If Sweep is connected to your production Salesforce org, the party that can end that connection is not ServiceNow, and it is not you. It is Salesforce. Section 9.2 of the Salesforce Partner Program Agreement — version date June 16, 2026 — lets either party "immediately terminate this SPPA upon written notice to the other Party if … the other Party publicly announces (including by reporting it in SEC filings) that it has reached agreement to acquire or be acquired by the terminating Party's competitor."
The trigger is the announcement. Not the close, not the integration, not some future roadmap decision. Calcalist reported the deal on September 3, 2026, at an estimated "hundreds of millions of dollars." The clock, whatever it is worth, started this week.
What ServiceNow Actually Bought
ServiceNow bought a live, metadata-deep connection into its customers' Salesforce orgs. Sweep, founded in 2021 by Ido Gaver and Eran Kirshenboim, raised $46 million in disclosed funding including a $22.5 million Series B led by Insight Partners with Bessemer participation in May 2025, and names Brex, LG Electronics, Mass General Brigham, NBC Sports, Exiger and Wix as customers.
Metadata, in a Salesforce org, is the configuration itself — the objects, fields, flows, Apex classes, validation rules and permission sets that define how the org behaves, as distinct from the customer records stored inside it. Sweep's own product page says it indexes exactly that: "objects, fields, flows, Apex, validation rules, and permissions", plus "automation logic, dependencies … and cross-org structure." Its homepage describes the product as "the agentic layer for your enterprise systems" and advertises auto-generated documentation of your Salesforce configuration.
That is not an app that writes a few records. It is a continuously refreshed map of how your revenue system is built. The AppExchange listing — "Sweep - The agentic layer for your enterprise systems," 5 stars across 35 reviews, freemium — was still live when this was written on September 5, 2026.
ServiceNow's confirmation to press was explicit about the destination: "Sweep's technology and expertise strengthen our AI-native development capabilities and advance agentic deployment for CRM," a spokesperson told Calcalist. CRM is the contested ground. ServiceNow's own FY2025 annual report names "Microsoft, Oracle, SAP, Salesforce and Workday" as the enterprise application vendors it competes with. Nobody has to argue that ServiceNow is a Salesforce competitor. ServiceNow says so in a filing.
The Clause Fires on the Announcement, Not the Close
The SPPA does not require Salesforce to wait for a deal to complete, and it does not require a cure period. Section 9.2 is immediate termination for cause upon written notice, and the acquisition trigger sits in the same list as bankruptcy and IP misappropriation. Section 9.3 adds a second, blunter route: Salesforce alone "may terminate this SPPA for convenience upon thirty (30) days' written notice to Partner." The partner has no matching right.
There is a third bar sitting above both of them. The agreement's opening page states that you may not participate in the Partner Program if you "ARE OR BECOME (IN WHOLE OR IN PART) A DIRECT COMPETITOR OF SFDC EXCEPT WITH SFDC'S PRIOR WRITTEN CONSENT." And Section 15 permits assignment on a merger or acquisition without consent only where the transaction does "not involving a direct competitor of the other Party." Read together, ServiceNow cannot simply inherit Sweep's partner status the way it would inherit a lease.
Now the steel-man, because it matters. The SPPA governs program participation — the Partner Community, the directory listing (the agreement now calls it AgentExchange), training, program benefits. It says so plainly: "The Partner Program does not provide distribution rights to the Partner for the Services, nor does it contemplate any kind of reseller relationship between SFDC and Partner, which are governed by separate and additional SFDC agreements and application processes." Section 9.4 says that on termination the partner "shall cease to be a participant in the Partner Program" and its rights to program benefits end. Terminating the SPPA delists the app and cuts the partner off from Salesforce's tooling and support. It does not, by its own terms, reach into your org and pull the plug on an already-installed package.
There is also a live question about whether the trigger has technically fired. Neither company has issued a formal press release; Salesforce Ben noted that "ServiceNow and Sweep have not officially announced the deal" even as ServiceNow gave reporters a confirming statement. Whether an on-the-record spokesperson quote constitutes a public announcement of a reached agreement is a lawyer's argument, not a settled fact. It is also an argument you will not be in the room for.
You Are Not a Party to Any of This
The customer has no standing in the agreement that governs the integration they depend on. Section 7 of the SPPA is one sentence long on this point: "There are no third-party beneficiaries to this SPPA." You cannot enforce it, cannot be notified under it, and cannot be given a cure period by it.
Look at what Sweep itself would be able to recover if Salesforce pulled the listing tomorrow. Section 11.1 caps Salesforce's maximum aggregate liability at "THE PROGRAM FEES PAID BY PARTNER IN THE 12 MONTHS PRECEDING THE FIRST INCIDENT," and Section 11.2 excludes lost profits, revenue and business interruption entirely. For a partner-program membership, that ceiling is somewhere between trivial and zero. If the vendor whose whole business depends on the relationship has no meaningful remedy, you — three contractual steps removed — have less.
This is a different shape from the change-of-control stories most buyers are trained to look for. When Descartes bought Tai, the lever was your own 60-day renewal notice. When Deloitte bought Wavicle, it was an assignment-consent clause in your MSA. When Adobe absorbed Rilo's team, the fix was revoking a stale OAuth grant you controlled. Here the decisive contract is one you have never seen, between two companies, one of which is not the vendor you pay.
Salesforce Has Pulled the Technical Switch Twice
Salesforce does not merely hold a contractual right; it has twice demonstrated it can revoke an ISV's tokens across every customer org at once. On August 20, 2025, after the UNC6395 campaign against Salesloft's Drift application, Google's threat intelligence team recorded that "Salesloft, in collaboration with Salesforce, revoked all active access and refresh tokens with the Drift application. In addition, Salesforce removed the Drift application from the Salesforce AppExchange until further notice."
Three months later it did it unilaterally. In a November 20, 2025 advisory quoted by The Register, Salesforce said it "revoked all active access and refresh tokens associated with Gainsight-published applications connected to Salesforce and temporarily removed those applications from the AppExchange while our investigation continues" — with Google's principal analyst reporting more than 200 potentially affected instances. Customers were not consulted. They were notified.
Both of those were security incidents, and that distinction is real. Revoking tokens over a suspected data-theft campaign is a defensible platform action with a clear precedent trail. Doing it to a competitor's newly acquired subsidiary would be a commercial act with antitrust counsel attached, and Salesforce has obvious reasons not to teach every ISV in its ecosystem that an acquisition means immediate cut-off. The realistic path is slower and quieter: the listing comes down, the partner loses the security-review and packaging pipeline, and the integration decays across two or three release cycles.
The commercial version of this already has a template. Veeva built its life-sciences CRM on Salesforce, announced in December 2022 that it would not renew, and the agreement expired in September 2025 — with pharma customers given until September 2030 to migrate. That was the civilised outcome, negotiated years in advance, and it still handed an entire industry a decade-long migration project.
Worth noting on the other side: ServiceNow has done this before and the ecosystem survived. It announced Logik.ai on April 3, 2025 — a CPQ vendor backed, among others, by Salesforce Ventures — and closed on May 30, 2025 for $506 million in total consideration, 0.4 million shares worth about $434 million plus $62 million in cash. Logik.ai — Logik.io Inc. in the filing — was a long-standing AppExchange partner, and its AppExchange listing was still live and installable when this was written, fifteen months after the deal closed. Salesforce did not visibly torch it. Precedent cuts both ways, and this is the half that argues for calm.
The Switch You Do Control
Your own admins hold the only lever in this story that answers to you, and Salesforce hardened it a year ago. Setup → Connected Apps OAuth Usage lists every app holding OAuth tokens against your org, with Install, Block and Revoke actions per app. Per Salesforce's own documentation, blocking an app ends all current user sessions and prevents future sessions until you unblock it.
Salesforce changed the defaults underneath this in 2025. Per Arkus's timeline of the rollout, new orgs were enforced on August 28, 2025, Data Loader's OAuth device flow was eliminated on September 2, and existing orgs were phased in between September 2 and 17. Users can no longer self-authorize uninstalled apps by default; a Summer '25 permission called "Approve Uninstalled Connected Apps" is now required. Sweep wrote its own blog post about the change, telling admins to "audit what's installed, block what you don't trust."
Take that advice, and apply it to the author.
The asymmetry worth internalising: the connection is authenticated today, the documentation Sweep generated is exportable today, and the metadata graph is queryable today. All three of those are conditions, not entitlements. If the integration goes read-only or dark in ninety days, everything you did not export becomes a reconstruction project — and the Klue OAuth breach already showed how little visibility most orgs have into what their connected apps hold.
What To Do
This Week:
- Pull Setup → Connected Apps OAuth Usage and record every app with a live token, its install status, and which user authorized it. If Sweep is uninstalled rather than installed, fix that classification now — an uninstalled app is one policy change away from being blocked for everyone.
- Export every artifact Sweep generated for you while it still authenticates: the auto-generated configuration documentation, the dependency and automation maps, the field-usage analysis. Store them where they survive the vendor, not in the vendor.
- Screenshot the AppExchange listing and its 35 reviews. If the listing comes down, the security-review status and version history come down with it, and that is what your risk register will ask for.
This Month:
- Ask ServiceNow, in writing, three questions and keep the answers: does Sweep remain in the Salesforce Partner Program, has Salesforce given written consent under the SPPA, and what is the committed support window for the Salesforce connector specifically. A roadmap slide is not an answer.
- Reprice the dependency. If Sweep's documentation is the only current map of your org, you are one contract you are not party to away from having no map. Decide whether that job moves in-house or to a vendor with no CRM ambitions.
- Run the same test across the rest of your Salesforce integration estate. Any ISV that could be bought by a Salesforce competitor carries this exact clause. That is not a Sweep problem; it is a platform-ecosystem problem, the same way connector roadmaps became the question after Nasuni bought DryvIQ.
Before Renewal:
- Demand a continuity term with teeth: written notice of any material change to the Salesforce partner relationship within five business days, a minimum export window measured in months, and data portability that survives termination for any reason including termination by a third party.
- Get the successor named. If the Salesforce connector is sunset, what replaces it and at what price — and does it run inside ServiceNow's own governance stack rather than yours?
- Price the alternative before you need it. The cheapest time to evaluate a replacement is while the incumbent still works.
The Bottom Line
Enterprise buyers have gotten good at reading change-of-control clauses in their own contracts. This deal is a reminder that the clause that matters is often in someone else's. Sweep's value came from sitting inside Salesforce's platform; that position was always a licence, revocable on written notice, granted by a company that is now watching a direct competitor hold the keys. ServiceNow paid hundreds of millions for a seat at a table Salesforce owns — and it is running $1 billion in AI annual contract value into that same fight, which is precisely why Salesforce is paying attention.
Most likely, nothing dramatic happens this quarter. Listings persist, tokens keep working, and the integration quietly stops getting better. That is the normal outcome, and it is still expensive if you find out about it in month eleven.
You cannot negotiate a contract you are not a party to. You can export everything it currently gives you, this week, while it still answers.
Continue Reading
- Adobe Took Rilo's Team. Its Slack Token Never Expires.
- Descartes Bought Tai. Your Only Lever Is 60 Days.
- Deloitte Bought Wavicle. Check Who Signs Your Audit Opinion.
- Nasuni Bought DryvIQ. Now Ask Which Connectors Survive.
- One Credential, 195 Breached Companies: The Klue OAuth Attack
- Claudeforce Runs Two Meters. One Throttles, One Bills.
- d-Matrix Bought Wallaroo. Get 'Any Hardware' in Writing.
- 9x Growth in 9 Months: ServiceNow's $1B AI Proof Point