Lusha

Lusha is a B2B database with retrieval surfaces on top of it. The homepage puts the scale at 515M+ verified contacts and 29M+ companies, with 77 fields on a record, a confidence score on each email and a last-update date on each phone and email. On top of that sit 26 dated buying signal types: job changes, funding rounds, hiring surges and leadership moves, described as "a dated event on a named company, not anonymous intent".

The same records are read from four places: the Lusha Workspace, a Chrome extension, the REST API, and a hosted MCP server. A second layer, which Lusha calls Deep Intelligence, ranks accounts by fit, scores recent signals, maps the buying committee at an account and finds lookalikes of existing customers. There is no outreach engine here beyond email sequence automation and call recording listed in the plan tables; the product's job is to supply records and signals to whatever does the sending.

Plans are flat subscriptions carrying a credit allowance, and credits are spent per reveal: one credit for an email address and five for a phone number. A list of 500 prospects with direct dials therefore costs five times the same list by email alone, which is the number to model before picking a tier.

Free is a standing plan at 40 credits a month on one seat, with no card. Starter is $49.90 a month for 400 credits, Pro $69.90 for 600, Premium $399.90 for 3,400. Paying yearly is advertised at 25 percent off and takes Starter to $37.45 a month, billed as a single upfront charge with the whole year's credits granted at once. The difference matters beyond the discount: on monthly plans unused credits "roll over and accumulate up to twice the credit limit", while on annual plans "any unused credits will be reset at the end of the annual cycle".

The pricing page runs a slider from 40 up to 120,000 credits a year, but publishes no per-credit rate and no overage rate. Extra credits are bought in account settings, and Scale, the only quote-priced tier, advertises its credit discount as "50%+ off price per credit" without a base figure. Self-serve purchase stops at five users: "For teams larger than 5 users, please reach out to our Sales team." Cancellation is done in account settings and takes effect at the end of the cycle.

Programmatic access is not gated behind an enterprise tier. The API FAQ answers which plans include it with "Every plan, including Free", and gives each user a key by default. What scales is throughput: 40 requests a minute and 100 a day on Free and Starter, 50 a minute and 1,500 a day on Pro, 300 a minute on Premium and Scale. The comparison table marks the two lower tiers "Strict rate limits", which 100 calls a day earns. Four endpoints are documented: enrichment, prospecting, signals and lookalikes.

The MCP server is hosted at mcp.lusha.com and listed on a connector page covering Claude, a Claude plugin, ChatGPT, Codex, Claude Code, Cursor, VS Code with Copilot, Gemini CLI, Clay, Make, n8n, Gong and Databricks. Balance checks are free and "usage at standard rates", meaning MCP calls draw on the same credit balance as the workspace. There is also a self-hosted server on npm, @lusha-org/mcp, MIT licensed on GitHub, exposing 8 tools including bulk lookup of up to 100 records per call. Outreach, Microsoft Copilot, AWS Bedrock, Grok and Google Cloud Marketplace carry "Coming soon" labels on the same page.

Lusha's own site also ships a WebMCP script that declares three browser tools for an agent reading the page: requestDemo, getPricing and findIntegration. All three navigate, they do not transact, and they register only in a browser that implements navigator.modelContext.

The API FAQ carries two restrictions worth reading before building on it. Resale and embedding are barred without written consent: "Data brokers and other third-party platforms can't embed, expose, or otherwise provide access to the Lusha API, or to data obtained through it, on or through their own website, product, or service." Model training is barred too: "Data obtained through the API can't be used to train or develop AI or ML systems, except where the Terms and Conditions specifically say otherwise."

That second clause sits beside a product sold as a data source for AI agents. Calling Lusha from an agent at query time is the documented use; accumulating its records into a training set or a derived model is not, and a team planning to build an internal dataset should get the exception in writing. Both restrictions are stated on the API page rather than only in the contract.

The compliance page links a downloadable certificate for each claim rather than naming a badge: SOC 2 Type II, ISO 27001, 27701, 27017, 31700 and 42001, GDPR certification by ePrivacyseal GmbH, CCPA validation by TrustArc, and a TRUSTe Responsible AI letter. A DPA is published for all customers, with SCCs, transfer impact assessments and a subprocessor list. The trust center states a 99.95 percent uptime SLA. SSO/SAML, role-based access control and audit logs are listed as in-product security features, though the plan tables place SSO on the Scale tier only.

On AI handling, the trust center enumerates every model family in use, its type, and whether customer data feeds it. The answer is "No" for search, normalization, technographics, enrichment and chat, and "Yes" for personalized recommendations, where the stated remedy is to contact support: "Yes, customers can opt-out by reaching out to Lusha's Support team." Training on customer data is ruled out, and retention at AI providers is zero.

What is not published is a retention control for the data a customer puts in or pulls down. Residency is described rather than chosen: personal data "mainly stored in EU regions for GDPR compliance" and US data in US regions, which is a policy, not a setting a buyer picks at signup.

This suits a sales or RevOps team that wants one credit balance behind the extension, the CRM sync, a workflow in n8n or Make, and an assistant in Claude or ChatGPT. The free tier is a real evaluation path: 40 credits and a working API key cost nothing and need no card, so coverage in a given region and seniority band can be measured before any money moves.

It fits less well in three cases. A team whose outreach is phone-first pays five credits per number and should price the tier on dials rather than on contacts. A team that needs per-user spend caps finds that control only on Scale, which means a sales conversation and a quote. And a business that wants to resell enriched data, embed the API in its own product, or train a model on what it pulls is outside the published terms and needs written consent first.

The operating company is Lusha Systems Inc., with the address on its own pages given as 800 Boylston St. Suite 1410, Boston, MA 02199. One inconsistency is worth noting for anyone matching plan names across documents: the structured data on the pricing page calls the third tier "Lusha Professional" while the rendered card and the comparison table call it "Pro".