Rachel Beard, Salesforce security architect, explains the foundational controls Salesforce manages for customers: physical security with 24/7 monitoring, application-layer encryption that separates customer data from metadata, and network encryption with a dedicated incident response team. These controls are tested and audited regularly.
In a world of constant digital threats, how can you be confident that your data is safe? At Salesforce, that confidence is built on a foundation of trust. Welcome to our Trusted Enterprise Security Series. We're going to unpack the concept of shared responsibility at Salesforce and show you how we work together to protect your data. I'm Rachel Beard, a security architect here at Salesforce, and we often talk about security in 3 layers: the foundationals, the configurables, and the enhanceables. In this video, we're starting with the foundationals. These are the powerful security controls that Salesforce manages for you. They're always on, working invisibly in the background to protect your data. Today, we'll dive into what those controls are. When we talk about these invisible security measures, we start at the physical level, the infrastructure layer. This means protecting the very facilities and equipment where your data lives. This includes around-the-clock physical security on-premise, 24/7 monitoring of activities within the building, and advanced measures taken to ensure no improper access to equipment. Next, let's move on to the application tier. With Hyperforce, our public cloud infrastructure, all data storage is encrypted at rest without our customers needing to turn anything on. At Salesforce, we use a metadata-driven architecture model. Our customers' data is stored physically separate from their metadata, and without the metadata to provide context, it's very difficult for anyone to read the raw data. Finally, let's move on to the network tier. Our data gets encrypted in transit. And our networks are under constant surveillance. We're actively identifying, intercepting, and patching threats, and we have a dedicated computer security and incident response team operating 24/7. You can think of them as our digital firefighters. Their sole mission is to detect, contain, and respond to any security incident, keeping you informed and ensuring business continuity. The security measures I unpacked here today are tested and audited routinely. So make sure you take some time to check out our compliance attestations at compliance.salesforce.com. And at the same time, Salesforce is constantly evolving our security architecture in response to the growing complexity of threats. Stay tuned for the rest of this security miniseries, where I'll be joined by one of our security product managers as we unpack the configurables, those out-of-the-box security controls our customers have, as well as our enhanceables, which provide added layers of data protection. Thanks for joining us today, and we'll see you next time.
