Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This is Salesforce's official sub-processor and infrastructure disclosure list, identifying every third-party entity and Salesforce affiliate authorized to process Customer Data across Salesforce's product portfolio as of June 19, 2026. The document discloses that Amazon Web Services, Microsoft Corporation (Azure), Google LLC, OpenAI, Akamai Technologies, and Cloudflare, among others, process Customer Data for hosting, generative AI inference, content delivery, and analytics purposes, with some CDN providers designated as 'Global,' meaning Customer Data may transit any country regardless of the customer's selected region. The document also states that in the event of an OpenAI service failover, Customer Data is temporarily re-routed to a Microsoft Azure endpoint, with priority given to the customer's provisioned region subject to availability, a condition that may affect data residency commitments for customers with strict localization requirements.
This document is Salesforce's sub-processor and infrastructure disclosure list, published June 19, 2026, governing the processing and storage of Customer Data across Salesforce's portfolio of covered services, with stated legal basis in Salesforce's Master Subscription Agreement and Data Processing Addendum. The document discloses that Customer Data may be processed by a global network of Salesforce-affiliated legal entities, hyperscale cloud providers including Amazon Web Services, Microsoft Azure, and Google LLC, and specialized third-party sub-processors for functions including generative AI inference, text-to-speech, speech-to-text, translation, content delivery, security scanning, and analytics, with processing locations varying by service, feature enablement, and customer-selected region. Notably, several services authorize cross-regional data flows as a function of feature enablement rather than explicit customer election: for example, Einstein Bots NLP functionality routes Customer Data to regions determined by the customer's org location rather than a separate regional selection, and OpenAI failover routing temporarily redirects Customer Data to Microsoft Azure endpoints regardless of the customer's provisioned region. The document engages the EU General Data Protection Regulation, the UK GDPR, and data residency frameworks applicable across the Asia-Pacific, Middle East, and Americas regions, with heightened compliance exposure for customers in regulated industries such as financial services, healthcare, education, and government, particularly where sub-processor chains include global CDN providers described as processing data 'in any country' and generative AI providers operating with failover routing that may cross jurisdictional boundaries.
The document establishes that Customer Data processed through Salesforce's covered services may be handled by a multi-tiered network of sub-processors spanning cloud infrastructure providers, generative AI services, content delivery networks, and specialized vendors, with the specific processors and locations depending on which services and features a customer has enabled. Under these terms, enabling features such as Einstein Bots NLP, Einstein Conversation Insights, Agentforce Speech Foundations, or generative AI capabilities introduces additional sub-processors and may route Customer Data to regions beyond the customer's primary provisioned location. The document states that customers may subscribe to notifications of new sub-processors for active subscriptions by completing a designated form, and may contact their Account Executive or Customer Support regarding data hosting region preferences.
Which mapped governance frameworks each document engages, tied to the specific provisions that engage them.
We withheld clauses we had published from this document. Each withholding is recorded in our correction log:
“Some Services run primarily on one infrastructure, but have some features that run partly or entirely on different infrastructures. For example, for many Customers, most Sales Cloud features run on the Salesforce's first-party infrastructure, but Sales Cloud also includes Einstein1 …”
“In addition to the locations identified in the below Infrastructure and Sub-processors tables, Salesforce may store across its processing locations identifying information about Customers' instance(s) and identifying information about Users for the purpose of operating the Services, such as facilitating …”
“Due to the ongoing situation in the Middle East, orgs hosted in the UAE as well as new trial org sign ups and Scratch Orgs from Lebanon, Bahrain, Oman, Jordan, Qatar, Kuwait, Egypt, or the UAE will be routed to …”
“Salesforce Customers may subscribe to notifications of new sub-processors for those Covered Services for which Customer has a then-current active subscription by filling out this form.”
“When a Service offers alternative locations to process/and or store data, the Customer may be able to choose their region during the setup process or by working with an Account Executive. … You may also request to have your Customer …”
“Services or features not yet generally available may be included within the list of Covered Services for the purpose of providing Customers advance notice of new sub-processors or processing locations. Any reference to future services or features does not obligate …”
We have not recorded a change to this document since we began capturing it. Monitor includes alerts from a daily check, structured change summaries, and monitoring for up to 20 platforms.
Need provision-level monitoring and regulatory mapping? Insight includes governance timelines, drift analysis, and full provision tracking.
Cross-platform context
See how other platforms handle Feature-Triggered Sub-processor Activation and Cross-Regional Data Flows and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 343 platforms.