How We Protect Our Data as Customer Zero

Key Takeaways

• By acting as “Customer Zero,” Salesforce proactively hardens its own products by deploying them across massive internal orgs.
• Transitioning from manual data management to automated tools saved 2,000 hours of manual work annually in one org and reduced the time needed to secure sandbox data by 66%.
• Utilizing automated archiving and masking tools successfully offloaded over 1 billion records, significantly improving org performance and mitigating long-term data risk.

At Salesforce, our ‘Customer Zero’ philosophy serves a dual purpose: it helps us to stress-test our products under the same scale and complexity our largest customers face, while allowing us to experience the benefits of our own solutions firsthand.

Here’s an inside look at how we deploy our Trusted Services products to protect our data across three critical pillars: security, compliance, and resilience.

Data Security

Our data security strategy focuses on mitigating threats and proactively monitoring our data across our enterprise.

Security Center

Security Center allows admins to manage security controls and track our security posture in a single view. It helps simplify security management, automate risk assessments, and uses Agentforce to detect atypical user activity.

As Customer Zero: We rely on Security Center to achieve impactful visibility across 15 internal Salesforce orgs (and counting). In our largest org alone, which houses 90,000 active users, our internal teams rely on Agentforce in Security Center to surface related reports and API anomalies into a single investigation.

Salesforce Shield

Shield provides comprehensive security for critical data by combining four solutions into one: Event Monitoring, Platform Encryption, Field Audit Trail, and Data Detect.

As Customer Zero: We employ the full Shield suite to enforce best-in-class security practices. We use Field Audit Trail to maintain a 10-year forensic history of field changes to meet strict governance mandates. Event Monitoring tracks anomalies, bulk data access, and API usage using AI-powered threat detection. Platform Encryption encrypts data at rest, including Customer-Managed Keys, while Data Detect scans up to 100 objects simultaneously to locate and classify sensitive fields, both structured and unstructured.

Data Compliance

Navigating privacy regulations and managing sensitive data requires precision tools that simplify privacy management.

Data Mask

Data Mask allows developers to build with realistic, but not real, data by replacing, anonymizing, or deleting sensitive information based on privacy needs.

As Customer Zero: We deploy Data Mask to obfuscate Personally Identifiable Information (PII) and sensitive records immediately after sandbox creation, ensuring privacy before the data is used in user acceptance testing (UAT). Implementing this end-to-end masking process has reduced the time to secure sandbox data by 66%.

Privacy Center

Privacy Center automates data privacy management by anonymizing sensitive data, deleting unnecessary records, and streamlining customer consent and privacy requests like the Right to be Forgotten.

As Customer Zero: We use Privacy Center for precision data management across our most complex environments. By streamlining sophisticated data architectures without impacting daily operations, we executed a global data optimization initiative. This freed up 1.3 TB of storage and returned 2,000 hours of operational capacity annually to our team in a single org.

Data Resilience

To future-proof our architecture, we must ensure our data remains relevant, reliable, and scalable.

Backup & Recover

Backup & Recover protects data with comprehensive, automated daily backups of critical data, metadata, and sandboxes, while providing precise, swift restoration.

As Customer Zero: We manage high volumes of data with Backup & Recover to accelerate development cycles and improve release quality through sandbox seeding. Crucially, our teams use metadata backups to run compare jobs between production environments and sandboxes, which eliminates hours of manual debugging per dev cycle by pinpointing exactly what is out of sync.

Salesforce Archive

Archive removes inactive data to improve overall org performance without consuming org storage. Users can monitor storage consumption, create custom retention policies, and securely view archived data.

As Customer Zero: Within our main org, “Org62,” we stress-tested the Archive solution at enterprise scale. Through automated, recurring policies, we offloaded and secured 2.3 TB of sample data (representing over 1 billion records), which significantly reduced our technical debt and mitigated long-term data risk.

Lessons Learned as Customer Zero

By using our own products, we can vet them at scale while keeping our data secure. Here are a few key lessons we’ve learned along the way:

• Divide and conquer for large-scale data masking: For high-volume orgs, running separate, object-specific masking templates is far more effective than trying to rely on one massive template.
• Upfront data hygiene saves significant time later: Replacing manual data removal processes with automated tools can save your teams thousands of hours down the line.
• Stress testing our solutions at scale helps harden our products: Embracing the “art of the possible” allows us to identify and preemptively address emerging risks before they manifest.

Ready to see these solutions in action? Check out our Trusted Services demo to learn how you can secure, manage, and future-proof your own data.