AI Vendor Security & Compliance Brief

Salesforce Einstein GPT logo Salesforce Einstein GPT

Independent due-diligence summary · every fact links to the vendor's official source
7 source-cited facts
0 independently verified certs
9 legal documents tracked
Generated 2026-07-03
89/100
AI Governance Readiness

Enterprise-Ready

This vendor is rated Enterprise-Ready with a score of 89 out of 100. Strong evidence includes confirmed SOC 2 and ISO certifications (FEDRAMP HIGH, HIPAA, ISO 27001, ISO 27017) available via the vendor's trust portal. A material gap is the absence of a security.txt vulnerability disclosure policy. The buyer should request the audit report for the confirmed certifications and inquire about the vendor's vulnerability disclosure process.

Summarized strictly from the source-cited facts below — no outside information. Verify each point against its linked source.

Readiness Breakdown deterministic · evidence-only

  • Independent Certification SOC 2 / ISO certifications confirmed via the vendor's trust portal (FEDRAMP HIGH, HIPAA, ISO 27001, ISO 27017). Audit report available under NDA — standard enterprise practice.
  • Vendor-Stated Compliance Vendor states (cited, not independently audited): BAA Available (HIPAA), GDPR, HIPAA, ISO 27001, SOC 2.
  • Customer-Data Training Enterprise terms: does NOT train on customer data (consumer/free tiers may differ — see breakdown).
  • Data Processing Agreement A Data Processing Agreement is published and tracked.
  • Breach History No known breaches in Have I Been Pwned.
  • Vulnerability Exposure No product identity match in vulnerability databases — not assessed.
  • Email Spoofing Protection (DMARC) DMARC enforced — domain spoofing mitigated.
  • Vulnerability Disclosure Policy No security.txt vulnerability disclosure policy found.
  • Web TLS Certificate Valid TLS certificate in place.
  • Legal Transparency 9 legal/policy documents publicly tracked.
Score is normalized over assessed components only — “unknown” items are shown but never silently counted against the vendor.

Ask This in Your Security Review 2 open items

  • Vulnerability ExposureRequest the remediation timeline / patch status for known CVEs (and any KEV-listed items).
  • Vulnerability Disclosure PolicyConfirm a coordinated vulnerability disclosure / security.txt contact.

Compliance Posture vendor-stated · cited

FrameworkStatusSource
BAA Available (HIPAA) Stated by vendor https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/Agreements/data-processing-addendum.pdf
GDPR Stated by vendor https://www.salesforce.com/company/privacy/
HIPAA Stated by vendor https://www.salesforce.com/company/privacy/
ISO 27001 Stated by vendor https://compliance.salesforce.com/en
SOC 2 Stated by vendor https://compliance.salesforce.com/en
As published on the vendor's own trust/compliance pages — not independently audited. Independently verified attestations, when available, appear in the certifications section below. Request the underlying report before relying on these.

Data & Contract Facts deterministic · cited

AttributeValueSource
Sub-processors (published list) View document → https://www.salesforce.com/company/legal/trust-and-compliance-documentation/
Trains on Customer Data key clause
Enterprise: does not train Einstein Trust Layer: zero data retention with third-party LLMs (OpenAI/Azure); Salesforce does not use Customer Data to train generative AI models. Future training would require explicit customer opt-in. cited →
see per-tier citations

Security Posture authoritative · cited

Known Vulnerabilities (CVE / CISA KEV) Not applicable
No CVE/CPE software identity is mapped to this hosted service; known-vulnerability tracking does not apply to the service identity assessed here.
Vulnerability Disclosure Policy (security.txt) None found
Queried the authoritative source; no records.
Email Spoofing Protection (DMARC) Protected
DMARC enforced and SPF present — spoofing well mitigated.
Web TLS Certificate Valid
Data Breach History None found
Queried the authoritative source; no records.
Supply-Chain Security (OpenSSF Scorecard) Not applicable
Closed-source service — no public source repository; OpenSSF Scorecard (open-source supply-chain) does not apply.
OFAC Sanctions Screening None found
Queried the authoritative source; no records.
SEC Cyber Incident Disclosures (8-K 1.05) None found
Queried the authoritative source; no records.

Certifications Available Under NDA / Trust Center attested · report gated

CertificationStatusTrust Center
FEDRAMP HIGH Available via Trust Center https://marketplace.fedramp.gov/products/FR1824807631
HIPAA Available via Trust Center https://trust.salesforce.com/
ISO 27001 Available via Trust Center https://compliance.salesforce.com/categories/iso-27001
ISO 27017 Available via Trust Center https://trust.salesforce.com/
ISO 27018 Available via Trust Center https://trust.salesforce.com/
PCI DSS Available via Trust Center https://trust.salesforce.com/
SOC2 TYPE2 Available via Trust Center https://trust.salesforce.com/
An independent audit report exists but is gated behind an NDA or trust-center registration. Request it directly via the vendor's trust center. These count as partial assurance — stronger than a vendor claim, but not an open third-party attestation.

Common compliance questions

Each answer is grounded in the cited evidence above — with an honest "no evidence on file" where nothing is published.

Tracked Legal & Policy Documents

DocumentURL
Baa https://www.salesforce.com/company/legal/business-associate-addendum-restrictions
Dpa https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Agreements/data-processing-addendum.pdf
Msa https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Salesforce_MSA.pdf
Pricing https://www.salesforce.com/pricing/
Privacy https://www.salesforce.com/company/legal/privacy/
Security https://www.salesforce.com/products/secure-ai/
Subprocessors https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/misc/salesforce-infrastructure-and-subprocessors.pdf
Tos https://www.salesforce.com/company/legal/sfdc-website-terms-of-service/
Trust https://trust.salesforce.com/

How to Obtain Non-Public Documents

These documents were not found at a public URL — which is normal. Many are provided on request, only on enterprise plans, or via the vendor's trust portal. Here is where each lives and what to do to get it.

DocumentAvailabilityHow to obtain
Service Level Agreement (SLA) Enterprise tier A formal uptime/support SLA is generally offered only on enterprise/paid plans and attached to the order form. Ask sales for the SLA exhibit or check the enterprise pricing page; the trust center often summarises uptime commitments. Trust center →

Continuous Monitoring change-tracking active

6 legal & policy documents under change-monitoring since 2026-06-11. Baseline captured — future revisions will be flagged.

BaaDpaMsaPrivacySubprocessorsTos

View full Salesforce Einstein GPT change history →

Search the Legal Documents verbatim · cited

Search Salesforce Einstein GPT's captured Terms, DPA, Privacy Policy and sub-processor list. Results are the exact clauses from the source documents, each with a link to where it lives. No summary, no interpretation — just the wording on the record. If nothing matches, we say so rather than guess.

Every result is a verbatim clause pulled straight from the linked source document — nothing is paraphrased or generated.

Monitor Salesforce Einstein GPT — get alerted when this changes

This brief is a point-in-time snapshot. Vendors quietly revise their DPA, sub-processors, certifications and security posture — and disclose new CVEs. Get a priority email the moment Salesforce Einstein GPT changes something that affects your risk. Built for procurement & security teams.

Free. One email per material change. Unsubscribe anytime. No sales spam.
Every data point above is extracted from the vendor's own official trust, security, or legal pages and links to its source. This brief contains no scraped sentiment, forum chatter, or AI-inferred opinion — only verifiable, deterministic facts. Verify each source before procurement decisions.