Salesforce - Add-ons - Digital Marketplace

Service scope

Software add-on or extension: Yes, but can also be used as a standalone service
What software services is the service an extension to: Salesforce services are all modular and pre-integrated with AI from einstein built-in. Functionality can be expanded as needed. Typically customers extend by adding: Service Cloud for case management, Sales Cloud for CRM and 360degree information view, and Marketing Cloud for engagements and customer journeys. Further information here https://appexchange.salesforce.com/ and https://www.salesforce.com/uk/products/
Cloud deployment model: Public cloud
Service constraints: Key considerations (further detail in our Supplier Terms) As Salesforce is multi-tenant, there are 'governor limits' which prevent resources from being monopolised by any single organisation. NB though these limits exist it's rare for customers to be impacted, and even more unusual for our current Public Sector customers. In the unlikely event of a need to increase, limits can be extended with various add-ons separately listed. Hitting a limit is often a sign of an underlying design flaw. Please make yourself aware of these limits at this link https://developer.salesforce.com/docs/atlas.en-us.210.0.salesforce_app_limits_cheatsheet.meta/salesforce_app_limits_cheatsheet/salesforce_app_limits_features.htm A user’s password may not be shared with any other individual.
System requirements: A standard browser, either desktop or mobile

Connection to the internet

Salesforce mobile app is available if preferred to a browser

User support

Email or online ticketing support: Yes, at extra cost
Support response times: Every Salesforce service includes support as standard. The lowest level relies on the Salesforce user community for responses and has a response time of 2 business days, this can be reduced to 1 hour with the appropriate upgrade in your support plan. https://www.salesforce.com/content/dam/web/en_us/www/cloud-services/documents/premier-success-plans-datasheet.pdf
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: WCAG 2.1 AA or EN 301 549
Phone support: Yes
Phone support availability: 24 hours, 7 days a week
Web chat support: Web chat
Web chat support availability: 24 hours, 7 days a week
Web chat support accessibility standard: WCAG 2.1 AA or EN 301 549
Web chat accessibility testing: Salesforce has not conducted usability studies to verify that the online chat function works effectively with screen reading and other assistive technology. However, the services have been assessed against the WCAG 2.1 standards and existing customers have conducted testing and are using the Salesforce Webchat capability in live services.

Details of our compliance with WCAG 2.1 AA accessibility standards for our web chat products are described in our VPAT statements available here: https://www.salesforce.com/company/legal/508_accessibility/
Onsite support: Yes, at extra cost
Support levels: Salesforce has not conducted usability studies to verify that the online chat function works effectively with screen reading and other assistive technology. However, the services have been assessed against the WCAG 2.1 standards and existing customers have conducted testing and are using the Salesforce Webchat capability in live services.

Details of our compliance with WCAG 2.1 AA accessibility standards for our web chat products are described in our VPAT statements available here: https://www.salesforce.com/company/legal/508_accessibility/
Support available to third parties: Yes

Onboarding and offboarding

Getting started: Salesforce provides an amazing immersive self-learning environment available called “Trailhead” for anyone who would like to have an engaging and interactive way of learning about salesforce. It is an online and free to use learning environment available here: https://trailhead.salesforce.com/ In addition, Salesforce's Customers for Life is designed to help customers be successful and get up and running quickly. A dedicated group is available for new customers to engage by asking questions, giving feedback, and sharing experiences. this also includes 'Getting Started Webinars', 'Getting started resources','Salesforce Tech-lounge for new customers' and 'getting started live Q&A' further detail available at https://www.salesforce.com/success-gettingstarted/
Service documentation: Yes
Documentation formats: HTML

PDF

Other
Other documentation formats: Salesforce also provides free online courses, referred to as 'Trails'

A dedicated website called 'Trailhead' gives access to these 'Trails'

Each designed with a specific purpose and skill in mind.

Further information on Trailhead can be found here

https://trailhead.salesforce.com/en/trails
End-of-contract data extraction: There are a number of options available for customers to extract their data from the service, either during the contract or when the contract ends. We encourage customers to export their data during their contract on a periodic basis to maintain a local copy of their salesforce database, rather than wait until the end of the contract These options include: The Weekly Export Service – export data from the service on a periodic basis via a zip file containing .csv files over a TLS link. Export data over the API via an integration or middleware solution. A comprehensive Salesforce exit strategy paper is available on request.
End-of-contract process: After termination of all subscriptions associated with an environment, Customer Data submitted to the Covered Services is retained in inactive status within the Covered Services for 120 days, after which it is securely overwritten or deleted from production within 90 days, and from backups within 180 days.
Physical media on which Customer Data is stored during the contract term is not removed from the data centers that Salesforce uses to host Customer Data unless the media is at the end of its useful life or being deprovisioned, in which case the media is first sanitized before removal. This process is subject to applicable legal requirements.

Within 30 days post contract termination, customers may request return of their respective Customer Data submitted to the Covered Services. Salesforce shall provide such Customer Data via downloadable files in comma separated value (.csv) format and attachments in their native format.

For more information on Data Deletion period upon contract termination, Please refer ""Deletion of Customer Data"" section of the Security, Privacy and Architecture Documentation for the respective services available on the Trust and Compliance site: https://trust.salesforce.com/en/trust-and-compliance-documentation/

Using the service

Web browser interface: Yes
Supported browsers: Internet Explorer 11

Microsoft Edge

Firefox

Chrome

Safari
Application to install: No
Designed for use on mobile devices: Yes
Differences between the mobile and desktop service: The capability of Salesforce via a browser and on a mobile device, via either a browser or the native Salesforce1 App is broadly similar. However, there are some subtle differences as described here: https://help.salesforce.com/s/articleView?id=sf.limits_mobile_sf1_parent.htm&type=5 Note that the salesforce browser UI can also be accessed on many mobile devices.
Service interface: Yes
User support accessibility: WCAG 2.1 AA or EN 301 549
Description of service interface: The interface is a modern and intuitive design, with help functions throughout. The interface can be configured as required

In the platform, it is easy to modify applications to unique requirements. Use the metadata framework and point-and-click tools, custom user interfaces, modify data models, create and edit application business logic and processes. Configuration to modify objects, fields, validation rules, workflow, security settings, formulas, and more without code.

Some functionality is beyond the constraints of a metadata framework. For such cases, developers can create needed functionality in open-ended development environments, using toolkits for most of the common programming languages, or Apex.
Accessibility standards: WCAG 2.1 AA or EN 301 549
Accessibility testing: Salesforce is committed to providing applications accessible to all. This includes users working with assistive technology, such as speech recognition software and screen readers. Salesforce follows international best practices in Section 508 of the Web Content Accessibility Guidelines and strives to meet WCAG 2.1 Level AA.

A third party has assessed and documented the accessibility status of Salesforce core products in the VPAT documents published here: https://www.salesforce.com/company/legal/508_accessibility.jsp

In addition, Salesforce includes an alternate user interface mode that lets users with assistive devices, such as speech recognition software and screen readers, work with Salesforce more effectively with detail here https://help.salesforce.com/articleView?id=accessibility_mode_enabled.htm&type=0
API: Yes
What users can and can't do using the API: For developers changing the system, two APIs are applicable for managing customizations and for building tools that can manage the metadata model, not the data itself.

The Tooling API is specifically designed to help developers build IDE apps for salesforce, while the metadata API is for more general purpose configuration migration. The metadata API is allows for migrations, , including retrieve, deploy, create, update, or delete customisations for your Salesforce instance amd migrate changes from testing to production; the Tooling API gives developers a platform for debugging, code coverage, auto complete, and more.
API documentation: Yes
API documentation formats: Open API (also known as Swagger)

HTML

PDF
API sandbox or test environment: Yes
Customisation available: Yes
Description of customisation: Point-and-click configuration: The Salesforce platform makes it easy to modify the functionality of Salesforce applications to meet your unique requirements. Working with the metadata framework and a series of simple point-and-click wizards, you can design custom user interfaces and modify the structure of the data model and the application’s business logic. Configuration enables organisations to modify objects, fields, validation rules, workflow, security settings, formulas, and much more without the need for code. Customise with code: Although point-and-click configuration with the Salesforce platform is the fastest and easiest way to customise, some functionality is beyond the constraints of a metadata framework. For such cases, developers can create needed functionality in open-ended development environments, using toolkits for most of the common programming languages, or Apex.

Scaling

Independence of resources: The current daily transaction average for our platform is regularly 6 billion, consistently at sub 250ms response time within the Salesforce environment. Within each logical system, we use load balancers to distribute load among multiple web and application servers for additional scalability and redundancy. The multitenant application design, combined with the fastest servers and high-performance networking infrastructure available, guarantees fast performance.

Analytics

Service usage metrics: Yes
Metrics types: 'The service includes various metrics to monitor usage and adoption of the service, for example, last login, login duration etc.
For Infrastructure detail metrics are available at https://trust.salesforce.com website provides performance and availability information for the entire service.

For specific metric monitoring and for more in-depth detail customers can extend capability through the use of Event Monitoring. For example - which applications are being used, by whom, how are they being used, when, where from and are there performance issues? This data can be used to improve adoption, security and performance of the application.'
Reporting types: API access

Real-time dashboards

Regular reports

Resellers

Supplier type: Reseller providing extra features and support
Organisation whose services are being resold: Salesforce

Staff security

Staff security clearance: Conforms to BS7858:2019
Government security clearance: Up to Security Clearance (SC)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom

European Economic Area (EEA)

Other locations
User control over data storage and processing locations: Yes
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency: At least every 6 months
Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest: Physical access control, complying with CSA CCM v3.0

Physical access control, complying with SSAE-16 / ISAE 3402

Physical access control, complying with another standard

Encryption of all physical media

Scale, obfuscating techniques, or data storage sharding

Other
Other data at rest protection approach: Classic Encryption: native Salesforce application feature which can be used to encrypt specific custom fields. There is no additional cost for this, but it does impact some application functionality. More information here: http://sfdc.co/FieldEncryption Platform Encryption:

Platform Encryption allows customers to encrypt data stored through Salesforce such as: files and attachments, certain standard and custom fields, and use an advanced key management system. It uses native strong, standards-based encryption. Controls help to protect data, which include the use of derived data encryption keys and customer-controlled key rotation, generation, and destruction process. Available for an additional cost.
Data sanitisation process: Yes
Data sanitisation type: Explicit overwriting of storage before reallocation

Deleted data can’t be directly accessed
Equipment disposal approach: A third-party destruction service

Data importing and exporting

Data export approach: Multiple options are available for ad hoc data export or regular backup:
Direct Export - into csv/Excel files from a list view or report. Commonly utilised by end users.
Salesforce Data Loader - a free tool for importing/updating/exporting data.
Salesforce API - export via APIs at any time.
Weekly Export Service - to csv files.
Backup & Restore - our native data recovery service: https://www.salesforce.com/products/platform/solutions/data-security/backup-restore-data-recovery/
Partner Tools - pre-integrated third party tools like Mulesoft or OwnBackup.
Data export formats: CSV

Other
Other data export formats: XLS

PDF

Out of The Box import via the open standard API

API export in open standards such as XML and OData

API also support bulk export and upload

Pre-integrated ETL tools such as Mulesoft etc.
Data import formats: CSV

Other
Other data import formats: Out of The Box import via the open standard API

API imports in open standards such as XML and OData

API also support bulk export and upload

Salesforce Connect code-free integration via OData

Salesforce Data Loader or third party service Dataloader.io

Pre-integrated ETL tools such as Mulesoft , Informatica, etc.

Salesforce can also store content in any flat file format.

Data-in-transit protection

Data protection between buyer and supplier networks: Private network or public sector network

TLS (version 1.2 or above)
Data protection within supplier network: IPsec or TLS VPN gateway

Other
Other protection within supplier network: Customer data is protected within the Salesforce service through a mature, standards-based defence-in-depth security architecture. Logical and physical access is strictly controlled, logged and monitored, and the access controls used are regularly audited for compliance with our certifications by third parties. Network security controls such as firewalls, intrusion detection, anti-malware, anti-ddos, file integrity monitoring are augmented with extensive monitoring to provide a robust prevention, detection and response model. Internal and external, as well as third-party vulnerability scanning and application penetration testing are also in place.

Availability and resilience

Guaranteed availability: The Salesforce Services are designed with the concept of continuous improvement and Trust (e.g. Availability, Performance and Security) in the infrastructure. Salesforce uses commercially reasonable efforts to make its on-demand services available to its customers 24/7, except for (minimal) planned downtime, for which Salesforce gives customers prior notice, and force majeure events. Excellent availability statistics (historically 99.5%) are critical to Salesforce's customers’ success and to the success of Salesforce as a company. Salesforce generally does not focus on a specific percentage, as we do not believe our job on availability will ever be “complete”. Live and historical statistics on Salesforce system performance are publicly published at: https://trust.salesforce.com/en/#systemStatus, and further detail can be shared upon request and NDA.
Approach to resilience: To maximise availability, the service is delivered using a world-class data centre infrastructure consisting of a primary production data centre, a full capacity secondary data centre for hosting the service provided to customers. The infrastructure utilises carrier-class components designed to support millions of users. Extensive use of high availability servers and network technologies, and a carrier-neutral network strategy help to minimise the risk of single points of failure, and provide a highly resilient environment with maximum uptime and performance. More detailed information is available under NDA on request.
Outage reporting: Outages are publicised on a public portal and via email alerts. Escalation policies are established and maintained as Salesforce's goal is to rapidly restore service. In the event of an extended outage, periodic updates are provided in near real time to customers via the trust.salesforce.com dashboard site and in addition, service notifications are provided to nominated contacts via various channels such as email. Update frequency for notifications is dependent on the customer support service plan.

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Identity federation with existing provider (for example Google Apps)

Dedicated link (for example VPN)

Username or password

Other
Other user authentication: Salesforce has a comprehensive set of authentication mechanisms that customers can chose from. These include the inherent username and password option, Single Sign-on, Social Sign-on through another application, such as google, integration with existing identity management systems a customer may have, 2 Factor Authentication is required from February 2022, and the application can also act as a Service Provider or Identity Provider for SSO integration using SAML.
Access restrictions in management interfaces and support channels: Management access for service support and delivery is done through multiple layers of controls including, but not limited to, multiple 2 factor authentication, bastion host and proxy control and segregation of duties. These controls are in scope for SSAE-18 auditing and evidences through the SOC 2/ISAE3402 report.

Access to the management interface for the customer to configure their salesforce environment, is configured by the customer themselves. The options are outlined in the above response. Robust application design and testing ensures that users without administrative access rights cannot access more sensitive areas of the application.
Access restriction testing frequency: At least every 6 months
Management access authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Identity federation with existing provider (for example Google Apps)

Dedicated link (for example VPN)

Username or password

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: At least 12 months
Access to supplier activity audit information: Users have access to real-time audit information
How long supplier audit data is stored for: At least 12 months
How long system logs are stored for: At least 12 months

Standards and certifications

ISO/IEC 27001 certification: No
ISO 28000:2007 certification: No
CSA STAR certification: No
PCI certification: No
Cyber essentials: Yes
Cyber essentials plus: Yes
Other security certifications: No

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: CSA CCM version 3.0

ISO/IEC 27001

Other
Other security governance standards: ISO/IEC 27001
ISO/IEC 27017
ISO/IEC 27018
SSAE-18/ISAE3402
PCI-DSS
UK Cyber Essentials PLUS
UK NHS DSPT
Information security policies and processes: Salesforce's Information Security Management System (ISMS) and information security policies are based on the ISO 27002 framework of best practices and are ISO 27001 certified. As required by this certification, the ISMS is endorsed by Senior Management. The EVP of Security has responsibility for the information security policies and ISMS. The Salesforce Security Steering Committee approves/authorizes all changes to the policies, the Statement of Applicability (SoA), the information security manual, and any separate policy statements. During the ISO 27001 audit process (as well as other audits such as SOX and SSAE 16 SOC 1), Senior Management for various departments are involved in verifying that policies and procedures are in place and adhered to. Policies are reviewed/approved at least annually.

Operational security

Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach: Salesforce has formal processes for placing a system into production. This procedure includes a build checklist, server hardening checklist and pre-production testing. Baseline configurations for servers, network devices, and databases are consistent with industry-accepted CIS (Centre for Internet Security) system hardening guidelines.

Change control procedures are required by the company’s Change Management Policy and include steps for testing, review, authorization, communication, verification, and back-out procedures. All changes to the infrastructure components are tested in a dedicated environment using production class equipment before being deployed into production. Changes are reviewed and approved by Technical Operations management prior to deployment to production.
Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach: Vulnerability and Patch Management Program is implemented where Salesforce performs vulnerability scans on external and internal facing systems using internal scanning resources and with third-party vendors to conduct external vulnerability assessments. Internal scans are completed daily, external service providers are used to perform penetration tests prior each major release (three times annually). Commercial and proprietary vulnerability scanning tools are configured to identify vulnerabilities and measure vulnerability impact in CVSS scores. Patching is applied following a risk-based approach and SLAs while using the change management process to ensure mitigations are deployed. detail on responsible disclosure https://trust.salesforce.com/en/security/responsible-disclosure-policy/
Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach: Salesforce Threat Intelligence and Detection team monitors the Salesforce services 24x7 for threats and unauthorized intrusions via the latest cutting edge technology and industry analysis, and in collaboration with the Security Incident Response teams. Extensive logging and monitoring is conducted across all Salesforce Services and environments (at application, network and database layers). All suspicious activities are flagged and reported to Salesforce CSIRT for investigation, management, communication, and resolution of security events and incidents in line with the NIST Incident Response model.
Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach: Salesforce has a formal Incident Management Process that guides the Salesforce Computer Security Incident Response team in investigation, management, communication, and resolution activities.

Salesforce will promptly notify the customer in the event of any security breach of the Service resulting in an actual or reasonably suspected unauthorised disclosure of Customer Data. Notification may include phone contact by Salesforce support, email to customer's administrator and Security Contact and public posting on trust.salesforce.com.

Salesforce.com is a member of the prestigious Forum of Incident Response and Security Teams (FIRST) and complies with the FIRST framework and best practices for incident response.

Secure development

Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks: No

Social Value

Fighting climate change
Tackling economic inequality
Equal opportunity

Fighting climate change

Skyflo Digital aims to be carbon neutral by 2028 which will be achieved by reduced emissions and utilising carbon credit initiatives.

Tackling economic inequality

Skyflo Digital is based in the north east and is committed to improving the employment outcomes of people in the local area by offering work placements to anyone interested in a career in technology.

Equal opportunity

Skyflo Digital is an equal opportunities employer and does not discriminate on ethnicity, age, gender, sexual orientation, religion or any other characteristic.

Pricing

Price: £5.40 a user a month
Discount for educational organisations: No
Free trial available: Yes
Description of free trial: Complete version limited by time only
Link to free trial: Please contact us for the current trial link

Salesforce - Add-ons

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Salesforce - Add-ons

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents