
Salesforce
- Rank
- Score
- 14/149
- 53 out of 100
Salesforce is an American cloud software company headquartered in San Francisco, founded in 1999 by Marc Benioff and others. It sells customer relationship management software used by sales and service teams, and Agentforce, an agentic AI platform for building autonomous business agents that succeeded Salesforce Einstein.
Is Agentforce safe?
Agentforce scores 53 out of 100 and ranks 14 of 149. Its strongest category is Security, and its weakest category is Transparency.
How is Agentforce scored?
Agentforce is scored out of 100 on Safety (25%), Transparency (25%), Security (25%), and Privacy (25%). See how we score.
Safety framework
Average used24.4This outside rating doesn't cover this company, so the average of the companies it covers is used.
Pre-release testing
0Points for each confirmed yes.
- No
Was the model tested for dangerous capabilities, such as biological, chemical or cyber risks?
Company claim0/50No document found - No
Did an outside organisation test the model before release?
Company claim0/50No document found
Safety test results
Average used74.1This outside rating doesn't cover this company, so the average of the companies it covers is used.
Incident record
Not enough dataProtecting children
50Points for each confirmed yes.
- No
Does the model card report child-safety tests or safeguards?
Company claim0/50No document found - Yes
Does the privacy policy set a minimum age, or say the service is not directed at children?
Company claim50/50“Our websites and services are not directed at children.”
salesforce.com privacy policy (opens in a new tab) · 20 Oct 2026
Model documentation
0Points for each confirmed yes.
- No
Does the model card describe what the model can do?
Company claim0/25No document found - No
Does the model card report test results?
Company claim0/25No document found - No
Does the model card state the model's limitations?
Company claim0/25No document found - No
Does the model card describe safety safeguards?
Company claim0/25No document found
Training-data disclosure
Average used29.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Independent transparency index
Average used40.7This outside rating doesn't cover this company, so the average of the companies it covers is used.
Transparency reports
Average used25This outside rating doesn't cover this company, so the average of the companies it covers is used.
Public safety commitments
0Average of the commitments signed.
- No
Has it signed the EU code of practice for general-purpose AI?
Company claim0/100European Commission (opens in a new tab) · 14 Oct 2026 - No
Did it sign only the safety and security chapter?
Company claim0/50European Commission (opens in a new tab) · 14 Oct 2026 - No
Has it signed the Frontier AI Safety Commitments (Seoul 2024)?
Company claim0/100Frontier AI Safety Commitments (opens in a new tab) · 14 Oct 2026
No problems found in 1 public record. That is not proof.
Security programme and certifications
100Points for each confirmed yes.
- Yes
Is there a way to report security flaws, such as a bug bounty?
Company claim34/34“Slack (bug bounty)”
hackerone.com (opens in a new tab) · 2 Nov 2026 - Yes
Does it state it holds a SOC 2 Type II report?
Company claim33/33“Salesforce is certified under SOC 2 Type II, ISO 27001/27018, and PCI DSS v4.0.1 (Level 1), and supports Salesforce Shield for field-level e…” MoreLess
“Salesforce is certified under SOC 2 Type II, ISO 27001/27018, and PCI DSS v4.0.1 (Level 1), and supports Salesforce Shield for field-level encryption and field audit trail for institutions with heightened governance requirements.”
salesforce.com (opens in a new tab) · 2 Nov 2026 - Yes
Does it state it holds ISO 27001 certification?
Company claim33/33“ISO/IEC 27001:2022 Certificate 2026-10-30”
Software vulnerabilities
70This check counts only when a source covers the company. With no events it holds the pillar, which is not proof of a clean record. Each recorded event takes points off the pillar, and serious or recent ones count most. Allegation checks, regulator actions and open investigations use half the severity load. Known-exploited flaws (CISA list) in the company's official software, last 24 months. A disclosed and fixed flaw does not lower the score.
No events
Independent sourceGitHub Advisory Database (opens in a new tab) · 12 Nov 2026
Data breaches
Not enough dataClear privacy policy
80Points for each confirmed yes.
- Yes
Does the privacy policy say what personal data is collected?
Company claim20/20“This may include identifiers such as contact information, professional or employment-related information, financial account information, com…” MoreLess
“This may include identifiers such as contact information, professional or employment-related information, financial account information, commercial information, visual information such as your image, and internet activity information, among others.”
salesforce.com privacy policy (opens in a new tab) · 20 Oct 2026 - No
Does the privacy policy say whether your data is used to train AI?
Company claim0/20salesforce.com privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say how long data is kept?
Company claim20/20“We may retain your Personal Data for a period of time consistent with the original purpose of collection (see Section 5 above) or as long as…” MoreLess
“We may retain your Personal Data for a period of time consistent with the original purpose of collection (see Section 5 above) or as long as required to fulfill our legal and/or regulatory obligations.”
salesforce.com privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy say who your data is shared with?
Company claim20/20“We may also share aggregated Usage Data with Salesforce’s service providers for the purpose of helping Salesforce in such analysis and impro…” MoreLess
“We may also share aggregated Usage Data with Salesforce’s service providers for the purpose of helping Salesforce in such analysis and improvements.”
salesforce.com privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does the privacy policy explain your privacy rights?
Company claim20/20“Depending on the applicable laws, these rights may include the right to: Access your Personal Data held by us; Know more about how we proces…” MoreLess
“Depending on the applicable laws, these rights may include the right to: Access your Personal Data held by us; Know more about how we process your Personal Data; Rectify inaccurate Personal Data and, taking into account the purpose of processing the Personal Data, ensure it is complete; Erase or delete your Personal Data; Restrict our processing of your Personal Data; Transfer your Personal Data to another controller (data portability), to the extent possible; Object to any processing of your Personal Data; Opt out of certain disclosures of your Personal Data to third parties; Know what categories of Personal Data are shared for delivering advertisements on non Salesforce websites, applications, and services and the categories of recipients of such Personal Data; Opt out of the sharing of your Personal Data for delivering advertisements on non-Salesforce websites, applications, and services; If you’re under the age of 16, or such other applicable age of consent for privacy purposes in relevant individual jurisdictions, opt in to certain disclosures of your Personal Data to third parties; Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects (“automated decision-making”); Withdraw your consent at any time (to the extent we rely on consent as our legal basis for processing); Complain about the use of your Personal Data; Not be discriminated against for exercising your rights as described above; and Appeal our refusal to act upon your request to exercise a right relating to your Personal Data by following the steps provided in response to your inquiry.”
salesforce.com privacy policy (opens in a new tab) · 20 Oct 2026
Training-data defaults
100100 if training is opt-in only, 50 if you can opt out, 0 if neither.
- Yes
Is your data used for training only if you opt in?
Company claim100/100“To the extent that Salesforce decides to train generative AI models on Customer Data in the future, the Product Terms (available in the Prod…” MoreLess
“To the extent that Salesforce decides to train generative AI models on Customer Data in the future, the Product Terms (available in the Product Terms Directory) applicable to products that a Customer may have purchased on an Order Form expressly require Customers to opt-in to such training.”
salesforce.com privacy FAQ (opens in a new tab) · 2 Nov 2026 - No
Can you stop your data being used for training?
Company claim0/50salesforce.com privacy policy (opens in a new tab) · 20 Oct 2026
Export and delete your data
100Points for each confirmed yes.
- Yes
Can you get a copy of your data?
Company claim50/50“Depending on the applicable laws, these rights may include the right to: Access your Personal Data held by us; Know more about how we proces…” MoreLess
“Depending on the applicable laws, these rights may include the right to: Access your Personal Data held by us; Know more about how we process your Personal Data; Rectify inaccurate Personal Data and, taking into account the purpose of processing the Personal Data, ensure it is complete; Erase or delete your Personal Data; Restrict our processing of your Personal Data; Transfer your Personal Data to another controller (data portability), to the extent possible; Object to any processing of your Personal Data; Opt out of certain disclosures of your Personal Data to third parties; Know what categories of Personal Data are shared for delivering advertisements on non Salesforce websites, applications, and services and the categories of recipients of such Personal Data; Opt out of the sharing of your Personal Data for delivering advertisements on non-Salesforce websites, applications, and services; If you’re under the age of 16, or such other applicable age of consent for privacy purposes in relevant individual jurisdictions, opt in to certain disclosures of your Personal Data to third parties; Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects (“automated decision-making”); Withdraw your consent at any time (to the extent we rely on consent as our legal basis for processing); Complain about the use of your Personal Data; Not be discriminated against for exercising your rights as described above; and Appeal our refusal to act upon your request to exercise a right relating to your Personal Data by following the steps provided in response to your inquiry.”
salesforce.com privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Can you delete your data?
Company claim50/50“Depending on the applicable laws, these rights may include the right to: Access your Personal Data held by us; Know more about how we proces…” MoreLess
“Depending on the applicable laws, these rights may include the right to: Access your Personal Data held by us; Know more about how we process your Personal Data; Rectify inaccurate Personal Data and, taking into account the purpose of processing the Personal Data, ensure it is complete; Erase or delete your Personal Data; Restrict our processing of your Personal Data; Transfer your Personal Data to another controller (data portability), to the extent possible; Object to any processing of your Personal Data; Opt out of certain disclosures of your Personal Data to third parties; Know what categories of Personal Data are shared for delivering advertisements on non Salesforce websites, applications, and services and the categories of recipients of such Personal Data; Opt out of the sharing of your Personal Data for delivering advertisements on non-Salesforce websites, applications, and services; If you’re under the age of 16, or such other applicable age of consent for privacy purposes in relevant individual jurisdictions, opt in to certain disclosures of your Personal Data to third parties; Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects (“automated decision-making”); Withdraw your consent at any time (to the extent we rely on consent as our legal basis for processing); Complain about the use of your Personal Data; Not be discriminated against for exercising your rights as described above; and Appeal our refusal to act upon your request to exercise a right relating to your Personal Data by following the steps provided in response to your inquiry.”
salesforce.com privacy policy (opens in a new tab) · 20 Oct 2026
Privacy fines
Not enough dataIndependent privacy ratings
Average used52.9This outside rating doesn't cover this company, so the average of the companies it covers is used.
Risk governance
Average used26.6This outside rating doesn't cover this company, so the average of the companies it covers is used.
Regulator actions
Not enough dataCourt judgments
Not enough dataPrivacy contact and complaints
100Points for each confirmed yes.
- Yes
Is there a privacy contact, such as an email or a data protection officer?
Company claim50/50“To exercise your rights regarding your Personal Data, or if you have questions regarding this Privacy Statement or our privacy practices ple…” MoreLess
“To exercise your rights regarding your Personal Data, or if you have questions regarding this Privacy Statement or our privacy practices please fill out this form, email us at privacy@salesforce.com, call us at +1-800-931-7365, or write to us at: Salesforce Data Protection Officer (Salesforce Privacy Team) 415 Mission St, 3rd Floor San Francisco, CA 94105, USA When you contact us, please indicate in which country and/or state you reside.”
salesforce.com privacy policy (opens in a new tab) · 20 Oct 2026 - Yes
Does it tell you that you can complain to a regulator?
Company claim50/50“If, however, you believe that we have not been able to assist with your complaint or concern, and you are located in the European Economic A…” MoreLess
“If, however, you believe that we have not been able to assist with your complaint or concern, and you are located in the European Economic Area or the United Kingdom, you have the right to lodge a complaint with the competent supervisory authority.”
salesforce.com privacy policy (opens in a new tab) · 20 Oct 2026
Score history
Newest first. Only days when the score changed are listed.
2 Nov 2026
Score 53
Method 2 Nov 2026
+16 · Method update and new evidence
23 Oct 2026
Score 37
Method 21 Oct 2026
+2
21 Oct 2026
Score 35
Method 21 Oct 2026
-2
20 Oct 2026
Score 37
Method Not recorded
-