All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
This analysis is scoped to Einstein Trust Layer.
The Einstein Trust Layer is Salesforce's built-in screening for customers running generative AI in Salesforce applications. It masks personal data before a prompt reaches an outside model, scores the answer for toxic content, and logs the interaction. Salesforce's own training material says masking is currently disabled for agents and available for embedded features. A 2025 comparative study found Salesforce and Microsoft supporting the same zero-retention policy through different architectures, so that guarantee is not scarce. No customer of the line appears in the cited record and no cited source measures its detection quality, so a buyer works from Salesforce's own account. Most useful to a team already building on Salesforce, least useful to a buyer choosing which platform to build on.
| Description | Salesforce is a publicly traded enterprise software company whose AI platform carries the Einstein Trust Layer, a set of guardrails that mask sensitive data, screen model output for toxic content, and hold third-party language models to zero data retention. | [f1] |
|---|---|---|
| Founded | 1999 | [f2] |
| HQ | San Francisco, California, USA | [f2] |
| Latest funding | Public (NYSE: CRM), IPO 2004 | [f2] |
| Product | What it does |
|---|---|
| Einstein Trust Layer | Guardrails between Salesforce applications and LLMs that mask sensitive data, run toxicity detection on model output, log an audit trail, and enforce zero data retention with third-party LLMs. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Orchestration Tools Agentic orchestration tools, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients on user devices. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Gateways & Routers MCP proxies and gateways, LLM routers, outbound AI-service traffic, shadow AI egress, and model-registry traffic. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, AIBOM, and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
The Einstein Trust Layer masks sensitive data before prompts reach external LLMs, runs toxicity detection on model generations, and records an audit trail of AI interactions. These capabilities are mapped to the AI Defense Matrix. [f3]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | TechCrunch named the compliance-constrained buyer at launch and reported that Amazon, Goldman Sachs and Verizon had restricted generative AI over privacy risks, and a 2025 arXiv study treats strong privacy guarantees as a requirement in regulated industries. The buyer and the problem are stated clearly and no cited source sizes the pain independently. [s5, s7, s8] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 3/5 | Salesforce's developer documentation details masking placeholders, a Salesforce Research toxicity model trained on 2.3 million prompts, the model gateway and the audit trail, and its training material records that masking is currently disabled for agents. No third party measures how well the masking or the toxicity scoring works, so a 2025 preprint describing the architecture is the whole external record. [s2, s4, s7] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | TechCrunch announced the line on June 12, 2023, reporting that Salesforce planned general availability later that month, as enterprises moved generative AI into production and named firms restricted it. The cited record carries no other kind of buyer-side signal, and the 2025 study and the disclosure document the risk rather than buyers shopping for guardrails. [s5, s7, s8] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | Salesforce Research trained the toxicity model on 2.3 million prompts from seven legal-approved datasets, verifiable in-domain engineering for this line rather than for the company at large. TechCrunch quotes Adam Caplan, Salesforce's SVP of emerging technology, speaking for the line at launch. The cited sources name no research or product owner of the layer itself and no prior build or recognition attached to it. [s2, s10, s5] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 3/5 | Salesforce told TechCrunch it had established a trust partnership with OpenAI for joint content moderation alongside the layer, and its documentation names OpenAI as the model partner it launched with, one named partnership on the company's own account. No customer of the line appears in the cited record, and the layer's built-in placement, which the annual report describes, is an indirect signal. [s5, s2, s9] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | The line ships as documented engineering that Salesforce's annual report names, and the cited record carries no revenue, margin or cost figure for the layer itself. Efficiency is therefore unconfirmed, and the cited record shows the line shipping without showing what Salesforce spends to run it. [s9, s2] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 3/5 | TechCrunch placed the line in a category at launch, calling it an AI moderation and redaction service similar to Nvidia's NeMo Guardrails, the one independent placement the cited record carries. The 2025 arXiv study describes architecture rather than category, calling the layer a middle layer and a distinct preprocessing step in its comparison of trust mechanisms. Salesforce's own pages name it three ways, the Salesforce Trust Layer, the Einstein Trust Layer, and the Agentforce Trust Layer on its training module. [s5, s7, s1, s4] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 4/5 | Salesforce's developer documentation says every LLM generation is created through the Trust Layer, whether the prompt comes from a CRM app, Prompt Builder or Apex. The same documentation says that grounding calls Flow and Data Cloud and that the audit trail keeps the prompt, the safety scores, the output and the user's action inside Salesforce. TechCrunch reported the ease of connecting Salesforce data to a model as probably a compelling pitch for a customer already entrenched in the ecosystem. A rival can reproduce the guardrail features without taking that position in the generation path. [s2, s5] |
Teams building generative AI features on the Salesforce platform have to keep regulated customer records away from outside language models, stop unsafe answers reaching users, and leave a record an auditor can read. The Einstein Trust Layer addresses those three, with one documented limit on masking. Salesforce masks personal data before a prompt leaves the platform, scores each generation for toxic content, and logs the interaction, and its training material says that masking is currently disabled for agents.
The pain is documented outside Salesforce. TechCrunch reported at the 2023 launch that a growing list of firms, including Amazon, Goldman Sachs and Verizon, had banned or restricted generative AI over privacy risks. A 2025 arXiv study of enterprise AI assistants treats strong privacy guarantees as a requirement in regulated industries, where data exposure can bring heavy fines.
Independent research has since shown the risk concretely on this platform. Noma Security disclosed a flaw it named ForcedLeak in Salesforce Agentforce, scored 9.4 for severity. Its researchers demonstrated an attack path in which a planted instruction in a web-to-lead form runs as a prompt injection that could exfiltrate CRM data to an expired allowlisted domain.
The problem statement is platform-specific rather than general. It assumes the buyer has already committed to building AI on Salesforce and now needs the safeguards that commitment requires. [s5, s7, s8, s4, s2]
The Einstein Trust Layer screens the prompt on the way out and the answer on the way back. Salesforce's trusted-AI page lists data masking, in-flight encryption and zero data retention with large language models among the guardrails, and its developer documentation describes replacing each detected personal-data element with a placeholder before the prompt leaves. Salesforce's training material adds that masking for language models is currently disabled for agents and available for embedded features such as Einstein Service Replies and Einstein Work Summaries, so a team building agents does not get the masking control today.
One component is attributed to Salesforce's own research organization. The toxicity detector combines a rule-based profanity filter with a model Salesforce Research trained on 2.3 million prompts drawn from seven legal-approved datasets. The same documentation says toxicity confidence scoring is currently supported only for English. Masking runs on a named entity detection tool covering government identifiers and payment-card entities, and the documentation does not say who built that tool, so the toxicity detector is the part of the stack Salesforce documents as its own work.
Two controls carry the trust claim. The gateway sends prompts to external models encrypted in flight and states that the calling model does not retain them, and Salesforce names OpenAI as the model partner it launched with. The audit trail records timestamped metadata including the original prompt, the safety scores and the model output. [s1, s2, s4]
One outside observer places the line in the AI-guardrails category. TechCrunch described it at launch as an AI moderation and redaction service similar to Nvidia's NeMo Guardrails. A 2025 arXiv preprint compares Salesforce and Microsoft directly, contrasting how each implements zero data retention, which describes the architecture rather than naming a category for the line.
What that comparison shows is two routes to the same assurance. The preprint states that both companies used distinct technical architecture to support zero data retention, and describes Microsoft embedding trust through its Graph integration and Azure filtering. TechCrunch separately reported that Microsoft offers model customization options similar to the Einstein Trust Layer through its Azure OpenAI Service, though only for OpenAI models.
Salesforce competes from the default position on its own platform rather than on neutrality. TechCrunch describes the layer sitting between an app or service and the model, so a team already building on Salesforce reaches it there. Salesforce told TechCrunch that models linked to AI Cloud from platforms such as Amazon SageMaker or Google's Vertex AI can still use the Einstein Trust Layer, so the layer is not tied to one model provider. What the cited record does not show is the layer screening applications built outside Salesforce. [s5, s7, s11]
Distribution comes from the platform rather than from a sales motion for the line. Salesforce's annual report describes the Trust Layer as built into the platform to set guardrails on what AI agents do with customer data, and its own training material calls the layer a sequence of gateways generative AI runs through. That is platform context rather than demand for the guardrails.
The cited record names one partnership and no customers. Salesforce told TechCrunch it had established a trust partnership with OpenAI to deliver joint content moderation using OpenAI's safety tools alongside the Einstein Trust Layer, and its developer documentation names OpenAI as the model partner it launched with. No customer of the guardrail line appears in any source cited here.
The cited pricing page lists Agentforce pricing and does not disclose separate Trust Layer pricing or licensing terms. Salesforce sells Agentforce consumption through Flex Credits or Conversations and also offers per-user licensing. A buyer therefore cannot tell from the cited pages whether the guardrails carry any separate commercial condition. [s9, s4, s5, s2, s3]
Salesforce builds and runs the line, and the cited record identifies no separate team behind it. Wikipedia describes Salesforce as best known for customer relationship management software delivered as a subscription service, the company context in which the layer ships.
The engineering visible in the documentation is the credibility signal for the line. Salesforce Research trained the toxicity model on 2.3 million prompts from seven legal-approved datasets, and the developer documentation walks through masking, the model gateway and the audit trail as separate controls with named mechanics.
TechCrunch quotes Adam Caplan, Salesforce's SVP of emerging technology, speaking for the line at its 2023 launch. What the cited sources do not carry is a named research or product owner of the Trust Layer itself. That leaves Salesforce's platform engineering and its shipping record as the evidence a reader can weigh. [s10, s2, s4, s5]
Salesforce documents the line for developers, and its own training material flags that some Trust Layer features in that module are still beta. Salesforce describes the layer as built directly into the platform, so a buyer evaluates it as part of the Salesforce AI stack.
Operational fit targets enterprise control. Salesforce states that prompts and generated responses are never stored or used to train the third-party models, and the audit trail keeps timestamped metadata covering the prompt, the safety scores and the model output.
Verification of efficacy is the open question. No independent test of masking or toxicity-detection quality appears in the cited record, so a buyer choosing the built-in layer over a focused product is working from Salesforce's own assurances. Outside testing of the platform has happened on a different surface. Noma Security's ForcedLeak disclosure targeted Agentforce's web-to-lead path rather than the masking or toxicity controls, and Salesforce then patched Agentforce and Einstein AI agents to send output only to allowlisted URLs. [s4, s1, s2, s8]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Microsoft | competes with | TechCrunch reports Microsoft offering model customization options similar to the Einstein Trust Layer, and a 2025 comparative study sets the two architectures side by side. | N/AMicrosoft is scored by product line, not as a whole company, so there is no company-wide column to compare. Open its profile to compare a specific product. |
| NVIDIA | competes with | TechCrunch described the Einstein Trust Layer at launch as similar to Nvidia's NeMo Guardrails. | N/ANVIDIA is scored by product line, not as a whole company, so there is no company-wide column to compare. Open its profile to compare a specific product. |
Add analyzed competitors to compare them side by side with Salesforce.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
The Einstein Trust Layer is durable on position and modest on assets. Salesforce puts the screening between its applications and outside models, and its annual report describes the layer as built into the platform. Behind the screening Salesforce keeps a toxicity model its research group trained on 2.3 million prompts from seven approved datasets. Salesforce's developer documentation adds that audit-trail feedback helps it refine those models. A funded rival could assemble a comparable model and feedback loop with time. A 2025 comparative study found Salesforce and Microsoft supporting the same zero-retention policy through different architectures, so Microsoft reaches that guarantee its own way. Salesforce's advantage for its customers is placement rather than scarcer detection.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Salesforce delivers the Trust Layer as software built into the platform, and the customer's team configures the controls and owns the outcomes of the AI feature that calls them. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | The controls are platform settings, and the layer accumulates an audit history the cited record does not show as portable. The cited record documents no mechanism whose exit it sizes, so the migration cost stays unmeasured. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | The zero-retention arrangement and the audit trail ease an enterprise review, and the cited record shows no authorization, mandate or retained liability carried by the layer itself, so a funded competitor could assume the same obligations through ordinary enterprise preparation. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Named entity detection on live prompts, a toxicity model trained on 2.3 million prompts, and an in-flight gateway that holds external models to zero retention put the line in machine-learning and real-time systems work that takes specialized expertise. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 2/3 | TechCrunch reports the layer is aimed at companies whose compliance and governance rules would otherwise preclude generative AI, which is the target segment rather than evidenced adoption. The cited record names no regulated buyer of this line. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 3/3 | Salesforce routes its generative AI calls through the Trust Layer as a managed sequence of gateways that its own applications depend on, infrastructure rather than an application a customer deploys and runs. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 2/3 | Salesforce Research trained the toxicity model on 2.3 million prompts from seven legal-approved datasets, and the developer documentation says feedback logged in the audit trail helps Salesforce refine its models, an accumulated asset the vendor retains rather than holds per customer. Nothing in the cited record shows the model or its training corpus published, and rebuilding it would take a funded rival time and effort. |
The Einstein Trust Layer targets the team building a generative AI feature or agent on the Salesforce platform. Salesforce presents it as built directly into the platform rather than as a standalone product, and its training material says masking is currently disabled for agents while available for embedded features such as Einstein Service Replies.
The press framed the buyer as the compliance-constrained enterprise. TechCrunch reported the line as aimed at companies whose strict compliance and governance requirements would otherwise preclude them from using generative AI tools. VentureBeat reported that the layer addresses concerns related to data privacy, security, residency and compliance.
Segmentation runs through the platform. The layer reaches whoever already builds AI on Salesforce, which is a reach the cited record does not separate from Salesforce generative-AI usage generally, and no customer of the guardrail line appears in the cited sources, so line-level demand is unmeasured.
The Einstein Trust Layer screens the prompt and the response on the path between Salesforce applications and the model. The developer documentation describes masking that substitutes a placeholder for each detected personal-data element, a toxicity detector that scores generations, and an audit trail of timestamped metadata covering the prompt, the safety scores and the model output. Salesforce's training material qualifies the masking claim, saying masking for language models is currently disabled for agents and available for embedded features.
The toxicity detector is the component the documentation ties to Salesforce's own research. It combines a rule-based profanity filter with a model Salesforce Research trained on 2.3 million prompts from seven legal-approved datasets, and the cited record carries no third-party measurement of its accuracy. The same documentation says toxicity confidence scoring is currently supported only for English.
The gateway is the control that carries the retention promise. It sends prompts to external models encrypted in flight and states that the calling model does not retain them, launching with OpenAI. A 2025 comparative study of enterprise assistants describes the same control, naming the Einstein Trust Layer as the foundation of Agentforce's zero-data-retention architecture.
The cited record describes distribution through the platform and names no separate sales motion for the line. Salesforce's annual report describes the Trust Layer as built into the platform to set guardrails on what AI agents do with customer data, and its training material describes the layer as the gateway sequence generative AI runs through.
Direct demand for the guardrail line is unproven in the cited record. Salesforce told TechCrunch it had established a trust partnership with OpenAI for joint content moderation alongside the layer, and its developer documentation names OpenAI as the model partner it launched with. No named customer of the line appears in the cited sources, so what the record shows is inclusion in the Salesforce AI stack rather than measured line-level adoption.
Nothing in the cited record establishes a field team, channel or pipeline for the line on its own. What the record establishes is that Salesforce builds the layer into the path its own AI calls take, and it does not measure line-level adoption or reach.
The cited record shows no standalone price for the Trust Layer. Salesforce describes the layer as built into the platform, and the Agentforce pricing page lists Agentforce pricing without disclosing the layer's licensing terms.
The published units are consumption and seats. The Agentforce pricing page offers Flex Credits or Conversations as consumption-based pricing plus per-user licensing, describes Conversations as flat-priced and optimized for external customer agents, and states that Flex Credits and Conversations are not supported in the same org.
The cited pages leave the layer's commercial treatment unresolved. A buyer therefore cannot weigh the layer against a focused third-party product on price.
Salesforce delivers the line inside its own platform rather than as infrastructure the customer runs. The layer evaluates each prompt and response on the path to the model, so it operates in the production request flow of the AI feature that invokes it.
The controls run inside Salesforce-managed workflows. Salesforce scores each generation for toxic content as it passes through, applies masking where the documentation says it is enabled, and records an audit trail of the interaction, the timestamped metadata the developer documentation lists.
Because Salesforce operates the safety checks, a customer runs no screening infrastructure of its own for them. That concentrates the buyer's AI safety operations on components Salesforce manages, which the cited record documents but does not size.
Salesforce makes its trust case with stated data controls and its platform standing. Salesforce states that prompts and generated responses are never stored or used to train the third-party models, and it records an audit trail of each interaction.
The capabilities map to the concerns generative AI raises for a regulated buyer. Masking targets data leakage to third-party models, toxicity detection targets unsafe output, and the audit trail targets the compliance record.
Verification of efficacy is the unresolved gap. The cited record carries no independent benchmark of masking or toxicity-detection quality, so a buyer choosing the built-in layer over a focused product is working from Salesforce's own assurances. Outside testing has landed on a different surface. Noma Security's ForcedLeak disclosure scored 9.4 for severity against Agentforce's web-to-lead path rather than against the masking or toxicity controls, and Salesforce then patched Agentforce and Einstein AI agents to send output only to allowlisted URLs.
The Einstein Trust Layer is a feature of a platform rather than a platform of its own. Salesforce's annual report states the layer is built into the platform to set guardrails on what AI agents do with customer data, so its value grows with Salesforce AI usage rather than with an ecosystem of its own.
The gateway extends Salesforce's reach across model providers. Salesforce says it launched with OpenAI, and VentureBeat describes the layer as letting customers integrate their preferred large language models into their chosen deployment environment, so Salesforce controls the connection between its data and whichever model a customer picks.
The ecosystem question for a buyer is concentration. Adopting the layer deepens reliance on Salesforce for AI safety. A 2025 comparative study shows Microsoft reaching the same retention guarantee through its own architecture, which is the alternative a buyer weighs.
Salesforce builds and operates the line rather than an identifiable standalone team, and its credibility comes from the company's broader AI platform engineering. Wikipedia describes Salesforce as best known for customer relationship management software delivered as a subscription service.
The documentation names the toxicity model, the size of its training set and each control separately. Salesforce Research trained that model on 2.3 million prompts from seven legal-approved datasets, and the masking, gateway and audit components carry their own documented mechanics.
That leaves Salesforce's platform organization and its shipping record as the evidence. TechCrunch quotes Adam Caplan, Salesforce's SVP of emerging technology, speaking for the line at its 2023 launch, and the cited record names no research or product owner of the Einstein Trust Layer itself.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Salesforce: Trusted AI key principles and how the Trust Layer works | official | 2026-08-28 |
| f2 | Wikipedia: Salesforce | press | 2026-08-28 |
| f3 | AI Defense Matrix Catalog: Einstein Trust Layer | official | 2026-08-28 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | Salesforce: Trusted AI key principles and how the Trust Layer works “The Trust Layer includes a number of data security guardrails such as data masking, TLS in-flight encryption, and Zero Data Retention with Large Language Models.” | official | 2026-08-28 |
| s2 | Salesforce Developers: Inside the Einstein Trust Layer “The Einstein toxicity detector uses a hybrid solution combining a rule-based profanity filter and an AI model developed by Salesforce Research (Transformer / Flan-T5-base model trained on 2.3 M prompts from seven legal-approved datasets).” | official | 2026-08-28 |
| s3 | Salesforce: Agentforce pricing “Choose from consumption-based pricing, with Flex Credits or Conversations, or per-user licensing — with options designed to fit how and where you deploy AI.” | official | 2026-08-28 |
| s4 | Salesforce Trailhead: Meet the Agentforce Trust Layer “In its simplest form, the Trust Layer is a sequence of gateways and retrieval mechanisms that together enable trusted and open generative AI.” | official | 2026-08-28 |
| s5 | TechCrunch: Salesforce launches AI Cloud to bring models to the enterprise “Salesforce is touting Einstein Trust Layer, a new AI moderation and redaction service. Similar to Nvidia's NeMo Guardrails, Einstein Trust Layer attempts to prevent text-generating models from retaining sensitive data, such as customer purchase orders and phone numbers.” | press | 2026-08-28 |
| s6 | VentureBeat: Salesforce announces AI Cloud to empower enterprises with trusted generative AI “Salesforce says that the Einstein Trust Layer aims to establish trust in enterprise generative AI by protecting sensitive data within AI applications and workflows.” | press | 2026-08-28 |
| s7 | arXiv: Zero Data Retention in LLM-based Enterprise AI Assistants, A Comparative Study of Market Leading Agentic AI Products “Both of these companies used distinct technical architecture to support zero data retention policies.” | research | 2026-08-28 |
| s8 | The Hacker News: Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection “The vulnerability has been codenamed ForcedLeak (CVSS score: 9.4) by Noma Security, which discovered and reported the problem on July 28, 2025.” | other | 2026-08-28 |
| s9 | U.S. SEC EDGAR: Salesforce, Inc. Form 10-K for the fiscal year ended January 31, 2026 “Our Trust Layer is built into the Platform to help customers safely use their data and set guardrails on what AI agents do with that data.” | regulatory | 2026-08-28 |
| s11 | arXiv: abstract page for Zero Data Retention in LLM-based Enterprise AI Assistants “[v1] Mon, 13 Oct 2025 16:00:34 UTC (545 KB)” | research | 2026-08-28 |
| s10 | Wikipedia: Salesforce “It is best known for customer relationship management software and related applications, which the corporation delivers through a software as a service subscription business model.” | press | 2026-08-28 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | Salesforce: Trusted AI key principles and how the Trust Layer works “The Trust Layer includes a number of data security guardrails such as data masking, TLS in-flight encryption, and Zero Data Retention with Large Language Models.” | official | 2026-08-28 |
| s2 | Salesforce Developers: Inside the Einstein Trust Layer “The Einstein toxicity detector uses a hybrid solution combining a rule-based profanity filter and an AI model developed by Salesforce Research (Transformer / Flan-T5-base model trained on 2.3 M prompts from seven legal-approved datasets).” | official | 2026-08-28 |
| s3 | Salesforce: Agentforce pricing “Choose from consumption-based pricing, with Flex Credits or Conversations, or per-user licensing — with options designed to fit how and where you deploy AI.” | official | 2026-08-28 |
| s4 | Salesforce Trailhead: Meet the Agentforce Trust Layer “In its simplest form, the Trust Layer is a sequence of gateways and retrieval mechanisms that together enable trusted and open generative AI.” | official | 2026-08-28 |
| s5 | TechCrunch: Salesforce launches AI Cloud to bring models to the enterprise “Salesforce is touting Einstein Trust Layer, a new AI moderation and redaction service. Similar to Nvidia's NeMo Guardrails, Einstein Trust Layer attempts to prevent text-generating models from retaining sensitive data, such as customer purchase orders and phone numbers.” | press | 2026-08-28 |
| s6 | VentureBeat: Salesforce announces AI Cloud to empower enterprises with trusted generative AI “Salesforce says that the Einstein Trust Layer aims to establish trust in enterprise generative AI by protecting sensitive data within AI applications and workflows.” | press | 2026-08-28 |
| s7 | arXiv: Zero Data Retention in LLM-based Enterprise AI Assistants, A Comparative Study of Market Leading Agentic AI Products “Both of these companies used distinct technical architecture to support zero data retention policies.” | research | 2026-08-28 |
| s8 | The Hacker News: Salesforce Patches Critical ForcedLeak Bug Exposing CRM Data via AI Prompt Injection “The vulnerability has been codenamed ForcedLeak (CVSS score: 9.4) by Noma Security, which discovered and reported the problem on July 28, 2025.” | other | 2026-08-28 |
| s9 | U.S. SEC EDGAR: Salesforce, Inc. Form 10-K for the fiscal year ended January 31, 2026 “Our Trust Layer is built into the Platform to help customers safely use their data and set guardrails on what AI agents do with that data.” | regulatory | 2026-08-28 |
| s11 | arXiv: abstract page for Zero Data Retention in LLM-based Enterprise AI Assistants “[v1] Mon, 13 Oct 2025 16:00:34 UTC (545 KB)” | research | 2026-08-28 |
| s10 | Wikipedia: Salesforce “It is best known for customer relationship management software and related applications, which the corporation delivers through a software as a service subscription business model.” | press | 2026-08-28 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.