Bending Spoons’ agreement to acquire Airtable is not only a financial story. For companies using Airtable across departments, it is also a vendor-management issue.
The proposed $1.285 billion deal is expected to close by the end of 2026, subject to regulatory approvals and other closing conditions. Until then, Airtable continues to operate independently.
This means IT and procurement teams do not need to take emergency action. However, they should understand where Airtable sits within the organization, what the current contract protects, and which business processes would be affected by future changes.
The goal is not to predict what Bending Spoons will do. It is to make sure the organization understands its Airtable vendor risk before the acquisition closes.
Why IT and Procurement Teams Should Review the Deal
Airtable often enters a company through one team and gradually expands across the organization.
A marketing department may use it for campaign planning, while operations uses it for project delivery, finance uses it for approvals, and sales uses it as a lightweight CRM. Over time, Airtable can become a critical operational platform without going through a full enterprise software review.
That makes the acquisition a useful point to ask some basic questions:
· Which teams are using Airtable?
· What business-critical data is stored there?
· Which systems are connected to it?
· Who owns the contract?
· Who manages security and access?
· When does the current agreement renew?
An Airtable procurement review should begin with visibility. It is difficult to evaluate risk when the organization does not know how widely the platform is being used.
Review the Current Airtable Contract
Procurement teams should gather the current order form, Master Subscription Agreement, renewal terms, pricing schedules, support commitments, and any separately negotiated documents.
One area to examine is the assignment clause.
Airtable’s standard Master Subscription Agreement says that either party may assign the agreement without the other party’s consent in connection with a merger, acquisition, reorganization, or transfer of substantially all its assets or voting securities. However, individual enterprise agreements may contain negotiated language that differs from the standard terms.
Your legal and procurement teams should therefore confirm:
· Whether the agreement can transfer automatically
· Whether Airtable must provide notice
· Whether the customer has any termination rights
· Whether pricing and discounts continue after assignment
· Whether prepaid fees remain protected
· Whether negotiated terms survive a change of ownership
An Airtable change-of-control review does not mean the company expects a problem. It simply confirms what rights and obligations will apply when ownership changes.
Recheck Security and Data-Processing Terms
IT and security teams should review which privacy and security documents are actually part of the contract.
Airtable offers a Data Processing Addendum covering the processing of customer personal data. The current DPA states that it becomes binding only after it has been validly executed by both parties.
Companies should not assume that an Airtable data processing agreement automatically applies simply because a public copy exists online.
Confirm that your organization has an executed DPA and review:
· The roles of Airtable and the customer
· International data-transfer terms
· Breach-notification obligations
· Data deletion after termination
· Audit and cooperation rights
· Subprocessor notification procedures
· Rights to object to new subprocessors
Airtable maintains a public list of subprocessors, which was most recently updated in July 2026. Its core infrastructure providers include Amazon Web Services, Mailgun, and Twilio, with regional hosting arrangements listed for certain services.
IT teams should compare this list with their internal vendor register and confirm that the platform’s data flows are properly documented.
Review Airtable Security Commitments
A proper Airtable security review should separate publicly described practices from contractually binding commitments.
Airtable’s Information Security Standards cover areas such as access control, encryption, vulnerability management, backups, business continuity, secure development, and subprocessor assessments. However, Airtable states that these standards are binding only when they are explicitly incorporated into the customer’s service terms or order form.
That distinction matters.
Procurement should confirm whether the organization’s agreement formally includes these standards. IT and security teams should also request current evidence that supports internal vendor requirements.
Airtable says customers may request its latest SOC 2 Type II report and current ISO 27001 certificate. Its trust documentation also lists ISO 27701, European Union data residency, Enterprise Key Management, SSO, and administrative security features.
The acquisition does not mean these controls have changed. The review simply establishes a clear baseline so future changes can be identified.
Check Enterprise Governance and Access
The acquisition is also a good reason to examine how Airtable is governed internally.
Airtable’s Enterprise Hub allows Enterprise Scale customers to manage users, workspaces, licenses, organizational units, SSO, SCIM, audit logs, APIs, and other security policies centrally.
However, having governance features available does not mean they are being used effectively.
IT teams should check for:
· Workspaces created outside approved structures
· Former employees who still have access
· External collaborators with unnecessary permissions
· Bases owned by individual users
· Automations connected to personal accounts
· Unmanaged API tokens
· Duplicate paid licenses
· Missing technical and business owners
Strong Airtable enterprise governance reduces acquisition-related uncertainty because the organization already knows who has access, where data is stored, and which processes depend on the platform.
Map Integrations and Business Dependencies
The greatest risk may not be the Airtable contract itself. It may be the number of systems and processes connected to it.
An organization may rely on Airtable integrations with Salesforce, HubSpot, Slack, Google Workspace, Microsoft applications, reporting tools, automation platforms, internal databases, or custom APIs.
IT should create a clear dependency map showing:
· What information enters Airtable
· What information leaves Airtable
· Which workflows depend on automations
· Which credentials are being used
· Who owns each integration
· What happens if an integration fails
This review should include custom scripts and personal access tokens. Airtable warns that enterprise API tokens should be treated like passwords because they may provide access to multiple bases.
Documenting these dependencies does not require planning a migration. It improves operational resilience even if nothing changes after the acquisition.
Confirm Support and Service Commitments
Airtable currently offers a 99.9% monthly uptime commitment for Enterprise and Enterprise Scale customers, as well as certain Business customers whose agreements include the relevant terms. Its public service-level agreement also describes eligibility for service credits when the commitment is not met.
Procurement teams should confirm whether this SLA applies to their specific agreement.
They should also review:
· Support response times
· Issue-severity definitions
· Escalation procedures
· Named account contacts
· Service-credit procedures
· Support for APIs and integrations
· Notice requirements for service changes
Where a support commitment is important, it should appear in the agreement rather than depend only on a conversation with the account team.
Practical Questions to Ask Airtable
Before the transaction closes or the next renewal begins, IT and procurement teams should ask Airtable:
1. Will our existing agreement transfer without any change to pricing or entitlements?
2. Will our DPA and security terms remain in effect?
3. Will there be changes to subprocessors or data-hosting arrangements?
4. Will current support contacts and escalation routes continue?
5. Are any product, API, automation, or governance changes planned?
6. How will customers be notified of material contract or policy changes?
7. Will existing enterprise features and usage limits remain available?
8. Who should customers contact after the acquisition closes?
Important answers should be requested in writing, particularly when they affect pricing, security, data protection, or operational continuity.
Conclusion
The Airtable acquisition does not require IT or procurement teams to panic, pause current systems, or begin an immediate migration.
It does justify a structured review.
Organizations should confirm their contract terms, execute any missing data-processing documents, review security commitments, map integrations, strengthen access controls, and document the business processes that depend on Airtable.
These steps are useful regardless of how the platform develops under Bending Spoons.
The strongest response to the acquisition is not speculation. It is knowing exactly how Airtable is used, what the contract protects, where the risks exist, and what changes would require further action.
.png)
.svg)
