This provision discloses that identifying information about customer instances and users may be stored across Salesforce's global processing locations for operational purposes including login facilitation and customer support, independent of the customer's selected region, with a specific exception for Government Cloud Plus services where such information is one-way hashed before leaving designated data centers.
This analysis describes what Slack's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that a category of data, specifically identifying information about customer instances and users, may be processed across Salesforce's global infrastructure regardless of the customer's selected regional configuration, representing a processing pathway that falls outside the scope of regional selection controls disclosed elsewhere in the document.
Interpretive note: The document does not define the precise scope of 'identifying information about Customers' instance(s) and identifying information about Users,' leaving ambiguity about whether this category encompasses personal data as defined under GDPR or equivalent frameworks.
Under this clause, identifying information about users and customer instances may be stored outside the customer's selected processing region for operational purposes, as stated in the document. The document also states that this storage is conducted across Salesforce's processing locations, which include the global network of Salesforce affiliates and sub-processors listed in the document.
Cross-platform context
See how other platforms handle Identifying Information Storage Outside Provisioned Region and similar clauses.
Compare across platforms →"In addition to the locations identified in the below Infrastructure and Sub-processors tables, Salesforce may store across its processing locations identifying information about Customers' instance(s) and identifying information about Users for the purpose of operating the Services, such as facilitating the login process and the provision of customer support. For the Government Cloud Plus and Government Cloud Plus - Defense Services, this information (except for business address) will be encrypted with a one-way hash algorithm before it leaves the Government Cloud Plus and Government Cloud Plus - Defense-specific data centers, rendering it unreadable to Salesforce and its cloud providers.Excerpt from Slack's Sub-Processors (Salesforce)
(1) REGULATORY LANDSCAPE: This provision engages GDPR and equivalent data protection frameworks applicable to the processing of personal data, specifically in the context of operational data flows that occur outside the primary data residency configuration.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that a category of data, specifically identifying information about customer instances and users, may be processed across Salesforce's global infrastructure regardless of the customer's selected regional configuration, representing a processing pathway that falls outside the scope of regional selection controls disclosed elsewhere in the document.
Under this clause, identifying information about users and customer instances may be stored outside the customer's selected processing region for operational purposes, as stated in the document. The document also states that this storage is conducted across Salesforce's processing locations, which include the global network of Salesforce affiliates and sub-processors listed in the document.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Slack.