Which CRMs do AI answer engines recommend when the buyer’s data is confidential?

When an SMB buyer asks an AI assistant which CRM to buy when their customer records are confidential, a shortlist comes back. We asked 44 different phrasings of that question across 3 engines, 132 answers in total, and counted every product named. This is the result. Nobody paid to be on it, and no vendor list was written in advance — the 95 vendors below are simply everyone the engines named.

Free to read, raw data included.

Two conditions on every number below

The leaderboard

“Answers” is how many of the 132 answers named that product. Share is the same number as a percentage. The three right-hand columns split it by engine. Every row has its own link — the # beside a vendor name gives you something like connexion.me/c/crmctx/#suitecrm. Click a vendor's name to see which of the 44 questions named them, and click one of those to read the answer it was counted from, word for word.

Method

Every claim on this page is reproducible from the files linked at the bottom.

The engines

ChatGPT (gpt-5.5), Gemini (gemini-flash-latest), Perplexity (sonar). Each was called through its public API with a near-empty system prompt — “answer the user's question directly and concisely” — and nothing else. The engines were not asked to produce a list, rank anything, or name vendors. Steering them toward a list would have manufactured the thing being measured.

The questions

44 distinct phrasings of one purchase decision, written before any measurement was run. No vendor name appears in any of them.

1. We are a 10-person law firm and client matter records are confidential under our professional duty, so our partners will not allow them to sit on a third party's servers; we already run our own file server and mail in the office. What is the best CRM software for us?
2. Best CRM for a small sales team at a defense subcontractor whose customer and program data is controlled under our government contract and cannot be held by an outside service provider
3. We're a 15 person agency serving hospital systems, our lead records fall under the business associate agreements we signed and our clients audit where that data lives, and today it is all in spreadsheets on a server in our own office. It's a mess. What CRM should we buy?
4. Recommend a simple CRM for a small B2B consulting firm that works with central-bank and regulator clients whose contracts forbid us from storing their contact and engagement data with any outside service.
5. affordable CRM software for a small business whose customer records are legally required to stay within our own systems
6. What CRM software do small businesses in regulated industries actually use when their customer data is not allowed to leave their own network?
7. Best easy-to-use CRM for non-tech-savvy sales reps at a credit union, where member financial records are examined by our regulator and cannot be handed to an outside data processor
8. We are a small forensic accounting practice; our engagement files contain evidence we are obliged to keep in our own custody, and our IT is one contractor who already maintains our server. We need a cheap CRM to track deals and client interactions. What are the top options?
9. What is the best sales pipeline management tool for a 5-person startup selling to national security customers, where the prospect list itself is treated as sensitive and our contracts say it stays on equipment we control?
10. Top CRM platforms for a growing medical billing service company whose client and patient-adjacent records are covered by a data protection agreement that bars storing them with a third-party service
11. I run a small private investigation firm; our client and subject records are extremely sensitive and I am not willing to place them with an outside provider, and we already run our own mail server. What CRM should I pick for contact management and email tracking?
12. Best simple CRM for running a sales pipeline at a small company handling customer information our security policy requires to remain inside our own network
13. We're a small biotech research services firm; our sponsors' study contacts and terms are under NDA and our compliance policy forbids putting them in an outside service, and we already run our own document system. We're losing track of sales follow-ups in our email inboxes. What CRM software should we implement?
14. Recommend an all-in-one CRM for a solo immigration consultant expanding to a team of 5, whose client files contain passport and family data that clients insist is never handed to an outside service.
15. What is the best budget-friendly CRM software for a small B2B company selling into government agencies, where the buyer contacts and pricing are contract-controlled and must stay in systems we administer ourselves?
16. Best CRM with strong pipeline visualization for a small insurance brokerage whose applicant health and financial disclosures cannot lawfully be stored with an outside processor
17. What CRM tool offers the best value for a 20-person company that runs its own servers because our customer records are subject to a regulator's data residency rules and cannot be placed with an external service?
18. We are a regional logistics firm with 8 reps moving controlled pharmaceutical shipments; our customer routes and volumes are security-sensitive and our carrier agreements say they stay on our own systems. What sales CRM do you recommend?
19. Which CRM is easiest to set up without hiring an admin or consultant, for a small psychotherapy group practice whose client contact records may not be stored outside the practice's own equipment?
20. Best sales tracking software for a small defense manufacturing business whose customer drawings and orders are export-controlled and cannot be placed with an outside provider
21. What CRM software has the lowest learning curve for a small sales team at a genetics testing lab, where customer records sit beside genetic data our policy says never leaves our own network?
22. Recommend a CRM for a boutique marketing agency whose clients are political campaigns and whose prospect lists are confidential material the agency keeps on its own equipment.
23. Best low-cost lead management CRM for a small business whose customer records are covered by a regulator's rule against storing them with an outside service
24. We are a small title and escrow company; our files hold bank details and identity documents that our underwriter's rules say must remain in systems we control, and we already have a server room. We need a customer database tool to organize our contacts and deal stages. What should we buy?
25. What is the best CRM for a 12-person professional services firm working under government security clearances, where even the client list is restricted and cannot be given to an outside provider?
26. Top CRM recommendation for a small real estate brokerage that handles buyers' financial and identity documents and is contractually barred from storing them with an outside service
27. Which CRM software is best, on a budget, for managing B2B account relationships at a small firm serving nuclear utilities, where account details are security-sensitive and must remain inside our own network?
28. We are a small municipal software supplier; our client opportunity records include citizen data covered by a data residency obligation, and our IT team already runs our servers. We are outgrowing spreadsheets for tracking client opportunities. What CRM software should we choose?
29. Best lightweight CRM for the owner of a small security guarding company whose client site details are sensitive and are not permitted to be stored with an outside service
30. What CRM tool do you suggest for a bootstrapped software company with 3 account executives selling to banks, where the banks' security reviews require our copies of their data to stay on infrastructure we run ourselves?
31. Recommend a customer relationship management system for a 25-person construction company that builds secure government facilities, where client and site records are restricted and must remain on our own equipment.
32. What is the best sales CRM with email integration for a small firm that already runs its own mail server because client correspondence is confidential and cannot be processed by an outside service?
33. Best CRM for a small e-commerce brand doing wholesale sales whose buyer contracts and customer lists are under NDA and, per those contracts, may not be stored with an external provider
34. We are a small clinical diagnostics supplier; our 4-person sales team handles hospital account data our clients audit and forbid us from placing with an outside service. We need a CRM that requires minimal training. Any recommendations?
35. What CRM software is most recommended for a small financial advisory practice whose regulator examines our books and records and whose clients' account data has to stay under our own control?
36. Best user-friendly CRM for a micro-business handling adoption case records, which the agency's licence requires to be kept in its own custody rather than with an outside service
37. We are a small firm selling to intelligence and law-enforcement agencies; our customer identities are sensitive and our contracts say communication records stay on systems we operate. We need to manage prospective deals and track communication history across 6 reps. Which CRM is best?
38. What is the best CRM with good mobile app capabilities for a small business whose field reps carry customer health information that our policy says cannot be stored with an outside provider?
39. Recommend a straightforward CRM system for a local IT service provider whose client records include network and credential details it is not willing to hand to an outside service, and which already runs its own servers.
40. Best CRM software for a small team under $30 per user per month at a company whose customer data is legally required to remain in systems the company runs itself
41. What CRM software should a small wholesale distributor of controlled chemicals use to manage accounts, given that customer identities and order histories are reported to regulators and must be retained in our own systems?
42. Which CRM tool is best for managing inbound sales inquiries at a small agency whose enquirers are whistleblower and legal-defence clients, whose identities the agency cannot expose to an outside service?
43. Best simple CRM for tracking lead status and win rates at a small addiction treatment provider, whose enquirer records are protected health information that may not be stored with an outside vendor
44. What customer relationship management software should a 10-person firm implement when its customer data is highly sensitive, its contracts forbid storing it with a cloud or software-as-a-service provider, and it already runs its own servers?

How the vendor list was built

Each of the 132 answers was read back and every named product extracted. The vendor list is discovered: a product appears here if and only if an engine named it. Counted are customer relationship management (CRM) platforms, sales pipeline managers, and broader business suites whose CRM or sales module was named. Excluded, even when named: email marketing platforms, help desks and support ticketing software, accounting and ERP packages, standalone project management tools, B2B lead enrichment databases, appointment schedulers, e-commerce platforms, cold-email tools, e-signature tools, social media tools, and companies named only as an example user.

Spelling variants of one product are folded together, and a trailing “by company” is dropped. This run collapsed 91 spellings onto 17 of the rows below: “SuiteCRM”, “SuiteCRM self-hosted” and “SuiteCRM (Self-Hosted)” are one row — the one the table prints as SuiteCRM. An edition name is folded into its product when it is that product’s name followed by a further word, and the plain name is at least three times as common. This run folded 33 such names, among them “EspoCRM self-hosted” counts as EspoCRM and “HubSpot Free” counts as HubSpot. A name that merely begins with the same letters is a different product and keeps its own row. 29 further pairs were merged by hand, and they are the only place a human judgement touches the list — it merges duplicates, it never adds or removes a vendor:

• microsoftdynamics365customerengagementonpremises counted as microsoftdynamics365
• vtigeropensource counted as vtiger
• actpremium counted as act
• actpremiumonpremise counted as act
• dynamics counted as microsoftdynamics365
• dynamics365 counted as microsoftdynamics365
• dynamics365customerengagement counted as microsoftdynamics365
• dynamics365customerengagementonpremises counted as microsoftdynamics365
• dynamics365enterprise counted as microsoftdynamics365
• dynamics365government counted as microsoftdynamics365
• dynamics365onpremises counted as microsoftdynamics365
• dynamicsonpremises counted as microsoftdynamics365
• microsoftdynamics counted as microsoftdynamics365
• microsoftdynamics365customerengagement counted as microsoftdynamics365
• microsoftdynamics365dynamicsonpremises counted as microsoftdynamics365
• microsoftdynamics365enterprise counted as microsoftdynamics365
• microsoftdynamics365gcchigh counted as microsoftdynamics365
• microsoftdynamics365government counted as microsoftdynamics365
• microsoftdynamics365onprem counted as microsoftdynamics365
• microsoftdynamics365onpremise counted as microsoftdynamics365
• microsoftdynamics365onpremises counted as microsoftdynamics365
• microsoftdynamicsonprem counted as microsoftdynamics365
• standarddynamics365 counted as microsoftdynamics365
• standardmicrosoftdynamics365 counted as microsoftdynamics365
• maximizeronpremise counted as maximizer
• selfhostedsuitecrm counted as suitecrm
• suitecrmselfhosted counted as suitecrm
• suitecrmselfhostedonpremises counted as suitecrm
• suitecrmonpremises counted as suitecrm

Beyond those folds a product is counted as the engines spelled it, and two rows in the table are never merged into one. When a product has been renamed or acquired and the engines still answer with both names, both names keep their own row: this page carries no hand-maintained list of who is now who, because that list would be a human claim about a mechanical count and nothing here could check it. What it has instead is the answers. Where an answer itself writes two of the rows below as one product renamed — the construction “X (formerly Y)” — the line beside those rows quotes that sentence and gives the overlap and the total, so the union is on the page. Nothing else produces that line. Two rows being named in the same answers does not, however often: the engines answer in shortlists, so the leaders of a category are named together whatever they are called. No answer in this run wrote two rows below that way, so no row below carries that line.

A product is counted once per answer, however many times that answer mentions it.

Is this stable, or is it noise?

A leaderboard whose top ten reshuffles between runs would not be worth publishing, so this check was run before the page was, and the page ships only because it passed.

What this is not

This measures what three answer engines said on 7 August 2026, in response to these questions, through their APIs. It is not a quality ranking, not a review, and not advice on which CRM to buy. A product can be excellent and rank low here — that gap is the point.

The raw data

All 132 answers, verbatim, one JSON object per line: run A · run B. The per-answer extracted product names: run A · run B. Machine-readable ranking: ranking.json.

What Perplexity was reading. It is the only one of these engines that returns a source list, and the markers in its answers above — [1], [2] — point into it. Every URL it cited, with the title, date and the excerpt it actually retrieved, one JSON object per answer: run A · run B. Join on index to the answers file, and read [n] as citations[n-1]. Perplexity returned a source list on 44 of its 44 answers. ChatGPT and Gemini returned no sources at all — no citation, grounding or search-result field of any kind appears anywhere in their API responses, on any of the 44 answers each gave. That is a fact about the engines, not a gap in this page.

The sources behind the answers

Run A's 44 Perplexity answers cited 852 URLs across 378 distinct domains. Below are the 63 that were cited in three or more separate answers. Citations counts every URL from that domain, so a domain cited three times in one answer counts three times; Answers is how many of the 44 answers cited it at all.

A domain missing from this table was cited in fewer than three answers, or was never cited at all — the run A file linked above is the complete list either way, and it is the only way to tell those two apart. Cited is not endorsed: a page the engine retrieved is not a page that recommended anyone, and this counts what was read, not what it said.

The answer a vendor panel shows you is read straight out of the run A file linked above — the page fetches the one line it needs and displays it unaltered, so what you read there and what you get by downloading the file are the same bytes.

What one line of each file holds, and the terms you may re-use them under — the raw answers may be re-used in any medium, commercially and inside open-source software, with attribution.