits expire at the end of the contract period with no rollover, while separately purchased ones stay valid for two years. Annual contracts are paid up front, quarterly on Scale. For terms of one year or longer the contract renews automatically for the same duration unless notice arrives 30 days before the end. Overestimating demand means paying twice: once for the plan and once for the credits left to expire.

## Three routes compared

### Buy a German vendor with a public price list

SalesViewer of Bochum is the nearest counterpart in the German-speaking market and bills by identified companies: EUR 99 a month for 50, EUR 339 for 250, EUR 629 for 750, cancellable monthly with 14 days' notice. For small volumes that is dearer, for large ones cheaper. In large corporates, by contrast, identification is rarely bought on its own. It sits inside the data platform already in the house, WebSights in ZoomInfo for instance, and rides along on the existing master agreement. What decides it is one counterparty fewer and a database that carries company identification and contact data in the same interface.

### The AI-native counterpart with outreach in the same tool

Warmly starts at the same point and attaches chat, calls and automatic follow-up directly to the signal. That is paid for on annual terms: USD 10,000 for identification, 20,000 with chat, 30,000 with autonomous follow-up, or USD 4,875 to 9,750 quarterly. Against EUR 79 a month that is a different order of magnitude, and the pricing page says nothing about storage location, processing within the EU or data processing terms. Buying there trades the cheap point solution for a chain of steps in one interface, with the data protection questions negotiated one by one.

### Your own identification on a purchased address database

The build is manageable. PostHog records the sessions in its EU environment, and the resolution from address range to company is bought in as a data source, from IPinfo or IP2Location for instance. The mapping and the scoring are written with Claude Code, run on Cloudflare Pages and Workers, the model calls go through LiteLLM, the keys sit in Infisical, and the result lands in Attio. Costed at EUR 900 a day and 8 to 12 person-days, a workable first version lands between EUR 7,200 and 10,800, plus the subscription for the address database and ongoing operation; that calculation is an estimate. What breaks it is data maintenance. Mobile networks, residential connections, data centres and service provider networks have to be filtered out, or the system reports the same cloud providers as prospects every day. The vendor maintains those exclusion lists for all customers at once; in a self-build one person does it alone. Add the question of who maintains the mapping once the person who built it leaves.

Recommendation by size:

- Solo: Start on Lite and pay only once your own traffic yields enough identified companies.
- Mid-market: Buy it and settle in the same move who picks up an identified company within 24 hours.
- Enterprise: Before signing, settle logging and the contradiction between the EU promise and the US model providers in writing.

## Context

- Implements method: [Inbound-Led Warm Outbound (95/5 Map)](https://www.convios.com/en/methods/inbound-led-warm-outbound) — The method needs a signal for outreach to start from, and visitor identification supplies exactly that signal out of your own web presence.
- Implements method: [GTM Stack Signal Routing](https://www.convios.com/en/methods/gtm-stack-signal-routing) — An identified company is the raw material for the chain, and without settling which workflow fires next, the list just sits there.
- Implements method: [Demand Creation vs. Demand Capture](https://www.convios.com/en/methods/demand-creation-vs-capture) — What gets identified is whoever was already there, so demand captured; the method shows why a second source has to run alongside it.
- Implements method: [The 95:5 Rule](https://www.convios.com/en/methods/95-5-rule) — Identification mostly surfaces the small in-market group and tempts you to overlook the large majority that buys later.
- Alternative: [Clay](https://www.convios.com/en/toolbox/clay)
- Alternative: Attio
- Displaces: Looking up individual visitor addresses by hand, Cold lists with no connection to your own web presence, Web analytics reports that deliver numbers and no names

## Evidence

- Legal entity, seat, register court and number, share capital, registration in 2022, renaming in 2023, change of managing director on 29 October 2025, shareholders — https://www.northdata.com/Dealfront%20Group%20GmbH,%20Karlsruhe/Amtsgericht%20Mannheim%20HRB%20744853 (as of 2026-08-20)
- Brand change on 24 March 2026, unchanged contracting entities Dealfront Group GmbH, Dealfront Germany GmbH and Dealfront Finland Oy, unchanged prices and contracts, relocation of the login — https://www.leadfeeder.com/product-updates/dealfront-is-rebranding-as-leadfeeder-faq/ (as of 2026-08-20)
- Plans, monthly and annual prices, unlimited users, 100 identified companies and seven days of history on Lite, expiry of credits, validity of separately purchased credits — https://www.leadfeeder.com/pricing/ (as of 2026-08-20)
- Controller, address, storage and processing exclusively on servers within the European Union, Article 46 GDPR as the framework, six months' retention for MCP server data, June 2026 version — https://www.leadfeeder.com/privacy/privacy-notice/ (as of 2026-08-20)
- Six sub-processors with purpose and country, among them Google Cloud EMEA, OpenAI Ireland and Perplexity AI located in the United States under standard contractual clauses, as at 14 November 2025 — https://www.leadfeeder.com/privacy/sub-processor-list-leadfeeder/ (as of 2026-08-20)
- Exclusion of training with all model providers, processing primarily within the EU with data possibly leaving the EU at the language models, self-classification as not high-risk under the AI Regulation — https://www.leadfeeder.com/privacy/ai-features-notice/ (as of 2026-08-20)
- Data processing agreement, February 2026 version: notice and objection rights for sub-processors with a 30-day right of termination, processing primarily in Germany or the EU, return and deletion after termination without a deadline, reference to the list under the old brand — https://marketing.dealfront.com/inside-eea-data-processing-agreement-dealfront-en.pdf (as of 2026-08-20)
- Data processing agreement incorporated through Section 3.2 of the terms, without signature, signed version on request, applying to visitor identification and CRM connection — https://help.leadfeeder.com/en/articles/13921491-when-do-we-need-a-dpa-and-how-is-it-concluded (as of 2026-08-20)
- No cookies without consent, identification continues, considerably fewer companies identified, no recognition of returning visitors, address anonymisation configurable — https://help.leadfeeder.com/en/articles/13922292-using-leadfeeder-tracker-with-consent-to-comply-with-gdpr (as of 2026-08-20)
- Authentication methods email and password, Microsoft Entra ID, Google and a one-time login link, enforcement only where all users sit in a single Leadfeeder company, no SAML connection to other directories documented — https://help.leadfeeder.com/en/articles/13922448-authentication-methods (as of 2026-08-20)
- ISO 27001 and ISO 27701 per the vendor, operation on Amazon Web Services within the EU/EEA, encryption in transit and at rest, private vulnerability programme on HackerOne — https://www.leadfeeder.com/security/ (as of 2026-08-20)
- Contract term, automatic renewal for the same duration, notice 30 days before the end, reasonable effort to delete under Section 6.3, incorporation of the data processing agreement — https://www.leadfeeder.com/terms/terms-and-conditions/ (as of 2026-08-20)
- Marketing claim of 100 per cent processing within the EU, Amazon Web Services in Ireland, allocation of processor and controller roles — https://www.leadfeeder.com/gdpr/ (as of 2026-08-20)
- Transition to ISO/IEC 27001:2022, announced on 30 July 2025 — https://www.leadfeeder.com/resources/press-releases/iso-iec-27001-2022-certification/ (as of 2026-08-20)
- EUR 180m investment by Great Hill Partners to merge Echobot and Leadfeeder, announced on 21 June 2022, plus EUR 50m for acquisitions — https://www.greathillpartners.com/media/great-hill-partners-invests-180-million-to-merge-echobot-and-leadfeeder-creating-an-innovative-ai-powered-sales-intelligence-and-go-to-market-platform (as of 2026-08-20)
- Acquisition of WiredMinds GmbH, reported on 11 March 2025, and EUR 30m in funding raised shortly before — https://www.ypog.law/en/press/ypog-advises-dealfront-on-acquisition-of-wiredminds (as of 2026-08-20)
- Prices of the German counterpart SalesViewer by identified companies, cancellable monthly with 14 days' notice — https://www.salesviewer.com/de/preise/ (as of 2026-08-20)
- Annual and quarterly prices of the AI-native counterpart Warmly for identification, chat and autonomous follow-up — https://www.warmly.ai/pricing (as of 2026-08-20)