If LinkedIn hit you in the Q1 2026 enforcement wave, this page is for you. Riffly is a Chrome extension that does the opposite of what got HeyReach killed: it never sends, never connects, never automates anything. There's nothing for LinkedIn to detect, because there's nothing to detect.
Late March 2026: LinkedIn pushed an enforcement wave specifically targeting accounts that drove API-pattern traffic, connection-request loops, automated InMail, scripted message sends. By the end of Q1, a meaningful share of accounts using non-compliant automation tooling had been temporarily restricted, and a smaller fraction were permanently removed. Multiple HeyReach leadership profiles disappeared from LinkedIn during this window.
The pattern wasn't new. LinkedIn has been issuing soft warnings and time-boxed restrictions to automation users for years, what changed is the volume, the speed, and the willingness to permanently remove accounts. Recruiters who had been told "this tool is safe" found out the tool was safe right up until it wasn't.
The recommendations going around in recruiting Slack and LinkedIn discourse: Northlight, Expandi, Dripify, Apollo's still-running connection sequencer, are also automation tools. They're "more conservative" only in the sense that they haven't been individually targeted yet. Same shape, same risk, same eventual outcome.
Riffly is structurally different. Not "more careful". Different.
LinkedIn's enforcement is signal-based. They look for patterns that don't match how a human uses the site: too many connection requests per hour, too many InMails per minute, sessions that move with machine cadence, login patterns matching server farms instead of laptops. When their ML flags one of those patterns, the account gets restricted.
HeyReach generated those signals by design. Riffly does not generate any of them.
Here is the entire interaction model:
From LinkedIn's side, what they observe is: a recruiter typed a message and clicked send. There is no fingerprint that distinguishes "this message was drafted by Riffly" from "this person typed it themselves" or "this person pasted it from a Google Doc". The detection problem is genuinely intractable for any tool that operates this way.
The closest reference point is Crystal Knows. Same architecture (read-only DOM, no automation, suggestion-only), 10+ years operating, never been mass-restricted by LinkedIn. Riffly sits in the same operating zone, with sharper drafts and a phrase blacklist that knocks out the 40+ tells that get cold messages deleted.
| HeyReach | Riffly | |
|---|---|---|
| Sending model | Automated sequences, scripted sends | Manual: you copy, paste, click send |
| Connection requests | Auto-queued at scale | Never. Riffly doesn't touch the connect button. |
| LinkedIn enforcement risk | High; mass restrictions Q1 2026 | Effectively zero (no automated signals) |
| What it produces | Sent messages, hands-off | Three draft variants, your eyes review every one |
| Multi-account orchestration | Yes (also: a major risk multiplier) | No. One account, one human, one inbox. |
| Sales Navigator / Recruiter | Automates these strictly-protected surfaces | Disclaimed; talk to your manager and legal team first |
| Voice fingerprint | - | Yes (Pro): drafts in your cadence and sign-off |
| Pricing entry point | $59/mo+ | $19/mo Pro · free tier exists |
| Status, May 2026 | Restricted by LinkedIn | Operating normally |
Riffly doesn't import contacts. It doesn't store contacts at all. You bring the candidate (their LinkedIn or GitHub or Wellfound profile, in your browser); Riffly drafts. If your old HeyReach workflow leaned heavily on stored sequences, the migration is genuinely a different shape, not a feature-for-feature swap. The "outreach as workflow" model is what got the category in trouble.
The enforcement model rests on detecting automation. Riffly has no automation to detect. A reviewer at LinkedIn looking at a Riffly user's account would see a recruiter typing messages and pressing send, indistinguishable from any other user. The closest reference points are Crystal Knows (10 years operating in the same zone, no mass enforcement) and ContactOut (read-mode browser extension, similarly tolerated). The /security page has the full structural argument.
Probably not, and that's a feature. LinkedIn's own restrictions on cold outreach kick in around 30-50 messages per day for most accounts; volume above that is what triggered the Q1 wave. Riffly's Pro tier (200 drafts/month) is calibrated to safe sending volume, not to the unsustainable volume that prior automation tools enabled.
Technically yes. Practically: those surfaces have stricter LinkedIn ToS terms (especially Recruiter, which forbids exporting candidate data). Talk to your manager and legal team before using any third-party tool on those surfaces, including Riffly. The product has a feature flag to disable these surfaces if your employer requires it.
Bounded by your own behavior, not the tool. A recruiter using Riffly at sensible volume (5-30 messages/day, well-targeted, low spam-report rate) is at lower ban risk than the same recruiter sending generic templates by hand, because Riffly's drafts get higher reply rates, and reply rate is the single biggest input to LinkedIn's spam-detection ML. Heavy volume is risky regardless of which tool you use; sensible volume with Riffly is in roughly the same risk envelope as not using any tool at all.
Free tier is 3 drafts a week. Most active recruiters hit that limit in a day or two and upgrade. Pro is $19/mo for 200 drafts; Plus is $39/mo for 1,500 drafts plus saved-search digest; Team is $129/mo for unlimited drafts. Full pricing →
Riffly Labs. We're a small bootstrapped team. The product has been in development since early 2026. Support email goes to someone who reads every message, 24-hour reply SLA. Funding to date: bootstrapped, no investors.
Most HeyReach refugees will settle into Northlight or Expandi inside the next 30-60 days, then realize the same risk applies. If you're going to migrate to a structurally different model, do it once.
More automation alternatives: vs Dripify · vs Expandi · vs Waalaxy · vs Octopus CRM · vs Linked Helper · vs Lemlist
Other tools and detail pages: vs Crystal Knows · vs Twain · vs ChatGPT · All tools 2026 · Voice fingerprint detail