Boomi US

Structured Summary of Important Changes

1. Major restructuring and possible document-integrity issue

The revision substantially replaces the original legal/service-description language with what appears to be website-navigation, marketing, and unrelated webpage content, including:

• “Leader in The Forrester Wave™…”
• “Close message,” “Back,” “Start,” and “Get report”
• Product and integration categories
• Links and marketing references to applications such as ChatGPT, Snowflake, Shopify, and Google Drive

This creates a significant ambiguity risk. The revised text may be a corrupted or improperly extracted version of the Service Description rather than a clean contractual amendment. The parties should obtain and sign a complete, readable version before relying on it.

2. Service scope and definitions

The revised language:

• Renames and simplifies the service as the “Service.”
• Describes it as a proprietary, internet-based, subscription SaaS platform.
• Adds or clarifies that the platform enables customers to design, build, execute, and manage integration processes.
• States that components may be hosted in Boomi’s public runtime cloud or downloaded and installed behind the customer’s firewall.
• Adds or restores definitions for the Boomi Runtime, Connector, Boomi Integration Platform, Connections, Boomi EDI, and ViewData.
• Changes the description of Boomi EDI from a narrower EDI-focused service to a broader platform capable of traditional AS2 and X12 integrations.
• Provides that available Connections may be added or deleted, with periodic written notice.

Risks: The broader service description may expand functionality without clearly defining performance obligations, availability, security responsibilities, or support commitments. Boomi’s ability to add or remove Connections could affect integrations and operational continuity.

3. Customer data and AI-model training

The diff does not contain an express provision authorizing or prohibiting the use of Customer Data to train AI models.

However, the revised material introduces AI-related products and features, including:

• “AI Infrastructure”
• “Agentic Capabilities”
• “Connect with ChatGPT”
• “Retrieval-Augmented Generation”
• MCP connectors

These references appear primarily to be marketing or navigation content, not operative contractual terms. They do not explain:

• Whether Customer Data, prompts, outputs, metadata, or usage logs are processed by AI systems;
• Whether data is used to train, fine-tune, evaluate, or improve Boomi’s or third-party models;
• Whether customer data is segregated from other customers’ data;
• Whether third-party AI providers may retain or use the data;
• Data deletion, opt-out, confidentiality, or security controls.

Key risk: The absence of a clear AI-data-use restriction leaves uncertainty, especially where integrations may connect sensitive business or personal data to AI services. A specific data-processing and AI-use clause should be added.

4. Support and optional services

The revision reorganizes optional consulting, training, certification, and support services. Some detailed support language is retained, but the presentation is fragmented and appears interspersed with unrelated content.

Risk: Support entitlements, response obligations, coverage hours, and service levels may be unclear or difficult to enforce.

5. Recommended action

Require Boomi to provide:

1. A clean, consolidated Service Description;

2. A clear Customer Data ownership and confidentiality clause;

3. An express prohibition or consent mechanism for AI training and model improvement;

4. Rules governing third-party AI connectors and data retention;

5. Defined security, deletion, support, and change-notice obligations.

Key Changes and Risks

1. Major expansion of the Service

• The Service is restructured and renamed around the Boomi Enterprise Platform, rather than a general internet-based integration service.
• The platform now expressly includes:
• Boomi Runtime;
• Integration and application connectors;
• EDI capabilities;
• ViewData functionality;
• Design, transformation, error-handling, decision-handling, and processing components.
• New integrations and capabilities are referenced, including ChatGPT, ServiceNow, Shopify, Google Drive, Snowflake, Retrieval-Augmented Generation (RAG), MCP connectors, AI infrastructure, and agentic capabilities.

Risk: The scope of the Service is materially broader and may include AI-enabled functionality that was not previously covered by the more limited description.

2. AI and training-data treatment

• The diff adds AI-related products and integrations, including ChatGPT and RAG functionality.
• However, it does not expressly state:
• whether Customer Data may be used to train, fine-tune, or improve Boomi’s or a third party’s AI models;
• whether prompts, outputs, embeddings, metadata, logs, or interaction history are retained;
• whether Customer Data is shared with OpenAI, other model providers, or subcontractors;
• whether Customer Data is segregated from other customers’ data;
• who owns AI-generated outputs or derivative models;
• whether the customer can opt out of model training or AI data retention.

Important risk: The absence of a clear “no training/no model improvement” restriction creates contractual ambiguity. The general confidentiality and security language added later in the Service Description addresses protection of Customer Data, but does not clearly limit permitted uses of that data. The MSA, privacy terms, AI addendum, or third-party provider terms should be reviewed for the controlling language.

3. Data location and international transfer

• Where Boomi hosts the Runtime or Customer uses ViewData, Customer Data will be transferred to the United States.
• Boomi promises confidentiality protection, technical and organizational safeguards, protection against loss or unauthorized access, and equivalent safeguards for relevant subcontractors and business partners.

Risk: U.S. transfer is now expressly disclosed and may create regulatory, localization, government-access, and cross-border transfer issues. The clause does not specify transfer mechanisms, retention periods, deletion procedures, audit rights, or a detailed subprocessors process.

4. Commercial and operational changes

• Pricing changes substantially: fees include one gigabyte per Runtime per month, with excess usage charged at $117 per additional gigabyte or fraction.
• Boomi may impose a reconnection fee after suspension.
• Support terms are replaced with detailed severity levels and response times.
• The SLA is incorporated by reference and may be amended by Boomi; the amendment becomes effective unless the customer objects within 30 days.

Risk: Usage-based charges and unilateral SLA changes may create unexpected costs and reduce contractual certainty.

5. Other customer obligations

• Customer agrees to reasonably support press releases, case studies, reference calls, and speaking engagements after implementation.

Risk: This is a new marketing/reference obligation and should be made subject to prior written approval, confidentiality, and brand-use limitations.

Structured Summary of Important Changes

1. Major rewrite of service description

The draft substantially replaces the existing introductory and definitions language. The service is no longer described primarily as the “Boomi Enterprise Platform” consisting of the Boomi Runtime, Connector, and Integration Platform. It is instead described more generally as a proprietary, Internet-based, subscription software-as-a-service offering.

Implications:

• The contractual scope may be broader and less precise.
• The revised language incorporates a wider range of Boomi capabilities, including AI infrastructure, data management, automation, API management, agentic capabilities, application integrations, MCP connectors, and retrieval-augmented generation.
• Because much of the inserted text appears to be website navigation or marketing content rather than carefully drafted contract language, the parties may face uncertainty over which features are actually included.
• References to “Enterprise” and “Standard” connections remain, but the revised text continues to permit Boomi to add or delete available connections with written notice. This creates a potential service-change risk.

2. Expanded or reframed functionality

The revised description expressly covers designing, building, executing, and managing integration processes, including traditional EDI functions using AS2 and X12. It also retains or clarifies:

• Public-cloud hosting;
• Downloading and installing the runtime behind the customer’s firewall;
• Connections to applications, databases, and file formats;
• Browser-based viewing of integration data (“ViewData”);
• Boomi-developed connectors, transformation maps, error handling, decision handling, and processing logic.

The revised language appears to move some previously separate definitions into a more consolidated service description. This may make the agreement easier to read, but it also removes some detailed limitations and distinctions that could previously have helped define the service boundary.

3. Optional services and support

The optional-services section is reorganized and now states that consulting, training, and related services will be reflected on the customer’s Order Form if purchased. The revised wording describes:

• Hourly, prepaid, or per-interface consulting;
• Integration consulting and pilot implementation assistance;
• Web-based or onsite training and consulting;
• Training and certification;
• Support according to the applicable support tables.

Support coverage is reformatted, including Standard, Premier, and Premier Plus levels, 24/7 Severity 1 support, channels, and case limits. The prior informal commitment to contact Customer Success if support was delayed is removed.

Risk: The support commitments may become more dependent on purchased support level and formal tables, with less discretionary remediation language.

4. AI training and use of customer data

The diff does not add an express provision stating that Boomi may use Customer Data to train, fine-tune, improve, or develop AI models. It also does not expressly prohibit such use.

The inserted references to AI infrastructure, agentic capabilities, MCP connectors, ChatGPT, retrieval-augmented generation, and other AI-related offerings appear largely to be website navigation or product-marketing text, not operative data-use terms.

Important risk: Because the revised scope now references AI-enabled services without addressing data governance, the agreement remains ambiguous regarding:

• Whether customer inputs, prompts, outputs, metadata, or integration data may be used for model training;
• Whether third-party AI providers may receive customer data;
• Retention, isolation, or deletion of AI-related data;
• Ownership and permitted use of AI outputs.

These issues should be addressed expressly in the MSA, privacy terms, or an AI/data-processing addendum.

Summary of Important Changes

1. Expanded Service Scope and AI Functionality

• The Service is substantially reframed as the Boomi Enterprise Platform, rather than a general internet-based integration service.
• The description now covers:
• Public-cloud and customer-firewall deployments;
• Integration with applications, databases, APIs and file formats;
• EDI functionality;
• ViewData browser access to processed integration data;
• Additional connectors and integrations, including ChatGPT, ServiceNow, Shopify, Google Drive, Snowflake and retrieval-augmented generation (RAG);
• “Agentic capabilities,” MCP connectors and other AI-related functionality.
• The revised language appears to broaden the features and services covered, but may also create uncertainty about which specific products and AI features are included in the customer’s Order Form.

2. Customer Data Use and AI Model Training

• No express provision in the supplied diff authorizes Boomi to use Customer Data to train, fine-tune or improve AI models.
• Similarly, the diff does not expressly prohibit:
• Use of Customer Data for model training;
• Retention of prompts, outputs or uploaded data by AI providers;
• Sharing Customer Data with third-party AI providers connected through ChatGPT, RAG, MCP or other connectors;
• Use of de-identified or aggregated Customer Data for analytics or product improvement.
• This is a significant contractual gap because the expanded Service expressly references AI functionality, but does not state whether Customer Data submitted to those features will be isolated from provider training systems.
• Customers should seek confirmation in the MSA, data-processing addendum, AI terms or applicable privacy documentation that:

1. Customer Data is not used to train or improve general-purpose or third-party AI models;

2. AI subprocessors cannot retain or reuse prompts, outputs or retrieved content;

3. Customer Data is used only to provide the ordered Service;

4. Boomi will disclose relevant AI subprocessors, locations, retention periods and deletion procedures.

3. Data Location and Security

• If the customer uses a Boomi-hosted Runtime or ViewData, Customer Data will be transferred to the United States.
• Boomi adds commitments to:
• Protect confidential data under the MSA;
• Apply technical and organizational security measures;
• Protect personal data against loss, destruction, alteration, unauthorized disclosure or access;
• Require equivalent security measures from subcontractors and business partners with access to Customer Data.
• These provisions improve specificity, but do not themselves address AI training, international-transfer mechanisms, audit rights, breach notification, deletion or data-subject obligations.

4. Commercial and Operational Risks

• Boomi may amend the online SLA; the amended version becomes operative unless the customer objects in writing within 30 days.
• New features that update or enhance the Service are automatically subject to the Service Description.
• A base allowance of one gigabyte per Boomi Runtime per month is introduced, with excess usage charged at $117 per gigabyte or fraction thereof.
• Boomi may impose reconnection fees after account suspension.
• Customers agree to reasonably support publicity, case studies, reference calls and speaking engagements after implementation.
• The Service Description is subordinate to the customer’s MSA only where that MSA expressly authorizes ordering the Service; otherwise, Boomi’s online terms of sale apply.

Executive Summary

The diff appears to replace and substantially rewrite the Service Description, rather than make targeted amendments. Much of the text is corrupted by inserted website-navigation content, so the final legal meaning should be confirmed against a clean version. The most important changes are below.

Key Changes and Risks

1. Service scope is broadened and redefined

• The prior description focused heavily on Boomi EDI, including AS2 and X12 data structures, trading-partner networks, and related integration functionality.
• The replacement defines a broader, web-based Boomi Enterprise Platform for designing, building, executing, and managing integration processes.
• The platform is described as including:
• Boomi Runtime;
• Connectors; and
• The Boomi Integration Platform.

Risk: The customer’s contractual service rights may change materially. EDI-specific functionality appears to be repositioned as only one component of a broader platform. The revised description may also expand Boomi’s discretion regarding platform features and functionality.

2. New or revised definitions

The revised language adds or restores definitions for:

• “Service”;
• “Boomi Enterprise Platform”;
• “Boomi Runtime”;
• “Connector”;
• “Connection”;
• “Boomi Integration Platform”; and
• “ViewData.”

A “Connection” is defined as an endpoint to a database, application, or API used in an integration process. “ViewData” permits browser-based viewing of data processed by the Boomi Runtime.

Risk: These definitions may affect usage limits, pricing, support obligations, and responsibility for data access. “ViewData” could create additional exposure if sensitive information is accessible through the browser interface.

3. Deployment options are retained

The revised language continues to permit the Runtime to be:

• Hosted by Boomi in a public runtime cloud; or
• Downloaded and installed behind the customer’s firewall.

Risk: The description does not itself clarify whether security, support, data-processing, or compliance obligations differ between deployment models. Those issues should be addressed in the MSA, DPA, and security documentation.

4. Connections may be added or removed

The provision stating that customers may be periodically notified in writing of added or deleted available Connections is retained.

Risk: Boomi may be able to change available integrations during the subscription. The agreement should clarify whether such changes trigger termination, service-credit, replacement, or refund rights.

5. Optional services are reorganized

Consulting, training, certification, and support services are rewritten and tied to the customer’s Order Form. The revised language describes consulting, pilot implementation assistance, training, and certification as optional services.

Risk: The new wording may make certain implementation or support commitments less definite, especially where services are only provided if purchased separately.

6. Support language is reformatted

Support hours, channels, severity coverage, and plan levels are reorganized. The prior informal escalation language appears removed or replaced by standardized support tables.

Risk: Customer remedies for delayed support may be less clear. Confirm applicable response times, service levels, escalation rights, and credits.

AI Training and Data Use

No operative language in the supplied diff expressly states that customer data may be used to train AI models, nor does it expressly prohibit such use. The inserted text references AI infrastructure, agentic capabilities, ChatGPT, retrieval-augmented generation, and MCP connectors, but these appear to be website-navigation or marketing content rather than contractual provisions.

Risk: Because AI-related functionality is referenced without corresponding data-use restrictions, the customer should obtain explicit written terms addressing whether prompts, inputs, outputs, metadata, logs, or connected-system data may be used to train, fine-tune, evaluate, or improve Boomi’s or third-party models.

Summary

The provided diff does not include the actual added language. It only states: “Added approximately 30 words to the document.”

Important Changes

• No specific contractual changes can be identified from the information provided.
• The nature, scope, and legal effect of the added wording cannot be assessed without seeing the exact 30 words and their location in the agreement.

Customer Data and AI Training

• It is not possible to determine whether the new language:
• Permits the customer’s data to be used to train, fine-tune, or improve AI models;
• Allows use of customer data for product development, analytics, or benchmarking;
• Authorizes retention or reuse of prompts, outputs, or uploaded materials;
• Applies data use rights to affiliates, subprocessors, or third-party AI providers;
• Uses customer data in aggregated, de-identified, or pseudonymized form;
• Limits or excludes use of confidential, personal, regulated, or proprietary information; or
• Provides an opt-out, consent requirement, deletion right, or other customer control.

Potential Risks

Because the added wording is unavailable, any assessment of new risks would be speculative. In particular, it cannot be determined whether the change:

• Broadens the provider’s license or rights in customer data;
• Creates ambiguity about whether customer content includes personal or confidential information;
• Permits model training after termination or deletion requests;
• Conflicts with confidentiality, data protection, or security obligations; or
• Shifts responsibility to the customer for obtaining consent to use data in AI systems.

Information Needed

To perform a reliable legal review, provide:

1. The exact added wording;

2. The surrounding provision; and

3. Any corresponding deleted or replaced language.

The actual redline is necessary to identify whether customer data may be used to train AI models and to evaluate the resulting contractual risks.

Summary

The diff only states that approximately 78 words were added, but it does not provide the actual wording of those additions.

Legal and Commercial Impact

Because the text of the added language is unavailable, it is not possible to determine:

• Whether the additions create new obligations, rights, restrictions, or liabilities.
• Whether the changes affect confidentiality, data ownership, intellectual property, security, privacy, indemnities, or termination rights.
• Whether the customer assumes additional costs, compliance obligations, or operational risks.
• Whether existing contractual provisions are modified or overridden.

AI Training and Data Use

The supplied diff does not contain enough information to determine whether customer data may be used to train, fine-tune, evaluate, or improve AI models.

The missing language should be reviewed for terms such as:

• “train,” “fine-tune,” “improve,” “develop,” or “enhance” models or services;
• “machine learning,” “artificial intelligence,” or “generative AI”;
• use of customer content, prompts, inputs, outputs, telemetry, or usage data;
• rights to create aggregated, anonymized, or de-identified data;
• retention or human review of data for model development;
• sharing data with affiliates, subprocessors, or third-party model providers;
• opt-out rights, deletion obligations, and restrictions on using confidential or personal data.

Required Information

To perform a meaningful legal-risk analysis, provide the actual 78-word addition and, preferably, the surrounding unchanged language. The comparison should show the precise inserted wording and its location in the agreement.

Summary of the Change

• The diff states that approximately 78 words were removed from the document.
• The actual deleted wording is not provided.

Legal and Commercial Impact

Because the removed text is unavailable, it is not possible to determine:

• Which contractual rights or obligations were deleted;
• Whether liability, indemnity, confidentiality, intellectual-property, privacy, or termination provisions changed;
• Whether customer protections or provider rights were reduced or expanded;
• Whether the deletion creates ambiguity or an unintended gap in the agreement.

AI Model Training and Data Use

• No specific change concerning the use of customer data to train AI models can be identified from the supplied diff.
• However, if the removed text addressed:
• use of customer content for model training or improvement;
• anonymization or aggregation of customer data;
• opt-out or consent rights;
• retention and deletion of prompts, inputs, or outputs;
• restrictions on using confidential information; or
• ownership of data and model outputs,

then its deletion could materially alter the customer’s privacy, confidentiality, and intellectual-property protections.

Key Risk

The principal risk is lack of visibility: deleting approximately 78 words may remove important restrictions or safeguards, but the effect cannot be assessed without the actual deleted language and its surrounding provisions.

Recommended Follow-Up

Obtain a marked-up version showing the exact deleted wording, including the relevant section headings and surrounding clauses. The deletion should then be reviewed specifically for:

1. Customer-data permissions and purposes of use;

2. AI training, fine-tuning, evaluation, or service improvement;

3. Confidentiality and data-isolation commitments;

4. Retention, deletion, and subprocessors;

5. Ownership and licensing of customer content; and

6. Any disclaimer, indemnity, or limitation of liability connected with AI outputs.

Summary

The provided diff does not include the actual amended language. It only states:

> “Added approximately 78 words to the document”

Accordingly, it is not possible to determine:

• What contractual terms were added or changed;
• Whether the changes expand or restrict either party’s rights;
• Whether liability, confidentiality, security, intellectual property, or termination provisions were affected; or
• Whether the customer’s data may be used to train, fine-tune, evaluate, or otherwise improve AI models.

AI Training and Customer Data

No substantive language concerning AI models or customer data is included in the diff. Therefore, there is no basis to conclude whether the amendment:

• Authorizes use of customer data for model training;
• Permits use of de-identified, aggregated, or derived data;
• Allows human review or sharing with subcontractors and AI providers;
• Gives the customer an opt-out or requires consent;
• Limits use to providing the contracted services; or
• Requires deletion, retention limits, confidentiality, or security safeguards.

Risk Assessment

The legal and commercial risk cannot be assessed from the information provided. The approximately 78 new words could materially change the agreement, but their effect depends entirely on the missing text and its location within the document.

Please provide the actual added, deleted, and replacement language for a substantive analysis.

Summary

The diff only states that approximately 78 words were removed from the document. The actual deleted language is not provided.

Legal and Business Impact

Because the specific wording is unavailable, it is not possible to determine:

• Whether customer rights or provider obligations changed.
• Whether liability, indemnification, confidentiality, security, termination, or governing-law provisions were affected.
• Whether any commercial terms, warranties, service commitments, or usage restrictions were narrowed.
• Whether the deletion creates ambiguity or removes protections previously available to the customer.

AI Training and Data Use

The provided diff does not identify whether any language concerning AI was added, removed, or modified. In particular, there is insufficient information to determine whether the document now:

• Permits the provider to use customer data, content, prompts, outputs, or usage data to train or improve AI models.
• Restricts training to aggregated, de-identified, or anonymized data.
• Allows human review or vendor access to customer data for AI development.
• Provides an opt-out or requires customer consent.
• Gives the provider ownership or broad usage rights over customer content or outputs.
• Applies different rules to personal data, confidential information, or regulated data.

Risk Assessment

The deletion itself may be significant if it removed a restriction, consent requirement, confidentiality protection, or opt-out relating to AI training. However, no reliable risk conclusion can be reached without the deleted text.

Information Needed

To perform a meaningful legal comparison, provide either:

1. The exact 78-word deletion; or

2. The full “before” and “after” versions of the affected provision.

Without that text, the only defensible conclusion is that the amendment’s legal and AI-data implications are undetermined.