Industry · SaaS

Cold email agency for B2B SaaS

GrowthPal runs outbound for B2B software companies, including dev tools, data platforms and API businesses whose buying committee looks the same. Lists are built from public product and hiring signals rather than an industry filter, because your buyer recognizes a bought list on sight. Best fit is past 3M in ARR, with an offer people already buy, a team ready to take calls, and roughly 30,000 reachable contacts.

The buyer

Who you are really selling to

RoleWhat they care aboutWhere they pay attentionBest channel
Founder or CEO, pre Series BPipeline coverage against a board number, whether outbound works at all for the category, and whether the motion survives after the founder stops sending emails personally.Founder peer groups, private Slack and WhatsApp communities, SaaS newsletters, posts from other founders, podcasts.Cold email to a personal work address, backed by a sender profile that looks like a real person. They reply to specifics about their own product, never to a category pitch.
VP Sales or CROAE ramp time, quota attainment, pipeline coverage ratio, and whether outbound-sourced pipeline converts at the same rate as inbound.Sales leadership communities, rep productivity benchmarks, their own CRM dashboards.Email with a sales operations angle, then a call. They will ask about meeting-to-opportunity conversion, not about open rates.
Head of Demand Generation or VP MarketingBlended CAC payback period, channel mix when paid search costs rise, attribution between an outbound touch and an inbound form fill, and brand risk from mass sending on the main domain.Marketing Slack groups, martech newsletters, category reports, webinars.Email referencing a specific campaign, landing page or paid ad they are running. They notice when you have actually looked.
Head of Sales Development or SDR ManagerWhether an agency replaces, competes with or feeds their team. Owns sequencer hygiene, domain health, data spend and SDR morale.Deliverability communities, sequencer user groups, cadence tooling discussions.Email framed as capacity beside their team, never as a replacement for it. This is the person most likely to kill a deal quietly.
Revenue Operations leadCRM data hygiene, duplicate account creation, routing rules, territory conflicts, and whether agency-sourced leads pollute reporting.RevOps communities, CRM admin documentation, data vendor release notes.Email that names the CRM and the sequencer correctly and settles deduplication and data handover before they raise it.
Constraints

What makes outbound different here

Your buyer sells the same way you do

A SaaS founder or VP Sales can spot a merge tag, a spun first line, an enrichment artifact and a generated opener. They run the same tools. After two years of AI SDR products, the playbook itself is familiar, so recognition is the default reaction and specificity is the only thing that survives it.

What it decides: The angle and the sequence length. Every line has to be something only readable off their product: a tier on the pricing page, a line in the changelog, a role on their job board. Each step carries new information, and any step that exists only to bump the thread gets cut, because this audience reads a bump as filler.

Product-led and sales-led need different lists entirely

A product-led company already knows which accounts have signups, which users invited colleagues and which hit a usage ceiling. A sales-led company wants net-new accounts it cannot see yet. Those are two different data problems with two different asks, and a campaign that mixes them fits neither.

What it decides: Where the list comes from. For a product-led buyer, outbound layers on top of their own product signals, so the list starts in their data and the ask is about the economic buyer above a product user. For a sales-led buyer, the list is cold accounts assembled from public triggers. We settle which one before a row is written.

The SaaS inbox is the saturated one

Founders, CROs and VP Marketing sit on every list every data vendor sells. Every published figure for how many pitches they receive traces back to a vendor selling a cure, so we do not quote one. The condition is real even where the number is not.

What it decides: List size, pacing and channel. Go narrower than the total addressable list and accept a smaller universe rather than more volume. For the most hammered titles, a manual LinkedIn touch or a reply to something they published goes first, and the cold email follows it.

Mailbox providers police infrastructure, not just copy

Google requires SPF, DKIM and DMARC for bulk senders, asks that user-reported spam stays below 0.1 percent and never reaches 0.3 percent, and requires one-click unsubscribe under RFC 8058 for marketing mail. Microsoft announced matching authentication rules for domains sending over 5,000 messages a day to consumer Outlook, Hotmail and Live addresses.

What it decides: Channel and pacing. Sending runs on separate domains from the one carrying product and billing mail, each with its own authentication records and a real DMARC policy, warmed before volume, with a per-inbox daily cap. Spam complaint monitoring in Postmaster Tools is a standing weekly job, not a setup task.

The committee is wider than the first reply

Even a mid-size SaaS deal pulls in the SDR manager, RevOps and sometimes security. The person who replies is rarely the person who approves, and the thread usually gets forwarded before it gets answered.

What it decides: The list schema and the follow-up. Accounts are built around two or three roles rather than one, so the thread survives a forward. The first email is answerable by one person without a meeting, and the follow-up hands that person something worth forwarding internally.
Signals

Buying triggers, and the angle each one earns

TriggerHow we find itThe angle it earnsProof the email needs
New funding roundCrunchbase, PitchBook and Dealroom round records, the company press page, and for US private issuers, Form D filings on SEC EDGAR full-text search, which carry an issuer name and a filing date from the regulator itself.The round was raised against a growth plan, and the hiring plan outruns the pipeline plan.The round name and lead investor, plus one concrete thing they said publicly they would do with the money.
Open sales roles postedThe careers page, LinkedIn Jobs, and the public Greenhouse and Ashby board URLs most SaaS companies expose per company. Role title, quota, segment and territory are usually stated in the posting text.They are buying pipeline capacity through headcount, which takes months to ramp. Outbound can run while the seats fill.The specific role title, how many are open, and the quota or segment named in the posting.
An SDR or demand gen seat open a long time, or repostedThe same public job boards, comparing the posting date against today, plus visible turnover in that team on LinkedIn.The in-house motion has stalled rather than never been tried, and the sequencer is idle while the data contract is still being paid.How long the role has been live, stated plainly and without smugness.
New pricing tier or a move upmarketThe pricing page compared against its old version in the Wayback Machine, the changelog, a launch post, Product Hunt. Watch for Enterprise, SSO, SAML or a contact-sales tier appearing where self-serve checkout used to be.A new tier needs a different buyer than the existing user base, and the self-serve funnel will not reach that buyer.The exact tier or gated feature, with the old pricing page as evidence, and a named role type that now has to be sold to.
Security posture changeThe trust center page. Vanta, Drata and SafeBase trust pages are public and dated, as are most security pages and compliance announcement posts.A SOC 2 Type II, ISO 27001 or HIPAA readiness milestone unlocks a buyer segment the company could not previously sell to, and usually has no list for.The standard, the date achieved, and the segment it opens.
Technology install changeBuiltWith and Wappalyzer for web-visible technology, HG Insights and Datanyze for broader install data, and public DNS and MX records for mail infrastructure.A company that just installed a sequencer, a CRM or a data platform has either just started a motion or just rebuilt one.The tool named correctly, and a reason why that specific tool matters to the hypothesis.
Sales leadership changeLinkedIn role changes read manually, the company blog announcement, press release wires.A new CRO or VP Sales rebuilds the motion in the first 90 days and will test channels they did not inherit.The person's name, where they came from, and what they built there.
A public complaint about deliverability or a burned sending domainPosts by the founder or sales lead on LinkedIn and X, community threads, and public DNS and DMARC records showing a recent policy change on the root domain.They already believe in outbound and have hit an infrastructure wall rather than a belief wall.A reference to what they said, in their words, without overclaiming a fix.
Peek inside

Example angles we would test

Examples of angles to race in this market, not results. Each one is a hypothesis with its proof assembled before a single send.

You raised, then hired AEs faster than you built pipeline, so new reps are prospecting their own lists instead of selling.

Proof it needs
The round, plus the count of open AE roles on their own job board, both cited with dates.
The ask
A short call about covering pipeline while the seats ramp.

You added an enterprise tier, and the self-serve funnel does not reach the person who signs for it.

Proof it needs
The pricing page change, with the previous version pulled from the Wayback Machine.
The ask
Who owns reaching that new buyer today.

Signups keep arriving from accounts nobody is working, so expansion depends on users upgrading themselves.

Proof it needs
A visible free tier or free trial, plus a named enterprise feature sitting behind a contact-sales tier.
The ask
Whether anyone works the accounts behind the signups.

The SDR seat has been open long enough that the sequencer is idle and the data contract is still being paid for.

Proof it needs
The posting date of the SDR role, and the sequencer visible in their install data.
The ask
What happens to the sequences while the seat is open.

Your new SOC 2 Type II opened a segment the sales team has no list for.

Proof it needs
The dated entry on their public trust center.
The ask
Which segment it unlocked, and whether anyone is prospecting into it yet.

Outbound is going out from the primary domain, which puts the domain carrying product and billing mail at risk.

Proof it needs
Public DNS and DMARC records, plus any visible sign of volume sending on the root domain.
The ask
Whether the sending setup separates marketing mail from product mail.

A new CRO arrived from a company with a different motion and is rebuilding the top of funnel.

Proof it needs
The hire announcement, and what the motion looked like at the company they came from.
The ask
What the first 90 day plan looks like for outbound.

Replies fell after the switch to AI-written sequences, and nobody has isolated the copy from the infrastructure.

Proof it needs
Something they published about their own sending, or visible evidence of generated copy in their outbound.
The ask
Whether the drop traces to deliverability or to the message.

Paid acquisition got more expensive in your category, so the CAC payback period now needs a second sourced channel.

Proof it needs
Visible paid ads in their category and the number of competitors bidding on the same terms.
The ask
What share of pipeline is currently single-channel.

You launched in a second geography and kept the same list rules and the same sequence you use at home.

Proof it needs
A localized site, a new regional entity filing, or a job posting in the new market.
The ask
How the list and the consent rules differ for that market.
The list

How the list gets built in this market

Lists here come from the product surface and the hiring surface, both of which the company publishes itself. An industry filter plus a headcount band is the list every competitor already bought.

Funding, entity and regulator data

  • Crunchbase, PitchBook and Dealroom for round records, amounts, dates and lead investors.
  • SEC EDGAR full-text search for Form D filings, which give a dated private placement record straight from the regulator.
  • Companies House in the UK and equivalent national registries, to confirm the legal entity, filing dates and registered address before a cold email goes out.
  • Investor portfolio pages, which list current holdings and often the stage.

Hiring signals

  • Company careers pages, which state quota, segment and territory more often than people expect.
  • Public Greenhouse and Ashby board URLs, one per company, readable without an account.
  • LinkedIn Jobs for posting dates and repost history, read manually.
  • Posting age itself, treated as its own signal: an SDR role live for months says something a new posting does not.

Product surface

  • The pricing page, compared against older versions in the Wayback Machine for tier and packaging changes.
  • The changelog and the docs site, for what shipped and who it was built for.
  • The status page, for reliability events worth referencing carefully or not at all.
  • Product Hunt launches, G2 and Capterra category placement, and the text of recent reviews.

Trust, compliance and install data

  • Vanta, Drata and SafeBase trust centers, which are public and carry dates.
  • BuiltWith and Wappalyzer for web-visible technographics, with HG Insights and Datanyze for broader install data.
  • Public DNS and MX records for mail infrastructure and sending posture.
  • LinkedIn for role and tenure verification only. LinkedIn prohibits scrapers, bots and automation extensions under its User Agreement and warns that accounts using them may be restricted, so it is a place to read and verify, never a place to run a harvest.

How a row gets verified

  1. Entity check: does the company still exist, still sell the product, and still match the segment. A funded company that pivoted a year ago is a dead row.
  2. Role check: is the person still in that role as of a dated source. Titles move fast in SaaS, and a stale title is the most common reason a good angle lands wrong.
  3. Trigger age check: the trigger has to be younger than the sales cycle. A round from two years ago is a fact, not a trigger, and the row gets dropped.
  4. Deliverability check: syntax, domain MX record, catch-all detection and a verification pass. Catch-all domains go into a separate, slower segment, because an accept-all result tells you nothing about whether a human reads that box.
  5. Suppression and dedupe: existing customers, prior opt-outs, anything on a do-not-contact list, and a deduplication pass against the client CRM agreed before the first send, so RevOps is not unwinding duplicate accounts later.

What makes a bad list here

  • Anything filtered only by an industry label of computer software plus a headcount band. That is the list every competitor bought from the same vendor.
  • A single data vendor export with no second source confirming the role.
  • Generic role catch-alls: info@, sales@, hello@. They reach a shared inbox watched by someone with no authority and a fast spam-report finger.
  • Rows whose trigger is older than the sales cycle, which forces the angle back to a category pitch.
  • Install lists treated as a census. BuiltWith publishes per-technology live site counts rather than a coverage figure, so an install list is a sample.
  • Mixed-geography lists sent under one set of rules, which ignores that UK sole traders and ordinary partnerships are treated as individuals under PECR while limited companies are not.
  • Any list where one person appears at two accounts, or one account appears under two legal entities. RevOps checks this first.
  • A product-led list and a sales-led list merged into one campaign, which produces a message that fits neither.
Rules

Compliance and trust constraints

Nothing here is legal advice. Rules differ by jurisdiction and change, so read each source directly and confirm your own position with counsel before sending.

CAN-SPAM makes no exception for business to business email

The FTC guide states the law covers commercial email including business to business. It requires accurate header and routing information, a non-deceptive subject line, disclosure that the message is an advertisement, a valid physical postal address, and a working opt-out that costs nothing and asks for no more than an email address, honored within ten business days and live for at least thirty days after sending. Hiring an agency does not move responsibility off the promoted company: both parties can be liable.


Read the source

UK PECR treats a sole trader differently from a limited company

The ICO separates corporate subscribers, meaning limited companies, LLPs, Scottish partnerships and public bodies, from individuals. Corporate subscribers can be emailed without prior consent. Sole traders and most ordinary partnerships count as individuals, so consent or the existing-customer route applies. In either case the sender must be identifiable, must give a valid contact address for opting out, and must screen against a suppression list. UK GDPR still applies to the personal data inside a named work address.


Read the source

Mailbox provider rules are not law but behave like it

Google requires SPF, DKIM and a DMARC record for senders approaching 5,000 messages a day to personal Gmail accounts, with From-domain alignment, one-click unsubscribe under RFC 8058 for marketing mail, a spam rate below 0.1 percent that never reaches 0.3 percent, and 48 hours as the working window for honoring an unsubscribe. Microsoft announced matching authentication requirements for domains sending over 5,000 messages a day to consumer Outlook, Hotmail and Live addresses, with non-compliant mail routed to junk and later rejected.


Read the source

LinkedIn automation is prohibited, so plan the step manually

LinkedIn's User Agreement prohibits scrapers, bots and automation extensions, and LinkedIn warns that accounts using them risk restriction or shutdown. Since a LinkedIn touch is often the step that lands first with saturated SaaS titles, it matters that the step is designed as manual work by a named person with a real profile, not as a connect-and-message tool running in the background.


Read the source
The actual document

A targeting brief for B2B SaaS, in full

GrowthPal fills in the document below before a single row is built, and publishes it whole rather than as a screenshot, because the shape of it is the argument. Every field comes from a public source before any call happens.

FieldWhat goes in it
MotionProduct-led or sales-led, chosen, not both. For product-led, whether the first campaign runs on your product signals or on cold accounts. Everything below changes with this answer.
SegmentCategory, stage band, and the deal shape: self-serve, contact-sales tier, or usage-based pricing. Stated as the segment, not as an industry label plus a headcount filter.
TriggerThe dated event that earns the email, with the public URL it was read from: the Form D filing, the job board posting, the archived pricing page, the trust center entry.
Trigger ageHow old the signal is, against your sales cycle. Anything older than the cycle is a fact about the company, not a reason to write this week.
Signal on the rowThe one thing about this company that could not be written about any other: a gated enterprise feature, a changelog entry, the number of open AE seats, the date on a SOC 2 Type II.
Roles on the accountTwo or three, not one, so the thread survives a forward. Usually a first reader plus the person who has to approve, with the SDR manager or RevOps named where they will be involved.
AngleThe pain hypothesis in one line, in their vocabulary. If it could be pasted into an email to a different company, it goes back.
The askAnswerable by one person without a meeting, with a follow-up that gives them something worth forwarding internally.
DisqualifiersRole catch-alls, catch-all domains routed to a slower segment, prior opt-outs, existing customers, duplicates against your CRM, and sole trader addresses in jurisdictions that treat those as individuals.
What would tell us this is wrongWritten down before sending. A hypothesis with no failure condition teaches you nothing, because no result would ever count against it.

We publish the brief rather than a dashboard screenshot because a screenshot proves a number and a brief proves a method. Copying this means copying how we work, which is the point.

Process

How the engagement runs

Three stages and nine steps, the same ones in every market: build the list from public sources, race message angles against it, scale the one that wins. The nine steps from kickoff to booked meetings are written out in full.

What changes for this market

  • Week one settles the motion before anything else. Product-led or sales-led, and if product-led, whether the first campaign runs on your own product signals or on cold accounts. The list source, the ask and the proof all change with that answer, so it is the engagement rather than a preliminary to it.
  • The same week we agree territory and account ownership with your SDR manager, and deduplication rules against your CRM with RevOps. Both are easier to settle before the first meeting arrives than after.
  • List building reads the product surface, not a database filter. The pricing page against its archived version, the changelog, the public Greenhouse or Ashby board, the trust center, the install data. Every row carries its trigger and the public URL that trigger was read from, and a row whose trigger is older than your sales cycle gets dropped.
  • The send calendar is paced for saturated inboxes rather than for maximum volume: separate sending domains warmed before any send, a per-inbox daily cap, and spam complaint rate watched in Postmaster Tools every week. Sequences stay short, and any step that only bumps the thread gets cut, because this audience reads a bump as filler.
Proof

What GrowthPal has published

GrowthPal takes on outbound engagements in this market, and the method above is the one it runs here. The published record below is the whole company record, across every client.

What was publishedWhat the figure countsSource
4M+ cold emails sent for 40+ B2B companiesEmails sent, cumulative across all clients. Not one campaign.Read it
449 interested replies from 67,934 contacts reached in one month, about 1 per 150, with 955 replies in totalContacts reached, in one month.Read it
A study of 412 campaigns across 47 companies over 18 months: campaigns scoring above 0.7 on the composite message-market fit score averaged an 11.4 percent reply rate, against 1.1 percent for campaigns below 0.3. Volume, warm-up and time of day explained less than 8 percent of the variance.Total reply rate, measured against messages in those campaigns. This is a different measure from interested replies per contact and the two must never be compared on the same page.Read it

How these are counted

An interested reply means a human reply expressing interest in continuing the conversation. Out-of-office messages, unsubscribes, referrals to someone else and automated responses are not counted. A figure measured against contacts reached and a figure measured against emails sent are different measures: the column above says which each one is, and we do not convert between them or add them together.

The full counting method, and what an interested reply is.

On an industry-specific result. GrowthPal has not published a client outcome specific to B2B SaaS, so this page offers the method instead: the public sources a list is built from, the verification passes, and the angles we would test first.

Honestly

Who this is not for

  • Before product-market fit. Outbound finds people with a problem you already solve. It does not tell you what to build. If the offer still moves every month, testing angles against it measures the wrong thing, and you will read a message failure as a market failure.
  • A market smaller than roughly 30,000 reachable contacts. Very narrow categories exist in SaaS: a few hundred accounts that all know each other. Outbound still works there, but testing needs volume to separate a message that works from one that got lucky, so a smaller and more manual approach usually beats a system.
  • No one ready to take the calls. Replies arrive within days of the first sends. In SaaS the first reply is often a founder with a technical question, so if nobody owns the follow-up inside a day, the interest goes cold and the spend is wasted.
  • The SDR team has not been told. If territory and account ownership have not been written down with the SDR manager in the room, the program will produce meetings the team refuses to take. That conversation happens before launch, not after the first booked call.
  • You want volume rather than a program. If the only thing being bought is more sends per week, a tool already does that cheaper. The work that moves results here is list construction from public triggers, angle testing and infrastructure maintenance between campaigns.
Questions

Answered straight

How is this different from the AI SDR tool we already pay for?

A tool generates and sends. It does not decide which accounts are worth writing to, and it does not rewrite the hypothesis when a segment stops replying. The work that moves results here is list construction from public triggers, angle testing, and inbox infrastructure maintenance between campaigns. If the only difference a vendor can name is volume, the tool you already have is enough, and you should keep it.

We are product-led. Does outbound even fit?

It fits differently. You already know which accounts have signups, which users invited colleagues, and which hit a usage ceiling. That is a warm account list most sales-led companies would pay for. Outbound here means reaching the economic buyer above a product user, or reaching peer accounts that resemble converted ones. Running a generic cold list alongside that usually dilutes both, so we pick one motion before building a list.

How do you prospect into companies that sell the same way we do?

By assuming the recipient can decode the email. No spun openers, no fake familiarity, no reference to a podcast nobody listened to. The angle has to come from something only visible by looking: a tier on the pricing page, an entry in the changelog, a role on the job board, a dated line on the trust center. The test is simple. If a line could be pasted into an email to a different company, it is a template, not research.

Will this burn our main domain?

It should not, because outbound does not run on the primary domain. Sending happens on separate domains with their own SPF, DKIM and DMARC records, warmed before volume, with a per-inbox daily cap. Google publishes its thresholds: user-reported spam below 0.1 percent, never reaching 0.3 percent. Watching that number in Postmaster Tools is an ongoing part of the program rather than a setup task, and product and billing mail stay isolated.

Our SDR team will think you are here to replace them.

Settle that before launch. The practical split is that the program owns cold accounts with no prior touch, while the in-house team keeps inbound, existing opportunities and named accounts. Territory and account ownership get written down with the SDR manager present. We also agree the deduplication rules against your CRM in the same conversation, because duplicate account creation is what turns a supportive RevOps lead into a blocker.

Can we send to our UK and EU prospects the same way as US ones?

No, and treating them identically is a common error. Under UK PECR you can email corporate subscribers, meaning limited companies and LLPs, without prior consent, but sole traders and ordinary partnerships are treated as individuals and need consent or the existing-customer route. Identification, a valid contact address and a screened suppression list apply everywhere. Not legal advice: confirm with counsel for each market before sending.

What should we measure?

Meetings booked matter less than meetings that become qualified opportunities, so the measure worth agreeing in advance is meeting-to-opportunity rate by segment and by angle. Alongside that: bounce rate, spam complaint rate, and a written record of which hypotheses were tested and retired. No reply rate or meeting count is promised in advance. The honest early output is a list of angles that did not work and one or two that did.

How quickly should a software team expect a read on the message?

First sends land two to four weeks after kickoff, after the infrastructure is warmed, and week eight is the usual point at which one angle pulls ahead. In SaaS the useful caveat is that week eight tells you about one motion only. If the first eight weeks tested a sales-led cold list, nothing in that result tells you how outbound layered on your own product signals would have performed.

The free GTM plan
See what we would test in your market.

We score your market, map the signals we would build the list from, and tell you honestly whether outbound is the right tool for it. If you would rather see the mechanics first, the nine steps from kickoff to booked meetings are written out in full.

No deckNo pitchHonest answers