Mutiny

The DPA documents authorized connections to Salesforce, HubSpot, LinkedIn and other CRM, sales engagement and data enrichment platforms, accessing account information, contact details and opportunity data through those services' APIs, plus account intelligence covering firmographics and intent signals from third-party providers.

The product pages add email, calendar, document stores and call recording as connected sources, the help center documents an Outreach integration, and the platform is operable from Slack and from any MCP client. These connections feed generation, so integration depth directly determines output quality rather than only keeping records in sync.

Sourcemutinyhq.com/products/integration, mutinyhq.com/dpa and help.mutinyhq.comread 2026-09-02

Routines are written by the customer, given a schedule and tool permissions, and run multi step work unattended: the documented stale deals routine reviews the CRM for opportunities with no recent activity, drafts a re-engagement email for each, builds a personalized asset to go with it, and emails the user the flagged deals and drafts for review.

The Automate collection carries the same pattern for call summaries, deal alerts, meeting prep, follow ups, forecasts and renewal updates, and skills, templates and playbooks are composable and shared across a team. No reference documents branching or conditions inside a routine beyond the per deal loop.

Sourcehelp.mutinyhq.com Automate articlesread 2026-10-01

Company Context gives the agent a foundational understanding of the company in sections for product, solution, customer, brand, voice, ICP, competitor and pricing, auto populated from the website and edited by users, with product briefs uploadable.

Around it sit CRM records covering accounts, contacts and opportunity data through Salesforce and HubSpot; account intelligence covering firmographics and intent signals; call recordings and transcripts; connected email, calendar and document stores; an asset library the agent references by name; and a playbook layer.

Per request the user attaches further context such as design screenshots, messaging documents, call transcripts and creative briefs, and the DPA confirms CRM and integration data and account intelligence as categories processed.

Sourcehelp.mutinyhq.com Company Context overview, mutinyhq.com/dpa and mutinyhq.com productsread 2026-10-01

A person approves before the agent's work goes out, at two points. Tool calls pause for approval by default: the routines documentation tells the user to "auto approve its tools" before a routine can reach the connected CRM and email without pausing on each execution, so approval is the default and auto approval is an opt in per tool.

Output is drafted, not sent: the stale deals routine emails the user the flagged deals and drafts "so I can review each one before sending", and assets are published only when a user clicks Publish in the editor. Around that, template prompts let an organization encode required fields, mandatory clarifying questions, locked layouts and approved assets into shared templates on Enterprise.

Sourcehelp.mutinyhq.com routines and publishing articlesread 2026-10-01

A detailed measures schedule and an attestation that still will not say what it is.

The DPA's Annex C documents role-based access control, MFA on production systems, unique user IDs and periodic access reviews with revocation on termination; TLS 1.2 or higher in transit and AES-256 at rest with keys in AWS KMS; firewalls, network segmentation, intrusion detection, regular vulnerability scanning and penetration testing, production logging and a tested incident response plan; a written information security policy reviewed annually, security training and background checks; business continuity tested annually with a four-hour RTO and one-hour RPO; and secure deletion to NIST SP 800-88.

Contractual terms are strong too: breach notification within 48 hours, deletion within 30 days with backups purged within 90 and written certification on request, sub-processors listed in Annex B with 30 days' notice of changes, an objection right and termination as the remedy, and audit rights extending to an annual on-site audit.

AI-specific measures are notable: enterprise-tier agreements with all AI sub-processors restricting training by default, prompt and output data not persisted by them beyond the API response, and a commitment not to train on personal data without consent. The attestation is hedged in two places at once.

The pricing FAQ says Mutiny is SOC 2 certified without naming the type; Annex C says the provider has achieved or is pursuing the following certifications, SOC 2 Type II, which does not assert achievement. No trust center, no report and no named auditor are offered. The legal entity is Mutiny HQ Corporation, a Delaware corporation.

Sourcemutinyhq.com/dpa and mutinyhq.com/faqsread 2026-09-02

Engagement analytics on the output, no auditability of the agent. What is documented and useful to a seller: deal-level visibility into who engaged with which published asset, replacing the vendor's stated before-state of having no idea whether prospects opened anything, plus visitor tracking on published pages resolving IP addresses to company and firmographic data, and analytics reachable through the MCP so a rep can ask for them in conversation. For deciding whether a champion is actually circulating the business case, that is the measurement that matters.

No audit log, no record distinguishing what the agent generated from what a rep subsequently edited, no attribution of a published asset to the person who commissioned it, no decision trail and no retention policy. The DPA adds logging and monitoring of access to production systems, but that is Mutiny's own security monitoring rather than a surface exposed to the buyer. For a product whose output goes directly to customers under the company's brand, the absence of a generated-versus-edited record is the consequential gap.

Sourcemutinyhq.com/products/beautiful-assets, help.mutinyhq.com and mutinyhq.com/dparead 2026-09-02

Shared configuration and authored context persist; agent memory is not documented.

What survives across sessions is brand configuration extracted from the customer's website, templates and their prompts, skills, routines, projects and an asset library, and Company Context, which the help center describes as auto populated from the website and then written and edited by users in sections for product, solution, customer, brand, voice, ICP, competitor and pricing; it is not updated by the agent from conversations or work.

Configuration and authored context are not agent memory. No per user or per account memory the agent writes and reads back is described.

Sourcehelp.mutinyhq.com Company Context overview and mutinyhq.com/pricingread 2026-10-01

The DPA, last updated April 2026, states that the customer authorizes transfer of personal data to the provider's primary processing facilities in the United States, and Annex C adds that personal data is hosted on AWS infrastructure. No region selection, EU hosting option, VPC, single tenant or on premises route is offered; Enterprise offers custom MSA and DPA terms, which is contract, not deployment.

Sourcemutinyhq.com/dpa and mutinyhq.com/pricingread 2026-10-01

A browsable library organized by deal stage. The site publishes Blueprints as a navigable set of sixteen named plays, each with its own page and grouped by where the deal is: Prospect carries 1:1 ABM, Vertical Landing Page, Cold Outreach and Event Invite; Evaluate carries Meeting Recap, Demo Pre-Read, Case Study, Case Study Round-Up, Competitive Comparison, Group Demo Follow Up and Pitch Deck; Negotiate carries Pricing Proposal, Executive Business Case and Deal Room; Expand carries Forward Looking Strategy, Impact Report and Expansion ABM.

Selecting one does not drop a static file: the agent asks follow-up questions and tailors the asset, so the blueprint is an interactive starting point. Two further layers sit alongside: templates authored by the customer's own organization, shareable and able to carry embedded prompts, visible on a Templates page beside the vendor blueprints; and skills, routines and playbooks preloaded with what revenue teams commonly run, composable and shareable, with the stated intent that a rep gets value on day one without a GTM engineer.

Sourcemutinyhq.com blueprints library and help center templates documentationread 2026-09-02

Scheduled routines wake the agent, and the input and output surfaces are wide.

The help center's Automate collection documents Routines that run on a schedule the customer sets, for example the stale deals routine run "Every Monday morning" or daily, in which the agent reviews the CRM for opportunities with no recent activity, drafts a re-engagement email for each and builds a personalized asset, with sibling articles for call summaries, deal alerts, meeting prep, follow ups, forecasts and renewal updates; the Free plan carries 5 routines per user and Business 20.

Around it the agent is reachable from Slack, Claude, ChatGPT and any MCP client, and the blueprint library spans 1:1 ABM pages, landing pages, outreach, event invites, follow ups, business cases, pitch decks, pricing proposals and deal rooms. Schedule options are shown by example, with no reference page listing them.

Sourcehelp.mutinyhq.com Automate articles and mutinyhq.com/pricingread 2026-10-01

No provider named and no customer choice. Consumption is metered as credits, defined as one interaction with the Mutiny agent, so a buyer sees the cost of model calls without seeing which model makes them, and no model selection, routing control, bring-your-own-model or bring-your-own-key is documented.

The DPA establishes that AI sub-processors exist in the plural, with enterprise-tier agreements restricting training by default and prompt and output data not persisted beyond the API response, which is a real disclosure about how models are used but not about which they are or who picks them; the sub-processor list in Annex B is published as an image, so the providers are not named in text.

Mutiny is reachable from Claude, which reads like model flexibility and is its opposite, since Claude is a client consuming Mutiny rather than the model powering Mutiny's agent.

Sourcemutinyhq.com/dpa, mutinyhq.com/faqs and help.mutinyhq.comread 2026-09-02

A published remote MCP server is the programmatic surface. Mutiny runs a remote MCP server at mcp.mutinyhq.com/mcp, documented in a dedicated help center collection with setup guides for Claude web, Desktop and Code, for ChatGPT web and Desktop, and for any client supporting remote MCP over HTTP with OAuth, explicitly including IDE integrations and custom agents.

Authentication is OAuth 2.0 with scoped consent covering reading and creating assets, publishing, and managing the content library, the workspace admin controls which scopes an account may authorize, access is revocable from the client, and the vendor states it does not receive or log conversation history. Further articles document creating assets through the MCP, passing context to it, and pulling analytics insights from it, so the interface carries real capability rather than a connection handshake. No REST API reference, SDK or developer portal is published, so MCP is the whole of the programmatic surface.

Sourcehelp.mutinyhq.com Mutiny MCP collectionread 2026-09-02

Measurement of the output after the fact, and nothing that tests the agent. Engagement tracking and asset analytics show whether a published asset was opened and by whom, with Visitor Intelligence analytics on Business, and template prompts standardize output quality across a team at authoring time. That measures the customer's artifact rather than the agent.

No sandbox, evaluation harness, output scoring or regression testing when a template or brand input changes is documented. The previous Mutiny product included A/B testing and a visual experimentation layer, and the April 2026 agent first rebuild removed it. The DPA states AI model outputs are reviewed for security and compliance risks before production deployment, which is Mutiny testing its own models internally.

Sourcemutinyhq.com/pricing, mutinyhq.com/products/beautiful-assets and mutinyhq.com/dpa; help.mutinyhq.comread 2026-10-01

Mutiny reaches CRM, sales engagement, email, calendar, document stores and call recording through authorized APIs and OAuth connections, is driven from chat, Slack or an MCP client, and publishes its output as hosted pages and documents. Mutiny crawls the customer's public website to learn their brand so generated assets are on brand by default, which is content ingestion, with no session, no authentication and no action taken as the user. No browser control, headless session, screen operation or robotic process automation is documented.

Sourcemutinyhq.com/products/integration, help.mutinyhq.com and mutinyhq.com/dparead 2026-09-02