What exists at day 30, and whose name is on it

Thirty days into an outbound engagement a set of things exists that did not exist before: sending domains, mailboxes, a prospect list, a live sequence, and a record of who was contacted and how. Eighteen agency and platform contracts were read for this page to answer two questions about that pile. Whose name is on each item, and who pays when one of them causes a problem. Northwell AI answers both the same way, by owning the infrastructure and carrying its risk, and most of the market answers them differently.

The agency builds the list, sends the mail, and hands you the liability

Leadium publishes a genuine Master Services Agreement, which already puts it ahead of most of this market, and section 7 is worth reading slowly. Compliance with “the TCPA (Telephone Consumer Protection Act), CAN-SPAM, GDPR (General Data Protection Regulation), and any and all laws, regulations, rules, or policies applicable to the Services” are, in the contract’s own words, “the sole responsibility of the Customer”.

The same clause states that “Leadium will be contacting prospective clients on behalf of Customer” and that “Customer shall be solely responsible for collecting consents and/or opt-outs by any individual who is a prospective client of Customer”. Leadium sources the list. Leadium sends the message. The customer is solely responsible for the consents behind records the customer never chose, and under section 8 the customer indemnifies Leadium if a claim arrives.

Beanstalk reaches the same allocation through a client warranty rather than a responsibility clause, requiring the client to warrant “that Client has the legal right and authority to authorize the collection, processing, review and/or production of any data”. CIENCE’s privacy policy says it acts “as a processor and process personal information solely on behalf of our business customers”, which by implication makes the client the controller of prospect data CIENCE assembled.

What the contract does	Who ends up answerable
Agency builds the prospect list	Client, for the lawful basis behind it
Agency sends the outreach	Client, for consents and opt-outs
A regulator complains	Client, and the client indemnifies the agency
A prospect exercises a data subject right	Not addressed by any agency contract read here

Zero of the fifteen agencies publish a data processing agreement. Three of the eighteen do, and all three are software vendors rather than agencies. Six companies publish no terms of any kind: Martal Group, Callbox, Growth Engine X, memoryBlue, EBQ and Operatix. Of the fifteen agencies, only three publish a document that governs the paid service at all rather than website use.

What you could actually recover is smaller than the monthly fee

Company	Published liability cap
Cleverly	The lesser of $100 or six months of fees
LeadGenius	”the amount you paid in the last six months or $100, whichever is greater”
SalesHive	”ANY CLAIMS EXCEEDING USD $500 OR THE AMOUNT YOU PAID US IF GREATER”
Beanstalk Consulting	Three months of fees
CIENCE	Twelve months of fees
Leadium	All fees paid, “CUMULATIVE AND NOT PER INCIDENT”
Belkins, Upcall, Pearl Lemon Leads	No cap published, consequential damages excluded

Not one company in eighteen expresses its cap as a multiple of fees. Every published cap is a fraction of fees or a flat floor, and every one of them sits alongside an exclusion of lost profits and consequential loss. CIENCE’s warranty section states it plainly: the services are provided “AS IS” and CIENCE makes no warranty “as to the results that may be obtained from use of the Services”.

Put that against the thing most likely to go wrong. A campaign that damages a domain’s reputation costs a company its transactional mail, and lost profits are exactly the category every one of these contracts excludes. Cleverly’s cap is the sharpest illustration: the lesser of $100 or six months of fees means a client on a $997 monthly plan who suffers a serious problem can recover one hundred dollars.

Nine of eighteen publish no cap at all, which is not better. A missing cap in a document that also disclaims all warranties leaves a client arguing from nothing.

Nine contracts make you indemnify them, three protect you

Three companies publish an indemnity running in the client’s favour, and two of those are software vendors. Beanstalk is the only agency in the set that indemnifies its client for breach, negligence and intellectual property. Nine publish an indemnity running only from client to agency. CIENCE publishes none in either direction.

Upcall’s is the clearest example of regulatory exposure being routed away from the vendor. Its terms require that “Customer shall indemnify and defend Upcall (including for its attorney’s fees) from and against any actual or alleged TCPA or other law violation related to the calls or Services provided hereunder.” Upcall’s own callers place the calls. The customer carries the telephone consumer protection liability for them.

The same document contains the only insurance clause found anywhere in eighteen companies, and it obliges the freelance caller to insure Upcall: “Freelancer User shall obtain, prior to performing any services for Upcall’s Customers, commercially reasonable general liability insurance with a policy limit of at least $1,000,000 and shall list Upcall as an additional insured”. No company in this research publishes that it carries professional indemnity, errors and omissions, or cyber liability cover of its own.

Three questions nobody in the market answers at all

Question	How many of eighteen publish an answer
What happens to the sending domains and mailboxes at the end	0
What happens if the provider ceases trading	0
Whether the provider carries any insurance	0

The first absence matters most, because the domains are the one asset built during those thirty days that carries forward. Beanstalk is the only company that even acknowledges an agency provisions them, classifying them as third party products and saying nothing about their fate. Everyone else is silent, which means the question gets answered by whoever happens to hold the registrar login.

The second absence is unusual for a professional services category. No escrow, no handover obligation, no transition assistance, no wind-down notice. What several contracts do publish is the right to be sold without asking: Leadium’s agreement states that “The Agreement may be assigned by Leadium without Customer’s consent”, while the customer may not assign without Leadium’s consent “in its sole discretion”. A client can be handed to a new owner and cannot leave for the same reason.

What day 30 looks like here

By day 30 a Northwell AI engagement has domains registered and authenticated, mailboxes warmed and sending, a market counted and a list built against it, and a sequence running with results accumulating. Every item on that list is bought, held and paid for by Northwell AI, including the domains, and the risk attached to each stays there.

The allocation is the point rather than a detail of it. A domain that gets blocklisted is Northwell AI’s domain and Northwell AI’s replacement cost. A list built badly is Northwell AI’s problem to rebuild, because no invoice has been raised and none will be until a qualified prospect attends. Nothing in the first thirty days generates a bill, so the client is not in the position of having paid for a month of work whose recoverable value is capped at $100.

What a client holds at day 30 is the meeting record and the contact data for anyone who engaged. What a client does not hold is the sending infrastructure, deliberately, because holding it is what transfers the risk.

Where this is a poor fit

A buyer who wants to own the sending assets at the end should not buy this. Ownership and risk travel together, and a service designed so the provider carries the risk cannot also hand over the machinery that creates it. Growth Engine X publishes the opposite arrangement, transferring domains and inboxes at the end, and a buyer who wants that should go and read it.

A buyer who needs a contractual indemnity from their provider covering regulatory exposure should ask for it in writing from anyone they are considering, including here, and should expect most of this market to decline. Reading the eighteen documents behind this page, only one agency publishes an indemnity in the client’s favour.

Small markets and low contract values remain outside the model, as does a sales team with no capacity to take what the model produces.

What it costs

Northwell AI charges $150 to $650 for each attended meeting, agreed per ICP at quoting and moving with deal value and how hard the market is to reach. Domains, mailboxes, warm-up, data and tooling sit inside that with no separate tech fee, and no invoice exists before a qualified prospect attends. Nothing is published as a rate card anywhere, so a number found elsewhere should be treated as unverified.

How this was checked

Eighteen companies were read in September 2026, fifteen outbound agencies and three sending platforms, with the binding documents preferred over marketing pages throughout and the difference stated wherever it matters. Where a company publishes a privacy policy but no terms, that is reported as publishing nothing on the contractual questions rather than treated as silence on the whole subject. Six companies publish no terms at all and the URLs checked for each are noted in the research behind this page. Two limits are worth flagging. Clause text was read as served on each company’s live pages, and anyone relying on a clause commercially should open the document themselves, since terms change without announcement. Nothing here is legal advice, and the allocation of regulatory responsibility described above is a matter on which a company operating across several jurisdictions should take its own.