REDA AI over MCP is live: your configured agents, inside Claude. Explore the connection →
White paper · Security

AI security in Salesforce

Risks, architecture and the questions buyers should ask.

Where information goes, what your team can control and what needs evidence before approval.

Get the white paper

What you’ll take away

  • A data-flow and responsibility framework
  • Questions about providers and information handling
  • A control-verification matrix

Written for Business and operations leaders, together with their Salesforce administrator, security reviewer and procurement team.

PDF guide companion worksheet · English

Explore what’s inside
Your copy, ready to explore

Get the white paper.

Fill in your details once to download this guide and explore all our white papers during this visit. All fields are required.

We’ll use your details to record your request and follow up about this topic. This does not subscribe you to a newsletter. Privacy policy

This form uses Google reCAPTCHA, which connects to Google when the form loads. Privacy · Terms

Complete the security check, then continue to your downloads.

A practical starting point

Follow the information

Security is more than asking whether data leaves Salesforce. For a workflow using an external model, identify the content it receives, the provider's terms, the identity performing the work and the actions that can follow. This guide separates those questions so your team can ask for evidence at the right boundary.

Draw one request from the person or event that starts it through Salesforce, the AI provider and any connected assistant. Distinguish processing, retention and training: they are different questions. Review the terms that apply to the actual service and account, rather than relying on a general statement about an AI brand.

Distinguish guidance from enforcement

An instruction tells a model how it should behave. It is not an access control. Identify the identity, permissions, tool restrictions and any approval step that actually govern a specific operation. Being allowed to read information does not settle where that information may subsequently be sent.

Ask for evidence you can interpret

Use synthetic information and restricted identities when planning acceptance tests. Check allowed work and denied work, then record the exact route, expected result and evidence. A log entry, an absent entry or two reviewers agreeing is not sufficient on its own to establish that a control worked.

Inside the guide

From the question
to a decision you can explain.

Practical frameworks, worked examples and a companion worksheet to bring into your own evaluation.

  1. A data-flow and responsibility framework

  2. Questions about providers and information handling

  3. A control-verification matrix

  4. A supplier questionnaire and proposed test approach

Put the questions to REDA AI

See how this connects to the platform.

Use REDA AI's governance information to examine the architecture, channel-specific access, spending controls and available records. The guide is a decision aid, not a security certification.

Review data handling and controls
White papers & practical guides
Explore all white papers