The rule is disclosure
English Wikipedia’s paid-contribution disclosure policy carries the Wikimedia Terms of Use requirement into practice. A paid editor must disclose their employer, their client plus their affiliation. The policy states that editors who fail to disclose paid contributions are prohibited from editing. It also states that non-disclosure agreements do not invalidate this requirement, which closes the door most of this industry walks through.
Disclosed paid editing is a different matter. The policy strongly discourages editors with a conflict of interest from directly editing affected articles, asking them instead to post content proposals on the talk pages of existing articles or to use the Articles for Creation process for new ones. That is a slower route with no guaranteed outcome at the end of it. It is also the only one that does not put the brand at risk.
What enforcement looks like
The Wikimedia Foundation reported on 31 August 2015 that volunteer editors on English Wikipedia had blocked 381 user accounts for black hat editing and deleted 210 articles those accounts had created. The same post states that no one should ever have to pay to create or maintain a Wikipedia article. That was a single investigation rather than a running total.
Then there is the part that never comes up in the sales call. An edit history is public forever and so is a talk page. If a paid editor is identified, the public record keeps a note that the subject paid somebody to write about themselves, which is precisely what a journalist researching your brand will find. The Foundation also describes the pattern to watch for, where companies approach a business after an article has been declined through the draft process or nominated for deletion.
What the bar actually is
Wikipedia’s notability guideline for organisations and companies sets the test. An organisation is presumed notable if it has been the subject of significant coverage in multiple reliable secondary sources that are independent of it. Every word is load bearing. The guideline adds that a single significant independent source is almost never sufficient for demonstrating the notability of an organisation.
The exclusions are where most brands fall short. Press releases, press kits or similar public relations materials. Any paid or sponsored articles, posts and other publications. Advertising and marketing materials by, about or on behalf of the organisation. Boilerplate notices, brief announcements and routine coverage. Interviews given by executives, which the guideline treats as primary sources. There is a geography test too, because attention solely from local media is not an indication of notability and at least one regional or wider source is necessary. That list has a second use worth more than the article. Judge every placement you earn against it, because coverage that fails Wikipedia’s independence test is marketing rather than evidence.