{"license":"CC BY 4.0","attribution":"AI Dispatch — https://aidispatch.news","methodology":"https://aidispatch.news/methodology","generated_at":"2026-09-18T12:25:05.833Z","entity":{"name":"Caddygo","slug":"caddygo","type":"agent","subtype":"purchasing","developer":null,"homepage_url":"https://caddygo.co","summary":"Caddygo is a procurement application that runs four named AI agents - Caddydraft, Caddyresearch, Caddyevaluate and Caddynegotiate - inside Microsoft 365, surfacing in Outlook, Word, Excel and SharePoint, with a separate Google Workspace version covering Gmail, Google Docs, Google Sheets and Google Drive. The agents read mail, create and update files, and draft messages and documents, but the company states they never send email: sending stays with the user. Microsoft 365 access is taken under narrow named grants for mail read and draft access. Caddygo says content and attachments are stored on servers in Frankfurt, encrypted in transit and at rest, processed in Google Cloud Vertex AI using Gemini models, and not used to train AI models, and that deleting an account erases stored mail and attachments. It describes itself as GDPR-compliant and states that SOC 2 and ISO 27001 certifications are in progress - neither certification is held. It charges per sourcing project rather than per seat, with unlimited users on every plan. Access is granted by request rather than open signup. The company publishes no insurance, indemnity or liability position, and the only adoption signal on the page is a single customer testimonial attributed to Markus Menz, Digital Transformation at Techem. Every field on this profile is evidenced from caddygo.co, the company's own site, captured 17 September 2026; AI Dispatch has not independently verified these claims.","url":"https://aidispatch.news/agents/caddygo/","published_at":"2026-09-18T08:28:14.296711+00:00","updated_at":"2026-09-18T11:31:54.55853+00:00"},"fields":[{"key":"user_base","label":"User base","category":"impact","status":"present","value":"One published customer testimonial, attributed to Markus Menz, Digital Transformation at Techem; no user, customer or deployment counts are published","not_yet_interpreted":false,"quote":"Being in charge of AI projects, I've tested a lot of tools that promise to simplify procurement. Caddygo stands out because it's genuinely easy to use and the output quality is on par with what an experienced procurement professional would deliver.\" Markus Menz Digital Transformation at Techem","source_url":"https://caddygo.co","retrieved_at":"2026-09-17T16:07:06.105546+00:00","review":null,"superseded_quote":null},{"key":"availability","label":"Availability","category":"practicality","status":"present","value":"Access by request: prospective users leave a work email and the company responds within 24 hours with access","not_yet_interpreted":false,"quote":"Leave your work email to get access and put the agents to work on your next sourcing project. Get Access Leave your work email and we'll get back to you within 24 hours with access, inside Microsoft 365.","source_url":"https://caddygo.co","retrieved_at":"2026-09-17T16:07:06.105546+00:00","review":null,"superseded_quote":null},{"key":"environment","label":"Operating environment","category":"agency","status":"present","value":"Operates embedded inside Microsoft 365 apps: Outlook, Word, Excel, SharePoint","not_yet_interpreted":false,"quote":"Agents surface inside Outlook, Word, Excel, and SharePoint. No new tabs, no context switching.","source_url":"https://caddygo.co","retrieved_at":"2026-09-17T16:07:06.105546+00:00","review":null,"superseded_quote":null},{"key":"human_oversight","label":"Human oversight","category":"agency","status":"present","value":"Human decides at every step; AI only prepares recommendations for review","not_yet_interpreted":false,"quote":"AI prepares, you decide. Every recommendation is transparent, auditable, and under your control.","source_url":"https://caddygo.co","retrieved_at":"2026-09-17T16:07:06.105546+00:00","review":null,"superseded_quote":null},{"key":"model_provider","label":"Model provider","category":"models","status":"present","value":"Google (Gemini models via Google Cloud Vertex AI)","not_yet_interpreted":false,"quote":"processed in Google Cloud Vertex AI using Gemini models","source_url":"https://caddygo.co","retrieved_at":"2026-09-17T16:07:06.105546+00:00","review":null,"superseded_quote":null},{"key":"compliance_certs","label":"Compliance certifications","category":"assurance","status":"present","value":"GDPR-compliant; SOC 2 and ISO 27001 certifications in progress (not yet certified)","not_yet_interpreted":false,"quote":"We are GDPR-compliant, and SOC 2 and ISO 27001 certifications are in progress.","source_url":"https://caddygo.co","retrieved_at":"2026-09-17T16:07:06.105546+00:00","review":null,"superseded_quote":null},{"key":"pricing_model","label":"Pricing model","category":"practicality","status":"present","value":"Usage-based: charged per sourcing project/event rather than per seat; unlimited users included on every plan","not_yet_interpreted":false,"quote":"Caddygo charges for sourcing volume, not seats. You pay per sourcing project the agents run, every plan includes unlimited users, and every plan starts with three free sourcing events.","source_url":"https://caddygo.co","retrieved_at":"2026-09-17T16:07:06.105546+00:00","review":null,"superseded_quote":null},{"key":"audit_trail","label":"Audit trail","category":"assurance","status":"present","value":"Audit trail preserved in the customer's own inbox and SharePoint","not_yet_interpreted":false,"quote":"The full audit trail stays in your inbox and SharePoint.","source_url":"https://caddygo.co","retrieved_at":"2026-09-17T16:07:06.105546+00:00","review":null,"superseded_quote":null},{"key":"action_space","label":"Action space","category":"agency","status":"present","value":"Reads mail, creates and updates files, and drafts messages and documents; never sends email -- sending remains a human action","not_yet_interpreted":false,"quote":"Mail read access lets them pick up sourcing requests and vendor offers from your inbox. Draft access lets them prepare messages to the internal reviewers who sign off on a project. Caddygo only ever writes drafts and never sends email, so sending stays with you. File access lets them create and update the RFx documents, pricing matrices, and comparison documents they draft for you.","source_url":"https://caddygo.co","retrieved_at":"2026-09-17T16:07:06.105546+00:00","review":null,"superseded_quote":null},{"key":"permission_scopes","label":"Permission scopes","category":"assurance","status":"present","value":"Narrow, named Microsoft 365 grants scoped to the agents' tasks: mail read access and draft access","not_yet_interpreted":false,"quote":"Caddygo connects to your Microsoft 365 account with the narrowest grants the agents can work with. Mail read access lets them pick up sourcing requests and vendor offers from your inbox. Draft access lets them prepare messages to the internal reviewers who sign off on a project.","source_url":"https://caddygo.co","retrieved_at":"2026-09-17T16:07:06.105546+00:00","review":null,"superseded_quote":null},{"key":"data_handling","label":"Data handling","category":"safety","status":"present","value":"Content stored on servers in Frankfurt, encrypted in transit and at rest, processed in Google Cloud Vertex AI; not used to train AI models; deleting the account erases stored mail and attachments","not_yet_interpreted":false,"quote":"Content and attachments are stored on servers in Frankfurt, encrypted in transit and at rest, and are processed in Google Cloud Vertex AI using Gemini models so the agents can classify requests, compare offers, and draft documents. Your content is not used to train AI models. You can disconnect Caddygo at any time, and deleting your account erases the stored mail and attachments from our systems.","source_url":"https://caddygo.co","retrieved_at":"2026-09-17T16:07:06.105546+00:00","review":null,"superseded_quote":null},{"key":"integrations","label":"Integrations","category":"practicality","status":"present","value":"Microsoft 365 (Outlook, Word, Excel, SharePoint), with a separate Google Workspace version covering Gmail, Google Docs, Google Sheets and Google Drive","not_yet_interpreted":false,"quote":"Both. This version of Caddygo is built for the Microsoft ecosystem: Outlook, Word, Excel, and SharePoint. There is also a Google Workspace version covering Gmail, Google Docs, Google Sheets, and Google Drive.","source_url":"https://caddygo.co","retrieved_at":"2026-09-17T16:07:06.105546+00:00","review":null,"superseded_quote":null},{"key":"multi_agent","label":"Multi-agent","category":"ecosystem","status":"present","value":"Four named agents -- Caddydraft, Caddyresearch, Caddyevaluate, Caddynegotiate -- covering the sourcing workflow from RFx to negotiation","not_yet_interpreted":false,"quote":"Four AI agents run the operational side of competitive sourcing: Caddydraft writes your RFx, Caddyresearch finds and shortlists vendors, Caddyevaluate compares incoming offers, and Caddynegotiate prepares your negotiation.","source_url":"https://caddygo.co","retrieved_at":"2026-09-17T16:07:06.105546+00:00","review":null,"superseded_quote":null},{"key":"base_models","label":"Base models","category":"models","status":"present","value":"Gemini, used to classify requests, compare offers and draft documents","not_yet_interpreted":false,"quote":"using Gemini models so the agents can classify requests, compare offers, and draft documents.","source_url":"https://caddygo.co","retrieved_at":"2026-09-17T16:07:06.105546+00:00","review":null,"superseded_quote":null}],"trust_gap_scores":[{"dimension":"runtime_governance","score":2,"rationale":"Authority is bounded at run time by OAuth grant scoping and one hard product limit: the page states Caddygo connects under \"the narrowest grants the agents can work with\" (mail read, draft, file access, each enumerated with its purpose) and that it \"only ever writes drafts and never sends email, so sending stays with you.\" A structural bar on the highest-consequence action is real enforcement, not a policy statement. Held below 3: no spend control, no per-run or per-project caps, no administrator-configurable limits, and no independent attestation that the scoping is enforced as described.","rubric_version":"v1","scored_by":"fact-checker","judged":true,"scored_at":"2026-09-18T08:27:08.684464+00:00","superseded_scores":[{"score":1,"rationale":"Scored from 1 evidenced field(s): permission_scopes. Automated score; capped at 2 pending review.","rubric_version":"v1-auto","scored_by":"spark-verifier","judged":false,"scored_at":"2026-09-18T08:00:00.168144+00:00"}],"rests_on_flagged_absence":null,"evidence_newer_than_judgement":null},{"dimension":"audit_trail","score":1,"rationale":"A reviewable record exists and sits in systems the customer controls: \"The full audit trail stays in your inbox and SharePoint.\" That is customer-reviewable, which clears 0. It is ordinary mail and SharePoint content, so nothing is tamper-evident, hash-chained, or independently verifiable, and the page describes no immutable log of agent actions as distinct from the documents they produce.","rubric_version":"v1","scored_by":"fact-checker","judged":true,"scored_at":"2026-09-18T08:27:08.684464+00:00","superseded_scores":[{"score":1,"rationale":"Scored from 1 evidenced field(s): audit_trail. Automated score; capped at 2 pending review.","rubric_version":"v1-auto","scored_by":"spark-verifier","judged":false,"scored_at":"2026-09-18T08:00:00.168144+00:00"}],"rests_on_flagged_absence":null,"evidence_newer_than_judgement":null},{"dimension":"compliance","score":1,"rationale":"A compliance posture is published but no certification is held. The page states \"We are GDPR-compliant, and SOC 2 and ISO 27001 certifications are in progress\" -- both named certifications are explicitly in progress, not awarded. Supporting controls are published (EU data residency in Frankfurt, encryption in transit and at rest, no model training on customer content). Scored 1 rather than 2 because a self-asserted GDPR posture plus two pending certifications is a statement of intent, not a third-party attestation, and no auditor, scope or target date is named.","rubric_version":"v1","scored_by":"fact-checker","judged":true,"scored_at":"2026-09-18T08:27:08.684464+00:00","superseded_scores":[{"score":1,"rationale":"Scored from 1 evidenced field(s): compliance_certs. Automated score; capped at 2 pending review.","rubric_version":"v1-auto","scored_by":"spark-verifier","judged":false,"scored_at":"2026-09-18T08:00:00.168144+00:00"}],"rests_on_flagged_absence":null,"evidence_newer_than_judgement":null},{"dimension":"outcome_settlement","score":1,"rationale":"Pricing is a unit-of-work model, not an outcome model: \"Caddygo charges for sourcing volume, not seats. You pay per sourcing project the agents run, every plan includes unlimited users.\" Charging per project executed rather than per seat moves off the 0 anchor, and clears 0 on that basis alone. Payment is nonetheless owed for work the agents run regardless of whether the sourcing event produces an accepted or verified result; nothing on the page conditions payment on an outcome, and full prices are not published.","rubric_version":"v1","scored_by":"fact-checker","judged":true,"scored_at":"2026-09-18T08:27:08.684464+00:00","superseded_scores":null,"rests_on_flagged_absence":null,"evidence_newer_than_judgement":null},{"dimension":"insurance_indemnity","score":0,"rationale":"No public evidence found. The 2026-09-17 capture of caddygo.co contains no occurrence of insurance, insured, indemnity, liability, warranty, underwriting or carrier, and no guarantee, SLA or refund terms (verified by regular-expression scan over the stored document, not by reading impression). Nothing on the page offers cover, indemnity or a liability position. This is a finding about what the vendor publishes, not a gap in our research.","rubric_version":"v1","scored_by":"fact-checker","judged":true,"scored_at":"2026-09-18T08:27:08.684464+00:00","superseded_scores":null,"rests_on_flagged_absence":null,"evidence_newer_than_judgement":null}]}