XMA LIMITED

Salesforce Lightning Agentforce Marketing (formerly Lightning Marketing Cloud)

Salesforce Agentforce Marketing empowers organisations of all sizes to unify data and modernise engagement across email, mobile, social, ads, and web. It streamlines operations to deliver secure, personalised communication, enhanced by the power of AI to build citizen trust

Features

• Email creation and deployment, Digital advertising, Landing page creation
• 2-way SMS and push message/in-app creation and deployment
• Media buying & Planning Analytics integrated with campaigns.
• No-code & Low-code declarative configuration, Open API integration, Training included.
• Execute automated data imports, extracts, and marketing processes
• Analyse digital marketing through reporting and analytics
• Automated marketing journeys and campaign management
• Single subscriber view across multiple data sources and channels
• Drag-and-drop audience segmentation tools
• Social Collaboration, omni-channel engagement, Mobile ready, Knowledge base, Analytics, AI

Benefits

• Data-driven, boosting satisfaction, enhancing trust, reducing queries.
• Integrates all data sources for a unified citizen profile.
• Instantly adapts interactions across all digital channels.
• Measures media and campaign effectiveness accurately across Channels.
• Optimise channel use, lowering service costs for cost-Effective Communication.
• Improved data handling with unified citizen records enhancing Data Governance
• Reduces costs by minimising need for citizen inquiries.
• The world's most utilised marketing cloud, driving massive engagement.
• Builds trust with clear data usage, consent, and CSAT measurement.
• Streamline case management and internal efficiencies through OTS Salesforce integration.

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@xma.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

685425831713028

Contact

Nancy Clayton-Schofield
0115 846 4000
bidteam@xma.co.uk

About your service

• Service categories:

  Applications

  Customer relationship management

  • Marketing campaign management
  • Digital commerce
  • Customer service
  • Contact centre

  Advertising

  • Advertising Placement
  • Advertising Measurement
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Salesforce services are all modular and pre-integrated with AI from einstein built-in. Functionality can be expanded as needed. Typically customers extend by adding: Service Cloud for case management, Sales Cloud for CRM and 360degree information view, and Marketing Cloud for engagements and customer journeys. Further information here https://appexchange.salesforce.com/ and https://www.salesforce.com/uk/products/
• Cloud deployment model: Public cloud
• Service constraints: Key considerations (further detail in our Supplier Terms) As Salesforce is multi-tenant, there are 'governor limits' which prevent resources from being monopolised by any single organisation. NB though these limits exist it's rare for customers to be impacted, and even more unusual for our current Public Sector customers. In the unlikely event of a need to increase, limits can be extended with various add-ons separately listed. Hitting a limit is often a sign of an underlying design flaw. Please make yourself aware of these limits at this link https://developer.salesforce.com/docs/atlas.en-us.210.0.salesforce_app_limits_cheatsheet.meta/salesforce_app_limits_cheatsheet/salesforce_app_limits_features.htm A user’s password may not be shared with any other individual.
• System requirements:
  • Marketing Cloud is a software-as-a-service application
  • On-demand and web-based using HTTP and HTTPS ports
  • Supports the latest versions of IE, Firefox, and Chrome browsers

User support

• Email or online ticketing support: Yes
• Support response times: Every Salesforce service includes support as standard. The lowest level relies on the Salesforce user community for responses and has a response time of 2 business days, this can be reduced to 15 minutes with the appropriate upgrade in your support plan. https://www.salesforce.com/content/dam/web/en_us/www/cloud-services/documents/premier-success-plans-datasheet.pdf
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: Our webchat products have been assessed against WCAG 2.2 standards. Details of this compliance are described in our Voluntary Product Accessibility Template (VPAT) statements (available at: https://www.salesforce.com/company/legal/508_accessibility/). While formal usability studies with assistive technology have not been conducted, the services have been robustly assessed against WCAG 2.2. Furthermore, existing customers have successfully conducted testing and are utilising the Salesforce Webchat capability in live services.
• Onsite support: Yes, at extra cost
• Support levels: Every Salesforce service includes community-based support. This can be enhanced with guaranteed response times through Premier Success. For more critical applications we provide Signature Success which provides Salesforce staff with a knowledge of a specific customers applications and configurations and an initial response from your designated support team in as little as 15 minutes, with personalised updates every 30 minutes.
• Support available to third parties: No
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: Users can get started with Agentforce Marketing through a mix of structured digital learning and personalised support. ; ; 1. Expert-Led and Onsite trainings and webinars; There are regularly scheduled "Expert Coaching" sessions for live Q&A. For more information on this please check: https://help.salesforce.com/s/articleView?id=000387492&type=1 Bespoke training courses are also available as required. ; ; 2. Online Training and Self-Paced Learning; There is specific Training Material built on the needs of customers. The primary tool for self-paced training is Salesforce Trailhead, a free gamified platform with guided "trails" like Marketing Cloud Engagement Basics. For deep technical proficiency, users can access the Trailhead Academy - https://trailheadacademy.salesforce.com/products/marketing-cloud#f-products=Marketing%20Cloud&f-siteLanguage=en_US; ; 3. User Documentation and Technical Guides; Comprehensive HTML-based documentation is available via the Salesforce Developer Center (https://developer.salesforce.com/) and the Help Portal (https://help.salesforce.com/).
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
  • Other
• Other documentation formats:
  • Salesforce also provides free online courses, referred to as 'Trails'
  • A dedicated website called 'Trailhead' gives access to these 'Trails'
  • Each designed with a specific purpose and skill in mind.
  • Further information on Trailhead can be found here https://trailhead.salesforce.com/en/trails
• End-of-contract data extraction: During the contract term, customers may export a copy of any Customer Data that is made available for export through the Covered Services. After contract termination, there is a 30-day period for customers to request a return of their Customer Data. Following this, Customer Data remains in inactive status for up to 90 days (for Marketing Cloud Engagement and related services). After this retention period, the data is securely overwritten or deleted across production and backup systems, ensuring full and irreversible removal, subject to applicable legal requirements.
• End-of-contract process: After contract termination, there is a 30-day period for customers to request a return of their Customer Data. Following this, Customer Data remains in inactive status for up to 90 days (for Marketing Cloud Engagement and related services). After this retention period, the data is securely overwritten or deleted across production and backup systems, ensuring full and irreversible removal, subject to applicable legal requirements.; ; Physical media on which Customer Data is stored during the contract term is not removed from the data centers that Salesforce uses to host Customer Data unless the media is at the end of its useful life or being deprovisioned, in which case the media is first sanitized before removal. This process is subject to applicable legal requirements.; ; Within 30 days post contract termination, customers may request return of their respective Customer Data submitted to the Covered Services. Salesforce shall provide such Customer Data via downloadable files in comma separated value (.csv) format and attachments in their native format.; ; For more information on Data Deletion period upon contract termination, Please refer "Deletion of Customer Data" section of the Security, Privacy and Architecture Documentation for the respective services available on the Trust and Compliance site: https://trust.salesforce.com/en/trust-and-compliance-documentation/
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The interface is a modern and intuitive design, with help functions throughout. The interface can be configured as required; ; In the platform, it is easy to modify applications to unique requirements. Use the metadata framework and point-and-click tools, custom user interfaces, modify data models, create and edit application business logic and processes. Configuration to modify objects, fields, validation rules, workflow, security settings, formulas, and more without code.; ; Some functionality is beyond the constraints of a metadata framework. For such cases, developers can create needed functionality in open-ended development environments, using toolkits for most of the common programming languages, or Apex.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: We are committed to ensuring our user support channels (Email, Ticketing, and Webchat) are accessible for users working with assistive technology. We strive to ensure our support staff work with services that strive to meet WCAG 2.2 Level AA to ensure an effective support experience.
• API: Yes
• What users can and can't do using the API: Approximately 95% of the functionality in the Marketing Cloud application is available via API. The platform offers a REST and SOAP API that share a common authentication mechanism based on OAuth 2. For documentation of our APIs please see: https://developer.salesforce.com/
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Clients and partners can build applications using a set of Developer Tools, including APIs, UX components and Marketing Cloud application integration tools

Scaling

• Independence of resources: Salesforce ensures users are not impacted by demands placed on the service by others through its multi-tenant architecture. This architecture allows multiple organisations (tenants) to share the same infrastructure and resources while maintaining strict data isolation and performance reliability. Each organisation’s data and processes are logically separated, ensuring activities of one do not affect the others. Salesforce employs robust system monitoring and resource management, including dynamic resource allocation, load balancing, and proactive system updates to ensure consistent performance across the platform, regardless of demand fluctuations. Performance and availability information for the entire service are available at https://trust.salesforce.com.

Analytics

• Service usage metrics: Yes
• Metrics types: The standard infrastructure metrics provided at trust.performance.com cover MC instance and API performance. Trust includes uptime and transaction volumes. At Premier+ and higher support levels, a custom report can be created.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Salesforce

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Data can be exported via scheduled or ad-hoc flat file transfer to FTPs, via ad-hoc or scheduled API call. For larger files, they can be pushed to S3 buckets
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • A file export wizard for a CSV or TXT file
  • An FTP export as either an automated or batch process
  • Via an Application Programming Interface or API call
  • A file export to S3 buckets
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • A delimited file (.txt, comma or other delimiter).
  • SOAP-based API.
  • JSON

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The Salesforce Services are designed with the concept of continuous improvement and Trust (e.g. Availability, Performance and Security) in the infrastructure. Salesforce uses commercially reasonable efforts to make its on-demand services available to its customers 24/7, except for (minimal) planned downtime, for which Salesforce gives customers prior notice, and force majeure events.
• Approach to resilience: To maximise availability, the service is delivered using a world-class data centre infrastructure consisting of a primary production data centre, a full capacity secondary data centre for hosting the service provided to customers.The infrastructure utilises carrier-class components designed to support millions of users. Extensive use of high availability servers and network technologies, and a carrier-neutral network strategy help to minimise the risk of single points of failure, and provide a highly resilient environment with maximum uptime and performance. More detailed information is available under NDA on request.
• Outage reporting: Outage escalation policies are established and maintained as Salesforce's goal is to rapidly restore service. In the event of an extended outage, periodic updates are provided in near real time to customers via the trust.salesforce.com dashboard site and in addition, service notifications are provided to nominated contacts via various channels such as email. Update frequency for notifications is dependent on the customer support service plan.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
• Other user authentication: Salesforce has a comprehensive set of authentication mechanisms that customers can choose from. These include Multi-factor authentication, Single Sign-on, Custom Login flows, and Connected Apps. A connected app is a framework that enables an external application to integrate with Salesforce using APIs and standard protocols, such as SAML, OAuth, and OpenID Connect. Connected apps use these protocols to authenticate, authorise, and provide single sign-on (SSO) for external apps.; ; Salesforce requires each user to have a unique username that they enter at each login. Administrators can configure several settings to ensure that users' passwords are strong and secure.
• Access restrictions in management interfaces and support channels: Management access for service support and delivery is done through multiple layers of controls including, but not limited to, multiple 2 factor authentication, just-in-time access, access related to an approved trouble ticket and segregation of duties. These controls are in scope for SSAE-18 auditing and evidenced through the SOC 2/ISAE3402 report.; ; Access to the management interface for the customer to configure their salesforce environment, is configured by the customer themselves. Robust application design and testing ensures that users without administrative access rights cannot access more sensitive areas of the application.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
  • Other
• Other security governance standards: ISO/IEC 27017; ISO/IEC 27018; ISO 9001; ISO 42001; SSAE-18/ISAE3402; PCI-DSS; UK Cyber Essentials
• Information security policies and processes: Salesforce's Information Security Management System (ISMS) and information security policies are based on the ISO 27002 framework of best practices and are ISO 27001 certified. ; ; As required by this certification, the ISMS is endorsed by Senior Management. The Chief Trust Officer/CISO has responsibility for the information security policies and ISMS. The Salesforce Security Steering Committee approves/authorizes all changes to the policies, the Statement of Applicability (SoA), the information security manual, and any separate policy statements. ; ; During the ISO 27001 audit process (as well as other audits such as SOX and SSAE 16 SOC 1), senior management for various departments are involved in verifying that policies and procedures are in place and adhered to. Policies are reviewed/approved at least annually.; ; Company wide security awareness training highlights the importance of the security policies to employees and reinforces the company’s number 1 value of Trust.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: The change management process supports a controlled framework as well as proper segregation of duties for the approval and implementation of changes. Salesforce’s Change Management Standard outlines the activities to be performed during each phase of the change process, as applicable, and the supporting tasks that need to be completed for each activity.; ; Components are tracked as part of asset management and changes made to components follow a well established change management process. Change readiness testing includes a number of steps including a security testing step.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Salesforce includes threat modelling into its software development lifecycle to help ensure the risks associated with potential threats are mitigated as early as possible. Multiple threat intelligence sources are used to help understand the current and evolving threat landscape. ; ; Vulnerability scans are performed on all Salesforce information systems and hosted applications. Patches are deployed in timeframes based on CVSS scores and risk level. ; ; All vulnerabilities discovered during penetration tests are entered into the salesforce central ticketing system and are assigned an internal vulnerability ranking according on the OWASP risk rating framework based on likelihood and impact.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Salesforce Threat Intelligence and Detection team monitors the Salesforce services 24x7 for threats and unauthorized intrusions in collaboration with the Security Incident Response teams. Extensive logging and monitoring is conducted across all Salesforce Services and environments (at application, network and database layers). All suspicious activities are flagged and reported to Salesforce CSIRT for investigation, management, communication, and resolution of security events and incidents in line with the NIST Incident Response model.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Salesforce has an Incident Management Process that guides the Salesforce Computer Security Incident Response team in investigation, management and resolution activities which includes developing standard pre-defined procedures for dealing with common events. ; ; Salesforce will promptly notify the customer in the event of any security breach of the Service resulting in an actual or reasonably suspected unauthorized disclosure of Customer Data. Notification may include phone contact by Salesforce support, email to customer's administrator and Security Contact and public posting on trust.salesforce.com.; ; Customers can email security@salesforce.com or use the https://security.salesforce.com/contact page to report incidents.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Complete version limited by time only
• Link to free trial: Please contact us for the current trial link

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: LRQA Limited
• ISO/IEC 27001 accreditation date: Thursday 27 November 2025
• What the ISO/IEC 27001 doesn’t cover: The certificate scope covers the full company business operations, across all business locations, applicable and relevant to the delivery, deployment and management of IT solutions, support and services in accordance with Statement of Applicability Version 4, and is audit against the new 2022 standard.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: LRQA Limited
• ISO 9001 accreditation date: Monday 17 February 2025
• What the ISO 9001 doesn’t cover: The certificate scope covers the full company business operations, across all business locations, applicable and relevant to the Delivery, Deployment and Management of IT Solutions, Support and Services.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: Barclaycard
• PCI DSS accreditation date: Thursday 9 January 2025
• What the PCI DSS doesn’t cover: Our PCI DSS certification applies exclusively to payment processing systems and hosted payment gateways and does not extend to non‑payment systems, corporate IT infrastructure, or business applications outside the cardholder data environment.
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: B5f066ef-ff99-48a9-94b0-23f1f0ee595b
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 2d75659c-9df3-4d75-9406-9052a6e68c4b
• Other security certifications: Yes
• Any other security certifications: IASME CYBER ASSURANCE LEVEL ONE

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@xma.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.