Material changes to Cometly’s public trust documents, each linked to its source.
Data as of 2026-10-19 — refreshed on a rolling bake, not live. · cometly.com
Prohibits training on customer data
Reviewed by a Driftline analyst · as of 2026-10-02
5 material changes in the last 12 months
Summaries are AI-generated and can be wrong. Check the source document linked on each change before relying on it. Vendor? Request a correction.
high · AI feature launched · 2026-10-05 · Terms of Service
Cometly's ToS materially changed its AI Chat feature: AI features now retrieve data from the customer's workspace (which may include personal data of contacts, and may update contact, company, and event records at the user's instruction), replacing the prior prohibition on submitting PII. AI providers and underlying models are now referenced via the AI Policy rather than named in the ToS, AI credits became one-time prepaid non-renewing purchases, and Cometly also added a new Public API/MCP server section (2.5).
Source documentmedium · Terms changed · 2026-10-03 · Trust Center
Cometly's trust center materially weakened several security/service commitments: it removed the 99.9% uptime SLA (replaced with "incident communications by email"), narrowed audit logging from "immutable logs of every workspace action" to only AI and MCP tool calls retained 90 days (broader logging now on roadmap), and changed penetration testing from "independent third-party tests conducted" to "not yet, planned as part of SOC 2." It also shifted infrastructure to Laravel Cloud, AWS, and SingleStore Helios, with encryption keys no longer held by Cometly.
Source documenthigh · AI subprocessor added · 2026-10-02 · AI Disclosure
Cometly's AI policy added Voyage AI as a new AI subprocessor (voyage-3-large embeddings, rerank-2.5), which embeds and ranks Agent memory notes for retrieval (not response generation). The same update also changed xAI's model from Grok 4.5 to Grok 3 for AI report summaries and introduced limited write/update tools to the vendor's AI features, which were previously read-only.
Source documenthigh · AI subprocessor added · 2026-09-30 · Privacy Policy
Cometly's privacy policy now discloses that its AI features (Agent, AI Ads Manager, AI Slack Reports, and the MCP server) are powered by Anthropic, xAI, and Voyage AI as sub-processors. Prompts and workspace data, which may include personal data such as contact names and email addresses, are sent to these providers to generate responses, with a commitment that the data is not used to train their models. This adds new AI subprocessors receiving customer content.
Source documenthigh · AI feature launched · 2026-08-31 · Trust Center
Cometly's trust center now prominently announces a live AI "Agent" feature ("Agent is live— ask anything about your data") that can query customer data, creating a new AI processing path for customer content. The page also weakens several security commitments (removed retention controls, RPO/RTO and quarterly DR testing, annual pen-test frequency, EU data residency guarantee, and ISO 2026 certification target), but the AI agent launch is the most significant change.
Source documentPaste your vendor list and confirm your email, and we build your report and email it to you — the material changes across your vendors in the last 12 months, which of them added AI subprocessors or reserved the right to train on your data, and where your nth-party exposure concentrates. Free.