Agentforce
salesforce.com
Automated, point-in-time. Not independently reviewed or approved by TRUSTYCYBER unless expressly stated.
- Data retention window not stated
See Before you sign, with what to ask for ↓
Scanned Aug 31, 2026 · Public evidence · Point-in-time
Higher scores indicate stronger, independently supported AI assurance — governance, AI systems, models, data, supply chain and third-party assurance evidence. The score and the decision are related but different: a well-scored vendor can still carry conditions.
Before you sign
Why it matters: The public sources scanned do not give a retention period for customer data or prompts/outputs.
What to ask for: Get retention windows, in days, in writing.
Buyer questionsanswered only from the public evidence scanned — click a row for the answer
✓Will they train on your data?Clear
Salesforce states the Trust Layer applies zero data retention: prompts and generated responses are never stored or used to train the underlying third-party large language models, and the data remains customer property.
“Zero data retention is a strict policy where the prompts and generated responses are never stored or used to train the underlying third-party large language models, guaranteeing the data remains exclusively the customer's”
“Complementing this, data masking is the process that replaces sensitive Personally Identifiable Information”
!How long do they keep your data?Ask the vendor
Not found in the public sources scanned — ask the vendor directly.
!Who else can access your data?Ask the vendor
Salesforce names Microsoft Corporation (Microsoft Azure) and OpenAI, L.L.C. in its sub-processor register as providers of generative artificial intelligence services, with the processing locations for each.
Confirm in writing: Ask the vendor to state this in writing before signing.
“Provider of generative artificial intelligence services. Microsoft Corporation (Microsoft Azure) United States Switzerland France Germany Sweden India Australia Japan Brazil Canada United Kingdom Provider of generative artificial intelligence services. OpenAI, L.L.C. United States”
“Agentforce Speech Foundations is an add-on to the Salesforce Services--see infrastructure details for Salesforce Services –and provider of text to speech and speech to text services in Einstein Generative AI Services, voice offerings such as Agentforce Voice, and translation services supported in Salesforce Services. Additional sub-processors for this Service are:”
“but have some features that run partly or entirely on different infrastructures. For example, for many Customers, most Sales Cloud features run on the Salesforce’s first-party infrastructure, but Sales Cloud also includes Einstein 1 Features that run on the Einstein Platform infrastructure. Similarly, the Marketing Cloud Engagement Services are based primarily on the Marketing Cloud Engagement infrastructure, but some features of Marketing Cloud run partially on Einstein Platform or Marketing Cloud Einstein infrastructure. If these features are enabled, Customer Data will be processed by these additional infrastructures.”
!Where is your data processed?Ask the vendor
In a failover, customer data is temporarily re-routed to an endpoint hosted on Microsoft Azure, with priority given to the region the customer org is provisioned in, subject to availability.
Confirm in writing: Ask the vendor to state this in writing before signing.
“In the event of a failover, Customer Data is temporarily re-routed to an endpoint hosted on Microsoft Azure and priority will be given to the region in which Customer’s org is provisioned, subject to availability.”
!What happens in a security incident?Ask the vendor
Not found in the public sources scanned — ask the vendor directly.
Confirm in writing: Ask the vendor to state this in writing before signing.
Key findingsclick a row for the evidence
✓The generative AI providers are named in the sub-processor registerStrong
Microsoft Azure and OpenAI are both listed as providers of generative artificial intelligence services, each with its processing locations, inside the contractual sub-processor document rather than a marketing page.
It puts the AI supply chain inside the DPA's change-notification machinery, so a buyer can track it contractually. It also settles a question buyers frequently get wrong about Agentforce: the models are not exclusively Salesforce's own.
“Provider of generative artificial intelligence services. Microsoft Corporation (Microsoft Azure) United States Switzerland France Germany Sweden India Australia Japan Brazil Canada United Kingdom Provider of generative artificial intelligence services. OpenAI, L.L.C. United States”
“Agentforce Speech Foundations is an add-on to the Salesforce Services--see infrastructure details for Salesforce Services –and provider of text to speech and speech to text services in Einstein Generative AI Services, voice offerings such as Agentforce Voice, and translation services supported in Salesforce Services. Additional sub-processors for this Service are:”
“but have some features that run partly or entirely on different infrastructures. For example, for many Customers, most Sales Cloud features run on the Salesforce’s first-party infrastructure, but Sales Cloud also includes Einstein 1 Features that run on the Einstein Platform infrastructure. Similarly, the Marketing Cloud Engagement Services are based primarily on the Marketing Cloud Engagement infrastructure, but some features of Marketing Cloud run partially on Einstein Platform or Marketing Cloud Einstein infrastructure. If these features are enabled, Customer Data will be processed by these additional infrastructures.”
!Failover can move customer data to a different provider and regionGap
The register states that in a failover, customer data is temporarily re-routed to an endpoint hosted on Microsoft Azure, with regional priority only "subject to availability".
An organisation that selected a region for residency reasons can have data processed elsewhere during an incident, and the wording makes regional preference best-effort rather than guaranteed. This is exactly the clause that needs to be raised before an Australian sovereignty commitment is signed.
Question for vendor: Under failover, which regions can our data reach, for how long, and are we notified when it happens?
“In the event of a failover, Customer Data is temporarily re-routed to an endpoint hosted on Microsoft Azure and priority will be given to the region in which Customer’s org is provisioned, subject to availability.”
✓Zero data retention, stated plainly, on a product that routes CRM data to third partiesStrong
Salesforce states the Trust Layer applies zero data retention - prompts and generated responses are never stored or used to train the underlying third-party large language models - and that sensitive personally identifiable information is masked before it reaches the model.
Agentforce sends customer CRM data to Microsoft Azure and OpenAI, so this is the commitment that makes the arrangement acceptable rather than alarming. Masking before egress is a stronger control than a contractual promise alone, because it limits what the provider could retain even in error. It is vendor-published, so it belongs in the contract rather than relied on from a webpage.
Question for vendor: Please confirm zero data retention and the masking scope contractually for our org, and state which fields masking covers.
“Zero data retention is a strict policy where the prompts and generated responses are never stored or used to train the underlying third-party large language models, guaranteeing the data remains exclusively the customer's”
“Complementing this, data masking is the process that replaces sensitive Personally Identifiable Information”
“Provider of generative artificial intelligence services. Microsoft Corporation (Microsoft Azure) United States Switzerland France Germany Sweden India Australia Japan Brazil Canada United Kingdom Provider of generative artificial intelligence services. OpenAI, L.L.C. United States”
!Retention periods and incident handling are still not addressed publiclyGap
Zero retention is stated for prompts and responses at the model boundary, but nothing in the sources scanned states retention periods for data Salesforce itself holds, nor covers breach notification or vulnerability disclosure for Agentforce.
The model-boundary commitment answers the loudest question but not the whole one. A buyer still needs the retention schedule and incident terms, which are ordinary contract schedule items and should be requested directly.
Question for vendor: What retention periods apply to Agentforce data held by Salesforce, and what are the breach notification timeframes?
“Zero data retention is a strict policy where the prompts and generated responses are never stored or used to train the underlying third-party large language models, guaranteeing the data remains exclusively the customer's”
“In the event of a failover, Customer Data is temporarily re-routed to an endpoint hosted on Microsoft Azure and priority will be given to the region in which Customer’s org is provisioned, subject to availability.”
!Agentforce reaches whatever the customer connectsGap
Agents act on CRM data plus external data surfaced through Data 360, and Salesforce separately discloses that enabling Einstein features causes data to be processed on additional infrastructures.
The assessment surface is not the product alone but everything connected to it. An organisation scoping an Agentforce deployment is really scoping its whole connected data estate, and the infrastructure a feature runs on changes with the features enabled.
Question for vendor: Which Einstein features are enabled in our org, and which additional infrastructures does that place our data on?
“AI Agents are autonomous, proactive applications designed to execute specialised tasks to help employees and customers. Agents use large language models ( LLMs ) to analyse and understand the full context of customer interactions or an automated trigger, then reason through decisions on the next steps autonomously.”
“These agents generate responses that are consistent with your company’s brand voice and guidelines using trusted”
“Agentforce IT Service runs partially on the Lightning Platform and Service Cloud infrastructures - see infrastructure details for Salesforce Services. It includes a component, CMDB, that runs on Hyperforce as noted below. It also includes the following Einstein features:”
“but have some features that run partly or entirely on different infrastructures. For example, for many Customers, most Sales Cloud features run on the Salesforce’s first-party infrastructure, but Sales Cloud also includes Einstein 1 Features that run on the Einstein Platform infrastructure. Similarly, the Marketing Cloud Engagement Services are based primarily on the Marketing Cloud Engagement infrastructure, but some features of Marketing Cloud run partially on Einstein Platform or Marketing Cloud Einstein infrastructure. If these features are enabled, Customer Data will be processed by these additional infrastructures.”
✓Assurance documentation is structured and per-service, but not itself publicStrong
Salesforce maintains SPARC documentation per service describing architecture, the audits and certifications received, and the applicable controls, alongside Binding Corporate Rules for the EU and UK and Data Privacy Framework and APEC CBPR certifications.
Per-service security documentation and processor Binding Corporate Rules are a materially stronger governance position than a single company-wide trust page. The SPARC documents name the certifications, but the index alone does not, so the certification scope for Agentforce specifically remains to be read from the document itself.
Question for vendor: Please provide the SPARC document covering Agentforce, and confirm which certifications name it within their scope.
“The Security, Privacy, and Architecture (“SPARC”), which describes: • The architecture of the services, • The security and privacy related audits and certifications received for the services, and • The administrative, technical and physical controls applicable to these services.”
“Salesforce's EU Processor Binding Corporate Rules Salesforce's UK Processor Binding Corporate Rules Salesforce Group Affiliates for UK Binding Corporate Rules for Processors”
“Data Processing Addendum Data Processing Addendum FAQ Data Transfer Mechanisms FAQ Salesforce's Notice of Data Privacy Framework Certification Trust and Compliance Documentation”
“The Notices and License Information (“NLI”) which describes the features, restrictions and notices associated with any: • Information sourced from third parties or public sources and provided to customers via these services, • Functionality that allows customers to interact with social media, other websites, and/or non-Salesforce applications, including licensor terms,”
?Technical dependency observed: StripeObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Stripe as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Stripe appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“Provider of generative artificial intelligence services. Microsoft Corporation (Microsoft Azure) United States Switzerland France Germany Sweden India Australia Japan Brazil Canada United Kingdom Provider of generative artificial intelligence services. OpenAI, L.L.C. United States”
“Agentforce Speech Foundations is an add-on to the Salesforce Services--see infrastructure details for Salesforce Services –and provider of text to speech and speech to text services in Einstein Generative AI Services, voice offerings such as Agentforce Voice, and translation services supported in Salesforce Services. Additional sub-processors for this Service are:”
“but have some features that run partly or entirely on different infrastructures. For example, for many Customers, most Sales Cloud features run on the Salesforce’s first-party infrastructure, but Sales Cloud also includes Einstein 1 Features that run on the Einstein Platform infrastructure. Similarly, the Marketing Cloud Engagement Services are based primarily on the Marketing Cloud Engagement infrastructure, but some features of Marketing Cloud run partially on Einstein Platform or Marketing Cloud Einstein infrastructure. If these features are enabled, Customer Data will be processed by these additional infrastructures.”
?Technical dependency observed: AtlassianObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Atlassian as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Atlassian appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“Provider of generative artificial intelligence services. Microsoft Corporation (Microsoft Azure) United States Switzerland France Germany Sweden India Australia Japan Brazil Canada United Kingdom Provider of generative artificial intelligence services. OpenAI, L.L.C. United States”
“Agentforce Speech Foundations is an add-on to the Salesforce Services--see infrastructure details for Salesforce Services –and provider of text to speech and speech to text services in Einstein Generative AI Services, voice offerings such as Agentforce Voice, and translation services supported in Salesforce Services. Additional sub-processors for this Service are:”
“but have some features that run partly or entirely on different infrastructures. For example, for many Customers, most Sales Cloud features run on the Salesforce’s first-party infrastructure, but Sales Cloud also includes Einstein 1 Features that run on the Einstein Platform infrastructure. Similarly, the Marketing Cloud Engagement Services are based primarily on the Marketing Cloud Engagement infrastructure, but some features of Marketing Cloud run partially on Einstein Platform or Marketing Cloud Einstein infrastructure. If these features are enabled, Customer Data will be processed by these additional infrastructures.”
?Technical dependency observed: GoogleObservation
Technical evidence (DNS, certificate, or HTTP) shows a dependency on Google as a service provider. This dependency is not identified in the vendor's published materials.
An undisclosed provider dependency is exactly the gap independent verification exists to surface.
Question for vendor: Verification required — Google appears to be involved as a service provider: confirm whether this dependency exists, and whether it processes customer data.
“Provider of generative artificial intelligence services. Microsoft Corporation (Microsoft Azure) United States Switzerland France Germany Sweden India Australia Japan Brazil Canada United Kingdom Provider of generative artificial intelligence services. OpenAI, L.L.C. United States”
“Agentforce Speech Foundations is an add-on to the Salesforce Services--see infrastructure details for Salesforce Services –and provider of text to speech and speech to text services in Einstein Generative AI Services, voice offerings such as Agentforce Voice, and translation services supported in Salesforce Services. Additional sub-processors for this Service are:”
“but have some features that run partly or entirely on different infrastructures. For example, for many Customers, most Sales Cloud features run on the Salesforce’s first-party infrastructure, but Sales Cloud also includes Einstein 1 Features that run on the Einstein Platform infrastructure. Similarly, the Marketing Cloud Engagement Services are based primarily on the Marketing Cloud Engagement infrastructure, but some features of Marketing Cloud run partially on Einstein Platform or Marketing Cloud Einstein infrastructure. If these features are enabled, Customer Data will be processed by these additional infrastructures.”
Assurance dimensionsweighted components of one score — not eight separate ratings
Organisation & AI governance15% of the scoreorganisation-level evidence40
Graded from organisation-level evidence — it does not automatically establish assurance for this product.
Who owns AI risk — policies, responsible-AI principles, human oversight and administrative controls.
Assessed against ISO 42001 · NIST AI RMF · AIUC-1
“Salesforce's EU Processor Binding Corporate Rules Salesforce's UK Processor Binding Corporate Rules Salesforce Group Affiliates for UK Binding Corporate Rules for Processors”
AI system15% of the score20
What AI the vendor actually runs and where it sits in the product — the map everything else is judged against.
Assessed against ISO 42001 · NIST AI RMF
“AI Agents are autonomous, proactive applications designed to execute specialised tasks to help employees and customers. Agents use large language models ( LLMs ) to analyse and understand the full context of customer interactions or an automated trigger, then reason through decisions on the next steps autonomously.”
“Agentforce IT Service runs partially on the Lightning Platform and Service Cloud infrastructures - see infrastructure details for Salesforce Services. It includes a component, CMDB, that runs on Hyperforce as noted below. It also includes the following Einstein features:”
“These agents generate responses that are consistent with your company’s brand voice and guidelines using trusted”
How AI features are evaluated before and after release — evals, red-teaming, monitoring.
Assessed against NIST GenAI · NIST AI RMF · ISO 42001
How changes to models and AI features are controlled and communicated — versioning, notice, rollback.
Assessed against ISO 27001 · ISO 42001
AI system description: vendor-evidenced, not yet independently corroborated.
Testing & evaluation: not publicly evidenced.
Change management: not publicly evidenced.
Model10% of the scoreorganisation-level evidence60
Graded from organisation-level evidence — it does not automatically establish assurance for this product.
Which model providers and versions process customer data, and how changes to them are disclosed.
Assessed against NIST GenAI · ISO 42001
“Provider of generative artificial intelligence services. Microsoft Corporation (Microsoft Azure) United States Switzerland France Germany Sweden India Australia Japan Brazil Canada United Kingdom Provider of generative artificial intelligence services. OpenAI, L.L.C. United States”
Model provider transparency: vendor-evidenced, not yet independently corroborated.
Customer data15% of the score72
Whether customer data trains models, how long it is retained, where it is processed, and how it is protected.
Assessed against ISO 27018 · OAIC APPs · EU AI Act
“Zero data retention is a strict policy where the prompts and generated responses are never stored or used to train the underlying third-party large language models, guaranteeing the data remains exclusively the customer's”
“Complementing this, data masking is the process that replaces sensitive Personally Identifiable Information”
“Secure data retrieval allows users to securely access the data to ground generative AI prompts in context about your business while maintaining permissions and data access controls.”
“In the event of a failover, Customer Data is temporarily re-routed to an endpoint hosted on Microsoft Azure and priority will be given to the region in which Customer’s org is provisioned, subject to availability.”
Customer data treatment: the certifications above are independently corroborated, but they cover the management system — these specific disclosures are the vendor's own statements, not yet independently verified.
AI supply chain10% of the score60
The named chain of AI and infrastructure providers behind the product, and how it is disclosed.
Assessed against ISO 27001 · ISO 27017
“Provider of generative artificial intelligence services. Microsoft Corporation (Microsoft Azure) United States Switzerland France Germany Sweden India Australia Japan Brazil Canada United Kingdom Provider of generative artificial intelligence services. OpenAI, L.L.C. United States”
“Agentforce Speech Foundations is an add-on to the Salesforce Services--see infrastructure details for Salesforce Services –and provider of text to speech and speech to text services in Einstein Generative AI Services, voice offerings such as Agentforce Voice, and translation services supported in Salesforce Services. Additional sub-processors for this Service are:”
“but have some features that run partly or entirely on different infrastructures. For example, for many Customers, most Sales Cloud features run on the Salesforce’s first-party infrastructure, but Sales Cloud also includes Einstein 1 Features that run on the Einstein Platform infrastructure. Similarly, the Marketing Cloud Engagement Services are based primarily on the Marketing Cloud Engagement infrastructure, but some features of Marketing Cloud run partially on Einstein Platform or Marketing Cloud Einstein infrastructure. If these features are enabled, Customer Data will be processed by these additional infrastructures.”
Subprocessors & supply chain: vendor-evidenced, not yet independently corroborated.
Security foundation15% of the scoreorganisation-level evidence12
Graded from organisation-level evidence — it does not automatically establish assurance for this product.
How security problems are found, reported and handled — disclosure channels, bug bounty, incident response.
Assessed against ISO 27001 · NIST AI RMF
Vulnerability & incident handling: not publicly evidenced.
Independent assurance evidence10% of the scoreorganisation-level evidence59
Graded from organisation-level evidence — it does not automatically establish assurance for this product.
Whether claimed certifications and attestations are independently corroborated — checked against official registries and issuing bodies. Which certifications, and what each one does and does not establish, is stated per certificate.
Assessed against ISO 17021-1 · ISO 42006 · ISO 27006-1 · ISO 27008
“The Security, Privacy, and Architecture (“SPARC”), which describes: • The architecture of the services, • The security and privacy related audits and certifications received for the services, and • The administrative, technical and physical controls applicable to these services.”
“Data Processing Addendum Data Processing Addendum FAQ Data Transfer Mechanisms FAQ Salesforce's Notice of Data Privacy Framework Certification Trust and Compliance Documentation”
Read from the registry record above — cited, not reproduced.
Read from the registry record above — cited, not reproduced.
None of the corroborated certifications is AI-specific (ISO/IEC 42001 or AIUC-class) — this assurance is security and data-transfer attestation, not AI-management-system assurance.
Legal & contractual10% of the scoreorganisation-level evidence60
Graded from organisation-level evidence — it does not automatically establish assurance for this product.
The contractual backbone a buyer can rely on — terms, DPAs, privacy commitments and regulatory posture.
Assessed against EU AI Act · OAIC APPs
“Data Processing Addendum Data Processing Addendum FAQ Data Transfer Mechanisms FAQ Salesforce's Notice of Data Privacy Framework Certification Trust and Compliance Documentation”
“The Notices and License Information (“NLI”) which describes the features, restrictions and notices associated with any: • Information sourced from third parties or public sources and provided to customers via these services, • Functionality that allows customers to interact with social media, other websites, and/or non-Salesforce applications, including licensor terms,”
Legal & contractual transparency: vendor-evidenced, not yet independently corroborated.
Not graded: Agent — not applicable to this scan.
What would strengthen assuranceeach figure is from today's score — resolving one changes the others
Resolving an evidence gap strengthens the dimension it belongs to, and with it the score: 46 → up to 79 with every identified gap resolved.
AI supply chainclick a node to focus it · drag to pan · zoom with the controls
View as list
What you inheritTrustyCyber's AI Shared Responsibility Matrix v1.0
This scan names the vendor’s AI supply chain without assessing the responsibility split — that depends on how you consume the product. Under the common managed models, a deployer inherits 16 of the matrix’s 41 responsibilities from providers, each with named evidence owed.
Map your inherited responsibilitiesAssurance evidence: certifications 4 — registry checks and verification ladders, click to view
Salesforce publishes a Data Privacy Framework certification notice. Not corroborated against the official participant list in this collection.
Checked against Data Privacy Framework (dataprivacyframework.gov), Aug 31, 2026: Verified on the registry
APEC CBPR and PRP certification notices are published alongside the Trust and Compliance Documentation.
Not yet checked against a registry — a verification task is queued with TrustyCyber.
Not claimed in any public source scanned. This is the AI-management-system certification — in its absence, the vendor’s AI governance rests on its general security and privacy certifications.
Checked against FedRAMP Marketplace (fedramp.gov), Aug 31, 2026: Verified on the registry
Sources 14 — click to view
Appendix: standards landscape 8 — click to view
Where each standard behind this assessment stands today, from TrustyCyber’s continuously maintained standards radar.
This automated result is based on publicly available information at the time of scanning. It is not an audit, certification, legal opinion or assurance engagement. Publicly unavailable evidence may materially change the conclusion.