Accounts: agent intent for sales

See which companies' AI agents are researching you, what they read, and how strong the signal is. Accounts are company-level only: Punchline studies what agents read, not who people are.

How a company gets connected

1. An agent researches in someone's browser. Agents that work inside a person's own browser share that person's connection and browser, so their page views join the person's visit the same day, through the daily visitor hash. No cookie, and nothing stored on the device.
2. That person gives you a work email. When they fill in a demo request, signup or contact form, your server sends Punchline the email's domain with the event.
3. The day belongs to the company. That visitor's day, the person's pages and any agent that worked in their browser that day, is linked to the company.

Agents running in the cloud (a provider's own browser or crawler) carry their operator's name, OpenAI or Anthropic, never the buyer's. They can be counted, not connected to a company. AI & agents → Where agents run shows how much of your agent traffic is which.

Send the company domain

Add company_domain to the event your server sends when someone submits a form, with the visitor's IP address and user agent:

curl -s https://app.punchlineanalytics.com/v1/events \
  -H "Authorization: Bearer $PUNCHLINE_WRITE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "site_id": "<your site id>",
    "events": [
      { "name": "demo_request",
        "visitor": { "ip": "203.0.113.7", "user_agent": "Mozilla/5.0 …" },
        "company_domain": "acme.com" }
    ]
  }'

• Send just the domain. If you send a whole address, only the part after @ is used and the rest is dropped before anything is stored.
• Personal mail (gmail.com, outlook.com, icloud.com and the like) is skipped: it doesn't name a company.
• The response says how many companies were linked and skipped (companies_linked, companies_skipped). A company can only be linked with a visitor.

What you see

Accounts lists each company with:

• Signal: strong, moderate or light, from what its agents read over the date range. Pricing, security and comparison pages count most, then demo, contact and integrations pages, then docs, product and customer pages. Careers pages don't count. Strong is roughly four or more reads of the pages that count most.
• What their agents read, in one line, for example Agents read pricing and security pages 7 times.
• Agent sessions, against the previous period of the same length, and how many people visited.

Open a company to see its journey (agent research, then people), what it read by intent and page, and the evidence behind the link.

Intents come from the page's path: /pricing and /plans are pricing, /security, /trust and /compliance are security, /compare and -vs- pages are comparisons, and so on. To set a page's intent yourself, give it a topic named after a category (pricing, security, comparison, demo, integrations, docs, product, customers, support) in Site settings → Page rules.

Into your CRM

Connect HubSpot or Salesforce to write signals straight onto the company, and to see each company's pipeline and revenue next to its research. Or use the alert and webhook:

• Alert: add A company is researching you in Alerts. It fires when a company's agents reach a strong (or, if you choose, moderate) signal over 7 days, and reports each company once a week.
• Webhook: in Alerts → Where alerts go, add a webhook URL. The daily digest arrives as JSON, with each company's domain, signal, summary, agent sessions and top intents, ready for a Zapier, Make, HubSpot or Salesforce workflow to create an account activity.

Each webhook request carries Punchline-Signature: t=<unix time>,v1=<signature>, the HMAC-SHA256 of t.body with the signing secret shown when you saved the URL. Check it, and reject old timestamps (full payload and Python version):

import { createHmac, timingSafeEqual } from "node:crypto";

function verify(header, body, secret) {
  const { t, v1 } = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
  const want = createHmac("sha256", secret).update(`${t}.${body}`).digest("hex");
  return typeof v1 === "string" && v1.length === want.length && timingSafeEqual(Buffer.from(want), Buffer.from(v1));
}

API and AI assistants

GET /v1/accounts and the MCP tool get_account_signals return the same accounts. Outside your dashboard, people's activity for a company is withheld when fewer than 5 people are involved; agent activity is shown in full.

Privacy

• Only the domain is kept, never the address. Company links are deleted after 90 days, like page views.
• A company is linked to a visitor for one day only: daily visitor hashes can't be connected across days.
• Browsers sending Global Privacy Control get no visitor hash, so they're never linked to a company.
• Where a company domain could identify one person (a sole trader's own domain), treat the account like that person's data.