Verification of Declaration of Adherence
Declaring Company: Salesforce Inc.

Verification-ID

2022LVL02SCOPE3111

Date of Approval

July 2023

Valid until

July 2024

Table of Contents
1

Verification against v2.11 of the EU Cloud CoC

32

List of declared services

3

Salesforce Services

3

2.1
3

Verification Process - Background4

3.1

Approval of the Code and Accreditation of the Monitoring Body

4

3.2

Principles of the Verification Process

4

3.3

Multiple Safeguards of Compliance

53.4

Process in Detail53.4.1

Levels of Compliance

6

3.4.2

Final decision on the applicable Level of Compliance

73.5
4Transparency about adherence

7Assessment of declared services by Salesforce (see 2.)

84.1

Fact Finding

84.2

Selection of Controls for in-depth assessment

84.3

Examined Controls and related findings by the Monitoring Body

94.3.1

Examined Controls

94.3.2Findings by the Monitoring Body

95Conclusion

106Validity

11

SCOPE Europe SRLManaging Director

ING Belgium

Rue de la Science 14Gabriela Mercuri

IBAN BE14 3631 6553 4883

1040 BRUSSELSSWIFT / BIC: BBRUBEBB

https://scope-europe.eu

Company Register: 0671.468.741

info@scope-europe.eu

VAT: BE 0671.468.741

2 | 11

1 Verification against v2.11 of the EU Cloud CoC
This Declaration of Adherence was against the European Data Protection Code of Conduct for Cloud
Service Providers (‘EU Cloud CoC’) 1 in its version 2.11 (‘v2.11’) 2 as of December 2020.
Originally drafted by the Cloud Select Industry Group 3 (‘C-SIG’) the EU Cloud CoC – at that time called
C-SIG Code of Conduct on data protection for Cloud Service Providers – was developed against Directive 95/46/EC 4 and incorporated feedback by the European Commission as well as Working Party29. Following an extensive revision of earlier versions of Code and further developing the substanceof the Code (v2.11) and its provisions has been aligned to the European General Data ProtectionRegulation (‘GDPR’) 5.

2 List of declared services
2.1 Salesforce Services■

Sales Cloud■

Financial Services Cloud■

Service Cloud■

Manufacturing Cloud■

Salesforce Mobile App (iOS/Android)■

Public Sector Solutions■

Experience Cloud (formerly Community■

Salesforce Configure Price Quote (CPQ)

Cloud)and Salesforce Billing (together for-■

Chatter

merly Salesforce Quote-to-Cash)■

LightningPlatform(including■B2B Commerce and B2B CommerceForce.com)

on Lightning Experience (formerly■Site.com

CloudCraze)■

Database.com■

Einstein Prediction Builder■

Tableau CRM (formerly Einstein Analyt-■

Einstein Case Classificationics)■

Einstein Language■

IoT Explorer■

Einstein Vision■

Salesforce Surveys■

Einstein Next Best Action■

Salesforce Shield■

Salesforce.org

■

WDC

■

Grants Management■

Health Cloud■

Salesforce Private Connect

1 https://eucoc.cloud2 https://eucoc.cloud/get-the-code

3 https://ec.europa.eu/digital-single-market/en/cloud-select-industry-group-code-conduct
4 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:31995L0046

5 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

Verification of Declaration of Adherence

3 | 11■Workplace Command Center and Em-■

Salesforce Order Management (CMS)

ployee Wellness Check■

Salesforce B2B2C Commerce■

Platform Events■Net Zero Cloud (formerly Sustainability■

Salesforce Identity■

Service Cloud Voice (SCV)

Cloud)■

Loyalty Management

3 Verification Process - BackgroundV2.11 of the EU Cloud CoC has been developed against GDPR and hence provides mechanisms asrequired by Articles 40 and 41 GDPR 6.

3.1 Approval of the Code and Accreditation of the Monitoring Body
The services concerned passed the verification process by the Monitoring Body of the EU Cloud CoC,i.e., SCOPE Europe sprl/bvba 7.
The Code has been officially approved in May 2021 8. SCOPE Europe has been officially accredited as
Monitoring Body in May 2021 9. The robust and complex procedures and mechanisms can be reviewed
by any third-party in detail at the website of the EU Cloud CoC alongside a short summary thereof. 103.2 Principles of the Verification Process
Notwithstanding the powers of and requirements set out by the supervisory authority pursuant toArticle 41 GDPR, the Monitoring Body will assess whether a Cloud Service, that has been declaredadherent to the Code, is compliant with the requirements of the Code - especially as laid down in theControls Catalogue. Unless otherwise provided by the Code, the Monitoring Body’s assessment process will be based on an evidence-based conformity assessment, based on interviews and document
reviews; proactively performed by the Monitoring Body.
To the extent the Monitoring Body is not satisfied with the evidence provided by a CSP with regards tothe Cloud Service to be declared adherent to the Code, the Monitoring Body will request additional
information. Where the information provided by the CSP appears to be inconsistent or false, the Monitoring Body will - as necessary - request substantiation by independent reports.

6 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679
7 https://scope-europe.eu

8 https://www.gegevensbeschermingsautoriteit.be/publications/decision-n05-2021-of-20-may-2021.pdf9 https://www.gegevensbeschermingsautoriteit.be/publications/decision-n-06-2021-of-20-may-2021.pdf
10 https://eucoc.cloud/en/public-register/assessment-procedure/

Verification of Declaration of Adherence

4 | 11

3.3 Multiple Safeguards of Compliance
Compliance of adherent services is safeguarded by the interaction of several mechanisms, i.e., continuous, rigorous, and independent monitoring, an independent complaints’ handling process, andfinally any CSP declaring services adherent is subject to substantial remedies and penalties in caseof any infringement.

3.4 Process in Detail
It is expected that, prior to any assessment of the Monitoring Body, each CSP assesses its complianceinternally. When declaring its service(s) adherent to the EU Cloud CoC, each CSP must elaborate its
compliance with each of the Controls as provided by the Code considering the Control Guidance, asprovided by the Controls Catalogue, to the Monitoring Body.
The CSP may do so either by referencing existing third-party audits or certifications, their respective
reports and by free text responses. Additionally, the CSP will have to provide a general overview of thefunctionalities, technical, organisational and contractual frameworks of the service(s) declared adherent.
With regards to internationally recognised standards, the Monitoring Body will consider the mappingas provided by the Controls Catalogue. However, the Monitoring Body will verify whether (a) any thirdparty certification or audit provided by the CSP applies to the Cloud Service concerned, (b) such thirdparty certification or audit provided by the CSP is valid, (c) such third-party certification or audit has
assessed and sufficiently reported compliance with the mapped controls of the third-party certification or audit concerned. Provided that the aforementioned criteria are met, the Monitoring Body may
consider such third-party certifications or audits as sufficient evidence for the compliance with theCode.
Within Initial Assessments, the Monitoring Body selects an appropriate share of Controls that will
undergo in-depth scrutiny, e.g., by sample-taking and requesting further, detailed information including potentially confidential information. Within any other Recurring Assessment, the Monitoring Body
will select an appropriate share of Controls provided that over a due period every Control will be subject to scrutiny by the Monitoring Body. Where applicable, aspects of current attention at the time ofassessment shall be covered too, e.g., where such aspects were indicated in media reports, publications or actions of supervisory authorities.

Verification of Declaration of Adherence

5 | 11

If the responses of the CSP satisfy the Monitoring Body, especially if responses are consistent and ofappropriate quality and level of detail, reflecting the requirements of the Controls and indicating appropriate implementation by the Control Guidance, then, the Monitoring Body verifies the service(s)declared adhered as compliant and thereupon, makes them subject to continuous monitoring.

3.4.1 Levels of ComplianceV2.11 of the Code provides three different levels of Compliance. The different levels of compliancerelate only to the levels of evidence that are submitted to the Monitoring Body. There is, however, nodifference in terms of which parts of the Code are covered, since adherent Cloud Services have tocomply with all provisions of the Code and their respective Controls.

3.4.1.1 First Level of Compliance
The CSP has performed an internal review and documented its implemented measures proving compliance with the requirements of the Code with regard to the declared Cloud Service and confirmsthat the Cloud Service fully complies with the requirements set out in this Code and further specified
in the Controls Catalogue. The Monitoring Body verifies that the Cloud Service complies with the Codeby information originating from the CSP.

3.4.1.2 Second Level of Compliance
Additional to the “First Level of Compliance”, Compliance with the Code is partially supported by independent third-party certificates and audits, which the CSP has undergone with specific relevanceto the Cloud Service declared adherent and which were based upon internationally recognised standards procedures. Any such third-party certificates and audits that covered controls similar to thisCode, but not less protective, are considered in the verification process of the Monitoring Body. Eachthird-party certificates and audits that were considered in the verification process by the Monitoring
Body shall be referred in the Monitoring Body’s report of verification, provided that the findings ofsuch certificates were sufficiently and convincingly reported and documented towards the Monitoring
Body and only to the extent such certificates and audits are in line with the Code. The CSP must notify
the Monitoring Body if there are any changes to the provided certificates or audits.
The Controls Catalogue may give guidance on third-party certificates and audits that are equivalent
to certain Controls in terms of providing evidence of complying with the Code.
However, to those Controls that the CSP has not provided any equivalent third-party certificate oraudit, the Monitoring Body verifies that the Cloud Service complies with the Code by information originating from the CSP.

Verification of Declaration of Adherence

6 | 11The Monitoring Body may refuse application of Second Level of Compliance if third-party certificatesand audit reports, that are recognised by the Monitoring Body in the verification process concerned,
are not covering an adequate share of Controls of this Code; such adequate share shall be subject tothe discretion of the Monitoring Body, considering e.g., the share related to the overall amount ofControls of the Code or whether a full Section or topic is being covered.

3.4.1.3 Third Level of Compliance
Identical to the “Second Level of Compliance” but Compliance is fully supported by independent thirdparty certificates and audits, which the CSP has undergone with regard to the Cloud Service declaredadherent and which were based upon internationally recognised standards.
To the extent a CSP refers to individual reports, such as ISAE-3000 reports, the CSP shall ensure thatsuch reports provide sufficient and assessable information and details on the actual measures implemented by the CSP regarding the Cloud Service concerned. The Monitoring Body shall, if considered necessary, in consultation with the Steering Board, define further requirements on such individual reports, such as accreditation and training for auditors against the provisions and requirementsof this Code.

3.4.2 Final decision on the applicable Level of Compliance
When declaring its Cloud Service adherent, the CSP indicates the Level of Compliance it is seeking toachieve. Any final decision, whether a CSP is meeting the requirements of a specific Level of Compliance is at the sole discretion of the Monitoring Body.

3.5 Transparency about adherence
Each service adherent to the EU Cloud CoC must transparently communicate its adherence by bothusing the appropriate Compliance Mark 11 and referring to the Public Register of the EU Cloud CoC 12
to enable Customers to verify the validity of adherence.

11 https://eucoc.cloud/en/public-register/levels-of-compliance/
12 https://eucoc.cloud/en/public-register/

Verification of Declaration of Adherence

7 | 11

4 Assessment of declared services by Salesforce (see 2.)
4.1 Fact Finding
Following the declaration of adherence of Salesforce Inc. (‘Salesforce’), the Monitoring Body provided
Salesforce with a template, requesting Salesforce to detail its compliance with each of the Controlsof the EU Cloud CoC.
As this declaration is a renewal 13, the Monitoring Body requested from Salesforce a confirmation that
there has been no material change to the applicable technical and organisational and contractual
framework. The Monitoring Body also requested from Salesforce a comparison of the declared Cloud
Services of last year and this year as well as to explicitly indicate any Cloud Services that are no longer
included in the Declaration of Adherence and, where applicable, provide the Monitoring Body withadequate reasons. To the extent the list of Cloud Services was extended, the Monitoring Body requested a confirmation, that any such additional Cloud Services are subject to the same technical,
organisational and contractual framework as the original Cloud Services.
Salesforce promptly responded to the templates. Information provided consisted of references andlist of actual measures meeting the requirements of each Control, a free text answer describing theirmeasures, and a reference to third party audits and certifications, where applicable. This information
was completed by the two confirmations requested by the Monitoring Body as well as a detailed comparison of the declared Cloud Services between last year and this year verification highlighting thechanges and the reasons for them.

4.2 Selection of Controls for in-depth assessment
Following the provisions of the Code and the Assessment Procedure applicable to the EU Cloud CoC14,
the Monitoring Body analysed the responses and information provided by Salesforce.
Salesforce’s declared services have been externally certified and audited. Salesforce holds an ISO
certificate, which is valid for the duration of the Declaration of Adherence, and the scope of registration includes all the declared services. The declaration of adherence referred to the respective ISO
certification within the responses to Section 6 of the Code (IT Security). As provided by the Code, theMonitoring Body may consider third-party certifications and audits. Accordingly, the Monitoring Body

13 You can access the Verification Report(s) of previous year(s) via the following link(s): Report 2022
14 https://eucoc.cloud/en/about/about-eu-cloud-coc/applicable-procedures/

Verification of Declaration of Adherence

8 | 11

verified the certification and references. Further in-depth checks were not performed, as provided
third-party certifications adequately indicated compliance.

4.3 Examined Controls and related findings by the Monitoring Body
4.3.1 Examined ControlsThe Monitoring Body reviewed the submission from Salesforce which outlined how all the requirements of the Code were met by Salesforce’s implemented measures. In line with the Monitoring
Body’s process outlined in Section 3.4, the Monitoring Body selected a subset of Controls from theCode for in-depth scrutiny. In-depth scrutiny reflects sample taking and follow-up questions, whilst thelatter may address requests for clarifications or more detailed information. The Controls selected forthis level of review were: 5.1.A, 5.1.E, 5.2.A, 5.2.G, 5.3.D, 5.4.A, 5.4.C, 5.4.D, 5.4.E, 5.4.F, 5.5.C,
5.7.F, 5.11.A, 5.11.B, 5.11.C, 5.13.A, 5.14.B, 5.14.F, 6.1.C and 6.2.P.

4.3.2 Findings by the Monitoring Body
During the process of verification, Salesforce consistently prepared the Declaration of Adherence welland thoroughly. Salesforce’s responses were detailed and never created any impression of intentional
non-transparency. Requests for clarification, additional and supporting information, as well as relevant samples were promptly dealt with and always met the deadlines set by the Monitoring Body.
Related to the Monitoring Body’s requests (see section 4.1), Salesforce indicated that no relevantchanges to the Cloud Service Family were applied in regards of the implemented technical, organisational and contractual framework. Where additional Cloud Services were added, Salesforce provided
explicit confirmation that such Cloud Services belong to the same Cloud Service Family.
Salesforce presented the Monitoring Body with its (new) contractual framework, which includes aMain Services Agreement and a Data Protection Addendum (DPA). Responsibilities of Salesforce, as
Data Processor and the Customer as Data Controller are defined in the DPA. In addition to its agreements, Salesforce has established documented procedures to assist Customers to comply with theirobligations under Article 28 of the GDPR. Several of those procedures are made available to theCustomers through Salesforce’s public-facing Trust and Compliance website.
An area of focus was built around subprocessor engagement. Salesforce makes its list of current
subprocessors available to the Customer through its contractual agreements. In addition to this,Salesforce has a defined mechanism to notify Customers of changes in subprocessors. The timelinesfor objection and/or exercising an alternative option, as well as the means to do so were confirmed
by Salesforce’s contractual documents.

Verification of Declaration of Adherence

9 | 11

Salesforce indicated having designated a Data Protection Officer (DPO) with competencies in accordance with Chapter IV, Section 4 GDPR. The contact of the DPO has been communicated and madeavailable through Salesforce’s Privacy Statement, as well as on Salesforce’s website where the contact details would be visible to interested parties.
The Code requires CSPs to assist Customers to respond to data subject requests. Salesforce confirmed providing Customers with self-service functionalities to enable them to respond to data subject
requests. Likewise, where Customers may require additional support, Salesforce offers assistance toCustomers in this respect. Further to this, Salesforce has documented procedures on how to address
Data Subject Requests it receives as a Data Processor with respect to Customer Personal Data.
Procedures to deal with requests from Supervisory Authorities were assessed. Salesforce’s contractual documents confirmed Salesforce’s contractual obligations to notify Customers, where legally permissible. In addition to this, an overview of the key elements of the procedure to respond to requests
by Supervisory Authorities was provided by Salesforce, which included the steps taken by Salesforce
to deal with the respective requests internally and any potential internal escalations.
Finally, the Monitoring Body assessed Salesforce’s incident response procedures, which defines escalation paths depending on the incident. Relevant teams work in collaboration to determine whethera security breach potentially resulted in a Data Breach so follow ups and relevant notifications can bedone accordingly.

5 Conclusion
The information provided by Salesforce were consistent. Where necessary, Salesforce gave additional
information or clarified their given information appropriately.
The Monitoring Body therefore verifies the services as compliant with the EU Cloud CoC based on theperformed assessment as prescribed in 1. The service(s) will be listed in the Public Register of the EU
Cloud CoC 15 alongside this report.
In accordance with sections 3.4.1.2 and 3.4.2 and given the type of information provided bySalesforce to support the compliance of its service, the Monitoring Body grants Salesforce with a
Second Level of Compliance.

15 https://eucoc.cloud/en/public-register/

Verification of Declaration of Adherence

10 | 116 Validity
This verification is valid for one year. The full report consists of 11 pages in total, whereof this is thelast page closing with the Verification-ID. Please refer to the table of contents at the top of this report
to verify that the copy you are reading is complete, if you have not received the copy of this report via
the Public Register of the EU Cloud CoC16.
Verification-date: July 2023
Verification-ID:

Valid until: July 2024

2022LVL02SCOPE3111

16 https://eucoc.cloud/en/public-register/

Verification of Declaration of Adherence

11 | 11