{"id":23285,"date":"2026-10-21T08:08:18","date_gmt":"2026-10-21T08:08:18","guid":{"rendered":"https:\/\/dianapps.com\/blog\/?p=23285"},"modified":"2026-10-21T08:11:25","modified_gmt":"2026-10-21T08:11:25","slug":"salesforce-security-and-compliance","status":"publish","type":"post","link":"https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/","title":{"rendered":"Salesforce Security and Compliance: GDPR, HIPAA, SOC 2, and more"},"content":{"rendered":"<p><b>Key Takeaways<\/b><span style=\"font-weight: 400;\">:\u00a0<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Salesforce certifications cover its infrastructure, not your organisation\u2019s compliance obligations.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">HIPAA coverage depends on named services in your current Business Associate Agreement (BAA).<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">GDPR requires you to manage lawful basis, consent, DSARs, and data erasure.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Apex and record-triggered Flows can expose regulated data when system-mode access is unchecked.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Data masking, access reviews, audit trails, and third-party app assessments help close compliance gaps.<\/span><\/li>\n<\/ul>\n<blockquote><p><b>Quick Answer<\/b><span style=\"font-weight: 400;\">: Salesforce provides platform security, encryption, compliance certifications, and tools that support GDPR, HIPAA, and SOC 2 requirements, but your organisation must configure and maintain its own controls. This includes managing user permissions, enforcing field-level security in Apex and Flow, documenting consent and lawful basis, handling data subject access and erasure requests, masking sandbox data, and assessing third-party applications. For HIPAA, verify which services your current BAA covers rather than assuming your Salesforce edition is eligible. Compliance depends on how your org is configured, monitored, and documented, not simply on Salesforce\u2019s certifications.<\/span><\/p><\/blockquote>\n<p><span style=\"font-weight: 400;\">Salesforce holds SOC 1, SOC 2, and ISO 27001 certifications, and will sign a BAA for HIPAA. None of that makes your org compliant.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The certifications cover Salesforce\u2019s infrastructure. What determines whether you pass an audit is your configuration, who can see which records, whether your Apex enforces field-level security, whether real patient data is sitting unmasked in a sandbox.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The phrase worth remembering: a signed BAA without correct configuration is a paper shield. It documents who\u2019s responsible; it doesn\u2019t prevent anything.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">This guide covers the split honestly, what Salesforce genuinely handles, and the specific things that are yours.<\/span><\/p>\n<h2><b>The Shared Responsibility Model<\/b><\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-23295\" src=\"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Shared-Responsibility-Model-Infographic.webp\" alt=\"Two-column comparison of what Salesforce is responsible for versus what the customer must configure\" width=\"1672\" height=\"941\" srcset=\"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Shared-Responsibility-Model-Infographic.webp 1672w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Shared-Responsibility-Model-Infographic-1024x576.webp 1024w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Shared-Responsibility-Model-Infographic-768x432.webp 768w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Shared-Responsibility-Model-Infographic-1536x864.webp 1536w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Shared-Responsibility-Model-Infographic-640x360.webp 640w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Shared-Responsibility-Model-Infographic-400x225.webp 400w\" sizes=\"auto, (max-width: 1672px) 100vw, 1672px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">Salesforce\u2019s side is genuinely strong: physical and network security, encryption in transit and at rest, SOC 1, SOC 2 and ISO 27001, published audit reports, and a BAA for named services.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">While Salesforce provides the tools needed to support regulatory compliance, configuring them correctly requires a clear understanding of your organisation\u2019s security and data protection requirements. <\/span><a href=\"https:\/\/dianapps.com\/salesforce-consulting-services\"><span style=\"font-weight: 400;\">Salesforce consulting services<\/span><\/a><span style=\"font-weight: 400;\"> can help businesses review access permissions, assess automation risks, strengthen data governance and identify configuration gaps before they become compliance issues.<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Your side is bigger, and it\u2019s where audits fail:<\/b><span style=\"font-weight: 400;\"> Access design, field-level security in Apex and Flow, consent records, DSAR processes, sandbox data masking, third-party app assessment, training and documentation.\u00a0<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>The pattern across every regulation below is the same:<\/b><span style=\"font-weight: 400;\"> Salesforce provides the capability, and you provide the implementation. A vendor certification is a prerequisite, not an outcome.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">The cost of maintaining these controls also matters when assessing\u00a0<\/span><span style=\"font-weight: 400;\"><span style=\"box-sizing: border-box; margin: 0px; padding: 0px;\">your CRM&#8217;s overall value, and our\u00a0<a href=\"https:\/\/dianapps.com\/blog\/salesforce-roi\/\" target=\"_blank\" rel=\"noopener\">guide to Salesforce ROI<\/a> explains how to evaluate\u00a0<\/span>returns against your platform investment.<\/span><\/p>\n<h2><b>HIPAA: The Gate Is the Service, Not the Edition<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">This is the detail that catches organisations out most often.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Salesforce publishes a BAA Restrictions document that lists HIPAA Covered Services by name. Coverage is determined by which service you\u2019re using, not which edition you bought.<\/span><\/p>\n<p><b>Two practical consequences:<\/b><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Services not on the list must not store, process, or transmit PHI. That includes newer capabilities that haven\u2019t been added yet, and it\u2019s the reason to check the list rather than assume.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">The BAA also restricts <\/span><i><span style=\"font-weight: 400;\">how<\/span><\/i><span style=\"font-weight: 400;\"> covered services may be used. You may need to disable specific features or apply additional controls when handling PHI on an otherwise-covered service.<\/span><\/li>\n<\/ul>\n<h2><b>Five Gaps Salesforce Doesn\u2019t Close<\/b><\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-23294\" src=\"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-HIPAA-Compliance-Gaps-Infographic.webp\" alt=\"Five HIPAA gaps: services outside the BAA, data in motion, third-party apps, system-mode automation, and unmasked sandbox data\" width=\"1536\" height=\"1024\" srcset=\"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-HIPAA-Compliance-Gaps-Infographic.webp 1536w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-HIPAA-Compliance-Gaps-Infographic-1024x683.webp 1024w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-HIPAA-Compliance-Gaps-Infographic-768x512.webp 768w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-HIPAA-Compliance-Gaps-Infographic-640x427.webp 640w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-HIPAA-Compliance-Gaps-Infographic-400x267.webp 400w\" sizes=\"auto, (max-width: 1536px) 100vw, 1536px\" \/><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Data in motion is the one most people miss:<\/b><span style=\"font-weight: 400;\"> Salesforce encrypts PHI at rest and in transit <\/span><i><span style=\"font-weight: 400;\">within<\/span><\/i><span style=\"font-weight: 400;\"> its ecosystem. When a support agent replies to a case containing PHI and that message travels over the public internet to a patient, encrypting it is your problem.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Third-party apps need their own BAAs:<\/b><span style=\"font-weight: 400;\"> An AppExchange app that touches PHI can move it outside Salesforce\u2019s controlled environment. Each one needs a separate agreement and its own security assessment.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>System-mode automation is the technical gap:<\/b><span style=\"font-weight: 400;\"> Apex and record-triggered Flows run in system mode by default, ignoring the sharing model entirely. In an org holding PHI, that\u2019s a genuine exposure route, and it rarely appears on a compliance checklist because it looks like a development concern rather than a security one.<\/span><\/li>\n<\/ul>\n<div style=\"background: #EEF2FE; border: 1px solid #DBE2FB; border-radius: 14px; padding: 28px 32px; margin: 38px 0;\">\n<h3 style=\"color: #1b3fae; font-size: 22px; line-height: 1.3; font-weight: bold; margin: 0 0 10px;\"><span style=\"font-weight: 400;\"><b>Is Your Salesforce Org Compliance-Ready?<\/b><\/span><\/h3>\n<p style=\"color: #4b5563; font-size: 16px; line-height: 1.6; margin: 0 0 22px;\"><span style=\"font-weight: 400;\">Identify gaps in access controls, automation, and third-party security before they become compliance risks. Get expert guidance to strengthen your Salesforce security setup.<\/span><\/p>\n<p><a style=\"display: inline-block; background: #2563EB; color: #ffffff; text-decoration: none; font-size: 15px; font-weight: 600; padding: 13px 26px; border-radius: 8px;\" href=\"https:\/\/dianapps.com\/contact\">Talk to Our Salesforce Experts \u2192<\/a><\/p>\n<\/div>\n<p><b>On Shield:<\/b><span style=\"font-weight: 400;\"> It isn\u2019t strictly required by HIPAA. What it provides: platform encryption, Event Monitoring, Field Audit Trail- satisfies the Security Rule\u2019s technical safeguards in a way that\u2019s straightforward to evidence during an audit. For most healthcare deployments, it\u2019s the practical baseline rather than an optional extra.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Related: <\/span><a href=\"https:\/\/dianapps.com\/blog\/salesforce-shield-guide\/\"><span style=\"font-weight: 400;\">Salesforce Shield explained<\/span><\/a><span style=\"font-weight: 400;\"> \u00b7 <\/span><a href=\"https:\/\/dianapps.com\/blog\/salesforce-development-for-healthcare\/\"><span style=\"font-weight: 400;\">Salesforce for healthcare<\/span><\/a><\/p>\n<h2><b>GDPR in Salesforce<\/b><\/h2>\n<p><b>Salesforce is a data processor; you\u2019re the controller.<\/b><span style=\"font-weight: 400;\"> That distinction determines almost everything.<\/span><\/p>\n<table>\n<thead>\n<tr>\n<th><span style=\"font-weight: 400;\">Obligation<\/span><\/th>\n<th><span style=\"font-weight: 400;\">What Salesforce provides<\/span><\/th>\n<th><span style=\"font-weight: 400;\">What you must do<\/span><\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><b>Lawful basis<\/b><\/td>\n<td><span style=\"font-weight: 400;\">Fields and objects to record it<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Decide it, capture it, evidence it<\/span><\/td>\n<\/tr>\n<tr>\n<td><b>Consent management<\/b><\/td>\n<td><span style=\"font-weight: 400;\">Individual object, consent fields<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Design the model, keep it current across channels<\/span><\/td>\n<\/tr>\n<tr>\n<td><b>Right of access (DSAR)<\/b><\/td>\n<td><span style=\"font-weight: 400;\">Data Privacy Manager, APIs<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Find every record, including in integrations<\/span><\/td>\n<\/tr>\n<tr>\n<td><b>Right to erasure<\/b><\/td>\n<td><span style=\"font-weight: 400;\">Deletion APIs, Data Privacy Manager<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Define what \u201cdelete\u201d means across sandboxes and backups<\/span><\/td>\n<\/tr>\n<tr>\n<td><b>Data minimisation<\/b><\/td>\n<td><span style=\"font-weight: 400;\">Field-level control<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Stop collecting what you don\u2019t need<\/span><\/td>\n<\/tr>\n<tr>\n<td><b>Breach notification<\/b><\/td>\n<td><span style=\"font-weight: 400;\">Event Monitoring, audit logs<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Detect, assess and report within 72 hours<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><b>The erasure requirement is the hard one<\/b><span style=\"font-weight: 400;\">, and it\u2019s where most organisations are weakest. Deleting a contact in production doesn\u2019t remove them from a Full Copy sandbox, an integrated marketing platform, or a backup. <\/span><b>Define the scope of deletion before you receive a request, not after.<\/b><\/p>\n<p><b>And DSARs get harder the more integrated you are.<\/b><span style=\"font-weight: 400;\"> A subject access request covers everywhere their data lives, which means your integration architecture is a privacy question, not just a technical one.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">If you\u2019re also evaluating which CRM best fits your organisation\u2019s needs, our <\/span><a href=\"https:\/\/dianapps.com\/blog\/salesforce-vs-hubspot\/\"><span style=\"font-weight: 400;\">Salesforce vs HubSpot<\/span><\/a><span style=\"font-weight: 400;\"> comparison examines the differences in pricing, customisation, and ongoing administration.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Related: <\/span><a href=\"https:\/\/dianapps.com\/blog\/salesforce-sandbox-explained\/\"><span style=\"font-weight: 400;\">Salesforce sandboxes explained<\/span><\/a><span style=\"font-weight: 400;\"> \u00b7 <\/span><span style=\"font-weight: 400;\">Salesforce integration<\/span><\/p>\n<h2><b>What Each Regulation Requires<\/b><\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-23293\" src=\"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Compliance-Configuration-Guide-1.webp\" alt=\"Table mapping GDPR, HIPAA, SOC 2, CCPA, PCI DSS, data residency and DPDPA to the configuration work each requires\" width=\"1685\" height=\"933\" srcset=\"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Compliance-Configuration-Guide-1.webp 1685w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Compliance-Configuration-Guide-1-1024x567.webp 1024w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Compliance-Configuration-Guide-1-768x425.webp 768w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Compliance-Configuration-Guide-1-1536x850.webp 1536w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Compliance-Configuration-Guide-1-640x354.webp 640w, https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Compliance-Configuration-Guide-1-400x221.webp 400w\" sizes=\"auto, (max-width: 1685px) 100vw, 1685px\" \/><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>On PCI DSS specifically:<\/b><span style=\"font-weight: 400;\"> the cheapest compliance strategy is to keep cardholder data out of Salesforce entirely. Tokenise at the payment gateway and store only the token. Organisations that store card data \u201ctemporarily\u201d for a business reason expand their audit scope substantially for very little benefit.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>On SOC 2:<\/b><span style=\"font-weight: 400;\"> Salesforce\u2019s own SOC 2 report covers Salesforce. Your SOC 2 covers your controls, and the Salesforce-related ones tie directly to your DevOps discipline, change management, access reviews, and audit logging. See <\/span><a href=\"https:\/\/dianapps.com\/blog\/salesforce-devops-guide\/\"><span style=\"font-weight: 400;\">Salesforce DevOps<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>On DPDPA:<\/b><span style=\"font-weight: 400;\"> India\u2019s Digital Personal Data Protection Act creates obligations for India-headquartered enterprises and Global Capability Centres. If you\u2019re a Western buyer using Indian delivery, your obligation is more likely GDPR, but confirm how your data is handled either way.<\/span><\/li>\n<\/ul>\n<h2><b>Encryption: Classic vs Shield<\/b><\/h2>\n<table>\n<thead>\n<tr>\n<th><\/th>\n<th><span style=\"font-weight: 400;\">Classic Encryption<\/span><\/th>\n<th><span style=\"font-weight: 400;\">Shield Platform Encryption<\/span><\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><b>Cost<\/b><\/td>\n<td><span style=\"font-weight: 400;\">Included<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Paid add-on<\/span><\/td>\n<\/tr>\n<tr>\n<td><b>Field types<\/b><\/td>\n<td><span style=\"font-weight: 400;\">Custom text fields only<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Standard and custom fields, files, attachments<\/span><\/td>\n<\/tr>\n<tr>\n<td><b>Search<\/b><\/td>\n<td><span style=\"font-weight: 400;\">Not searchable<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Searchable<\/span><\/td>\n<\/tr>\n<tr>\n<td><b>Key management<\/b><\/td>\n<td><span style=\"font-weight: 400;\">Salesforce-managed<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Bring your own key supported<\/span><\/td>\n<\/tr>\n<tr>\n<td><b>Functionality impact<\/b><\/td>\n<td><span style=\"font-weight: 400;\">Significant restrictions<\/span><\/td>\n<td><span style=\"font-weight: 400;\">Fewer, but real<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-weight: 400;\">Shield\u2019s practical value isn\u2019t only the encryption. It\u2019s Field Audit Trail and Event Monitoring, the ability to show an auditor who accessed what and when, and to retain field history far longer than the standard 18 months.<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>The Honest Caveat<\/b><span style=\"font-weight: 400;\">: Encryption restricts functionality. Encrypted fields have limitations in formulas, filters, and some integrations. Encrypt what genuinely needs it rather than everything, and test the impact before rolling out.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">Related: <\/span><a href=\"https:\/\/dianapps.com\/blog\/salesforce-shield-guide\/\"><span style=\"font-weight: 400;\">Salesforce Shield explained<\/span><\/a><\/p>\n<h2><b>Data Residency<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Hyperforce changed this materially. Salesforce infrastructure now runs on public cloud in an expanding number of countries, deployed as cells, which means data residency is a configuration choice rather than a compliance blocker.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Two things to do if residency matters:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Confirm where your org actually sits. Don\u2019t assume. Check, and get it in writing if it\u2019s contractual.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Remember that residency and access are different questions. Data stored in the EU can still be accessed from elsewhere. If your obligation is about access as well as storage, that\u2019s a separate control.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">If compliance requirements are also prompting you to reassess CRM costs, our <\/span><a href=\"https:\/\/dianapps.com\/blog\/salesforce-vs-zoho-crm\/\"><span style=\"font-weight: 400;\">Salesforce vs Zoho CRM<\/span><\/a><span style=\"font-weight: 400;\"> comparison explains the differences in pricing, reporting, integrations, and scalability.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Related: <\/span><span style=\"font-weight: 400;\">how Salesforce works, architecture and Hyperforce<\/span><\/p>\n<h2><b>A Practical Compliance Checklist<\/b><\/h2>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Access and permissions<\/b><span style=\"font-weight: 400;\"> &#8211; Org-wide defaults set to the most restrictive workable level &#8211; Profiles and permission sets reviewed quarterly, not annually &#8211; No user holding \u201cView All Data\u201d without a documented reason &#8211; Deactivation tied to HR offboarding, same day<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Code and automation<\/b><span style=\"font-weight: 400;\"> &#8211; <\/span><span style=\"font-weight: 400;\">WITH USER_MODE<\/span><span style=\"font-weight: 400;\"> on queries touching regulated data &#8211; <\/span><span style=\"font-weight: 400;\">AccessLevel.USER_MODE<\/span><span style=\"font-weight: 400;\"> on DML &#8211; Every record-triggered Flow reviewed for system-mode exposure &#8211; Fault paths on data operations<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Environments<\/b><span style=\"font-weight: 400;\"> &#8211; Data Mask run before any developer accesses a Full or Partial Copy sandbox &#8211; Sandbox refresh process documented, including who gets access<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Evidence<\/b><span style=\"font-weight: 400;\"> &#8211; Field Audit Trail enabled on regulated objects &#8211; Event Monitoring in place if you need to show access history &#8211; Retention periods defined and configured, not assumed<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Third parties<\/b><span style=\"font-weight: 400;\"> &#8211; Every AppExchange app touching regulated data assessed and covered by its own agreement &#8211; Integration endpoints reviewed for what they transmit and where<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Governance<\/b><span style=\"font-weight: 400;\"> &#8211; Named owner for compliance configuration &#8211; Quarterly access review, documented &#8211; Training records kept<\/span><\/li>\n<\/ul>\n<div style=\"background: #EEF2FE; border: 1px solid #DBE2FB; border-radius: 14px; padding: 28px 32px; margin: 38px 0;\">\n<h3 style=\"color: #1b3fae; font-size: 22px; line-height: 1.3; font-weight: bold; margin: 0 0 10px;\"><span style=\"font-weight: 400;\"><b>Close Your Salesforce Compliance Gaps<\/b><\/span><\/h3>\n<p style=\"color: #4b5563; font-size: 16px; line-height: 1.6; margin: 0 0 22px;\"><span style=\"font-weight: 400;\">From permission reviews to audit trails and data masking, find out what your org needs to meet its compliance obligations. Get a clear plan to address the gaps that matter most.<\/span><\/p>\n<p><a style=\"display: inline-block; background: #2563EB; color: #ffffff; text-decoration: none; font-size: 15px; font-weight: 600; padding: 13px 26px; border-radius: 8px;\" href=\"https:\/\/dianapps.com\/contact\">Contact Our Team \u2192<\/a><\/p>\n<\/div>\n<h2><b>Where to Go Next<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">For the encryption and monitoring layer, <\/span><a href=\"https:\/\/dianapps.com\/blog\/salesforce-shield-guide\/\"><span style=\"font-weight: 400;\">Salesforce Shield explained<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">For enforcing security in code, <\/span><a href=\"https:\/\/dianapps.com\/blog\/apex-programming-guide\/\"><span style=\"font-weight: 400;\">the Apex programming guide<\/span><\/a><span style=\"font-weight: 400;\"> and <\/span><a href=\"https:\/\/dianapps.com\/blog\/the-ultimate-guide-to-salesforce-flow\/\"><span style=\"font-weight: 400;\">Salesforce Flow Guide<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">For protecting lower environments, <\/span><a href=\"https:\/\/dianapps.com\/blog\/salesforce-sandbox-explained\/\"><span style=\"font-weight: 400;\">Salesforce sandboxes explained<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">For where data physically sits, <\/span><span style=\"font-weight: 400;\">how Salesforce works<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">For regulated industries specifically, <\/span><a href=\"https:\/\/dianapps.com\/blog\/salesforce-development-for-healthcare\/\"><span style=\"font-weight: 400;\">Salesforce for healthcare<\/span><\/a><span style=\"font-weight: 400;\"> \u00b7 <\/span><a href=\"https:\/\/dianapps.com\/blog\/salesforce-for-financial-services\/\"><span style=\"font-weight: 400;\">Salesforce for financial services<\/span><\/a><span style=\"font-weight: 400;\"> \u00b7 <\/span><a href=\"https:\/\/dianapps.com\/blog\/salesforce-for-education\/\"><span style=\"font-weight: 400;\">Salesforce for education<\/span><\/a><span style=\"font-weight: 400;\"> \u00b7 <\/span><a href=\"https:\/\/dianapps.com\/blog\/salesforce-development-for-nonprofits\/\"><span style=\"font-weight: 400;\">Salesforce for nonprofit<\/span><\/a><\/p>\n<p><span style=\"font-weight: 400;\">For change management and audit evidence, <\/span><a href=\"https:\/\/dianapps.com\/blog\/salesforce-devops-guide\/\"><span style=\"font-weight: 400;\">Salesforce DevOps<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">For the platform context, <\/span><a href=\"https:\/\/dianapps.com\/blog\/what-is-salesforce\/\"><span style=\"font-weight: 400;\">what is Salesforce<\/span><\/a><span style=\"font-weight: 400;\"> and <\/span><a href=\"https:\/\/dianapps.com\/blog\/salesforce-pricing\/\"><span style=\"font-weight: 400;\">Salesforce pricing<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p>\n<h2><b>Certifications Are the Starting Line<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Every vendor page in this category leads with the certification list. It\u2019s the least useful information available, because it describes what Salesforce did rather than what you need to do.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The work that determines whether you pass an audit is unglamorous: access reviews, masked sandboxes, <\/span><span style=\"font-weight: 400;\">USER_MODE<\/span><span style=\"font-weight: 400;\"> in your Apex, a documented deletion process, and someone whose job it is to keep all of that current.<\/span><\/p>\n<div style=\"background: #EEF2FE; border: 1px solid #DBE2FB; border-radius: 14px; padding: 28px 32px; margin: 38px 0;\">\n<h3 style=\"color: #1b3fae; font-size: 22px; line-height: 1.3; font-weight: bold; margin: 0 0 10px;\"><span style=\"font-weight: 400;\"><b>Is Your Salesforce Setup Ready for Regulatory Scrutiny?<\/b><\/span><\/h3>\n<p style=\"color: #4b5563; font-size: 16px; line-height: 1.6; margin: 0 0 22px;\"><span style=\"font-weight: 400;\">We\u2019ll review access design, code-level enforcement, environment handling, and third-party exposure, and give you the gaps in priority order.<\/span><\/p>\n<p><a style=\"display: inline-block; background: #2563EB; color: #ffffff; text-decoration: none; font-size: 15px; font-weight: 600; padding: 13px 26px; border-radius: 8px;\" href=\"https:\/\/dianapps.com\/contact\">Talk to our Salesforce Consulting Team\u00a0\u2192<\/a><\/p>\n<\/div>\n<p>&nbsp;<\/p>\n<style>.elementor-23297 .elementor-element.elementor-element-2932a52{text-align:left;}.elementor-23297 .elementor-element.elementor-element-2932a52 > .elementor-widget-container{margin:0px 0px 0px 0px;}.elementor-23297 .elementor-element.elementor-element-0b767d1 .elementor-tab-title{border-width:1px;border-color:#00000014;}.elementor-23297 .elementor-element.elementor-element-0b767d1 .elementor-tab-content{border-width:1px;border-bottom-color:#00000014;}.elementor-23297 .elementor-element.elementor-element-0b767d1 > .elementor-widget-container{margin:0px 0px 0px 0px;}<\/style><div class=\"porto-block elementor elementor-23297\">\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-27707ca elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"27707ca\" data-element_type=\"section\">\r\n\t\t\t\r\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\r\n\t\t\t\t\t\t\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-0163611\" data-id=\"0163611\" data-element_type=\"column\">\r\n\r\n\t\t\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\r\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-03a2969 elementor-widget elementor-widget-text-editor\" data-id=\"03a2969\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.14.0 - 26-06-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#69727d;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2932a52 elementor-widget elementor-widget-heading\" data-id=\"2932a52\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.14.0 - 26-06-2023 *\/\n.elementor-heading-title{padding:0;margin:0;line-height:1}.elementor-widget-heading .elementor-heading-title[class*=elementor-size-]>a{color:inherit;font-size:inherit;line-height:inherit}.elementor-widget-heading .elementor-heading-title.elementor-size-small{font-size:15px}.elementor-widget-heading .elementor-heading-title.elementor-size-medium{font-size:19px}.elementor-widget-heading .elementor-heading-title.elementor-size-large{font-size:29px}.elementor-widget-heading .elementor-heading-title.elementor-size-xl{font-size:39px}.elementor-widget-heading .elementor-heading-title.elementor-size-xxl{font-size:59px}<\/style><h2 class=\"elementor-heading-title elementor-size-large\">FAQs <\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0b767d1 elementor-widget elementor-widget-toggle\" data-id=\"0b767d1\" data-element_type=\"widget\" data-widget_type=\"toggle.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.14.0 - 26-06-2023 *\/\n.elementor-toggle{text-align:left}.elementor-toggle .elementor-tab-title{font-weight:700;line-height:1;margin:0;padding:15px;border-bottom:1px solid #d5d8dc;cursor:pointer;outline:none}.elementor-toggle .elementor-tab-title .elementor-toggle-icon{display:inline-block;width:1em}.elementor-toggle .elementor-tab-title .elementor-toggle-icon svg{-webkit-margin-start:-5px;margin-inline-start:-5px;width:1em;height:1em}.elementor-toggle .elementor-tab-title .elementor-toggle-icon.elementor-toggle-icon-right{float:right;text-align:right}.elementor-toggle .elementor-tab-title .elementor-toggle-icon.elementor-toggle-icon-left{float:left;text-align:left}.elementor-toggle .elementor-tab-title .elementor-toggle-icon .elementor-toggle-icon-closed{display:block}.elementor-toggle .elementor-tab-title .elementor-toggle-icon .elementor-toggle-icon-opened{display:none}.elementor-toggle .elementor-tab-title.elementor-active{border-bottom:none}.elementor-toggle .elementor-tab-title.elementor-active .elementor-toggle-icon-closed{display:none}.elementor-toggle .elementor-tab-title.elementor-active .elementor-toggle-icon-opened{display:block}.elementor-toggle .elementor-tab-content{padding:15px;border-bottom:1px solid #d5d8dc;display:none}@media (max-width:767px){.elementor-toggle .elementor-tab-title{padding:12px}.elementor-toggle .elementor-tab-content{padding:12px 10px}}.e-con-inner>.elementor-widget-toggle,.e-con>.elementor-widget-toggle{width:var(--container-widget-width);--flex-grow:var(--container-widget-flex-grow)}<\/style>\t\t<div class=\"elementor-toggle\">\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-1201\" class=\"elementor-tab-title\" data-tab=\"1\" role=\"button\" aria-controls=\"elementor-tab-content-1201\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">Is Salesforce HIPAA compliant?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-1201\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"1\" role=\"region\" aria-labelledby=\"elementor-tab-title-1201\"><p><span style=\"font-weight: 400;\">Salesforce is HIPAA-<\/span><i><span style=\"font-weight: 400;\">eligible<\/span><\/i><span style=\"font-weight: 400;\">; it signs a Business Associate Agreement covering services named in its BAA Restrictions document, and provides capabilities including Shield encryption and Field Audit Trail. Actual compliance depends on your configuration, access controls, training, and monitoring; a BAA alone doesn\u2019t achieve it.<\/span><\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-1202\" class=\"elementor-tab-title\" data-tab=\"2\" role=\"button\" aria-controls=\"elementor-tab-content-1202\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">Which Salesforce products are covered by the BAA?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-1202\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"2\" role=\"region\" aria-labelledby=\"elementor-tab-title-1202\"><p><span style=\"font-weight: 400;\">Salesforce publishes a BAA Restrictions document listing HIPAA Covered Services by name. The gate is the service, not the edition you bought. Published sources disagree on the specifics, so request the current document from Salesforce and confirm in writing which of your services are in scope.<\/span><\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-1203\" class=\"elementor-tab-title\" data-tab=\"3\" role=\"button\" aria-controls=\"elementor-tab-content-1203\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">Is Salesforce GDPR compliant?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-1203\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"3\" role=\"region\" aria-labelledby=\"elementor-tab-title-1203\"><p><span style=\"font-weight: 400;\">Salesforce acts as a data processor and provides the tools: Data Privacy Manager, deletion APIs, consent objects, audit logging. You\u2019re the controller, responsible for lawful basis, consent records, responding to subject access requests, and defining what erasure means across sandboxes, backups, and integrated systems.<\/span><\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-1204\" class=\"elementor-tab-title\" data-tab=\"4\" role=\"button\" aria-controls=\"elementor-tab-content-1204\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">Do I need Salesforce Shield for compliance?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-1204\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"4\" role=\"region\" aria-labelledby=\"elementor-tab-title-1204\"><p><span style=\"font-weight: 400;\">Not strictly; HIPAA and GDPR don\u2019t require Shield, but it provides platform encryption, Event Monitoring, and Field Audit Trail that satisfy technical safeguards and are much easier to evidence during an audit. For most regulated deployments, it\u2019s the practical baseline.<\/span><\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-1205\" class=\"elementor-tab-title\" data-tab=\"5\" role=\"button\" aria-controls=\"elementor-tab-content-1205\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">Does Salesforce encrypt data by default?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-1205\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"5\" role=\"region\" aria-labelledby=\"elementor-tab-title-1205\"><p><span style=\"font-weight: 400;\">Yes, in transit and at rest at the platform level. Shield Platform Encryption adds field-level encryption with searchability and bring-your-own-key support. Classic Encryption is included but limited to custom text fields and isn\u2019t searchable.<\/span><\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-1206\" class=\"elementor-tab-title\" data-tab=\"6\" role=\"button\" aria-controls=\"elementor-tab-content-1206\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">What is the Salesforce shared responsibility model?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-1206\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"6\" role=\"region\" aria-labelledby=\"elementor-tab-title-1206\"><p><span style=\"font-weight: 400;\">Salesforce secures the platform, infrastructure, network, physical security, and certifications. You secure what you build on it, access control, field-level security in code, consent records, DSAR processes, sandbox data masking, and third-party app assessment. The customer side is the larger half.<\/span><\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-1207\" class=\"elementor-tab-title\" data-tab=\"7\" role=\"button\" aria-controls=\"elementor-tab-content-1207\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">Can I store credit card data in Salesforce?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-1207\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"7\" role=\"region\" aria-labelledby=\"elementor-tab-title-1207\"><p><span style=\"font-weight: 400;\">You can, but you shouldn\u2019t. Storing cardholder data expands your PCI DSS audit scope substantially. Tokenise at the payment gateway and store only the token; that keeps Salesforce out of scope for the most demanding PCI requirements.<\/span><\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-1208\" class=\"elementor-tab-title\" data-tab=\"8\" role=\"button\" aria-controls=\"elementor-tab-content-1208\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">Where is my Salesforce data stored?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-1208\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"8\" role=\"region\" aria-labelledby=\"elementor-tab-title-1208\"><p><span style=\"font-weight: 400;\">On the instance your org runs on. With Hyperforce, that can be a specific country\u2019s cell, which makes data residency a configuration choice. Confirm your org\u2019s actual location rather than assuming, and note that residency and access restrictions are separate questions.<\/span><\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-1209\" class=\"elementor-tab-title\" data-tab=\"9\" role=\"button\" aria-controls=\"elementor-tab-content-1209\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">Do AppExchange apps affect my compliance?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-1209\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"9\" role=\"region\" aria-labelledby=\"elementor-tab-title-1209\"><p><span style=\"font-weight: 400;\">Yes, third-party apps can move regulated data outside Salesforce\u2019s controlled environment. Each app touching PHI or personal data needs its own agreement and its own security assessment; Salesforce\u2019s BAA doesn\u2019t extend to them.<\/span><\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-toggle-item\">\n\t\t\t\t\t<h3 id=\"elementor-tab-title-12010\" class=\"elementor-tab-title\" data-tab=\"10\" role=\"button\" aria-controls=\"elementor-tab-content-12010\" aria-expanded=\"false\">\n\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon elementor-toggle-icon-left\" aria-hidden=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-closed\"><i class=\"fas fa-caret-right\"><\/i><\/span>\n\t\t\t\t\t\t\t\t<span class=\"elementor-toggle-icon-opened\"><i class=\"elementor-toggle-icon-opened fas fa-caret-up\"><\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t<a class=\"elementor-toggle-title\" tabindex=\"0\">What is the biggest compliance mistake in Salesforce?<\/a>\n\t\t\t\t\t<\/h3>\n\n\t\t\t\t\t<div id=\"elementor-tab-content-12010\" class=\"elementor-tab-content elementor-clearfix\" data-tab=\"10\" role=\"region\" aria-labelledby=\"elementor-tab-title-12010\"><p><span style=\"font-weight: 400;\">Assuming the vendor\u2019s certifications transfer to your org. The second is running Apex and record-triggered Flows in system mode without realising they bypass the sharing model entirely, a genuine exposure route that looks like a development concern rather than a security one.<\/span><\/p><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t<script type=\"application\/ld+json\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"Is Salesforce HIPAA compliant?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p><span style=\\\"font-weight: 400;\\\">Salesforce is HIPAA-<\\\/span><i><span style=\\\"font-weight: 400;\\\">eligible<\\\/span><\\\/i><span style=\\\"font-weight: 400;\\\">; it signs a Business Associate Agreement covering services named in its BAA Restrictions document, and provides capabilities including Shield encryption and Field Audit Trail. Actual compliance depends on your configuration, access controls, training, and monitoring; a BAA alone doesn\\u2019t achieve it.<\\\/span><\\\/p>\"}},{\"@type\":\"Question\",\"name\":\"Which Salesforce products are covered by the BAA?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p><span style=\\\"font-weight: 400;\\\">Salesforce publishes a BAA Restrictions document listing HIPAA Covered Services by name. The gate is the service, not the edition you bought. Published sources disagree on the specifics, so request the current document from Salesforce and confirm in writing which of your services are in scope.<\\\/span><\\\/p>\"}},{\"@type\":\"Question\",\"name\":\"Is Salesforce GDPR compliant?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p><span style=\\\"font-weight: 400;\\\">Salesforce acts as a data processor and provides the tools: Data Privacy Manager, deletion APIs, consent objects, audit logging. You\\u2019re the controller, responsible for lawful basis, consent records, responding to subject access requests, and defining what erasure means across sandboxes, backups, and integrated systems.<\\\/span><\\\/p>\"}},{\"@type\":\"Question\",\"name\":\"Do I need Salesforce Shield for compliance?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p><span style=\\\"font-weight: 400;\\\">Not strictly; HIPAA and GDPR don\\u2019t require Shield, but it provides platform encryption, Event Monitoring, and Field Audit Trail that satisfy technical safeguards and are much easier to evidence during an audit. For most regulated deployments, it\\u2019s the practical baseline.<\\\/span><\\\/p>\"}},{\"@type\":\"Question\",\"name\":\"Does Salesforce encrypt data by default?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p><span style=\\\"font-weight: 400;\\\">Yes, in transit and at rest at the platform level. Shield Platform Encryption adds field-level encryption with searchability and bring-your-own-key support. Classic Encryption is included but limited to custom text fields and isn\\u2019t searchable.<\\\/span><\\\/p>\"}},{\"@type\":\"Question\",\"name\":\"What is the Salesforce shared responsibility model?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p><span style=\\\"font-weight: 400;\\\">Salesforce secures the platform, infrastructure, network, physical security, and certifications. You secure what you build on it, access control, field-level security in code, consent records, DSAR processes, sandbox data masking, and third-party app assessment. The customer side is the larger half.<\\\/span><\\\/p>\"}},{\"@type\":\"Question\",\"name\":\"Can I store credit card data in Salesforce?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p><span style=\\\"font-weight: 400;\\\">You can, but you shouldn\\u2019t. Storing cardholder data expands your PCI DSS audit scope substantially. Tokenise at the payment gateway and store only the token; that keeps Salesforce out of scope for the most demanding PCI requirements.<\\\/span><\\\/p>\"}},{\"@type\":\"Question\",\"name\":\"Where is my Salesforce data stored?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p><span style=\\\"font-weight: 400;\\\">On the instance your org runs on. With Hyperforce, that can be a specific country\\u2019s cell, which makes data residency a configuration choice. Confirm your org\\u2019s actual location rather than assuming, and note that residency and access restrictions are separate questions.<\\\/span><\\\/p>\"}},{\"@type\":\"Question\",\"name\":\"Do AppExchange apps affect my compliance?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p><span style=\\\"font-weight: 400;\\\">Yes, third-party apps can move regulated data outside Salesforce\\u2019s controlled environment. Each app touching PHI or personal data needs its own agreement and its own security assessment; Salesforce\\u2019s BAA doesn\\u2019t extend to them.<\\\/span><\\\/p>\"}},{\"@type\":\"Question\",\"name\":\"What is the biggest compliance mistake in Salesforce?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"<p><span style=\\\"font-weight: 400;\\\">Assuming the vendor\\u2019s certifications transfer to your org. The second is running Apex and record-triggered Flows in system mode without realising they bypass the sharing model entirely, a genuine exposure route that looks like a development concern rather than a security one.<\\\/span><\\\/p>\"}}]}<\/script>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\r\n\t\t\t\t<\/div>\r\n\t\t\t\t\t\t<\/div>\r\n\t\t\t\t<\/section>\r\n\t\t<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Key Takeaways:\u00a0 Salesforce certifications cover its infrastructure, not your organisation\u2019s compliance obligations. HIPAA coverage depends on named services in your current Business Associate Agreement (BAA). GDPR requires you to manage lawful basis, consent, DSARs, and data erasure. Apex and record-triggered Flows can expose regulated data when system-mode access is unchecked. Data masking, access reviews, audit [&hellip;]<\/p>\n","protected":false},"author":15,"featured_media":23296,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_yoast_wpseo_opengraph-title":"Salesforce Security and Compliance: GDPR, HIPAA, SOC 2, and more","_yoast_wpseo_opengraph-description":"What Salesforce handles for GDPR, HIPAA, and SOC 2 compliance, plus the access controls, data masking, audit trails, and salesforce security settings you must configure.","_yoast_wpseo_opengraph-image":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Security-and-Compliance-1024x576.webp","_yoast_wpseo_twitter-title":"","_yoast_wpseo_twitter-description":"","_yoast_wpseo_twitter-image":"","_wp_applaud_exclude":false,"footnotes":""},"categories":[85],"tags":[2821],"class_list":["post-23285","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-salesforce","tag-salesforce-security"],"featured_image_src":{"landsacpe":["https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Security-and-Compliance-1140x445.webp",1140,445,true],"list":["https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Security-and-Compliance-463x348.webp",463,348,true],"medium":["https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Security-and-Compliance-300x169.webp",300,169,true],"full":["https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Security-and-Compliance.webp",1536,864,false]},"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Salesforce Security and Compliance: GDPR, HIPAA, SOC 2, and more<\/title>\n<meta name=\"description\" content=\"What Salesforce handles for GDPR, HIPAA, and SOC 2 compliance, plus the access controls, data masking, audit trails, and salesforce security settings you must configure.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Salesforce Security and Compliance: GDPR, HIPAA, SOC 2, and more\" \/>\n<meta property=\"og:description\" content=\"What Salesforce handles for GDPR, HIPAA, and SOC 2 compliance, plus the access controls, data masking, audit trails, and salesforce security settings you must configure.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/\" \/>\n<meta property=\"og:site_name\" content=\"Learn About Digital Transformation &amp; Development | DianApps Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-21T08:08:18+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-21T08:11:25+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Security-and-Compliance.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1536\" \/>\n\t<meta property=\"og:image:height\" content=\"864\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Vaibhav Sharma\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Vaibhav Sharma\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Salesforce Security and Compliance: GDPR, HIPAA, SOC 2, and more","description":"What Salesforce handles for GDPR, HIPAA, and SOC 2 compliance, plus the access controls, data masking, audit trails, and salesforce security settings you must configure.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/","og_locale":"en_US","og_type":"article","og_title":"Salesforce Security and Compliance: GDPR, HIPAA, SOC 2, and more","og_description":"What Salesforce handles for GDPR, HIPAA, and SOC 2 compliance, plus the access controls, data masking, audit trails, and salesforce security settings you must configure.","og_url":"https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/","og_site_name":"Learn About Digital Transformation &amp; Development | DianApps Blog","article_published_time":"2026-10-21T08:08:18+00:00","article_modified_time":"2026-10-21T08:11:25+00:00","og_image":[{"width":1536,"height":864,"url":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Security-and-Compliance.webp","type":"image\/webp"}],"author":"Vaibhav Sharma","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Vaibhav Sharma","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/#article","isPartOf":{"@id":"https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/"},"author":{"name":"Vaibhav Sharma","@id":"https:\/\/dianapps.com\/blog\/#\/schema\/person\/e0ee1e2a6cfb8681a3cc69154f8d8bcf"},"headline":"Salesforce Security and Compliance: GDPR, HIPAA, SOC 2, and more","datePublished":"2026-10-21T08:08:18+00:00","dateModified":"2026-10-21T08:11:25+00:00","mainEntityOfPage":{"@id":"https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/"},"wordCount":1762,"commentCount":0,"image":{"@id":"https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/#primaryimage"},"thumbnailUrl":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Security-and-Compliance.webp","keywords":["salesforce security"],"articleSection":["Salesforce"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/","url":"https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/","name":"Salesforce Security and Compliance: GDPR, HIPAA, SOC 2, and more","isPartOf":{"@id":"https:\/\/dianapps.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/#primaryimage"},"image":{"@id":"https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/#primaryimage"},"thumbnailUrl":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Security-and-Compliance.webp","datePublished":"2026-10-21T08:08:18+00:00","dateModified":"2026-10-21T08:11:25+00:00","author":{"@id":"https:\/\/dianapps.com\/blog\/#\/schema\/person\/e0ee1e2a6cfb8681a3cc69154f8d8bcf"},"description":"What Salesforce handles for GDPR, HIPAA, and SOC 2 compliance, plus the access controls, data masking, audit trails, and salesforce security settings you must configure.","breadcrumb":{"@id":"https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/#primaryimage","url":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Security-and-Compliance.webp","contentUrl":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/10\/Salesforce-Security-and-Compliance.webp","width":1536,"height":864,"caption":"Salesforce Security and Compliance: GDPR, HIPAA, SOC 2 and Your Half of It"},{"@type":"BreadcrumbList","@id":"https:\/\/dianapps.com\/blog\/salesforce-security-and-compliance\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/dianapps.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Salesforce Security and Compliance: GDPR, HIPAA, SOC 2, and more"}]},{"@type":"WebSite","@id":"https:\/\/dianapps.com\/blog\/#website","url":"https:\/\/dianapps.com\/blog\/","name":"Learn About Digital Transformation &amp; Development | DianApps Blog","description":"Dianapps","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/dianapps.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/dianapps.com\/blog\/#\/schema\/person\/e0ee1e2a6cfb8681a3cc69154f8d8bcf","name":"Vaibhav Sharma","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/07\/cropped-Vaibhav-Sharma-Salesforce-Specialist-96x96.jpg","url":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/07\/cropped-Vaibhav-Sharma-Salesforce-Specialist-96x96.jpg","contentUrl":"https:\/\/dianapps.com\/blog\/wp-content\/uploads\/2026\/07\/cropped-Vaibhav-Sharma-Salesforce-Specialist-96x96.jpg","caption":"Vaibhav Sharma"},"description":"A Salesforce specialist with over 15 years in the field, Vaibhav Sharma has built his career at the intersection of CRM strategy and enterprise transformation. As the driving force behind Salesforce innovation at DianApps, he architects solutions across Sales Cloud, Service Cloud, and Experience Cloud that turn fragmented customer data into unified growth engines. His work spans a 360-degree perspective in BFSI, healthcare, and retail, where he's known for engineering platforms that don't just go live, they move revenue and retention numbers. Vaibhav's edge lies in reading where Salesforce is headed next, from AI-powered automation, AgentExchange to Agentforce, and translating that foresight into roadmaps enterprise leaders can act on today.","url":"https:\/\/dianapps.com\/blog\/author\/vaibhav-sharma\/"}]}},"_links":{"self":[{"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/posts\/23285","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/comments?post=23285"}],"version-history":[{"count":4,"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/posts\/23285\/revisions"}],"predecessor-version":[{"id":23304,"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/posts\/23285\/revisions\/23304"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/media\/23296"}],"wp:attachment":[{"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/media?parent=23285"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/categories?post=23285"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dianapps.com\/blog\/wp-json\/wp\/v2\/tags?post=23285"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}