GTM Trust Index

Salesforce Agentforce: security & AI-training scorecard

salesforce.com ↗ · CRM AI · Last checked Oct 17, 2026

Does Salesforce Agentforce train AI on customer data?

Unclear
“Zero data retention is a strict policy where the prompts and generated responses are never stored or used to train the underlying third-party large language models”

Note: Commitment covers third-party LLMs. Einstein Platform notices separately state for Einstein Conversation Insights: 'Salesforce employees may access and review submitted Customer Data, including recorded phone calls and related transcripts, for the purposes of improving and training the product.'

SOC 2

Independent audit of security controls. Type II covers operating effectiveness over a period.

Partial / unclear

SOC 2 (type not stated)

“undergoes an independent evaluation in the form of SOC 2.”

Note: From the Einstein Platform (Agentforce) Security, Privacy and Architecture doc; reports available from account executive.

ISO/IEC 27001

Certified information security management system.

Confirmed

Yes

“Salesforce has achieved ISO 27001/27017/27018 certification for its ISMS from an independent third party.”

HIPAA / BAA

Whether the vendor will sign a Business Associate Agreement for PHI.

Unknown

Not verified from vendor-owned sources

Note: Not addressed in the Einstein Platform security doc; Salesforce compliance portal did not render.

No vendor source found as of check date.

GDPR DPA

Data Processing Agreement/Addendum for personal data.

Confirmed

DPA published

Trains AI on customer data

Whether the vendor says it uses customer data to train AI models.

Unclear

Unclear

“Zero data retention is a strict policy where the prompts and generated responses are never stored or used to train the underlying third-party large language models”

Note: Commitment covers third-party LLMs. Einstein Platform notices separately state for Einstein Conversation Insights: 'Salesforce employees may access and review submitted Customer Data, including recorded phone calls and related transcripts, for the purposes of improving and training the product.'

Data retention

What the vendor publishes about how long customer data is kept.

Published

Up to 120 days inactive after termination, then deleted within 120 days

“Customer Data submitted to the Covered Services may remain in inactive status for up to 120 days. After such period, Customer data will be overwritten or deleted within 120 days.”

Subprocessor list

Where the vendor lists third parties that process customer data.

salesforce.com/company/legal/trust-and-compliance-documentation ↗

Note: Infrastructure & Sub-processors documents linked per service.

Trust center

The vendor's security/trust portal.

trust.salesforce.com ↗

All sources checked (6)

Fetched on Oct 17, 2026. Vendor pages can change after this date.

Is this wrong? / Claim this listing

Vendors and readers can send evidence links. Nothing is published without a source.

Send a correction

Informational only, not legal advice or an audit. Summaries reflect Salesforce Agentforce's published pages as of Oct 17, 2026; verify with the vendor. Methodology & disclaimer.