Gravy Analytics

• Use cases that require insights about inherently sensitive locations (healthcare, places of worship, schools/childcare, shelters, military installations, political gatherings).
• Brand requirements that preclude association with vendors subject to recent enforcement actions or public breach reporting.
• Procurement policies that mandate publicly documented SOC 2/ISO audits when the vendor cannot provide those documents.

• Security certifications such as SOC 2 or ISO 27001 are not publicly documented in reviewed sources.
• Pricing is opaque and requires request-for-quote engagement.

• FTC final order (January 2025) restricting sale, disclosure, and use of sensitive-location data and requiring a sensitive-location data program.
• A reported breach discovered in early January 2025 involving unauthorized access to cloud storage and alleged exposure of a large location dataset.

• Post-merger messaging references AI/ML and privacy enhancements, but public detail on product roadmaps, timelines, and independent verification of controls is limited.

• Vendor materials claim multi-supplier global scale (marketing statements reference coverage across many countries and high device-count figures).
• Vendor materials reference forensic flags and origin/accuracy characteristics for records.
• Product pages reference a privacy-related toolset for identifying and removing sensitive-location data.

• Independent, third-party validation of these claims is limited in public sources; most distinguishing features are vendor-reported and should be validated through technical due diligence and an objective pilot.
• Regulatory scrutiny and journalistic coverage provide external validation regarding operational and privacy risks rather than validation of product superiority.

G2 shows very limited review volume for Gravy Analytics offerings and should not be over-weighted. Individual review excerpts on seller pages include negative language in some cases that appear to reference a different product context and should be validated for relevance.

Capterra contains a listing titled "Gravy" with low ratings referencing failed payment recovery. The review content references payment retry logic and therefore likely pertains to a different company or product than the Gravy Analytics location data business.

Discussions on Reddit and similar forums are dominated by concerns about a reported security incident and broader data broker privacy issues. These community posts influence reputation and procurement risk but are not direct feature or implementation testimonials.

From vendor materials and legacy ecosystem partnerships, reasons cited include:

• A need for verified visitation or attendance signals for ad audiences and attribution (vendor materials reference a verification engine in legacy content).
• Claimed scale of device and location signals.

• Regulatory risk and downstream compliance exposure stemming from enforcement actions.
• Concerns about data governance, including consent provenance and sensitive-location handling.
• Security incident risk and associated reputational concerns.
• Preference for aggregated analytics approaches rather than raw device-level data in privacy-sensitive contexts.

Current, detailed case studies on vendor sites were not consistently discoverable in the reviewed search results. Unacast + Gravy product pages describe benefits (scale, cleansing, forensic flags, privacy tools), but these are vendor claims and frequently lack independent methodology disclosure and verifiable outcome metrics.

Older press materials reference inclusion or partnerships in ad-tech ecosystems and DMP partner announcements. These indicate historical ecosystem integration and market presence but should not be interpreted as validated business outcomes or ROI evidence in the current privacy and regulatory environment.

• Mid-sized to large organizations with established data governance and legal resources.

• Retail and real estate analytics.
• Telecommunications and financial services analytics.
• Advertising measurement and audience targeting in organizations that maintain strong compliance oversight.

• Heads of Data and Data Engineering.
• Marketing measurement and attribution leaders.
• Privacy and compliance counsel (should be involved in procurement).
• Security and vendor risk management leaders.

• Ability to run a controlled pilot under strict privacy and contractual constraints.
• Documented legal basis for processing and the ability to validate consent provenance and downstream use cases.
• Capacity to enforce contractual obligations around sensitive locations and deletion requirements.