Swordfish AI Review 2026: Data, Workflow, and Buyer Fit

Swordfish AI is a contact-data and enrichment product for revealing phones and emails, building and enriching prospect files, and adding records to existing systems. It is a good trial candidate for teams that value direct mobile numbers and can test the data against a representative sample. Buyers should hold procurement until Swordfish reconciles its unlimited-pricing message with credit-bearing workflows, fair-use rules, API approval, and downstream licensing terms.

Swordfish AI review: quick facts

Swordfish supplies contact data through several routes rather than running a complete sales-engagement workflow. Its data page reports 3.5 billion verified data points and more than 571 million profiles. Those units are different: one profile can contain several data points.

The product is an enrichment layer

Swordfish's Chrome extension reveals direct dials and emails on individual profiles and lists. Prospector builds lists from filters. File Upload enriches CSV rows. Reverse Search accepts a phone or email, as well as a social profile. The API supports application and CRM enrichment after a sales-led setup.

None of those routes replaces a sequencer, dialer, reply inbox, suppression system, or CRM. A buyer should assign Swordfish one clear job: return a contact candidate with source, verification state, lookup route, timestamp, and charge. The system of record should decide whether that candidate is accepted and where it can be used.

This boundary prevents a green checkmark from becoming automatic permission to contact. It also keeps data quality separate from campaign performance.

Coverage headlines need careful labels

Swordfish's data inventory lists more than 169 million email addresses, 118 million personal emails, 87 million professional emails, 77 million mobile phones, and 560 million LinkedIn URLs. These fields can overlap. They are vendor inventory counts rather than independent evidence of freshness or accuracy, including match rate, for a buyer's territory.

The privacy policy says business-profile data comes from third-party databases, public sources, business partners, user or partner contributions, and Swordfish's own collection. Algorithms combine those sources to select what the vendor describes as current information. Business-domain emails may be checked against company mail servers.

Prospector claims 82% accuracy on the first dial and 95% overall accuracy on each profile. The FAQ separately claims more than 95% email accuracy and about 80% direct-dial accuracy globally. Public pages do not disclose the sample, denominator, geography, test period, record age, or treatment of identity and employer mismatches.

Attribute those numbers to Swordfish and set independent acceptance thresholds. A valid mailbox can belong to the wrong person, and an active phone can belong to a former employee. A current employee can still be outside the approved audience.

Extension coverage is not described consistently

The extension page names LinkedIn, GitHub, Stack Overflow, Dribbble, Google, and Bing, including LinkedIn Recruiter and Sales Navigator projects or lists. The FAQ instead describes LinkedIn and Facebook alongside X or Twitter. Swordfish's privacy policy names logs from LinkedIn, Facebook, X, GitHub, and Stack Overflow.

Confirm the exact supported sites in the installed extension. Record its version, browser permissions, host access, individual and bulk surfaces, and whether each surface consumes a credit or falls under a flat allowance.

The policy says extension and site logs can include pages viewed, browsing activity, clicks, actions, installs, timestamps, and time on pages. Use a dedicated work browser profile and approve only the sites required for the test. Remove the extension and its site data at the end of the evaluation.

Platform access is another boundary. A vendor-supported page does not establish that the underlying platform authorizes scraping or automated actions, including bulk collection. Review each site's current rules before enabling list workflows.

Prospector and file enrichment use inputs that differ from reverse lookup

Swordfish Prospector filters by title, company, location, profile keywords, direct-dial or email availability, employee count, seniority, industry, department, and other attributes. Users can require a phone or email before revealing a record and export resulting lists.

The file enrichment workflow accepts a CSV, lets the user select a required output such as mobile, email, both, or either, and returns enriched rows. The page says there is no charge when it cannot supply the selected required response.

Reverse Search can take a phone and return a name or email, or take an email and return a direct dial. Social-profile inputs cover LinkedIn and two other networks: Facebook and X. The live page says this route needs Premium credits.

Test the same known records through multiple routes. Record whether Swordfish recognizes a repeated person, returns conflicting fields, charges again, or creates duplicate CRM records. A repeat-lookup rule on one product surface should not be assumed to cover every other surface.

API access requires separate approval

Swordfish's API page describes a sales-assisted process. The buyer explains the use case, selects custom data or a phone or email, works with a data specialist, and can request a sample or trial credits. Direct-dial and email routes describe no charge when the required field is not found.

The terms add a material condition. API access is limited to an approved Team and Scale plan, requires case-by-case review, is rate-limited, and can be changed or suspended, including through revocation. Buying a plan does not automatically grant access.

There is no public technical reference with endpoint schemas, authentication, errors, webhooks, or numerical rate limits. Get the production schema, match logic, timeout, retry rules, duplicate behavior, limits, support response, and revocation conditions before designing around the API.

A custom sample is preferable to the standard ten-credit trial for data evaluation. Ten records cannot support a stable conclusion across industries, seniority, geography, job changes, catch-all domains, and identity collisions.

Integrations need a one-way write test

Swordfish's integrations page names Zapier, Salesforce, HubSpot, Crelate, LOXO, Top Echelon, Pipedrive, Salesloft, Lever, and Outreach. Marketing describes pushing contact data into existing tools.

The privacy policy provides a narrower detail for Salesforce and CRM workflows: data moves from Swordfish into the CRM, and Swordfish says it does not collect data from the connected Salesforce account through that route. Public pages do not establish that every listed connection is native or bidirectional.

Test one new record, update, duplicate, suppressed contact, missing required field, and unauthorized write. Confirm field mapping, overwrite precedence, owner assignment, rollback, error handling, deletion propagation, and whether a rejected record still incurs a charge.

Every accepted row should retain the lookup route, timestamp, raw verification state, and immutable test ID. Without that trail, teams cannot compare routes or investigate stale data later.

Unlimited access conflicts with credit language

The pricing page says unlimited prospecting and no credits, subject to fair use. Professional includes the extension and Prospector, along with reverse lookup. Team cards add file upload, integrations, API, and management functions.

Other first-party pages still describe credit events. The FAQ says a successful extension reveal uses one credit. Prospector tells users to spend credits on selected data. File Upload asks the user to choose a credit amount. Reverse Search requires Premium credits. The verifier and validator advertise free credits and credit purchases. The API describes route-specific charges and test credits.

The terms say fair use requires genuine human-led outreach by individuals. They prohibit automated scraping, bots, scripts, shared credentials, and robotic bulk workflows without written authorization. Professional has no fixed public numerical cap, while Team thresholds can vary and remain undisclosed. Swordfish can throttle, suspend, charge additional fees, or terminate access.

Request a route-by-route billing schedule and numerical fair-use rules. State which actions are unlimited, which consume credits, what counts as success, how duplicates behave, and what happens at the threshold. Test wallet or usage balances before and after every controlled action.

Downstream viewers can change the seat count

Swordfish's terms make Professional an individual-use product and require paid seats for Team users. They also say every person who can view or interact with Swordfish data in shared internal tools, including a CRM or applicant tracking system, must be licensed.

That wording can make downstream viewers the main cost driver. A team with three researchers and 50 CRM users may face a different license count from the number shown in the research workflow.

The terms also require exported or synchronized data to be removed after subscription termination unless the customer keeps a paid license or obtains written perpetual rights. Confirm how this applies to campaign history, suppression records, audit evidence, previously contacted people, backups, and legally required records. Do not accept a purge duty that would erase evidence the buyer must retain.

Privacy and security evidence require follow-up

Swordfish's privacy policy identifies the company as a registered data broker in California and Vermont. It acts as a controller for some information and a processor for some customer-submitted inputs and connected workflows. The policy provides an opt-out route for business profiles.

The policy describes a seven-year retention period from a defined processing date, with possible longer retention for service, legal, dispute, or enforcement needs. Buyers should ask how that rule applies to search inputs, extension logs, uploaded files, returned data, CRM records, support data, and deletion requests.

Public security wording refers to industry-standard procedures but does not publish a current SOC 2 status, ISO 27001 certification, encryption standards, hosting locations, subprocessor list, incident-notification period, backup deletion timeline, or customer audit rights. The public security URL returned 404 during research, and the DPA route required a login.

That absence does not prove weak controls. It means procurement must request the DPA, current assurance reports, subprocessors, encryption details, access logs, incident terms, retention by data type, and verified deletion before uploading production records.

Run a blind contact-data trial

Negotiate at least 100 immutable test rows and written billing rules. Include current employees, recent job changers, restrictive and catch-all domains, invalid records, duplicate people submitted through several routes, common names, phone-only requests, email-only requests, and representative markets.

1. Freeze submitted identity, employer, domain, geography, and test ID.
2. Run comparable subsets through the extension, Prospector, file enrichment, and approved API.
3. Save raw fields, verification state, route, timestamp, charge, and balance change.
4. Verify identity and current employer separately from email and phone status.
5. Push a controlled subset into a test CRM and inspect mapping, deduplication, suppression, overwrite, and rollback.
6. Mark each row accepted or rejected, with held as an interim state, using rules defined before results are revealed.
7. Calculate match rate, identity precision, current-employer precision, accepted-record rate, credit leakage, and total cost per accepted CRM record.
8. Export required evidence, revoke access, cancel, and confirm the agreed data-removal process.

Choose Swordfish when its phone and email results clear the buyer's thresholds and route charges match the written schedule. CRM licensing must also remain economical. Pass when the team needs a complete engagement platform, high-volume automation without written approval, predictable public limits, or stronger assurance evidence than Swordfish supplies.

Need a defensible contact-data test?

We can build the blind sample and define accepted-record rules, then connect the passing data routes to a client-owned outbound system without treating vendor confidence labels as proof.

Book your free discovery call →