November 5, 2026 · B2B Data
Prospecting data moved into the agent stack. Compliance did not
A people-data catalogue now sits behind the same key developers use to scrape pages, which means a sanctions check and a verified work email are one call apart. For export teams the win is real. So is the new failure mode.
For most of the last decade the export sales stack had a fixed shape. You bought a list from one vendor, enriched it with a second, sent from a third, and kept a spreadsheet of what bounced. Each step had its own invoice and its own compliance checkbox that nobody opened.
That shape is being flattened. Firecrawl launched its Alexandria catalogue on 22 September alongside a $75M Series B, and by early November it listed 430 providers and 2,461 capabilities reachable with the same API key developers already used to turn pages into markdown. Twelve of those providers sit in a People category: Apollo, People Data Labs, FullEnrich and Data Legion on the commercial side, plus seven public-record sources that include OpenSanctions, the UK sanctions list and US Senate financial disclosures. The launch coverage puts the underlying coverage at more than 250 million people and 26 million companies.
Read that list again and notice what has been put in the same drawer. A tool that finds a VP of Sourcing at a German importer now sits next to a tool that checks whether the same name appears on a sanctions list. Those two jobs used to live in different departments, with different budgets, and one of them was done once a year by a consultant.
Why the call order now matters more than the tool
Most teams will wire this up in the obvious order: find people, enrich emails, then screen whoever survives. For anyone selling into regulated buyers or shipping into restricted destinations, that order is backwards. Screening is cheap and fast. Email enrichment is the expensive, rate-limited step. Put the screen first and you stop paying to enrich a person you are not allowed to contact.
The public-record providers are what make this practical. Sanctions and politically-exposed-person checks were previously an annual PDF exercise. When the same agent can call OpenSanctions before it calls an enrichment provider, the check moves from an audit artefact to a runtime condition — something the pipeline enforces rather than something a lawyer samples.
The two numbers that decide whether this is cheap
Two details in the catalogue matter more than the marketing. First, People Data Labs carries a quota of 50,000 API calls per year per organisation, shared across person and company endpoints, counting retries, and resetting on 1 January UTC. That is a hard ceiling on how much exploring an agent can do. Second, some providers return a terms-required response with a URL that an organisation admin has to accept before data flows at all. Both are signals that the provider, not the reseller, holds the compliance relationship.
The credit maths compounds it. Discovery is free; execution is billed. An agent that reasons its way through five candidate providers before finding the right one has spent four calls learning nothing. Teams that budget by seat rather than by call get a surprise in month two.
The vendor claim worth testing rather than repeating is the cost comparison, which the launch coverage states as roughly 88% cheaper than Clay at scale. Treat that as a hypothesis. Your cost per usable contact depends on hit rate in your market, and the hit rate for Vietnamese furniture buyers is not the hit rate for US software buyers.
The part that will not be automated
Public record is not the same as lawful basis. A company registry entry tells you a person exists and holds a title. It does not give you permission to email them about your product. For contacts in the EU and the UK, the GDPR and the ePrivacy rules still govern B2B outreach, and the fact that a vendor will return an address does not move the liability to the vendor.
There is a quieter risk underneath. An agent that can see sanctions lists can also infer things about individuals that your privacy notice does not cover. If the output of a screening call is written into a CRM, that write is a processing activity and belongs in your records — with the source and the timestamp, not just the verdict.
A build order that survives an audit
- Screen before you enrich. Run the sanctions and PEP check first, and store the provider, the query and the timestamp alongside the result.
- Cap the agent. Set per-run and per-month credit ceilings. Log which provider answered which field, so a wrong number has an owner.
- Keep a person on the first touch. Automated first contact from a freshly assembled list is the fastest way to lose a sending domain.
- Treat a hit as a flag, not a verdict. Transliteration differences and common-name collisions produce false positives; a human reviews, always.
- Re-check on a schedule. Designations change. A clean check in March is not a clean check in November.
What we would do this week
Pick one destination market, one product category and twenty accounts. Run the whole loop by hand before automating any of it: screen, enrich, verify one address by phone, send four emails, and write down where it broke. The data layer is genuinely better than it was a year ago, and the cost of a bad list is unchanged. The judgement about who you are allowed to approach has not moved at all.