Executive Summary
Demandbase is a leading Account-Based Marketing (ABM) platform founded in 2005 and headquartered in San Francisco. Despite maintaining SOC2 Type II and ISO 27001 certifications with a comprehensive trust center, runtime analysis reveals a 92.2% pre-consent tracking rate across 64 site detections. The company deploys 30+ third-party vendors on its own website that are not disclosed in its official subprocessor list, including major ad tech platforms like Criteo, MetaPixel, and RubiconProject. This creates a significant gap between Demandbase's compliance posture and actual data practices, with particular concern around the extensive ad tech stack that enables cross-site tracking and identity resolution capabilities beyond their stated ABM scope.
Revenue Threat Profile
4 COLLAPSE VECTORSHow this vendor creates financial exposure. Each score (0-100) reflects observed runtime behavior and documented business practices.
CAC Subsidization
Demandbase operates as a core component of B2B measurement infrastructure, providing intent data and account identification. Their undisclosed use of multiple attribution vendors (Bizible, GoogleAnalytics4, HockeyStack) creates measurement blind spots where signal ownership becomes unclear. Companies relying on Demandbase for attribution may not realize their data also flows to competing measurement platforms.
Signal Corruption
As an ABM platform, Demandbase aggregates demand signals across customer websites. The presence of LiveRamp (disclosed) combined with undisclosed ad networks (Criteo, RubiconProject, Sojern) suggests these intent signals may flow into programmatic advertising ecosystems. This means a company's buying intent could surface to competitors bidding on the same audiences.
Legal Tail Risk
The deployment of 30+ third-party scripts on Demandbase's own website expands their attack surface significantly. With RB2B, identity resolution vendors, and multiple ad pixels loading pre-consent, any compromise of these vendors could propagate malicious code through Demandbase's customer base. The Cheq bot detection paradoxically runs alongside the very tracking it claims to protect against.
GTM Attack Surface
The 92.2% pre-consent tracking rate directly contradicts GDPR consent-before-processing requirements. SOC2 and ISO certifications focus on security controls, not privacy compliance, creating false assurance. The explicit statement that Demandbase does not honor DNT signals, combined with undisclosed ad tech vendors, creates material regulatory exposure for customers deploying their tag.