Upwex

Are scope, spend, and authority enforced while the agent runs?

Auto-bidding runs inside limits the user sets once - the capture names max bids per day, minimum match score, red-flag filters, hourly rate and active hours, which is a genuine run-time bound on scope and rate. Not a 3: no spend ceiling, no enforcement mechanism and no failure behaviour is published, and the page carries an unresolved internal contradiction - it claims "read-only access to your Upwork account" while also describing "Fill all & submit in one click" and submitting bids on the user's behalf. Read-only and write-on-your-behalf cannot both hold, so the authority limit is asserted rather than established.

Is there a tamper-evident record of what it actually did?

A per-action record exists and is customer-reviewable: "Every scan, match, bid, and reply in one log. Filter by date, campaign, status." Not a 2 or 3: nothing on the capture claims the log is tamper-evident, hash-chained, immutable or externally verifiable, and it is the vendor's own dashboard with no export or third-party attestation described.

Are compliance obligations attached per engagement?

No public evidence found. The captured homepage and FAQ contain no occurrence of SOC 2, ISO 27001, GDPR alignment, HIPAA, or any certification, audit report, or stated regulatory posture. The only use of the word "audit" on the page is a product feature ("Upwork Profile Score: 29-point audit"), not a compliance audit. Absence is the finding.

Does payment depend on a verified result?

Payment is a per-seat monthly subscription metered by an AI-credit allowance ($9.99/month entry tier, 100 credits per seat per month), charged regardless of whether any bid wins work. The capture contains no escrow, milestone-release, clawback or success-fee language. This is the rubric's definition of 0: paid per seat regardless of result.

Can the deployment be insured, and is the customer indemnified?

No public evidence found. The captured document contains no occurrence of "insur", "indemn" or "liabilit" in any form - no cover, no carrier, no indemnity offered to customers, no liability cap. Absence is the finding.