Skip to main content
Skip to main content

Salesforce SOC 2 & FedRAMP Compliance Assessment

Before you share customer data with Salesforce, your compliance team needs documented proof they can be trusted. ThirdProof investigated Salesforce across 27 intelligence sources — here's what we found.

✓ FedRAMP Status: Authorized (Moderate) — verified against marketplace.fedramp.gov

Risk Tier
Tier 2High Risk
SOC 2
— Not Found
FedRAMP
✓ Authorized
Last Assessed
Mar 5, 2026
🟢IP Reputation: Abuse score: 0%, 0 reports🟡SSL/TLS: TLSv1.3🟢Domain Age: 27.4 years🟢Infrastructure: 2 open ports, 0 CVEs
FedRAMP Status
Salesforce is listed on the FedRAMP Marketplace as Authorized (Moderate) as of March 2026.
SOC 2 Status
Salesforce has not had a SOC 2 claim detected on their trust page.
Sanctions Screening
Salesforce returned no matches in OFAC SDN, EU Consolidated, and UN sanctions screening.
Risk Tier
ThirdProof assigned Salesforce a Moderate Risk tier with 100% confidence across 27 intelligence sources.

22 sources queried. 82% confidence. Every Salesforce investigation produces both a risk report and an auto-filled security questionnaire — no vendor follow-up required.

Get Salesforce's Full Report Free →
5 free investigations|Risk report + auto-filled questionnaire|Avg. 7 minutes

Certification & Compliance Status

Need a complete vendor security questionnaire?

Run a full ThirdProof investigation to get 133 security questions auto-filled with source evidence — ready for your next audit or vendor onboarding review.

Get Salesforce's Full Report Free →
FedRAMP Authorized (Moderate)

Verified against FedRAMP Marketplace API as of March 2026

Verified against the official FedRAMP Marketplace API as of March 2026.

Salesforce Government Cloud authorized at Moderate impact level.

27 data sources queried per assessment
Reports generated in an average of 7 minutes
SHA-256 verified for audit integrity
Deterministic risk scoring — no AI guesswork
2Tier

High Risk

Salesforce

Vendor Risk Assessment

Confidence Score82%

Based on data availability and source coverage

22

Sources Queried

20

Sources With Data

March 5, 2026

Last Assessed

Executive Summary

AI-generated analysis for Salesforce

Salesforce (salesforce.com) is a globally recognized enterprise SaaS platform with a 27-year domain history, clean malware and threat reputation across 94 security engines, and strong SSL/TLS configuration (A+).

Area Requiring Attention

However, the vendor carries a significant adverse media burden: multiple credible sources document a series of security incidents in the 2025–2026 timeframe, including unauthorized data access via compromised third-party OAuth integrations, extortion demands related to alleged data leaks, downstream breaches affecting major enterprise customers, and a $25M regulatory fine imposed by South Korean authorities. These incidents collectively represent meaningful risk to organizations sharing medium-sensitivity data with the platform. The rule engine has assigned a Tier 2 (High Risk) rating with 82% confidence, reflecting the weight of documented incident activity against an otherwise strong technical security posture. Procurement teams should treat this as a conditional engagement requiring active contractual and monitoring controls.

Independence Statement

All evidence in this report was independently sourced from external data providers, public registries, and open-source intelligence without vendor participation or review.

Investigation Findings

6 findings identified for Salesforce

2 critical1 high3 medium
critical

HTTP Security Grade: F

salesforce.com received a failing grade (F) from Mozilla HTTP Observatory. This indicates serious HTTP security configuration issues.

critical

Critical Adverse Media: data leak

8 recent article(s) reference critical security or regulatory issues for "Salesforce": "Cybersecurity News: Salesforce data leak, SimonMed breach, Chipmaker vs. Dutch g..." (CISO Series); "Salesforce Security Incident: Unauthorized Data Access via Compromised Gainsight..." (Rescana); "Cyber gang demands billion to prevent Salesforce data leak" (Techzine Global)

high

Adverse Media: breach

24 article(s) reference significant concerns for "Salesforce": "South Korea slaps $25M fine on Dior, Louis Vuitton, Tiffany over Salesforce brea..." (Security Affairs); "Token Hijack: The Drift-Salesforce Breach that Shook SaaS" (KELA Cyber Threat Intelligence); "Lessons from the Salesforce breach" (InfoWorld)

medium

Sanctions Screening Unavailable

A critical data source was unavailable during this investigation. Manual verification is recommended.

medium

Missing Security Headers

salesforce.com is missing 2 recommended security headers: Content-Security-Policy, X-Frame-Options.

medium

Multiple Certificate Issuers (37)

salesforce.com has certificates from 37 different Certificate Authorities. This may indicate inconsistent certificate management practices.

Security Strengths

21 positive signals verified

Legal Entity Actively Registered

Business Registration

No Adverse Media Signals

Adverse Media Scan (Fallback)

Firmographic Data Available

Company Intelligence

Valid SSL Certificate

Domain Analysis

2 Open Ports Detected

Infrastructure Exposure

Established Domain (27+ years)

Domain Registration

Clean Domain Reputation

Threat Intelligence

Well-Known Domain

Threat Intelligence

Tech Community Discussion: security incident

Tech Community Sentiment

Tech Community Discussion: legal

Tech Community Sentiment

SSL/TLS Grade: A+

SSL/TLS Analysis

Large Certificate Footprint (1157 subdomains)

Certificate Transparency

Established Web Presence (26+ years)

Web Archive History

Domain in 46 Threat Intelligence Pulses

Threat Intelligence (OTX)

Clean IP Reputation

IP Reputation

Clean Safe Browsing Status

Malware & Phishing Check

Clean Website Scan

Website Security Scan

Certification Claimed: GDPR

Trust & Compliance Page Scan

Subprocessor Page Found, No Entries Parsed

Supply Chain & Subprocessor Discovery

Not Found as FDIC-Insured Institution

FDIC Institution Check

No SEC Enforcement Filings Found

SEC Filing Search

Recommended Actions

Steps to address findings for Salesforce

  1. 1

    Obtain Salesforce's incident advisory communications for the Gainsight OAuth breach (November 2025) and the September–October 2025 breach cluster — contact your Salesforce account executive and request written confirmation of whether your organization's data or integration configurations were within the affected scope. Target completion: within 10 business days.

  2. 2

    Request Salesforce's current SOC 2 Type II report directly from your account team or via trust.salesforce.com. Ask specifically for the report covering the most recent 12-month audit period and request the bridge letter if the report is older than 6 months. Target completion: prior to contract renewal or within 30 days.

  3. 3

    Subscribe to Salesforce Trust status notifications for your specific instance pod at trust.salesforce.com — this provides real-time incident and maintenance alerts. Assign a named internal owner to monitor these alerts. Complete within 5 business days.

  4. 4

    Resolve the sanctions screening gap by manually verifying Salesforce, Inc. (the U.S. parent entity) against the OFAC SDN List and EU Consolidated Sanctions List. Use the OFAC sanctions search at home.treasury.gov/policy-issues/financial-sanctions/specially-designated-nationals-list-data-formats-data-schemas. Target completion: within 5 business days.

  5. 5

    Request Salesforce's published subprocessor list in a structured format (CSV or PDF) directly from your account team, since the automated scan could not parse their subprocessor page. Review subprocessors for any entities operating in sanctioned jurisdictions or with known security concerns. Target completion: within 30 days.

  6. 6

    Document complementary user entity controls (CUECs) applicable to your Salesforce deployment — including access provisioning/deprovisioning controls, session timeout policies, OAuth integration governance, and data export/deletion procedures — and include these in your SOC 2 control documentation if Salesforce is within your audit boundary.

Intelligence Sources Queried

22 sources in this assessment

20of 22 sources returned data
IP Reputation
Threat Intelligence (OTX)
Certificate Transparency
Domain Analysis
FDIC Institution Check
Business Registration
Historical Media Search
Tech Community Sentiment
Company Intelligence
Adverse Media Scan (Fallback)
HTTP Security Scan
Malware & Phishing Check
SEC Filing Search
Infrastructure Exposure
SSL/TLS Analysis
Trust & Compliance Page Scan
Website Security Scan
Threat Intelligence
Web Archive History
Domain Registration
Sanctions & Watchlist Screening
Supply Chain & Subprocessor Discovery

Data Coverage Notes

Some data sources may have had limited availability during this assessment. This does not reflect negatively on the vendor.

  • Sanctions and watchlist screening was unavailable during this investigation. Manual verification against OFAC, EU, and UN sanctions lists is recommended as a compensating control.
  • The subprocessor page at salesforce.com was located but no structured subprocessor entries could be parsed due to a non-standard page format. The full subprocessor chain could not be assessed for this report.
  • External cyber risk scoring data was not available for this investigation, preventing a quantitative comparison against the SaaS industry benchmark score.
  • The automated trust page scan did not surface SOC 2 Type II, ISO 27001, or FedRAMP certification evidence. This is likely a scan coverage limitation rather than an indication that these certifications are not held — direct vendor confirmation is required.
  • The Google News adverse media dataset included 21 articles whose severity was adjusted for age, indicating the full scope of incident reporting may extend beyond the 12-month primary window. Older incidents were weighted down by the rule engine but may still carry residual contractual or reputational relevance.
183+
Vendors assessed
98%
Average confidence
<2 min
Time to report
What a ThirdProof assessment covers

Sanctions Screening

Is Salesforce on any OFAC, EU, or UN sanctions list? Are any officers or affiliates flagged?

Cyber Risk Assessment

What is Salesforce's security posture? Threat intelligence scanning, known vulnerabilities, and security header analysis.

Business Registration

Is Salesforce a legitimately registered business entity? Corporate status, jurisdiction, and officer verification.

Adverse Media Analysis

Has Salesforce appeared in negative news coverage? Data breaches, lawsuits, regulatory actions, and complaints.

Domain & Infrastructure

Is Salesforce's website secure? TLS configuration, DNS hygiene, security headers, and domain age analysis.

Company Intelligence

What are Salesforce's firmographics? Employee count, industry classification, technology stack, and corporate structure.

Trust & Compliance Verification

Does Salesforce claim SOC 2, ISO 27001, HITRUST, or FedRAMP? ThirdProof scans trust pages for certification claims and cross-references the FedRAMP public registry for independent verification.

Supply Chain & Subprocessor Discovery

Who does Salesforce depend on? ThirdProof discovers subprocessors from vendor-published pages and runs sanctions screening and safe browsing checks against each one.

Regulatory & Financial Filings

Has Salesforce appeared in SEC enforcement filings? Is it associated with any FDIC bank failures? ThirdProof searches regulatory databases with entity verification to confirm attribution.

Full methodology, rule engine, and AI disclosure: /methodology

Salesforce Compliance and Certification Status

Salesforce claims SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, FedRAMP (Government Cloud), HIPAA (Health Cloud), and PCI DSS compliance. Salesforce Government Cloud holds FedRAMP Moderate authorization on marketplace.fedramp.gov. Given Salesforce's scale and the number of product families, organizations should verify that their specific clouds and connected apps fall within each relevant certification's scope.

Salesforce Security Posture and Recent Incidents

ThirdProof investigated Salesforce across 27 intelligence sources and assigned a High Risk (Tier 2) rating with 82% confidence. Historical media search identified critical adverse media related to the 2025 Gainsight OAuth and Drift-Salesforce token compromise incidents. Current threat intelligence is clean, SSL/TLS grade is A+, and sanctions screening is clear. The Tier 2 rating is driven by the scale and recency of supply-chain incidents affecting Salesforce customer data via connected apps — review the full report to understand whether your specific connected apps were affected.

Seeing this in an audit? ThirdProof lets you investigate Salesforce and every other vendor in your stack — average report time: 7 minutes. Get Salesforce's Full Report Free →

Frequently asked about Salesforce

Is Salesforce FedRAMP authorized?+
Yes, Salesforce holds FedRAMP Moderate authorization as of April 2026.
Does Salesforce have SOC 2 Type II?+
No SOC 2 found. Salesforce rated Moderate Risk — breach history in media. See all 6 findings →
Is Salesforce on the OFAC sanctions list?+
Salesforce returned no matches in ThirdProof's OFAC SDN, EU Consolidated, and UN sanctions screening as of April 2026.
What is Salesforce's vendor risk tier?+
ThirdProof assigned Salesforce a risk tier of Moderate Risk with 100% confidence based on assessment across 27 intelligence sources as of April 2026.
Is Salesforce SOC 2 certified?+
Salesforce claims SOC 2 Type II certification. Request the current SOC 2 Type II report (issued within the last 12 months) from trust.salesforce.com or your Salesforce account team. Salesforce operates multiple clouds (Sales Cloud, Service Cloud, Marketing Cloud, Commerce Cloud) — confirm the SOC 2 scope covers the specific products your organization uses.
Has Salesforce had a data breach?+
ThirdProof's assessment flagged critical adverse media in historical archives, including the September–November 2025 Gainsight OAuth token compromise and Drift-Salesforce token hijack incidents. These supply-chain incidents affected Salesforce customer orgs via connected applications. Request Salesforce's post-incident Root Cause Analysis documentation and confirm which connected apps in your org were affected.
Does Salesforce support HIPAA?+
Salesforce Health Cloud and specific Salesforce offerings support HIPAA compliance with a Business Associate Agreement (BAA). Standard Salesforce products do not include HIPAA coverage by default. Covered entities should execute a BAA with Salesforce for the specific products in use and confirm the BAA scope covers all PHI workflows before production use.
Can I get an auto-filled security questionnaire for Salesforce?+
Yes. Every ThirdProof investigation of Salesforce produces two deliverables: an audit-ready risk report and a 133-question security questionnaire pre-filled with evidence from 27 independent sources. The questionnaire is mapped to SIG, SOC 2, HIPAA, PCI DSS and 9 other frameworks — answered without sending Salesforce a single email or waiting for a vendor response.
Is Salesforce safe to use as a vendor?+
Salesforce is a CRM vendor that handles customer PII and communication records. Safety depends on their current security posture, certification status, and how they handle your specific data. ThirdProof automates this evaluation across 27 intelligence sources — sanctions databases (OFAC, EU, UN), business registration verification, adverse media scanning, and cyber risk assessment — producing a deterministic risk tier with confidence score plus an auto-filled security questionnaire. Run a free investigation to see Salesforce's full risk profile.
Does Salesforce have SOC 2 certification?+
No SOC 2 found. Salesforce rated Moderate Risk — breach history in media. See all 6 findings →
Has Salesforce had any data breaches?+
Data breach history is an important signal for any vendor, particularly CRM platforms like Salesforce that handle customer PII and communication records. ThirdProof's adverse media analysis searches multiple news APIs and public records for data breaches, security incidents, lawsuits, regulatory enforcement actions, and financial distress signals. Each finding is linked to its original source with severity classification.
Is Salesforce on any sanctions lists?+
Sanctions screening is standard due diligence for CRM vendors. ThirdProof screens Salesforce against OFAC SDN, consolidated international sanctions lists, and PEP databases. The screening uses entity name verification to reduce false positives. If Salesforce or any associated officers appear on a sanctions list, this triggers automatic escalation to the highest risk tier.
How do I assess Salesforce for vendor risk?+
Assessing Salesforce as a CRM vendor involves verifying SOC 2 Type II and GDPR compliance, reviewing their subprocessor chain, and checking sanctions exposure. ThirdProof automates this across 27 intelligence sources in an average of 7 minutes — no questionnaires or vendor participation required. Your first 5 investigations are free.
How long does a ThirdProof assessment take?+
A ThirdProof assessment completes in an average of 7 minutes. 27 intelligence sources are queried in parallel — sanctions databases, business registries, threat intelligence feeds, certificate transparency logs, and more. The result is a deterministic risk tier with confidence score and audit-ready PDF report.
Is ThirdProof free?+
ThirdProof offers 5 free vendor assessments with no credit card required. Each assessment includes the full report — risk tier, confidence score, individual findings, executive summary, and PDF export. Paid plans start at $399/month for teams that need ongoing vendor monitoring.
Can I use a ThirdProof report as SOC 2 audit evidence?+
Yes. ThirdProof reports are designed to satisfy SOC 2 CC9.2 (vendor risk management) requirements. Each report includes SHA-256 integrity verification, methodology disclosure, source attribution for every finding, and AI content labeling. Auditors can independently verify the report's authenticity and trace each finding to its original source.
How is ThirdProof different from a security questionnaire?+
Security questionnaires require vendor participation, take weeks, and produce self-reported answers. ThirdProof queries 27 independent intelligence sources — no vendor involvement needed. Risk tiers are assigned by a deterministic rules engine (not AI opinion), and every finding links to its original source. You get an audit-ready report in an average of 7 minutes instead of waiting weeks for a questionnaire response.

Salesforce is in your vendor stack. Can you prove you assessed them?

SOC 2 CC9.2, HIPAA, PCI-DSS, and CMMC all require documented vendor due diligence — not just knowing the answer, but having audit-ready evidence you verified it. Most compliance teams can't produce that documentation on demand.

ThirdProof investigates Salesforce across 27 intelligence sources in an average of 7 minutes — sanctions screening, cyber posture, SOC 2 verification, FedRAMP status, and more. Every investigation produces two deliverables: an audit-ready risk report and an auto-filled security questionnaire your prospects and auditors expect to see.

✓ 5 free investigations✓ Risk report + auto-filled questionnaire✓ No credit card required✓ Average report time: 7 minutes

Replaces $600–$900 in manual compliance consulting time per vendor assessed.