# Report: Spinnable > GAMMA-Ray v0.0.155 (beta, for review; every rating is experimental). The GAMMA-Ray beta report on Spinnable: Spinnable AI employees (called AI workers in the documentation) A3 · R2 · C1 · O2; 69 provisions lit, 25 sources captured. > Page: https://gamma-ray.sgit.ai/reports/spinnable/ · Source: data/reports/spinnable.json GAMMA-Ray report · Spectrum 0.2 beta · Public tier · read 2026-11-10 · not reviewed by the company yet Spinnable sells AI workers that a business hires for a role; each has its own email address, can be reached on WhatsApp, Slack and voice, and acts in the customer's connected tools. 1 solution carded of 4 found 25 sources captured and hashed 69 provisions lit in 8 of 8 instruments 6 examples of the agent at work, with sources Built only from Spinnable's own public pages and, for company basics only, the news sources named beside each fact. Spinnable has not seen this report. Nothing was tested and no credentials were used. If you are Spinnable and something here is wrong or missing, the correction will be made and dated, and you can claim the card to add evidence. ## The agentic solutions One card per solution. Each level is computed from the evidence by a [published rule](../../spectrum/evidence-map/index.md); a dimension with nothing public reads "not yet evidenced", which is not a no. A card rates a product as documented, not anyone's deployment of it. ### Spinnable AI employees (called AI workers in the documentation) Role-based AI workers with their own email address, memory, scheduled tasks and access to 35+ connected tools, reachable by email, WhatsApp, Slack, meetings and voice. Spinnable AI employees a product, as documented SPECTRUM 0.2 BETA · Public tier · 2026-11-10 A3 Autonomy Acts π Moderate · S1·R5·A1 ×3 R2 Reach Integrated π Moderate · S1·R5·A1 ×3 C1 Control Stated π Moderate · S1·R5·A1 ×3 O2 Openness Documented π Moderate · S1·R5·A1 ×3 Draft Stage: Building (8 of 16) In production Standout. Autonomy 3 (Acts): "They can check your calendar, update databases, and send emails." Next unlock. Control 2 (Configurable): public evidence that high-impact actions need a person's approval would get there. Trust. FACT-Ray : 23 facts: 23 π Moderate · found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it. Standards constellation. 69 provisions lit across 8 of 8 instruments. Salesforce EAAMM OWASP MCP AAGMM Microsoft NIST AI Act Evidence: 19 sources, captured and hashed · the card's page has the vault's read key · Not reviewed by its vendor yet · correct or claim this card [The full card, every answer and its evidence](../../spectrum/cards/spinnable-ai-employees/index.md) · [the governance layer](../../scans/spinnable-ai-employees/index.md) ### Spinnable ID Gives a person's Claude or ChatGPT assistant its own WhatsApp number, email and identity, running on the person's own model plan. *No card yet (available): this solution has not been assessed.* ### Website Chat Widget An embeddable widget through which website visitors talk to a Spinnable worker. *No card yet (available): this solution has not been assessed.* ### Spinnable Enterprise Plan adding SSO, audit logs, EU data residency, workspace roles and onboarding support. *No card yet (available on request): this solution has not been assessed.* ## Our reading **The shape.** Spinnable AI employees read A3 · R2 · C1 · O2 (Building), and every level holds as shipped. A business hires a worker for a role; each has its own email address, memory and scheduled tasks, is reached by email, WhatsApp, Slack, meetings and voice, and acts in the tools it is granted, such as sending email and updating databases. When a step needs a decision without explicit rules, the worker may pause and wait for its manager. **Where the evidence is strongest.** The documentation describes the controls in working detail. Tools are granted to each worker separately, with capabilities such as read or send; a person can interrupt a running worker from the chat; a recurring task that fails three runs in a row is paused and the manager is emailed with the reason; weekly dated release notes run to 28 October 2026. By default a worker's outbound email carries a footer saying it is an AI worker, which a manager can switch off; no disclosure is documented for WhatsApp, Slack or voice. On the home page Smart Role's CEO says one worker manages his calendar, runs his outreach and keeps his pipeline current: a testimonial, without usage figures. **What would move it.** Autonomy 4: workers can already delegate tasks to one another in a team of two or more; a page stating that a worker works on its own and a person approves only critical decisions would complete the rule. Reach 3: a published protocol or interface through which other agents call a worker; a Read connection already narrows access as an option. Control 2: a documented setting that makes high-impact actions wait for a person's approval. Openness 3: published evaluation results with a method; an llms.txt and a channel for reporting problems with a worker are in place. **Seen, and not counted.** The home page says anything with external impact waits for a person's sign-off; no documented mechanism matches it yet, so it is not counted as an approval step. The action log is documented, not observed. A data processing clause promising breach notice within 72 hours is a contract term, not a record of telling those affected about an agent's errors, so the challenger lowered it. SOC 2 Type II is stated as in progress. **For readers.** Spinnable launched at Web Summit 2025 with a release datelined Lisbon; its co-founders Vasco Pedro, Gil Coelho and Fábio Kepler all came from Unbabel. At launch the company said 10 of its 15 staff were not human, as Essential Business reported. ## What would move it The one piece of public evidence that would lift each card next: - **Spinnable AI employees (called AI workers in the documentation)**: Control 2 (Configurable). Public evidence that high-impact actions need a person's approval. ## The agent at work Examples from public pages that name a customer or give figures. Each source was captured and hashed on the date shown. ### Smart Role CEO testimonial: two workers, one running calendar, outreach and pipeline, one watching a market. "Clara manages my calendar, runs my outreach, and keeps my pipeline current." [Source](https://www.spinnable.ai/) (captured 2026-11-10T19:45Z, sha256 `e524bed247dadd0e`) ### MDS Portugal Documentation example: a healthcare technology provider refining its customer support worker through feedback. "uses Spinnable's feedback system to continuously refine their customer support worker." [Source](https://docs.spinnable.ai/guides/training-feedback) (captured 2026-11-10T10:38Z, sha256 `76b7484497057bcb`) ### Centry Capital Co-founder testimonial: several workers across a family office handling email, travel, outreach and bookings. "I run multiple AI workers across my family office and ventures" [Source](https://www.spinnable.ai/) (captured 2026-11-10T19:45Z, sha256 `e524bed247dadd0e`) ### Importrust Partner testimonial: workers that act on the company's processes. "Spinnable gave us truly autonomous agents that understand our processes and act independently." [Source](https://www.spinnable.ai/) (captured 2026-11-10T19:45Z, sha256 `e524bed247dadd0e`) ### Sifted Chief of Staff testimonial on hiring workers and chatting with them on WhatsApp. "Workers are ridiculously easy to hire" [Source](https://www.spinnable.ai/enterprise) (captured 2026-11-10T10:38Z, sha256 `c5c6d62cb2a9878d`) ### Spinnable itself At launch the company said 10 of its 15 staff were not human (Essential Business). "has 15 staff but 10 are not human" [Source](https://www.essential-business.pt/?p=32959) (captured 2026-11-10T10:38Z, sha256 `10e2511715510777`) ## The company - Founded in Lisbon (About page metadata) "Founded in Lisbon" [Source](https://www.spinnable.ai/about) (captured 2026-11-10T10:38Z, sha256 `59d5a12e194f86ef`) - Launched at Web Summit 2025 with a release datelined Lisbon, 9 November 2025 "Lisbon, Portugal [09.11.25]" [Source](https://websummit.com/wp-media/2025/11/SPINNABLE-LAUNCH-RELEASE-1.pdf) (captured 2026-11-10T10:38Z, sha256 `3e02c19208b75551`) - Co-founded by Vasco Pedro, Gil Coelho and Fabio Kepler, all formerly of Unbabel "Vasco co-founded Spinnable alongside Gil Coelho, former Head of Product at Unbabel," [Source](https://websummit.com/wp-media/2025/11/SPINNABLE-LAUNCH-RELEASE-1.pdf) (captured 2026-11-10T10:38Z, sha256 `3e02c19208b75551`) - Raised about 2 million euros in a pre-seed round led by HeartCore, Florent.vc and Alphagraph (Essential Business, 12 November 2025) "raise around €2 million in a pre-seed round" [Source](https://www.essential-business.pt/?p=32959) (captured 2026-11-10T10:38Z, sha256 `10e2511715510777`) - Plans: Starter at 50 USD a month with 2 AI workers; Business from 150 USD with 5; Enterprise custom "Starter is $50 per month with 2 AI workers" [Source](https://www.spinnable.ai/) (captured 2026-11-10T19:45Z, sha256 `e524bed247dadd0e`) - Application and primary database hosted in the EU "Our application and primary database are hosted in the EU." [Source](https://www.spinnable.ai/enterprise) (captured 2026-11-10T10:38Z, sha256 `c5c6d62cb2a9878d`) - SOC 2 Type II is stated as in progress "SOC 2 Type II certification in progress." [Source](https://www.spinnable.ai/enterprise) (captured 2026-11-10T10:38Z, sha256 `c5c6d62cb2a9878d`) - Publishes a vulnerability disclosure policy (v1.0, effective 13 May 2026) that permits prompt injection testing against a researcher's own workers "Permitted exclusively against your own AI workers." [Source](https://www.spinnable.ai/security/vdp) (captured 2026-11-10T10:38Z, sha256 `ee01e69ba1682646`) ## The people Public and professional only, from the company's own pages or a public professional source. - **Vasco Pedro**, Founder & CEO. [Source](https://www.spinnable.ai/about) - **Gil Coelho**, Co-Founder & CPO. [Source](https://www.spinnable.ai/about) - **Fábio Kepler**, Co-Founder & CTO. [Source](https://www.spinnable.ai/about) ## The graph The company, its people and the stories on the left; each solution, the captured sources behind its card, the indicators those sources evidence and the provisions of the instruments those indicators touch, to the right. "Touched" never means "complies". people and stories company solutions 19 sources 23 indicators 69 provisions, by instrument I04: Workers run Python code and custom scripts in a sandbox, where stored credentials are exposed as environment variables. I08: The documentation states workers act in connected tools, such as updating databases and sending emails. I10: Workers connect to many tools across a business, from email and calendar to GitHub, Notion and Salesforce. I11: Each tool is connected by authenticating with the outside service through OAuth or an API key. I12: With two or more workers in a team, a worker can delegate tasks to the others; each sub-task shows as its own block in the activity trail (release notes, 10 June 2026). I17: The home page FAQ states that a worker schedules tasks, sends follow-ups and completes workflows without being prompted each time, that it will not take actions with external consequences without the person's approval and asks when unsure; no documentation page describes how that approval is configured. I20: The documentation states what the workers are for: joining a team and doing its work, by role or for a specific process. I21: Tools must be granted to each worker separately, with a chosen connection and capabilities such as read or send. I22: The troubleshooting page documents failure cases, such as a worker stopping mid-workflow, with causes and fixes. I25: A tool connection can be set to Read, so the workers using it can look things up but not create, change or send; Read is preselected for a new connection, while Full access remains the default and is needed to act. I26: Each worker has its own email address, separate from the people it works for. I30: Each worker has a manager who administers its settings; the role can be handed to another user. I39: A person can interrupt a worker from the chat with Send now, which cancels the reply it is generating; the page describes stopping a run, not stopping the worker as a whole. I40: A recurring task that fails three runs in a row is paused and the worker's manager is emailed with the reason. I41: The documentation states every tool action is logged with time, worker, tool, method and outcome; documented, not observed. I46: Who may message a worker is a per-worker setting in the same workspace account that runs the worker, changed by its manager or co-managers; the page does not say the worker itself can change it. I47: Persistent rules for a worker are written in prose in its Worker Policy. I56: By default, a worker's outbound email carries a signature footer saying it is an AI worker hired through Spinnable; a manager can switch the signature off, which removes the footer. Email only; no disclosure is documented for WhatsApp, Slack or voice. I57: A support page gives an email channel for reporting problems with a worker, for managers and for workers themselves. I58: The privacy policy lists what the agents access: email, calendar, documents, messages and data from connected platforms. I68: The documentation index lists dated release notes from 8 January to 28 October 2026, most weeks, with some gaps. S1: The home page quotes Smart Role's CEO: one worker manages his calendar, runs his outreach and keeps his pipeline current. A testimonial; no usage figures for what the workers do. S3: An llms.txt resolves on the marketing site and on docs.spinnable.ai, fetched on 10 November 2026. Spinnable Vasco Pedro Gil Coelho Fábio Kepler Smart Role MDS Portugal Centry Capital Importrust Sifted Spinnable itself Spinnable AI employees (called AI workers in the documentation) Spinnable AI employees A3 · R2 · C1 · O2 Spinnable ID Spinnable ID Website Chat Widget Website Chat Widget Spinnable Enterprise Spinnable Enterprise docs.spinnable.ai/guides/worker-v… docs.spinnable.ai/concepts/ai-wor… docs.spinnable.ai/tools/overview docs.spinnable.ai/release-notes/2… spinnable.ai docs.spinnable.ai/introduction docs.spinnable.ai/concepts/tool-p… docs.spinnable.ai/troubleshooting… docs.spinnable.ai/release-notes/2… docs.spinnable.ai/guides/change-m… docs.spinnable.ai/concepts/commun… docs.spinnable.ai/release-notes/2… docs.spinnable.ai/guides/connecti… docs.spinnable.ai/guides/worker-c… docs.spinnable.ai/guides/corporat… docs.spinnable.ai/support/contact spinnable.ai/privacy-policy docs.spinnable.ai/llms.txt spinnable.ai/llms.txt It generates and executes code with local or cloud privileges I04 It executes actions itself I08 It works across several domains or systems I10 It connects to external tools or services across a trust boundary I11 Several agents coordinate inside the organisation I12 The agent handles routine tasks; the person is consulted on exceptions I17 Its purpose and permitted tasks are stated in writing I20 Its autonomy limits and the tools it may use are defined I21 Its limits and known failure cases are documented for those who use it I22 It asks for narrower access than the whole account I25 It has its own identity, separate from any person's I26 Each agent has a named owner I30 There is a way to pause or stop it I39 There is a defined escalation path I40 Its actions are logged I41 A limit on it is a setting that its own account could change I46 A limit on it is a rule in prose I47 It tells the people it talks to that it is an AI I56 There is a channel to report problems with it or contest its output I57 The data it uses is described I58 It is improved on a regular cycle I68 It is in production: a public source names a customer or gives usage figures for what it does on its own S1 It is machine-readable for agents: it publishes an llms.txt, an AGENTS.md, an API description or an agent card S3 Salesforce 13 EAAMM 3 OWASP 12 MCP authorization 4 AAGMM 7 Microsoft 10 NIST AI RMF 16 EU AI Act 4 OWASP, AT4 Code Executing Agent Salesforce, Level 2: Simple Orchestration, Single Domain Salesforce, Level 1, how to advance from Level 1 to Level 2 Microsoft, 200: Repeatable, Business strategy Salesforce, Level 3: Complex Orchestration, Multiple Domain Salesforce, Level 2, how to advance from Level 2 to Level 3 Salesforce, Level 3, how to advance from Level 3 to Level 4 Microsoft, 400: Capable, Business strategy Microsoft, 200: Repeatable, Technology and data OWASP, AT6 Externally Extended Agent NIST AI RMF, GOVERN 6.1 NIST AI RMF, MAP 4.1 OWASP, AT7 Multi-Agent Orchestration Salesforce, Level 2, how to advance from Level 2 to Level 3 Microsoft, 500: Efficient, Technology and data AAGMM, GD-09 EAAMM, L3 Consultative (survey item Q9) NIST AI RMF, MAP 1.1 NIST AI RMF, MAP 2.1 NIST AI RMF, MAP 3.3 NIST AI RMF, MAP 1.3 EU AI Act, Article 13 OWASP, Maturity Level 1 Experimentation without Guardrails, key enterprise action NIST AI RMF, MAP 2.2 Microsoft, 300: Defined, Business strategy NIST AI RMF, MEASURE 2.5 MCP authorization, Authorization (draft) Salesforce, Level 2, how to advance from Level 2 to Level 3 Salesforce, Level 3, how to advance from Level 3 to Level 4 AAGMM, GD-02 MCP authorization, Authorization (draft) OWASP, Maturity Level 4 Adaptive, Self-Regulating Governance, key enterprise action OWASP, Maturity Level 2 Policy-Defined, Human-in-the-Loop, key enterprise action OWASP, Maturity Level 0 Unaware and Ad Hoc, key enterprise action Microsoft, 200: Repeatable, Organization and culture OWASP, Maturity Level 3 Integrated, Continuous Oversight, key enterprise action NIST AI RMF, MANAGE 2.4 EU AI Act, Article 14 EAAMM, Prerequisite, L2 to L3 NIST AI RMF, GOVERN 3.2 AAGMM, GD-06 OWASP, Maturity Level 0 Unaware and Ad Hoc, key enterprise action OWASP, Maturity Level 1 Experimentation without Guardrails, key enterprise action EU AI Act, Article 12 AAGMM, GD-03 AAGMM, GD-08 OWASP, Maturity Level 0 Unaware and Ad Hoc, key enterprise action EU AI Act, Article 50 NIST AI RMF, MEASURE 3.3 NIST AI RMF, GOVERN 5.1 Salesforce, Level 1, how to advance from Level 1 to Level 2 Salesforce, Level 4, how to maximize value NIST AI RMF, GOVERN 5.2 AAGMM, GD-05 EAAMM, Readiness dimension 2 Salesforce, Level 0, how companies can advance from Level 0 to Level 1 Salesforce, Level 1, how to advance from Level 1 to Level 2 AAGMM, GD-12 Microsoft, 400: Capable, AI governance and security Microsoft, 500: Efficient, Business strategy Microsoft, 500: Efficient, AI strategy and experience NIST AI RMF, MANAGE 4.2 OWASP, Maturity Level 1 Experimentation without Guardrails, key enterprise action NIST AI RMF, MEASURE 4.3 NIST AI RMF, MAP 1.4 Microsoft, 400: Capable, Business strategy Salesforce, Level 0, how companies can advance from Level 0 to Level 1 MCP authorization, Authorization (draft) MCP authorization, Authorization (draft) ## The evidence | Source | Read | SHA-256 (first 16) | |---|---|---| | [docs.spinnable.ai/concepts/ai-workers](https://docs.spinnable.ai/concepts/ai-workers) | 2026-11-10T19:45Z | `9d2680d11239f6d5` | | [docs.spinnable.ai/concepts/communication-channels](https://docs.spinnable.ai/concepts/communication-channels) | 2026-11-10T19:45Z | `1a2e71264a57e7d8` | | [docs.spinnable.ai/concepts/tool-permissions](https://docs.spinnable.ai/concepts/tool-permissions) | 2026-11-10T19:45Z | `342ec2920305e9c1` | | [docs.spinnable.ai/guides/change-manager](https://docs.spinnable.ai/guides/change-manager) | 2026-11-10T19:45Z | `2d671fed98e821aa` | | [docs.spinnable.ai/guides/connecting-tools](https://docs.spinnable.ai/guides/connecting-tools) | 2026-11-10T19:45Z | `7b74a21879216b40` | | [docs.spinnable.ai/guides/corporate-email](https://docs.spinnable.ai/guides/corporate-email) | 2026-11-10T19:45Z | `a9df835d12dae365` | | [docs.spinnable.ai/guides/training-feedback](https://docs.spinnable.ai/guides/training-feedback) | 2026-11-10T10:38Z | `76b7484497057bcb` | | [docs.spinnable.ai/guides/worker-communication-restrictions](https://docs.spinnable.ai/guides/worker-communication-restrictions) | 2026-11-10T19:45Z | `50276fae687884ba` | | [docs.spinnable.ai/guides/worker-vault](https://docs.spinnable.ai/guides/worker-vault) | 2026-11-10T19:45Z | `c02c431258de899b` | | [docs.spinnable.ai/introduction](https://docs.spinnable.ai/introduction) | 2026-11-10T19:45Z | `78c79870c3a10df4` | | [docs.spinnable.ai/llms.txt](https://docs.spinnable.ai/llms.txt) | 2026-11-10T19:45Z | `a017860de55023b0` | | [docs.spinnable.ai/release-notes/2026-06-10](https://docs.spinnable.ai/release-notes/2026-06-10) | 2026-11-10T19:45Z | `f3199219bcccd9df` | | [docs.spinnable.ai/release-notes/2026-08-05](https://docs.spinnable.ai/release-notes/2026-08-05) | 2026-11-10T19:45Z | `2460f07fc54c2741` | | [docs.spinnable.ai/release-notes/2026-10-28](https://docs.spinnable.ai/release-notes/2026-10-28) | 2026-11-10T19:45Z | `66c9eb59e08d9100` | | [docs.spinnable.ai/support/contact](https://docs.spinnable.ai/support/contact) | 2026-11-10T19:45Z | `85e1b88c1b6fd9a0` | | [docs.spinnable.ai/tools/overview](https://docs.spinnable.ai/tools/overview) | 2026-11-10T19:45Z | `e175e5806f7aa1d7` | | [docs.spinnable.ai/troubleshooting/index](https://docs.spinnable.ai/troubleshooting/index) | 2026-11-10T19:45Z | `dcf489600b0425cf` | | [websummit.com/wp-media/2025/11/SPINNABLE-LAUNCH-RELEASE-1.pdf](https://websummit.com/wp-media/2025/11/SPINNABLE-LAUNCH-RELEASE-1.pdf) | 2026-11-10T10:38Z | `3e02c19208b75551` | | [www.essential-business.pt/?p=32959](https://www.essential-business.pt/?p=32959) | 2026-11-10T10:38Z | `10e2511715510777` | | [www.spinnable.ai/](https://www.spinnable.ai/) | 2026-11-10T19:45Z | `e524bed247dadd0e` | | [www.spinnable.ai/about](https://www.spinnable.ai/about) | 2026-11-10T10:38Z | `59d5a12e194f86ef` | | [www.spinnable.ai/enterprise](https://www.spinnable.ai/enterprise) | 2026-11-10T10:38Z | `c5c6d62cb2a9878d` | | [www.spinnable.ai/llms.txt](https://www.spinnable.ai/llms.txt) | 2026-11-10T19:45Z | `c702a4fd1b2a1dcc` | | [www.spinnable.ai/privacy-policy](https://www.spinnable.ai/privacy-policy) | 2026-11-10T19:45Z | `7558a1dcef25c8a6` | | [www.spinnable.ai/security/vdp](https://www.spinnable.ai/security/vdp) | 2026-11-10T10:38Z | `ee01e69ba1682646` | ## How this report was made A researcher-assessor gathered and captured the sources and mapped the evidence to indicators, without assigning a level. A challenger argued against every level three and four and every doubtful credit. The [deterministic scorer](../../spectrum/pipeline/index.md) computed the levels and the gate checked the rules. A card appears here only after two rounds of review and a sign-off by agents that did not write it (the team's workflow); Spinnable AI employees (called AI workers in the documentation): reviewed in 6 rounds, signed off by gamma.approve@web-summit.dinis on 2026-11-10. A person's sign-off of the series is still to come. | Role | Who | |---|---| | researcher-assessor | a sub-agent of gamma.studio@web-summit.dinis | | challenger | a sub-agent | | scorer | build/spectrum.mjs | | analyst, designer, writer | gamma.studio@web-summit.dinis | | review | gamma.review@web-summit.dinis, 6 rounds | | sign-off | gamma.approve@web-summit.dinis, 2026-11-10 | ## The vault Every capture, the dossier, both assessors' mappings, the challenger's notes and this report's data are in a public sgit vault (`kghdiwq3`). Read key: sgit_public_read_76f8699d4556bfb03360cbda6e61d0c7f76b07e13444704e4ced072a90a1742c:kghdiwq3 With [sgit](https://sgit.ai/): `sgit clone` followed by the key. The key reads; it cannot write. ## Corrections None yet. A correction is made in place, dated here, and carried to the card, the vault and the article. ## The article [Spinnable AI employees on the GAMMA-Ray Spectrum: A3 · R2 · C1 · O2](article.md), written from this report for PrompTugal.news.