Explainers
What Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
Salesforce
GDPR evidence
Salesforce, Inc. is an American enterprise software company headquartered in San Francisco, California
No public evidenceSalesforce and GDPR
CertReports found no public GDPR evidence for Salesforce as of unknown date. This does not mean the vendor is non-compliant. It means CertReports found no public evidence at the last check.
Evidence
VerifiedActive: EU-US Certification, SW-US Certification, UK Extension Certification
as of 2 Nov 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 22 May 2018
- Expires or valid through
- 14 May 2027
- Scope
- ClickSoftware processes personal data of our customers and their personnel and end users of our software. The purpose of processing is to provide our services, operate our applications and websites, and for other purposes described in our privacy policies. We disclose personal data to service providers and business partners, as described in our privacy policies.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 2 Nov 2026 | ClickSoftware, Inc.: Active: EU-US Certification, SW-US Certification, UK Extension Certification | Live pagesha256 9919d86847 |
VerifiedActive: EU-US Certification, UK Extension Certification, SW-US Certification
as of 2 Nov 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 12 Aug 2016
- Expires or valid through
- 6 Oct 2027
- Scope
- Salesforce provides online tools that our customers use to communicate and operate aspects of their businesses. These include tools for customer relationship management, customer service, social engagement, community building, data analytics, internal employee management, communications and file management, and platforms for building online applications, among others. In providing these tools, Salesforce processes data our customers submit to our services or instruct us to process on their behalves. While Salesforce's customers decide what data to submit, it typically includes information about their customers, sales leads, prospects, employees, and users of online tools, such as contact information and billing information. Salesforce also processes personal data in connection with its internal business operations and interactions with individuals. This includes HR-data related to employees (current and former), contingent workers, and candidates in the context of their employment relationship, engagement, or application for a role at Salesforce. Additionally, Salesforce processes non-HR personal data relating to customers and prospects, website and community users, event attendees, business partners, and other business contacts in order to communicate for sales and marketing purposes, including by displaying personalized advertisements and content. Salesforce may also process personal data in connection with evaluating or completing potential corporate transactions, including mergers, acquisitions, investments, and related due diligence activities. Salesforce uses third-party service providers to assist us in providing our services to customers and supporting our business operations. These third party providers may offer customer support to our customers; perform database monitoring and other technical operations; assist with the transmission, hosting, and storage of data; support marketing, analytics, and event management activities; provide professional advice; and perform other business support functions, including HR-related functions such as benefits administration and background checks. These third parties may access, process, or store personal data in the course of providing their services. Salesforce maintains contractual protections governing their access to, use of, and disclosure of personal data in accordance with applicable Data Privacy Framework obligations.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 2 Nov 2026 | Salesforce: Active: EU-US Certification, UK Extension Certification, SW-US Certification | Live pagesha256 c89d0a9bb6 |
Data Privacy Framework list Official registry · HTTP 200 | 12 Oct 2026 | Salesforce: Inactive | Live pagesha256 e4383e491d |
Data Privacy Framework list Official registry · HTTP 200 | 5 Oct 2026 | Salesforce: Active: EU-US Certification, UK Extension Certification, SW-US Certification | Live pagesha256 f862b9af1b |
ExpiredInactive
as of 2 Nov 2026 · confidence 100%- Kind
- Listing
- Scope
- : • Soy el propietario beneficiario (o estoy autorizado para firmar en representación del beneficiario) de todos los ingresos a los cuales se refiere este formulario o estoy usando este formulario para hacer constar tal capacidad conforme a los efectos del capítulo 4, • La persona mencionada en la línea 1 de este formulario no es de nacionalidad estadounidense, • Los ingresos a los que se refiere este formulario: (a) no están efectivamente relacionados con la realización de un negocio o actividad comercial en los Estados Unidos, (b) están efectivamente relacionados pero no están sujetos a impuestos conforme a un tratado sobre impuesto a las ganancias, o (c) corresponden a la participación de un socio en los ingresos efectivamente relacionados con la sociedad, • La persona mencionada en la línea 1 de este formulario reside en un país comprendido en el tratado indicado en la línea 9 del formulario (si hubiese), según el significado del tratado fiscal de ingresos celebrado entre los Estados Unidos y ese país, y • En el caso de transacciones de agentes o permutas, el propietario beneficiario es una persona extranjera exenta según se define en las instrucciones. Además, autorizo que se entregue el presente formulario a cualquier agente de retención que controle, reciba o custodie los ingresos de los cuales soy el propietario beneficiario
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 2 Nov 2026 | gzmecrs1world: Inactive | Live pagesha256 a1198e720d |
ExpiredInactive
as of 2 Nov 2026 · confidence 100%- Kind
- Listing
- Scope
- UK attempting to take over Google slowly . My device api running of a opengi.search. its installed all of my company ip . As well there the sole enitity that been hacking Google sever . There move to take over Google search engines is illegal and i as a Google executive do not expect http://opengi.to (http://opengi.to) run on Android devices . opengi is in violation of there own dmca law for there silent attempts for a hostel takeover of the android google search engine. Google it is inpartive that you in the next-gen update that you block all 3 party software to run on your devices . As well i authorize for Google to role out a gen 8 pressing chip set that will gives customers a wide range of search engine that Google and android developers. In United States Google and Apple and Samsung, nexus are the flag ship device to others carriers should be allowed to use are broadband marke because of reason of trust has been broken by India and UK attempt at hostel takeover of united state communications lines . Allow me to be frank Pamela Harris . Your duty was to America and there Americans people and are congress . Once you become vp your duty to your country was over. Any assets you moved out of Google with Ali latif i want returned and i will downgrad me investigator posture. If you do not comply and do not receive the support i need a full Bipartisan criminal investigation oversight sub committee will be drafted up . This subcommittee will not be looking into president joe Biden admin. It will targets your admin. We the people find that president joe Biden is a honanble president . As well as commanders trump is a good leader . What are committee is not interested in is the running mate chief executive relay on to help them run there administration. When a administration fail it we believe is because internal entities was working against that president or company . If a org goes bankrupt i believe because there heads of state wasn't giving proper analysis of the org stustus. If they was im 100 % positive say trumps or bush would of made adjustment to combat situations on the ground. I do not believe for one minute that Harvard graduates lost the ability to lead when all there lives they tried to lead . Meaning internally that where the problem lay in any company. In Google its the Indian CEO ali Latif that do not belong. In congress its the southern Baptist thats the main issue. Mixing church and state don't work. In the white house its probably the secretary of state will have the most power to do the most damage to a administration. I believe in most industry there are to many Indain and not enough chiefs . Meaning the world has to downsize on the amounts of heads of state . The secretary of state office need to be in the white house. To the Global world understand that i am united state eye's and ears . I can see all and here everything anywhere around the would . Uk us needs you to return dmca back to Russia asap . For you took that provider off the json server. That was gifted to Russia to help me work on a international light on platform the willl helps with Uriope lighting issue . As well give them opengi because open gi is dmca . That cost Google billions . Return those items and there will be peace . My name is warith akbar/ warithuddin Akbar. Open Source assets are my wisleblowing platform. As well as the software creative common places as free on there lisance is illegal. Creative common is in none complacence and do not represent Google in any form or way do not donate or download any of there certificate . I warith Akbar fine creative common a billion dollar. And is authorizing that Russia the real DMCA leaders to block creative common from Google. And from operating inside of Google space. Russia I trust that you will hold this role with honor . You are to report to the the state department with this letter of approval and they will authentic this message. The threat is within you claim
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 2 Nov 2026 | Salesforce: Inactive | Live pagesha256 653a95258f |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Salesforce GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 19 Sep 2026First indexed by CertReports1 evidence row across 1 framework entered the index.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the CRM category) whose GDPR row is verified or vendor-stated, ranked by similarity.
No CRM vendor has GDPR evidence in the index yet.
Understand GDPR evidence
All articlesHow-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read