ServiceNow Bought Your Metadata Map

Open Setup in your production org, type [Connected Apps OAuth Usage](/terms/connected-apps-oauth-usage), and look for a row called Sweep. If it is there, the company on the other end of that token changed hands on Thursday, and nobody sent you an email about it.

Calcalist reported on 3 September that ServiceNow has acquired Sweep, the Israeli company whose product continuously indexes Salesforce metadata, in a deal estimated at hundreds of millions of dollars. Salesforce Ben picked it up on Friday. Neither ServiceNow nor Sweep has issued a formal announcement, and no value has been disclosed.

That is the whole of the confirmed news. The interesting part is what it means for the orgs Sweep is already installed in.

What Actually Changed Hands

Sweep was founded in 2021 by Ido Gaver and Eran Kirshenboim, who previously built Flok and sold it to Wix. The company raised roughly $46 million in disclosed funding, including a $22.5 million Series B in May 2025 led by Insight Partners with Bessemer Venture Partners participating. Named customers include Brex, LG Electronics, Mass General Brigham, NBC Sports, Exiger and Wix.

ServiceNow's line, as reported, is that Sweep's technology and expertise strengthen its AI-native development capabilities and advance agentic deployment for CRM, with faster time to value for customers scaling agentic systems.

Read that carefully. "Agentic deployment for CRM" is not a description of an internal tooling purchase. ServiceNow does not need a Salesforce metadata indexer to improve ServiceNow.

What Sweep Holds Inside Your Org

Sweep started life in 2022 as a no-code funnel and automation builder that generated Salesforce configuration behind a drag-and-drop canvas. It raised $28 million on that pitch. What it sells in 2026 is different and considerably more interesting.

By Sweep's own description, connecting Salesforce to Sweep ingests the org's metadata and builds a continuously refreshed model of how the org is configured and how it behaves. Objects, fields, record types, page layouts, validation rules, formulas, Flows, Apex classes, triggers, Lightning Web Components, CPQ logic, managed package components, profiles and permission sets. On top of that sit metadata agents, impact analysis, auto-generated documentation, dependency graphs and a permissions agent.

None of that is customer record data, which is precisely why it passed through most security reviews with less friction than an integration reading Accounts and Contacts. Metadata describes the machine. Records are only what the machine happens to be holding today.

For a meaningful number of orgs, the model Sweep generates is the most accurate written description of how the org works. More current than the Confluence page. More complete than the architect who left in March. That artefact is now owned by the company whose CEO spends his earnings calls describing Salesforce as a patchwork of acquired clouds.

There is no evidence that ServiceNow intends to use any customer's metadata competitively, and asserting otherwise would be careless. Standard partner and customer agreements prohibit exactly that. But the question your security team will ask on Monday is not what ServiceNow intends. It is who can switch the connection off, and on what notice.

The Contract Nobody In Your Company Signed

An analysis published on Friday by Rajesh Beri walks through the version of the Salesforce Partner Program Agreement dated 16 June 2026, and the clauses it points at are worth reading even if you have never installed Sweep.

Section 9.2 permits immediate termination if the other party publicly announces that it has reached agreement to acquire or be acquired by the terminating party's competitor. The trigger is the announcement, not the closing. On that reading, the condition was satisfied on 3 September. Section 9.3 separately allows Salesforce to terminate for convenience on 30 days notice. The programme's eligibility language bars direct competitors from participating at all, except with prior written consent.

Then there is Section 7, which states that there are no third-party beneficiaries to the agreement. If you are a customer relying on that integration, you have no standing to enforce anything in it and no claim if it ends. The partner-side liability cap is programme fees paid in the preceding twelve months, with lost profits excluded, which for a vendor of any size is not a remedy.

So the arrangement is three contracts deep. You negotiated your agreement with the vendor. You negotiated your agreement with Salesforce. The one that decides whether the integration survives sits between two other parties, and neither of them answers to you.

Most enterprise risk registers track change-of-control clauses in contracts the company signed. This is the case for tracking them in the ones it did not.

Salesforce Has Pulled Tokens Before

Salesforce has revoked third-party application tokens at scale twice in recent memory. In August 2025 it pulled all Drift application tokens after the UNC6395 campaign. In November 2025 it revoked tokens for Gainsight-published applications, and Google's analysis afterwards identified more than 200 potentially affected instances.

Both were security responses. Neither was competitive, and treating them as precedent for a competitive cut-off would be sloppy reasoning. What they establish is narrower and still relevant: the capability exists, it operates at the platform level, and it takes effect as a single administrative action with no notice period a customer could have planned around.

The realistic outcome here is duller than a revocation and harder to spot. A listing that stops being updated. A security review that never quite completes. A roadmap that slows while engineers are absorbed into someone else's org chart. Quiet degradation is the normal shape of this, and it is considerably more expensive to handle at the point you finally notice.

Why ServiceNow Paid For It

ServiceNow's AI annual contract value crossed $1 billion in Q2 2026, with net new AI ACV up more than 40% sequentially. Bill McDermott has been explicit about wanting the front office, pitching ServiceNow as an operational CRM platform spanning sales, service, CPQ and field operations on a single data model. Salesforce, for its part, reported $11.345 billion in Q2 revenue with AI annual recurring revenue near $4 billion, growing over 210%.

Two companies selling agents into the same accounts, from opposite ends of the building.

Against that, Sweep is a rational purchase at a high price. A machine-readable map of how enterprise Salesforce orgs are actually built is the single hardest thing to acquire when you are trying to displace one. It is also the fastest route to scoping a migration, which is a competence ServiceNow will need long before it needs another workflow product.

Sweep is also the sixth Israeli acquisition in ServiceNow's 2026 run, after Pyramid Analytics in February, Veza and Traceloop in March, Armis at roughly $7.75 billion completed in April, and ai.work in July. It is the first one that lives inside Salesforce orgs.

Elsewhere This Week

The first Winter '27 production upgrade wave ran over this weekend, with the remaining waves on 2 October and 9 October depending on instance. Confirm your own date on Salesforce Trust rather than assuming, because instance assignment does not follow org size or region in any pattern worth guessing at.

Dreamforce runs 15 to 17 September at Moscone Center, and the published agenda now includes a trust and security track with a dedicated keynote and hands-on training on securing agentic AI deployments. Given Thursday's post from Salesforce's CISO on machine-speed exploitation, that track is worth a slot in your schedule ahead of a product demo.

CRM closed Friday at $259.23, down roughly 2% on the day, giving back part of the run that followed the Q2 beat.

What To Do This Week

Export everything while the token is still live. Documentation, dependency maps, permission audits, anything the tool generated for you. All three of those are conditions today rather than entitlements, and the difference only becomes visible on the day the connection stops working.

Inventory every connected app holding an OAuth token. Setup, then Connected Apps OAuth Usage. Write down the publisher next to each one and, more usefully, who owns that publisher now. Most orgs have never produced that second column. This is the same list the shared responsibility model has always put on your side of the line.

Ask ServiceNow in writing. Request a support and partner-programme continuity commitment with dates attached. An account manager telling you nothing will change is not a commitment, and the person saying it is unlikely to have read Section 9.2 either.

Fix it at the next renewal. Every ISV agreement you sign from here should carry a change-of-control clause: notification within five business days, and an export window measured in months rather than days. That costs nothing to ask for before you sign and is impossible to obtain afterwards.

Run the question across the whole installed list. Which other application in your org could plausibly be bought by a Salesforce competitor in the next few quarters, and which of those hold metadata rather than records? The second half of that question is the one that separates an inconvenience from a genuine gap in how you understand your own platform.

Start with the export. It takes an afternoon, needs no budget approval, and is the only one of the five that stops being possible if you wait. Everything else on the list was overdue before Thursday.

About the Author

Dipojjal Chakrabarti is a B2C Solution Architect with 29 Salesforce certifications and over 13 years in the Salesforce ecosystem. He writes and edits salesforcedictionary.com, published by KineticBit Inc., to help admins, developers, architects, and cert/interview candidates sharpen their fundamentals. More about Dipojjal.