Does Drift sign a BAA?
No BAA available
The Salesloft Master Subscription Agreement, which Drift's acceptable use policy links as its terms, says the Services are not meant to comply with HIPAA. It also says Salesloft is not a business associate and lists PHI as prohibited data. Salesloft does not sign BAAs for Drift.
- Business associate
- Salesloft (Clari/Salesloft)
- Tool
- Drift
- Plans with a BAA
- None
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| All Salesloft and Drift subscriptions | No BAA | Not offered | Under MSA Section 2.8, the Services are not intended to comply with HIPAA, Salesloft is not a business associate, and customers must not submit Prohibited Data. Section 12.11 defines Prohibited Data to include patient and medical PHI.[1],[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Salesloft (Clari/Salesloft) says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Drift AI chat agent / bots | Excluded | The contract bans PHI from the Services as a whole, AI chat features included.[1] |
Customer support AI that offer a BAA
- AdaBAA on: Enterprise contracts (Ada is sales-led)Some plans only
- Freshdesk / Freddy AIBAA on: Freshdesk, Freshchat (standalone), Freshcaller, Freshdesk OmnichannelSome plans only
- Intercom FinBAA on: Fin workspaces (Fin AI Agent standalone), Intercom ExpertSome plans only
- Jotform AI AgentsBAA on: Enterprise, GoldSome plans only
- Kustomer AIBAA on: Enterprise or Ultimate with HIPAA add-on packageSome plans only
- LivePerson Conversational CloudBAA on: Conversational Cloud (enterprise contracts)Some plans only
All BAA-ready alternatives to Drift
Sources
- Clari/Salesloft Master Subscription Agreement
- Drift Acceptable Use Policy
- Security & Compliance | Salesloft
- Clari/Salesloft Trust Center
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.