{"id":1715,"date":"2021-12-08T14:49:22","date_gmt":"2021-12-08T19:49:22","guid":{"rendered":"https:\/\/poiseddevelopers.com\/vertex-old\/?p=1715"},"modified":"2023-02-28T10:59:57","modified_gmt":"2023-02-28T15:59:57","slug":"a-review-of-salesforce-security-compliance-measures","status":"publish","type":"post","link":"https:\/\/poiseddevelopers.com\/vertex-old\/blog\/a-review-of-salesforce-security-compliance-measures\/","title":{"rendered":"An Overview of Salesforce Security &#038; Compliance Measures"},"content":{"rendered":"<p><a href=\"https:\/\/poiseddevelopers.com\/vertex-old\/practices\/salesforce\/\">Salesforce<\/a> has rightfully earned and held on to the title of the &#8220;World&#8217;s #1 CRM Platform&#8221; by going to great lengths to enable their customers to access to their data across all devices, all while ensuring the data is protected from unauthorized access. As the adage goes, &#8220;Security is only as strong or weak as the weakest link in the chain.\u201d Salesforce, from its early days, recognized its part in its customers&#8217; security chain and has taken all measures possible to protect customer data at every layer of the OSI model. They also offer powerful and flexible tools to their customers to secure their data exactly the way they want. Let&#8217;s look at the tools in each of these categories.<\/p>\n<h3>Infrastructure<\/h3>\n<ul>\n<li>Salesforce&#8217;s office sites, development centers, support, and data centers are secured by state-of-the-art technologies and are ISO 270001, ISO 27017, and ISO 27018 certified by an independent party.<\/li>\n<li>Salesforce hosts multiple tenants on the same shared set of resources. Tenants are completely isolated from each other via an &#8220;Organization ID&#8221;.<\/li>\n<li>In addition, the platform is HIPAA, FedRAMP, and GDPR compliant. A full list of Salesforce&#8217;s certifications may be found <a href=\"https:\/\/compliance.salesforce.com\/en\">here.<\/a><\/li>\n<li>These security measures are entirely under the control of Salesforce and have been made available to the general public for informational purposes alone. The ones below are more important to the Salesforce customer and require careful review, planning, and execution.<\/li>\n<\/ul>\n<h3>Encryption<\/h3>\n<ul>\n<li>All data is encrypted using TLS 1.2 the moment it leaves the user&#8217;s browser or mobile device. Data is always encrypted as it moves around within Salesforce&#8217;s own networks.<\/li>\n<li>Salesforce offers the ability to encrypt data in sensitive fields at no extra cost, so they may only be accessed by authorized users<\/li>\n<li>For an additional cost, customers may purchase Salesforce Shield, which encrypts all customer data, at rest.<\/li>\n<\/ul>\n<h3>Real-time Monitoring<\/h3>\n<ul>\n<li>Salesforce offers\u00a0event\u00a0monitoring at an additional cost for Enhanced Transaction Security and Threat Detection.\n<ul>\n<li>Enhanced Transaction Security offers customers the ability to define policies around sensitive operations such as login, API access, and reporting.<\/li>\n<li>Threat Detection alerts customers in real-time to unauthorized access from\u00a0session\u00a0hijacking,\u00a0credential Stuffing and other anomalies<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3>Authorization<\/h3>\n<ul>\n<li>Salesforce offers a myriad of ways for customers to log in, ranging from traditional password-based logins to SAML or OAuth-based SSO.<\/li>\n<li>In addition, users also have the option of a wide range of two-factor authentication mechanisms. The simplest one (which all users are enrolled in, by default) is through an activation code emailed to the user. Other options include text messages to the user&#8217;s registered phone, Salesforce Authenticator App, or a physical security key.<\/li>\n<\/ul>\n<h3>Application Security<\/h3>\n<ul>\n<li>The final and the most important piece of the security chain, from a customer&#8217;s perspective, are the security configuration options in the Salesforce app itself.\n<ul>\n<li>System and Object access levels\n<ul>\n<li><strong>Profiles<\/strong> control Create, Read, Delete and Edit access to objects as well as access to fields. They also dictate the scope of what the user can do on the platform.<\/li>\n<li><strong>Permission Sets<\/strong> allow additional permissions to be added to the ones provided to a user by their Profile.<\/li>\n<li><strong>Permission Set Groups<\/strong> are a recent addition to the platform that allows grouping multiple Permission Sets together. They have been introduced to simplify the metadata representation of a user&#8217;s access levels and are projected to make Profiles less relevant soon.<\/li>\n<\/ul>\n<\/li>\n<li>Data access levels\n<ul>\n<li>For a user having at least Read access to an Object, access to individual records is controlled by a combination of Org-Wide Defaults, the User&#8217;s Role, the Object&#8217;s Sharing Rules, and Record Ownership. In addition, there are features like Sharing Sets, Queue Membership, Enterprise Territory Management, Manual Sharing, and Account\/Sales and Case Teams that can provide a user access to certain records.<\/li>\n<\/ul>\n<\/li>\n<li>Process execution contexts\n<ul>\n<li>Custom Screens and Automations designed on the Platform using Code or Flows may be run under the System Context or User Context. It requires careful planning and execution on the part of an admin or developer to ensure these processes always run with the least privileges necessary and don&#8217;t turn into attack surfaces, or inadvertently expose sensitive customer information<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>The features listed above are merely an overview. There are many\u00a0intricacies\u00a0to\u00a0configuring and\u00a0fine-tuning\u00a0data security in Salesforce. Although most small-to-midsize customers start out with an &#8220;open&#8221; model, where access to data is pretty much unrestricted to all users, the approach may not be suited to all customers and can quickly prove inadequate as the user list starts growing.<\/p>\n<p>Careful planning and execution, driven by an experienced Salesforce Consultant or Administrator can end up saving you a lot of time and money as you start to scale usage of the Platform. At the same time, a lack of proper planning and improper implementation can end up costing you time, money, and customer goodwill.<\/p>\n<p>Vertex Computer Systems is a trusted Salesforce Solutions Provider with specializations in Sales Cloud, Service Cloud, and Business Process Automation &amp; Transformation. If you would like to schedule a Salesforce security audit or just learn more about Salesforce security, please contact us.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Salesforce has rightfully earned and held on to the title of the &#8220;World&#8217;s #1 CRM Platform&#8221; by going to great lengths to enable their customers access to their data across all devices, all while ensuring the data is protected from unauthorized access.<\/p>\n","protected":false},"author":6,"featured_media":1716,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[72,128],"tags":[4,8,9,54,58,62,147,148,149,150],"acf":{"title_color":"black","select_cta":[1011],"header_size":"large","default_content":"center"},"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.2.1 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Overview of Salesforce Security &amp; Compliance Measures<\/title>\n<meta name=\"description\" content=\"Salesforce earned and held on to the title of the &quot;World&#039;s #1 CRM Platform&quot;, allowing customers to access data on any device while maintaining security.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Overview of Salesforce Security &amp; Compliance Measures\" \/>\n<meta property=\"og:description\" content=\"Salesforce earned and held on to the title of the &quot;World&#039;s #1 CRM Platform&quot;, allowing customers to access data on any device while maintaining security.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/poiseddevelopers.com\/vertex-old\/blog\/a-review-of-salesforce-security-compliance-measures\/\" \/>\n<meta property=\"og:site_name\" content=\"Vertex Computer Systems\" \/>\n<meta property=\"article:published_time\" content=\"2021-12-08T19:49:22+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-02-28T15:59:57+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/ozb.8fe.myftpupload.com\/wp-content\/uploads\/2021\/12\/Salesforce_Data_Security.png\" \/>\n\t<meta property=\"og:image:width\" content=\"919\" \/>\n\t<meta property=\"og:image:height\" content=\"483\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Sundip Nandy\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sundip Nandy\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/poiseddevelopers.com\/vertex-old\/blog\/a-review-of-salesforce-security-compliance-measures\/\",\"url\":\"https:\/\/poiseddevelopers.com\/vertex-old\/blog\/a-review-of-salesforce-security-compliance-measures\/\",\"name\":\"Overview of Salesforce Security & Compliance Measures\",\"isPartOf\":{\"@id\":\"https:\/\/poiseddevelopers.com\/vertex-old\/#website\"},\"datePublished\":\"2021-12-08T19:49:22+00:00\",\"dateModified\":\"2023-02-28T15:59:57+00:00\",\"author\":{\"@id\":\"https:\/\/poiseddevelopers.com\/vertex-old\/#\/schema\/person\/21c4cce298fbc1554f2210fb2536afed\"},\"description\":\"Salesforce earned and held on to the title of the \\\"World's #1 CRM Platform\\\", allowing customers to access data on any device while maintaining security.\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/poiseddevelopers.com\/vertex-old\/blog\/a-review-of-salesforce-security-compliance-measures\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/poiseddevelopers.com\/vertex-old\/#website\",\"url\":\"https:\/\/poiseddevelopers.com\/vertex-old\/\",\"name\":\"Vertex Computer Systems\",\"description\":\"We Got IT.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/poiseddevelopers.com\/vertex-old\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/poiseddevelopers.com\/vertex-old\/#\/schema\/person\/21c4cce298fbc1554f2210fb2536afed\",\"name\":\"Sundip Nandy\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/poiseddevelopers.com\/vertex-old\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/f399d31d7e80b0bd38b42e7c0e3f2ca0?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/f399d31d7e80b0bd38b42e7c0e3f2ca0?s=96&d=mm&r=g\",\"caption\":\"Sundip Nandy\"},\"description\":\"Sudip has over 20 years delivering Enterprise Solutions and Strategic Account Management. He heads the India Delivery Center and is responsible for scaling and optimizing service delivery and operations. Sudip embraces technologies and operational efficiency resulting in tech-driven success for every business. During his free time Sudip loves to explore emerging technologies and enjoys playing badminton.\",\"url\":\"https:\/\/poiseddevelopers.com\/vertex-old\/blog\/author\/sundipnandy\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Overview of Salesforce Security & Compliance Measures","description":"Salesforce earned and held on to the title of the \"World's #1 CRM Platform\", allowing customers to access data on any device while maintaining security.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Overview of Salesforce Security & Compliance Measures","og_description":"Salesforce earned and held on to the title of the \"World's #1 CRM Platform\", allowing customers to access data on any device while maintaining security.","og_url":"https:\/\/poiseddevelopers.com\/vertex-old\/blog\/a-review-of-salesforce-security-compliance-measures\/","og_site_name":"Vertex Computer Systems","article_published_time":"2021-12-08T19:49:22+00:00","article_modified_time":"2023-02-28T15:59:57+00:00","og_image":[{"width":919,"height":483,"url":"https:\/\/ozb.8fe.myftpupload.com\/wp-content\/uploads\/2021\/12\/Salesforce_Data_Security.png","type":"image\/png"}],"author":"Sundip Nandy","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Sundip Nandy","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/poiseddevelopers.com\/vertex-old\/blog\/a-review-of-salesforce-security-compliance-measures\/","url":"https:\/\/poiseddevelopers.com\/vertex-old\/blog\/a-review-of-salesforce-security-compliance-measures\/","name":"Overview of Salesforce Security & Compliance Measures","isPartOf":{"@id":"https:\/\/poiseddevelopers.com\/vertex-old\/#website"},"datePublished":"2021-12-08T19:49:22+00:00","dateModified":"2023-02-28T15:59:57+00:00","author":{"@id":"https:\/\/poiseddevelopers.com\/vertex-old\/#\/schema\/person\/21c4cce298fbc1554f2210fb2536afed"},"description":"Salesforce earned and held on to the title of the \"World's #1 CRM Platform\", allowing customers to access data on any device while maintaining security.","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/poiseddevelopers.com\/vertex-old\/blog\/a-review-of-salesforce-security-compliance-measures\/"]}]},{"@type":"WebSite","@id":"https:\/\/poiseddevelopers.com\/vertex-old\/#website","url":"https:\/\/poiseddevelopers.com\/vertex-old\/","name":"Vertex Computer Systems","description":"We Got IT.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/poiseddevelopers.com\/vertex-old\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/poiseddevelopers.com\/vertex-old\/#\/schema\/person\/21c4cce298fbc1554f2210fb2536afed","name":"Sundip Nandy","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/poiseddevelopers.com\/vertex-old\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/f399d31d7e80b0bd38b42e7c0e3f2ca0?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f399d31d7e80b0bd38b42e7c0e3f2ca0?s=96&d=mm&r=g","caption":"Sundip Nandy"},"description":"Sudip has over 20 years delivering Enterprise Solutions and Strategic Account Management. He heads the India Delivery Center and is responsible for scaling and optimizing service delivery and operations. Sudip embraces technologies and operational efficiency resulting in tech-driven success for every business. During his free time Sudip loves to explore emerging technologies and enjoys playing badminton.","url":"https:\/\/poiseddevelopers.com\/vertex-old\/blog\/author\/sundipnandy\/"}]}},"_links":{"self":[{"href":"https:\/\/poiseddevelopers.com\/vertex-old\/wp-json\/wp\/v2\/posts\/1715"}],"collection":[{"href":"https:\/\/poiseddevelopers.com\/vertex-old\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/poiseddevelopers.com\/vertex-old\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/poiseddevelopers.com\/vertex-old\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/poiseddevelopers.com\/vertex-old\/wp-json\/wp\/v2\/comments?post=1715"}],"version-history":[{"count":0,"href":"https:\/\/poiseddevelopers.com\/vertex-old\/wp-json\/wp\/v2\/posts\/1715\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/poiseddevelopers.com\/vertex-old\/wp-json\/wp\/v2\/media\/1716"}],"wp:attachment":[{"href":"https:\/\/poiseddevelopers.com\/vertex-old\/wp-json\/wp\/v2\/media?parent=1715"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/poiseddevelopers.com\/vertex-old\/wp-json\/wp\/v2\/categories?post=1715"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/poiseddevelopers.com\/vertex-old\/wp-json\/wp\/v2\/tags?post=1715"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}