Salesforce
salesforce.com
Automated, point-in-time. Not independently reviewed or approved by TRUSTYCYBER unless expressly stated.
Salesforce scores 41/100 (D): an AI assurance review is needed before approval. The score is below 55, mainly because the independent assurance evidence is thin. No certification could be independently confirmed.
Scanned Jul 23, 2026 · Public evidence · Point-in-time
Before you sign
What to ask for: Request a dated subprocessor register with change-notification terms for the DPA/order form.
Why it matters, and the evidence
The vendor names AI-related providers or partially addresses its supply chain, but the public sources scanned do not include a formal, dated subprocessor register.
What to ask for: Confirm in writing that the no-training commitment covers every model, plan and data type you will use, including any opt-in sharing or feedback.
Why it matters, and the evidence
The sources include a no-training statement ("Salesforce states the Agentforce Trust Layer guarantees customer data is never used to train external (third-party) AI models.") but do not settle the question for every model, plan and data type in scope.
“The Agentforce Trust Layer guarantees your proprietary data remains protected and is never used to train external models.”
Australian Government checksclick a check for the detail, directions checked Nov 1, 2026
PSPF directionsNone apply
No vendor-specific PSPF direction names this vendor or product (checked 2026-11-01).
IRAP assessmentNot collected
Not found in the sources this scan collected, which is not evidence the vendor has none. IRAP is an assessment, not a certificate, and there has been no public register since 2020. Ask the vendor for its IRAP assessment report and check its date, classification level and the services in scope.
Hosting Certification FrameworkNot collected
Not found in the sources this scan collected. If the service will hold government data, ask whether it is hosted with a provider certified under the Hosting Certification Framework, and at which level.
Data held in AustraliaNot collected
No Australian data residency commitment was found in the sources this scan collected. Ask where inputs, outputs, logs and backups are processed and stored, and whether processing can be kept in Australia.
What your organisation still has to do (7)
Every level of government
- Treat AI outputs, including meeting transcripts and summaries, as public records: capture or dispose of them under your records authority (the Archives Act 1983 for Commonwealth agencies, your state's records legislation for state agencies and councils). Source ↗
Commonwealth agencies
- Assess foreign ownership, control or influence risk for this technology asset, as PSPF Direction 001-2024 requires. Source ↗
- Apply the DTA Policy for the responsible use of AI in government: record the use case, assess its impact before deployment, and keep your AI transparency statement current. Source ↗
- Assess the service against the ISM controls for the highest classification of data you intend to use with it (OFFICIAL, OFFICIAL: Sensitive or PROTECTED). Source ↗
State agencies and councils
- Assess the service under your state's privacy law, which governs where residents' personal information may go: for example the PPIP Act 1998 in New South Wales, the Privacy and Data Protection Act 2014 in Victoria or the Information Privacy Act 2009 in Queensland.
- New South Wales agencies: complete the NSW AI Assessment Framework self-assessment, which Circular DCS-2024-04 makes mandatory. Source ↗
- Victorian public sector: follow Administrative Guideline 2024/07 on the safe and responsible use of generative AI. Source ↗
What to ask the vendor
Buyer questionsanswered only from the public evidence scanned, click a row for the answer
!Will they train on your data?Ask the vendor
Salesforce states the Agentforce Trust Layer guarantees customer data is never used to train external (third-party) AI models.
Requires written confirmation, see Before you sign ↓
“The Agentforce Trust Layer guarantees your proprietary data remains protected and is never used to train external models.”
✓How long do they keep your data?Clear
Salesforce offers a dedicated retention store built on Hyperforce with configurable retention settings plus automated fulfilment of Right-to-be-Forgotten and Data Subject Access Requests, giving customers control over how long personal data is kept.
“This native security architecture protects your information by using Sensitive Data Masking to hide PII and a Zero-Retention Policy, which ensures your proprietary data is never stored or used to train external AI models.”
“Transfer and retain data in a dedicated retention store built on Hyperforce, setting retention data based on key regulations or business requirements.”
!Who else can access your data?Ask the vendor
Salesforce operates an open model ecosystem letting customers connect to foundation models from named partners including OpenAI, Anthropic, and Google via 'Bring Your Own Model' capabilities.
Requires written confirmation, see Before you sign ↓
“Through our "Bring Your Own Model" (BYOM) capabilities, you can securely connect to foundation models from partners like OpenAI, Anthropic, and Google.”
✓Where is your data processed?Clear
Salesforce states it self-certifies adherence to the DPF Principles administered by the U.S. Department of Commerce, covering EU-U.S., Swiss-U.S. and UK Extension frameworks, and applies safeguards such as EU Standard Contractual Clauses for international transfers.
“Hyperforce Operating Zone Operate and grow your business with EU and Switzerland data residency.”
“Salesforce also commits to comply with the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the UK Extension to the EU-U.S. Data Privacy Framework (collectively, the “DPF”) and certifies its adherence to the DPF Principles as set forth by the U.S. Department of Commerce.”
“Salesforce's EU Processor Binding Corporate Rules Salesforce's UK Processor Binding Corporate Rules Salesforce Group Affiliates for UK Binding Corporate Rules for Processors”
!What happens in a security incident?Ask the vendor
Salesforce publishes a live Trust status page showing per-product operational status, including ongoing events and scheduled maintenance, covering AI-related products such as Agentforce.
Confirm in writing: Ask the vendor to state this in writing before signing.
“Sales and Service ongoing events | 3 maintenance”
Email to send the vendor5 items to confirm in writing
Hello Salesforce team, We are assessing Salesforce as part of our supplier review. Before we proceed, please confirm the following in writing: 1. Please provide your current, dated subprocessor list and explain how you notify customers of changes. 2. Do you use our data (inputs, outputs or uploaded files) to train or improve your models? Please confirm in writing, including any opt-out and whether it applies to every plan. 3. What is your commitment to notify customers of a security incident affecting our data, including the timeframe? 4. For a customer that does not configure BYOM, which model provider (if any) processes their requests by default, and under what data-processing terms? 5. Can Salesforce provide current SOC 2 / ISO 27001 / ISO 42001 attestations (or equivalent) specifically covering the Agentforce/Einstein AI services? A written reply to each point, or a link to where it is documented, is enough. Where a point is covered by a certification or independent report, please include the certificate number or the report and its date. Thank you,
How the score is built
Assurance dimensionsweighted components of one score, not eight separate ratings
Organisation & AI governance15% of the score40
Who owns AI risk: policies, responsible-AI principles, human oversight and administrative controls.
Assessed against ISO 42001 · NIST AI RMF · AIUC-1
“Last September, Salesforce signed onto the White House’s Voluntary AI Commitments, reinforcing our dedication to designing, developing, and deploying trustworthy AI. Read the new white paper outlining our progress on these eight commitments.”
AI system15% of the score40
What AI the vendor actually runs and where it sits in the product, the map everything else is judged against.
Assessed against ISO 42001 · NIST AI RMF
“Agentic AI is an advanced form of AI that goes beyond simple assistance to autonomously plan, reason, and execute multi-step tasks to achieve a specific goal.”
The vendor’s own evaluation of its AI features before and after release, evals, red-teaming, monitoring. A model supplier’s testing of its own model counts only in part.
Assessed against NIST GenAI · NIST AI RMF · ISO 42001
“The LLM is the foundation of Gen AI, but comes with 10 security risks identified by OWASP to consider. Salesforce’s Einstein 1 Platform integrates Einstein models with LLMs while mitigating risks and delivering control strategies to help teams securely manage Gen AI.”
How changes to models and AI features, including a change of underlying model, are controlled and communicated: versioning, notice, rollback.
Assessed against ISO 27001 · ISO 42001
“What’s New with Agentforce for Sales: Winter '25 Release + Dreamforce Preview”
Model10% of the score40
Which foundation models and model providers power the product. How model changes are disclosed is judged under change management.
Assessed against NIST GenAI · ISO 42001
“Through our "Bring Your Own Model" (BYOM) capabilities, you can securely connect to foundation models from partners like OpenAI, Anthropic, and Google.”
Customer data15% of the score45
Whether customer data trains models, how long it is retained, and where it is processed.
Assessed against ISO 27018 · OAIC APPs · EU AI Act
“The Agentforce Trust Layer guarantees your proprietary data remains protected and is never used to train external models.”
“This native security architecture protects your information by using Sensitive Data Masking to hide PII and a Zero-Retention Policy, which ensures your proprietary data is never stored or used to train external AI models.”
“Hyperforce Operating Zone Operate and grow your business with EU and Switzerland data residency.”
“Optionally, remove tracking history and ensure all personal information is no longer available to protect customer data and improve the accuracy of Agentforce outputs.”
“Transfer and retain data in a dedicated retention store built on Hyperforce, setting retention data based on key regulations or business requirements.”
AI supply chain10% of the score0
The named chain of AI and infrastructure providers behind the product, and how it is disclosed.
Assessed against ISO 27001 · ISO 27017
“we enable enterprise-grade agentic interoperability through Model Context Protocol , allowing you to orchestrate and connect AI agents seamlessly across your entire business infrastructure.”
Subprocessors & supply chain: not publicly evidenced.
Security foundation15% of the score0
How security problems are found, reported and handled: disclosure channels, bug bounty, incident response.
Assessed against ISO 27001 · NIST AI RMF
“Sales and Service ongoing events | 3 maintenance”
Vulnerability & incident handling: not publicly evidenced.
Independent assurance evidence10% of the score38
Whether claimed certifications and attestations are independently corroborated, checked against official registries and issuing bodies. Which certifications, and what each one does and does not establish, is stated per certificate.
Assessed against ISO 17021-1 · ISO 42006 · ISO 27006-1 · ISO 27008
“Salesforce also commits to comply with the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the UK Extension to the EU-U.S. Data Privacy Framework (collectively, the “DPF”) and certifies its adherence to the DPF Principles as set forth by the U.S. Department of Commerce.”
“Salesforce's Notice of APEC CBPR and PRP Certifications”
“Salesforce's EU Processor Binding Corporate Rules Salesforce's UK Processor Binding Corporate Rules Salesforce Group Affiliates for UK Binding Corporate Rules for Processors”
None of the corroborated certifications is AI-specific (ISO/IEC 42001 or AIUC-class) — this assurance is security and data-transfer attestation, not AI-management-system assurance.
Legal & contractual10% of the score40
The contractual backbone a buyer can rely on, terms, DPAs, privacy commitments and regulatory posture.
Assessed against EU AI Act · OAIC APPs
“Transparency Reports Information about Salesforce's principles for handling government requests for customer data and the relevant annual figures regarding such requests.”
Not graded: Agent, not applicable to this scan.
What would strengthen assuranceeach figure is from today's score, resolving one changes the others
Resolving an evidence gap strengthens the dimension it belongs to, and with it the score: 41 → up to 64 with every identified gap resolved.
The evidence behind the result
Key findingsclick a row for the evidence
✓External-model training exclusion via Trust LayerStrong
Salesforce commits that customer data is never used to train external AI models and is not stored by them (Zero-Retention Policy), backed by PII masking before data reaches an LLM.
This is a direct, favourable answer to the most common buyer question about generative AI - whether their data trains someone else's model.
“The Agentforce Trust Layer guarantees your proprietary data remains protected and is never used to train external models.”
“This native security architecture protects your information by using Sensitive Data Masking to hide PII and a Zero-Retention Policy, which ensures your proprietary data is never stored or used to train external AI models.”
!Scope of the 'never train' commitment is limited to external modelsGap
The Trust Layer language specifically scopes its no-training commitment to 'external' models; none of the fetched pages address whether Salesforce's own first-party predictive/generative models (e.g. Einstein) are trained using customer CRM data.
Buyers assuming a blanket no-training guarantee may be surprised that the public commitment only rules out third-party foundation models, not Salesforce's own models.
Question for vendor: Is customer data used to train or fine-tune Salesforce's own first-party (Einstein) predictive or generative models, as distinct from external/third-party models?
“The Agentforce Trust Layer guarantees your proprietary data remains protected and is never used to train external models.”
“This native security architecture protects your information by using Sensitive Data Masking to hide PII and a Zero-Retention Policy, which ensures your proprietary data is never stored or used to train external AI models.”
!BYOM model partners named but data flow unspecifiedGap
Salesforce names OpenAI, Anthropic and Google as available foundation-model partners via Bring-Your-Own-Model, but the fetched pages don't specify which model is used by default, what data these partners receive, or the contractual terms governing them.
Buyers need to know which named model providers actually sit in their data's request path by default versus only when a customer opts in, to assess real subprocessor exposure.
Question for vendor: For a customer that does not configure BYOM, which model provider (if any) processes their requests by default, and under what data-processing terms?
“Through our "Bring Your Own Model" (BYOM) capabilities, you can securely connect to foundation models from partners like OpenAI, Anthropic, and Google.”
“we enable enterprise-grade agentic interoperability through Model Context Protocol , allowing you to orchestrate and connect AI agents seamlessly across your entire business infrastructure.”
✓Customer control over data residency and retentionStrong
Salesforce gives customers a choice of EU/Switzerland data residency via Hyperforce plus a configurable, dedicated retention store with automated Right-to-be-Forgotten/DSAR fulfilment.
Direct customer control over data location and retention duration is a strong, concrete assurance signal for regulated buyers.
“Transfer and retain data in a dedicated retention store built on Hyperforce, setting retention data based on key regulations or business requirements.”
“Hyperforce Operating Zone Operate and grow your business with EU and Switzerland data residency.”
!Privacy certifications are self-certifications in the evidence gatheredGap
Salesforce cites the EU-U.S./Swiss-U.S./UK Data Privacy Framework and APEC CBPR/PRP as compliance certifications, but these are vendor-published notices/self-certifications in the fetched material with no independent registry confirmation captured, and no SOC 2, ISO 27001 or ISO/IEC 42001 attestation appears anywhere in this document set.
Buyers should not read these as independently audited security/AI-governance certifications; they are self-certified legal transfer mechanisms, which is a materially different assurance level.
Question for vendor: Can Salesforce provide current SOC 2 / ISO 27001 / ISO 42001 attestations (or equivalent) specifically covering the Agentforce/Einstein AI services?
“Salesforce also commits to comply with the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the UK Extension to the EU-U.S. Data Privacy Framework (collectively, the “DPF”) and certifies its adherence to the DPF Principles as set forth by the U.S. Department of Commerce.”
“Salesforce's Notice of APEC CBPR and PRP Certifications”
“Salesforce's EU Processor Binding Corporate Rules Salesforce's UK Processor Binding Corporate Rules Salesforce Group Affiliates for UK Binding Corporate Rules for Processors”
Assurance evidence: certifications 4, registry checks and verification ladders, click to view
Self-certification administered by the U.S. Department of Commerce for cross-border personal data transfers; not independently verified in this evidence set.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Referenced by notice title only; scope, certifying Accountability Agent, and validity period not described in the fetched page.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Referenced by title only; current regulatory approval status and scope of covered processing not confirmed in the fetched page.
Not yet checked against a registry. Treat it as the vendor’s own claim and ask the vendor for the current certificate.
Not claimed in any public source scanned. This is the AI-management-system certification — in its absence, the vendor’s AI governance rests on its general security and privacy certifications.
AI supply chainclick a node to focus it · drag to pan · zoom with the controls
View as list
What you inheritTrustyCyber's AI Shared Responsibility Matrix v1.0
This scan names the vendor’s AI supply chain without assessing the responsibility split, that depends on how you consume the product. Under the common managed models, a deployer inherits 16 of the matrix’s 41 responsibilities from providers, each with named evidence owed.
Map your inherited responsibilitiesSources and regulation
Sources 12, click to view
Appendix: standards landscape 8, click to view
Where each standard behind this assessment stands today, from TrustyCyber’s continuously maintained standards radar.
Want to go further?
This scan assesses Salesforce at an organisational level. Assurance can vary significantly between products, models and agents, enter the product you’re evaluating to run a deeper AI System Assurance Scan.
Scan a specific product →This automated result is based on publicly available information at the time of scanning. It is not an audit, certification, legal opinion or assurance engagement. Publicly unavailable evidence may materially change the conclusion.
Monitor for changes
Get an email if its TRUSTYCYBER Score, grade or certifications change. One credit per refresh; reading the report always stays free.