Cloud Protection for Salesforce Privacy Policy

October 2026

In brief

Cloud Protection for Salesforce is a cloud-based security solution that is designed to complement and extend the native security capabilities of the Salesforce platforms. The solution protects organizations against threats posed by files and web links (URLs) uploaded to or shared via the Salesforce cloud and the solution’s Identity Protection feature scans Salesforce user email addresses to detect potential data breaches.

The core privacy aspects of this solution are:

• the focus of data collection is on the customer’s Salesforce organization, not on individuals;
• much of the processed and collected data remains in the customer’s Salesforce organization;
• when data is sent to Security Cloud, it is anonymous to Cloud Protection by design;
• the customer’s Salesforce administrator has access to the data collected in identifiable format.

In full

This privacy policy focuses on the items we believe are the most relevant for you. Such items are in particular:

1. the type of personal and private data that the solution collects,
2. what we use it for,
3. our justification,
4. typical disclosures, and
5. for how long we store it.

More information on such topics as well as on other aspects (data subject rights, contact information, etc.) of the processing of your personal data is also available via the embedded links to our General Privacy Policy.

What data is collected and what it is used for

Content Protection

The solution is composed of a native Salesforce application and Security Cloud.

The Cloud Protection for Salesforce application is installed in the customer’s Salesforce organization. The application inspects all files uploaded and stored as Salesforce Files or Attachments with standard or custom objects in the Salesforce platform. The Cloud Protection for Salesforce application may send a copy of a file of unknown reputation to Security Cloud. Such copy is scanned in Security Cloud and deleted near-instantaneously after the analysis. See the ‘Retention’ section for more information.  

To check the security reputation and classification of web links, the Cloud Protection for Salesforce application sends them to Security Cloud. The application does not send actual message or body texts that contain web links.

Security Cloud is a cloud-based threat analysis and reputation system of WithSecure Corporation that scans data for any malicious or harmful content. Data sent to Security Cloud is always anonymized and cannot be connected to an individual user in any way. For further information please refer to the WithSecure™ Security Cloud whitepaper.

Of the data collected by the scanning activity, the results are made available to the customer’s Salesforce administrators via alerts and scan event logs. The results may include but not limited to:

• User name (given and surname)
• IP address of the network or device of origin for content uploaded to or downloaded from Salesforce
• Timestamp when content was accessed (uploaded or downloaded)
• Name, type, and size of file accessed (uploaded or downloaded)
• Location (name of standard or custom object) that a file is associated with or attached to
• Target web links (URLs) and their categories (e.g. gambling).

The customer’s Salesforce administrator is likely able to link an employee’s identity with the above results provided by the solution. This is necessary so that administrators can react to security issues detected by the solution. Cloud Protection has access to the following data types that may include data that could be personally identifiable: file hash, file name, file size.

The customer’s Salesforce administrator means a person who is granted with the Salesforce admin rights to the customer’s Salesforce organization.

Identity Protection

The Identity Protection feature in the solution scans Salesforce user email addresses to detect potential data breaches. Some personal data may be processed in the Identity Protection feature, namely the email address and related breach data. Such personal data is stored in encrypted form and processed in accordance with the Data Processing Agreement.

By turning on the Identity Protection feature, the customer confirms that their organization as the data controller has a legal basis for processing the personal data of individuals covered by the Identity Protection feature and that the Data Processing Agreement.  

Technical support

If the solution does not work as intended and there are no workarounds for the problem, the customer’s Salesforce administrator may utilize Cloud Protection’s expertise to investigate and resolve issues. In such rare cases, Cloud Protection’s support engineers may log in and access data in the customer’s Salesforce organization remotely via the support tool provided by Salesforce. The remote login access is explicitly granted by the customer’s Salesforce administrator, is always time-limited and is subject to the Data Processing Agreement.

When investigating problems with the solution via remote login access, no data except debug logs relevant to the solution are collected from the customer’s Salesforce organization. Cloud Protection is the controller for such data.

Contact

The contact data of the customer’s contact persons is processed as explained in the General Privacy Policy.

Legal grounds

Cloud Protection acts as a data processor on behalf of the customer when processing personal data that is temporarily stored in the solution’s backend for encryption purposes (URLs and files, if applicable). Cloud Protection also acts as a data processor on behalf of the customer in the Identity Protection feature. When acting as a data processor, the Data Processing Agreement applies.

To the extent that Cloud Protection processes other data in the solution that is identifiable to an individual, Cloud Protection processes such data as an independent controller to safeguard the following legitimate interests:

• providing the solution to secure our customers’ networks and devices as well as the confidentiality and availability of the data therein;
• enabling Cloud Protection to detect emerging threats and security-relevant trends among all of its customers so that our solution can keep on par with evolving threats;
• enabling Cloud Protection to provide a centralized security solution framework across multiple continents to a large number of customers and partners.

The data processing undertaken by the solution is mandatory for the efficient protection of customer data in its Salesforce organization. While the solution’s settings may enable a Salesforce administrator to limit the processing of security data by Cloud Protection, such adjustments are not recommended, as they endanger achieving the above intended purposes of the solution.

Transfers and disclosures

The security data produced by the solution is visible to the customer’s Salesforce administrator for its determined purposes. If the customer has outsourced its Salesforce administration, including the monitoring of this solution, that data may also be available to such outsourcing partner.

Cloud Protection further employs its own affiliates and subcontractors so we can provide our solution globally. The customer can choose whether the customer wants Cloud Protection to use third-party services for the further file analysis by adjusting this in the solution settings. However, Cloud Protection recommends to allow using them, as opting out will impact the quality of the solution’s detection and analysis. Cloud Protection has different regions available for the customer and the list of available regions is visible in the solution settings. The customer can change their region preference at any time.

More information on transfers and disclosures is available in our General Privacy Policy.

Retention

Data controlled by the customer

Results of scanning activity, such as alerts as well as file and URL scanning events, are stored inside the customer’s Salesforce organization depending on the retention intervals configured in the Cloud Protection for Salesforce application. The customer’s Salesforce administrators can delete them at any time and make backups if/as needed.

Data in Cloud Protection environment

Data controlled by Cloud Protection

With default settings, Cloud Protection does not store any customer data.

Anonymized security data and service statistics are stored without a set end date as long as the data is useful for the purpose it was collected for. As an exception, and to protect the confidentiality and privacy of the customer’s file contents, the service automation deletes any contents that are not found to be suspicious near-instantaneously after analysis.

If the customer has granted Cloud Protection a right to collect suspicious files and if the file is deemed suspicious, it will be subjected to further analysis. If the file is deemed as a false positive, it will be deleted after confirmation of such. If the file does contain malware, such sample is stored without a set end date as long as the data is useful for the purpose it was collected for. It is possible to disable storing the file copies via the privacy control settings available in the solution’s settings. 

The other data types (i.e. technical support data, contact information) mentioned above are stored for the duration given in their respective privacy policies, after which they are deleted or anonymized.

Please read our General Privacy Policy for possible exceptions or typical reasons why we may need to deviate from the primary retention rules set out above. 

Data processed by Cloud Protection

The data processed by Cloud Protection as a data processor is deleted near-instantaneously after the analysis.

When the customer activates the Identity Protection feature, the email address and its related breach data are temporarily stored in an encrypted format for a maximum of three days.

Security

We apply strict security measures to protect the confidentiality, integrity, and availability of your personal data when transferring, storing, or processing it.

We use physical, administrative, and technical security measures to reduce the risk of loss, misuse, or unauthorized access, disclosure, or modification of your personal data.

All personal data is stored on secure servers operated by Cloud Protection or our partners with access limited to authorized personnel only.

Your rights

Please read our General Privacy Policy for information on your statutory rights and how to contact us.

General

Please note that this privacy policy will regularly be updated to reflect any changes in the way we handle your personal data or any changes in applicable laws.

This version of the policy clarifies, updates, and replaces the previous version. To continue keeping this document up to date, we will make changes and additions to this from time to time.

More information on definitions and change management is available in our General Privacy Policy.