If you bought Bonfy.AI to police what Microsoft 365 Copilot, ChatGPT and Claude see, your standalone product now has a clock on it and nobody has told you the time. Kiteworks announced on September 8 that it "will continue to offer Bonfy.AI to customers as a separate solution while it is integrated into the Kiteworks platform." That sentence carries no renewal right, no price hold, no support commitment and no end date. Five weeks earlier, the same acquirer told WAMNET Japan's customers in writing that their contracts, pricing and support would stay unchanged. Ask for those terms now, while you still have a renewal to withhold.
This matters most to the buyers Bonfy was built for. CTech reports that the Israeli startup focused on healthcare, finance, insurance, law and media — exactly the firms that cannot switch off a data control on AI traffic while a vendor works out its roadmap.
What Did Kiteworks Actually Promise Bonfy Customers?
Kiteworks promised one thing: Bonfy stays on sale as a separate product "while it is integrated into the Kiteworks platform." Everything a renewal depends on — price, term, support model, where your data is processed — is absent from the announcement.
Here is what is on the record. The Kiteworks release says Bonfy covers "email, file sharing, SaaS applications, data repositories, Internet-facing AI assistants, and autonomous agents," and works with Microsoft 365 Copilot, Claude, ChatGPT and custom agentic workflows. Bonfy's own homepage now opens with "Bonfy.AI is now part of Kiteworks" and still lists Salesforce, HubSpot, Slack and Google Workspace among its integrations. Financial terms were not disclosed; CTech estimated the deal at tens of millions of dollars, and SecurityWeek counts it as Kiteworks' eighth acquisition in five years.
The product category needs a plain definition, because it is what you would be re-buying. Runtime data classification is a control that reads a message, file or AI prompt as it is being sent and applies policy before the send completes. Help Net Security's write-up describes Bonfy's version as weighing "the sender, the recipient, the counterparty relationship, the channel, and the business purpose of the exchange" before it decides.
Bonfy is young. CTech reports it was founded in early 2024 by Gidi Cohen, who previously founded Skybox Security, and Danny Kibel, and it emerged from stealth in June 2025 with a $9.5 million seed round led by TLV Partners. Most of its customers are likely still on their first contract — which means most of them have never negotiated a renewal with this vendor, let alone with its new owner.
Kiteworks Has Written Stronger Continuity Terms Before
Kiteworks knows how to write a continuity promise. Its own press releases show it doing so twice, and the Bonfy announcement sits at the weak end of that record.
| Deal | Announced | What customers were told |
|---|---|---|
| totemo | January 11, 2022 | Technology to be "integrated into the Kiteworks platform in coming months"; no standalone commitment |
| Zivver | June 17, 2025 | "Sold and supported independently"; customers "can continue renewing and upgrading their licenses as before"; data stays in the EU |
| WAMNET Japan | August 5, 2026 | "Current contracts, pricing structures, and dedicated support remain unchanged"; data stays in Japan |
| Bonfy.AI | September 8, 2026 | "A separate solution while it is integrated" |
The strongest case for Kiteworks is that the deals are different in kind. WAMNET brought more than 500 enterprise customers, and a written price freeze is how an acquirer stops a base that size from churning. Bonfy was bought for its engine. Cohen said as much in SecurityWeek's report: "Kiteworks gives that technology a control plane and a reach we could not have built on our own."
That reading is fair, and it is exactly why a Bonfy customer should push. An acquirer that bought technology rather than an installed base has the least reason to protect the installed base's terms. It is also why the ask is not unreasonable: you are requesting language Kiteworks has already published twice. The lesson is the same one Wallaroo buyers learned when d-Matrix bought it — a sentence in a press release is a mood, not an obligation.
Where totemo Customers Ended Up Is the Base Case
When Kiteworks absorbed totemo, it built a path to move customers onto the Kiteworks platform. Two years after the totemo deal, Kiteworks announced in January 2024 that AVL had moved from totemomail to the Kiteworks Email Protection Gateway. AVL's IT infrastructure department manager, Heimo Kirsch, said the move "eliminates our need to purchase and maintain an additional database and OS for totemomail." Kiteworks added that it had "developed a toolkit that makes the upgrade to the Kiteworks Email Protection Gateway both easy and fast."
Nothing in that release announces an end of support for totemomail, and none should be inferred. The point is the direction of travel. Even the generous WAMNET promise ends the same way: customers "will be offered a fully supported pathway to upgrade to the Kiteworks platform." And the Zivver release reserves Kiteworks' "24/7 support operation" for "customers electing to upgrade to the combined Kiteworks platform."
For Bonfy customers, migration has an edge totemo customers did not face: channel coverage. Bonfy enforces policy on traffic that may never touch Kiteworks — a Copilot prompt, a Slack message, a Salesforce record. One of Kiteworks' existing AI controls, its Secure MCP Server, is built the other way round: it lets AI assistants work with files while keeping "sensitive data within your control plane." Help Net Security reports that the combined capability is meant to reach Outlook, Gmail, OneDrive, SharePoint, Workspace and Salesforce. That is the stated intent. Whether a ChatGPT prompt that never passes through Kiteworks stays in scope after integration is the question to get answered in writing — as Stripe's OpenRouter buyers learned, a toggle is not a contract.
Why Regulated Buyers Cannot Wait for the Roadmap
A bank, insurer or hospital that relies on Bonfy for AI data controls has less room to wait than the average buyer, for two reasons: regulation and pace.
Regulation first. If you are an EU financial entity and this control supports a critical or important function, DORA Article 28(8) already requires a documented, periodically tested exit strategy under which you "identify alternative solutions and develop transition plans." A vendor that has committed to its standalone product only "while it is integrated" is the scenario that plan exists for. If Microsoft 365 Copilot is in scope, you also know from the Copilot memory persistence case that a gap in AI data controls there is not a theoretical risk.
Then pace. Kiteworks is an acquirer by design. It took a $456 million growth equity investment from Insight Partners and Sixth Street Growth in August 2024 at a valuation above $1 billion, and its leadership said the money would help fund the continuation of its acquisition strategy "into the next four years." Bonfy is its second announced deal in five weeks. Each integration draws on the same engineering organisation, and a seed-stage product is not obviously first in that queue.
What a Re-Bid Would Look Like
The obvious fallback for a Microsoft shop is Purview, and it is not a like-for-like swap.
Microsoft's documentation says Purview network data security can identify, block and alert on sensitive content in "interactions with generative AI through browsers, apps, and add-ins, such as ChatGPT, Gemini, and Claude." It works through an integrated secure access service edge or secure browser product, and with a non-Microsoft one it requires Purview E5 (or equivalent) per-seat licences plus pay-as-you-go billing, metered per network request. Microsoft's pricing page lists Microsoft 365 E5 at $60 per user per month and the Microsoft Purview Suite at $12.
So the Purview route is two purchases — the classification and policy engine, and the product that inspects the traffic — and it applies "the same classifiers already configured in other Microsoft Purview policies." Bonfy's pitch was context: who is sending, to whom, and for what business purpose. Test whether your actual policies needed that context before you pay a premium to keep it, or before you give it up.
Purview is not the only option. The point is to have one alternative priced and tested, so that the conversation with Kiteworks is a negotiation rather than a formality.
What to Do Before Your Bonfy Renewal
Your leverage is tied to your notice deadline, not your renewal date, so work backwards from it.
This Week:
- Find your notice date. Pull the Bonfy order form and master agreement, and put the non-renewal notice deadline, the term end date and the assignment clause on one page. The day that notice window closes is the day your leverage ends.
- Send the WAMNET request. Ask your account team, in writing, to confirm for Bonfy what Kiteworks already published for WAMNET Japan and Zivver: the product stays on sale and supported, current pricing and support terms stay unchanged, data processing locations stay unchanged, and you can renew and upgrade "as before."
- Map your channels against Kiteworks. List every channel where Bonfy enforces policy today — Copilot, ChatGPT, Claude, Slack, Salesforce, email — and mark which ones have no Kiteworks component. Those are the channels to name in the contract.
This Month:
- Ask for the end state in dates. Request the planned end-of-sale date for standalone Bonfy, the minimum support period after it, and whether a move to the Kiteworks platform carries a licence credit for the Bonfy term you have already paid for.
- Cap the renewal that matters. Negotiate a price cap on the first renewal after integration completes, not only on the next one. That is the renewal where the SKU changes.
- Update the exit plan. If you are DORA-scoped, name the alternative, get it priced, and put the test on the calendar with an owner.
Before Renewal:
- Run the fallback on one channel. Put a Purview network data security policy, or another vendor's equivalent, in audit-only mode on browser traffic to ChatGPT for two weeks, and compare what it flags with what Bonfy blocks.
- Decide on paper. Standalone with continuity terms, the Kiteworks platform with a migration credit, or a re-bid. Any of the three is defensible. Renewing on a press-release sentence is not.
The Bottom Line
Security platforms buying AI-era point products is the consolidation cycle running again, and the standalone SKU is what integration is designed to retire. Kiteworks' own history shows the arc in three steps: a standalone product, an integration "in coming months," and then a migration toolkit.
None of that makes the Bonfy deal bad for customers. A seed-funded startup with a well-capitalised owner may well be a safer vendor than it was a month ago. But "safer vendor" and "the same product, at the same price, covering the same channels" are different promises — and only the first has been made.
"Separate" is a status. Make it a term.
