Is Salesforce Einstein safe with your data?
Salesforce Einstein
Salesforce
Good disclosure · high confidence
Largely yes. Salesforce Einstein earns a B (83/100) for what it discloses about your data: the Trust Layer states that zero data retention is a strict policy: prompts and generated responses are never stored or used to train the underlying third-party large language models, and PII is masked before the prompt reaches the model.
#5
of 69 apps ranked
83
score · Enterprise copilot avg 60
+23
vs category average
Salesforce Einstein sits at the top of the B band because it guarantees zero data retention for AI prompts, states clearly that the customer owns the data, and lists every data-subject right. It misses an A because controller-side retention timing is vague, the security language is generic, and the policy is silent on breach notification and government access standards.
What Salesforce Einstein's privacy policy says about your data
AI prompts never stored or trained on
The Trust Layer states that zero data retention is a strict policy: prompts and generated responses are never stored or used to train the underlying third-party large language models, and PII is masked before the prompt reaches the model.
Customer owns the data and outputs
Salesforce commits that the data it manages does not belong to Salesforce, it belongs to the customer. Permission-aware dynamic grounding then limits the model to customer-approved sources.
Full rights and named transfer safeguards
Section 10 grants access, rectification, erasure, restriction, portability, and objection. Section 7 names SCCs under Article 46 plus EU-US, Swiss-US, and UK DPF certification for international transfers.
Weak spots on retention timing and breach notice
Controller-side retention is described only as 'as long as required' with deletion after applicable retention periods and no number, security is described in generic terms, and the policy says nothing about breach notification or any government access standard.
What the policy is silent or vague on
- Doesn't clearly: says whether training use differs by plan or tier
- Doesn't clearly: states a standard for government and law-enforcement access
- Doesn't clearly: commits to breach notification
- Only partly: states a deletion timeline after closure or request
Salesforce Einstein privacy rating
Details
- Category
- Enterprise copilot
- Modalities
- text
- Processes biometrics
- No
- Policy last updated
- 2026-05-19
- Region scored
- Global / US-default
- Assessed
- 2026-06-20
Each grade reflects our analysis of what an app states in its public privacy policy and terms as of the assessment date. It measures the transparency of those documents, not the company's actual data practices, security, or compliance. Grades are our opinion, offered for general information. Full disclaimer.