Where the reviewed products stand
Compare documented control across the named products and routes. Open a review for its plan, region and agreement (this is a selected sample).
0–10 on both axes · Higher and further right means more documented control
Exact scores & review links (14)
| Vendor | Data access & portability | Build & act |
|---|---|---|
| HubSpot ↗ | 8.3* | 5.5* |
| Attio ↗ | 7.1* | 5.8* |
| Salesforce ↗ | 7.1* | 8.0* |
| Gong ↗ | 8.2* | 5.8* |
| Quo ↗ | 8.2* | 5.8* |
| Pipedrive ↗ | 7.6* | 5.9* |
| Zoho CRM ↗ | 4.8* | 7.4* |
| Copper ↗ | 7.6* | 5.6* |
| Close ↗ | 7.6* | 6.7* |
| Keap ↗ | 7.7* | 5.5* |
| Insightly ↗ | 8.2* | 5.4* |
| Nutshell ↗ | 7.4* | 5.1* |
| Microsoft Dynamics 365 Sales ↗ | 7.6* | 6.1* |
| Permute ↗Publisher self-assessment | 8.0* | 7.1* |
Axes average three dimensions each: access, third-party access and exit horizontally; action, continuity and business logic vertically. Fixed 0–10 scale, midlines at 5 (overall grades use separate weights). * Some evidence is unresolved. Marker colors identify companies, not score bands. How to read the map ↗
Permute is included as a reference (it owns this site and is a publisher self-assessment). Its score is excluded from sample averages. Read the Permute review ↗
CRM objects and sales conversation records serve different purposes. Findings apply to the stated data and operations, without assuming complete sales workflow portability.
Compare the six dimensions
| Overall control | |
|---|---|
| Data access | |
| Third-party accessibility | |
| External action | |
| Continuity | |
| Data exit | |
| Business logic and customization | |
Product scopes, dates & reviews
HubSpot
CRM and sales · Checked 2026-10-12
Smart CRM / Starter customer-owned CRM integration and authorized third-party apps. Premium objects, Marketplace distribution and Marketing Hub exit terms have separate conditions.
Read findings and sources ↗Attio
CRM and sales · Checked 2026-10-12
Attio / customer single-workspace token, REST records and webhooks; the separately entitled Enterprise SQL beta is disclosed, but its joined-query expressiveness is not credited.
Read findings and sources ↗| Customer control | HubSpot ↗ | Attio ↗ | Salesforce ↗ | Gong ↗ | Quo ↗ | Pipedrive ↗ | Zoho CRM ↗ | Copper ↗ | Close ↗ | Keap ↗ | Insightly ↗ | Nutshell ↗ | Microsoft Dynamics 365 Sales ↗ | Permute ↗ |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Category | CRM and sales | CRM and sales | CRM and sales | CRM and sales | CRM and sales | CRM and sales | CRM and sales | CRM and sales | CRM and sales | CRM and sales | CRM and sales | CRM and sales | CRM and sales | Databases and data platforms |
| Overall control | ||||||||||||||
| Data access | ||||||||||||||
| Third-party accessibility | ||||||||||||||
| External action | ||||||||||||||
| Continuity | ||||||||||||||
| Data exit | ||||||||||||||
| Business logic and customization | ||||||||||||||
| Assessment scope | Smart CRM / Starter customer-owned CRM integration and authorized third-party apps. Premium objects, Marketplace distribution and Marketing Hub exit terms have separate conditions. | Attio / customer single-workspace token, REST records and webhooks; the separately entitled Enterprise SQL beta is disclosed, but its joined-query expressiveness is not credited. | Salesforce Platform / API-enabled paid org, customer-authorized External Client App, REST, Bulk API and Apex. Data 360 and AppExchange distribution are separate offerings. | Gong / customer API keys, call/transcript retrieval, recording imports and Foundation webhook rules. Seats and content grants still qualify accessible fields. | Quo / customer owner/admin API key, v1 contact/call retrieval and contact mutations. Newer task/conversation actions require separate version checks. | Pipedrive CRM / customer API token or unlisted private OAuth app; deals, people and organizations through REST, with general webhooks v2. Public Marketplace approval is a separate distribution route. | Zoho CRM v8 / customer-authorized OAuth, module records, Bulk Read, COQL and notification APIs; supported CRM modules only. | Copper Developer API / customer API key and user email; leads, people, companies, opportunities and supported webhooks. Partner-registered OAuth is a separate distribution route. | Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events. | Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate. | Insightly CRM REST v3.1 user-key API, contact collection reads/search and contact mutations; email-associated attachments are excluded by the reference. | Nutshell current REST contacts/accounts APIs and webhooks using customer Basic credentials; Enterprise read-only SQL is disclosed as a separate route. | Dynamics 365 Sales standard Dataverse tables, customer-authorized Web API application and explicitly enabled table change tracking; elastic tables, Finance OData and complete Sales solution migration are excluded. | Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed. |
| Assessment checked | 2026-10-12 | 2026-10-12 | 2026-10-12 | 2026-10-12 | 2026-10-12 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-16 | 2026-10-12 |
| Read the findings | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ | Detailed review ↗ |
Scores are out of 10. * Incomplete evidence discounts verified capabilities (unknown answers stay unknown). Planned migration drives data exit. Scoring method ↗
Who can connect?
Yes No- Unknown
A check means the column applies to that route (customer credentials can still require provider approval). Report exports use the customer account without separate API credentials. Open a connection method for its authentication, requirements and last review date.
What each review covers
HubSpot ↗
Customer-owned apps can access CRM records on Free and Starter. The useful limits are per app and per account; export permissions and AI-use terms still matter.
Smart CRM / Starter customer-owned CRM integration and authorized third-party apps. Premium objects, Marketplace distribution and Marketing Hub exit terms have separate conditions.
Attio ↗
Attio offers customer-controlled tokens, record APIs and webhooks. Its Enterprise SQL endpoint adds a distinct plan and beta boundary to an otherwise direct integration path.
Attio / customer single-workspace token, REST records and webhooks; the separately entitled Enterprise SQL beta is disclosed, but its joined-query expressiveness is not credited.
Salesforce ↗
Salesforce combines operational SOQL queries, bulk extraction and custom interfaces. API-enabled editions and user permissions determine whether those capabilities are usable.
Salesforce Platform / API-enabled paid org, customer-authorized External Client App, REST, Bulk API and Apex. Data 360 and AppExchange distribution are separate offerings.
Gong ↗
Gong lets technical admins create API keys on any plan. Call-time filters aid retrieval, but are not modification timestamps.
Gong / customer API keys, call/transcript retrieval, recording imports and Foundation webhook rules. Seats and content grants still qualify accessible fields.
Quo ↗
Quo includes API access on any active plan without a monthly API fee. Messaging usage and carrier registration are separate requirements.
Quo / customer owner/admin API key, v1 contact/call retrieval and contact mutations. Newer task/conversation actions require separate version checks.
Pipedrive ↗
Pipedrive supports customer tokens and unlisted OAuth apps, with updated-time queries and scoped delete events. Public Marketplace review does not gate the documented private installation route.
Pipedrive CRM / customer API token or unlisted private OAuth app; deals, people and organizations through REST, with general webhooks v2. Public Marketplace approval is a separate distribution route.
Zoho CRM ↗
Zoho CRM combines paginated records, asynchronous bulk export and COQL joins and aggregates. Deleted-record queries supply a bounded recovery source beyond transient notifications.
Zoho CRM v8 / customer-authorized OAuth, module records, Bulk Read, COQL and notification APIs; supported CRM modules only.
Copper ↗
Copper offers customer-generated API keys and searchable CRM records. Its webhooks announce deletes but never retry, so ongoing copies need polling and reconciliation.
Copper Developer API / customer API key and user email; leads, people, companies, opportunities and supported webhooks. Partner-registered OAuth is a separate distribution route.
Close ↗
Close supports customer-authorized CRM integrations and paginated record retrieval. Its event log extends change recovery to 30 days, with consolidated updates and a shorter payload-visibility window for non-administrators.
Close REST v1 lead/contact record access through customer API keys or user-authorized OAuth; 30-day event log for documented object events.
Keap ↗
Keap offers user-scoped personal tokens, administrator service keys and OAuth connections. Its developer guide expressly limits continuous or excessively frequent synchronization and export, so API access does not establish unrestricted replication.
Keap REST v2 contact reads/create/update with customer PAT/service-account keys or developer OAuth; documented synchronization/export restrictions apply. Legacy v1/XML-RPC remain separate.
Insightly ↗
Insightly makes its CRM API available on all plans and binds each API key to a user’s permissions. Contact records support pagination and updated-time searches, with daily limits that vary by plan.
Insightly CRM REST v3.1 user-key API, contact collection reads/search and contact mutations; email-associated attachments are excluded by the reference.
Nutshell ↗
Nutshell includes REST API access at no additional charge for customers. REST contact writes and webhooks are documented; Enterprise read-only SQL is a separate commercial entitlement.
Nutshell current REST contacts/accounts APIs and webhooks using customer Basic credentials; Enterprise read-only SQL is disclosed as a separate route.
Microsoft Dynamics 365 Sales ↗
Sales uses Dataverse Web API for role-scoped records and writes. Enabled table change tracking provides deletion identities and delta links, with a default seven-day token window that must be checked for the actual environment.
Dynamics 365 Sales standard Dataverse tables, customer-authorized Web API application and explicitly enabled table change tracking; elastic tables, Finance OData and complete Sales solution migration are excluded.
Permute ↗
Scoped APIs expose SQL reads, managed records and customer-authored operation code. Customer-built apps are supported, while complete workspace recovery, outbound CDC and minimum-plan access terms remain unresolved.
Permute hosted workspaces / scoped REST and TypeScript SDK access to connected query sources, file datasets, managed database records, operation code and custom apps. Signed enterprise contracts and upstream vendor rights remain separate; no live tenant migration or reliability test was performed.