Skip to main content
Salesforce logo

Salesforce

PCI DSS evidence

Salesforce, Inc. is an American enterprise software company headquartered in San Francisco, California

salesforce.comCRMLast verified 3 Nov 2026
Request the report Are you Salesforce?
PCI DSS mark, CertReports state Verified as of 2 Nov 2026Verified

Salesforce and PCI DSS

Salesforce is listed in the Visa Global Registry of Service Providers for PCI DSS (Listed on the Visa Global Registry as PCI DSS validated through 2027-07-31), dated 22 Jan 2016, assessed by VikingCloud, Inc.. CertReports last verified this on 2 Nov 2026 from the registry.

Evidence

VerifiedListed on the Visa Global Registry as PCI DSS validated through 2027-05-31
as of 2 Nov 2026 · confidence 100%
Kind
Attestation
Issued or listed
8 Jul 2020
Expires or valid through
31 May 2027
Auditor or assessor
BroadBand Security, Inc. (BBSec)
Scope
PAYMENT FACILITATOR
SourceCapturedQuoteLinks
Visa Global Registry of Service Providers
Official registry · HTTP 200
2 Nov 2026ILK KOREA Co., Ltd.: PCI DSS, assessor BroadBand Security, Inc. (BBSec), valid through 2027-05-31
Live pagesha256 719c204fdd
Visa Global Registry of Service Providers
Official registry · HTTP 200
26 Oct 2026ILK KOREA Co., Ltd.: PCI DSS, assessor BroadBand Security, Inc. (BBSec), valid through 2027-05-31
Live pagesha256 18bc059f1c
Visa Global Registry of Service Providers
Official registry · HTTP 200
19 Oct 2026INTERSWITCH EAST AFRICA UGANDA LIMITED: PCI DSS, assessor CYBERVERGENT LIMITED, valid through 2026-12-31
Live pagesha256 fece02edef
Visa Global Registry of Service Providers
Official registry · HTTP 200
5 Oct 2026Salesforce, Inc.: PCI DSS, assessor VikingCloud, Inc., valid through 2027-07-31
Live pagesha256 f75e8ad4b6
This is wrong
VerifiedListed on the Visa Global Registry as PCI DSS validated through 2027-04-30
as of 2 Nov 2026 · confidence 100%
Kind
Attestation
Issued or listed
26 Jan 2015
Expires or valid through
30 Apr 2027
Auditor or assessor
A-LIGN Compliance and Security, Inc., dba A-LIGN
Scope
THIRD PARTY SERVICER
SourceCapturedQuoteLinks
Visa Global Registry of Service Providers
Official registry · HTTP 200
2 Nov 2026Mission Lane LLC.: PCI DSS, assessor A-LIGN Compliance and Security, Inc., dba A-LIGN, valid through 2027-04-30
Live pagesha256 b80dfb3fdb
Visa Global Registry of Service Providers
Official registry · HTTP 200
26 Oct 2026Mission Lane LLC.: PCI DSS, assessor A-LIGN Compliance and Security, Inc., dba A-LIGN, valid through 2027-04-30
Live pagesha256 2f1ce451f2
Visa Global Registry of Service Providers
Official registry · HTTP 200
19 Oct 2026Stripe Payment (Thailand) Ltd.: PCI DSS, assessor Coalfire Systems, Inc, valid through 2027-03-31
Live pagesha256 ffcc2929a0
Visa Global Registry of Service Providers
Official registry · HTTP 200
12 Oct 2026Salesforce, Inc.: PCI DSS, assessor VikingCloud, Inc., valid through 2027-07-31
Live pagesha256 fa0e1e4585
This is wrong
VerifiedListed on the Visa Global Registry as PCI DSS validated through 2027-07-31
as of 2 Nov 2026 · confidence 100%
Kind
Attestation
Issued or listed
22 Jan 2016
Expires or valid through
31 Jul 2027
Auditor or assessor
VikingCloud, Inc.
Scope
MERCHANT SERVICER - VISA
SourceCapturedQuoteLinks
Visa Global Registry of Service Providers
Official registry · HTTP 200
2 Nov 2026Salesforce, Inc.: PCI DSS, assessor VikingCloud, Inc., valid through 2027-07-31
Live pagesha256 534a54f7e3
Visa Global Registry of Service Providers
Official registry · HTTP 200
26 Oct 2026Salesforce, Inc.: PCI DSS, assessor VikingCloud, Inc., valid through 2027-07-31
Live pagesha256 1705667541
This is wrong
VerifiedListed on the Visa Global Registry as PCI DSS validated through 2027-07-31
as of 19 Oct 2026 · confidence 100%
Kind
Attestation
Issued or listed
22 Jan 2016
Expires or valid through
31 Jul 2027
Auditor or assessor
VikingCloud, Inc.
Scope
MERCHANT SERVICER - VISA
SourceCapturedQuoteLinks
Visa Global Registry of Service Providers
Official registry · HTTP 200
19 Oct 2026Salesforce, Inc.: PCI DSS, assessor VikingCloud, Inc., valid through 2027-07-31
Live pagesha256 b6d1536f9f
This is wrong

What is not public

  • The Visa registry lists the assessor and the date the validation runs through, not the services in scope of the attestation of compliance.
What PCI DSS means, and what it does not

Only a registry listing (Visa Global Registry, Mastercard SDP) or an AOC letter is strong evidence. In the Visa registry only rows validated as PCI DSS with a validation date count; Third Party Agent registrations are not PCI evidence.

Read the PCI DSS guide and browse all vendors with evidence

Questions buyers ask

Is Salesforce PCI DSS compliant?

Salesforce is listed as a PCI DSS validated service provider, assessed by VikingCloud, Inc., valid through 31 Jul 2027, as of 2 Nov 2026.

How does CertReports verify this?

Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.

Change history

  1. 29 Sep 2026PCI DSS evidence addedA PCI DSS row entered the index with state Verified.
  2. 19 Sep 2026First indexed by CertReports1 evidence row across 1 framework entered the index.

Alternatives with PCI DSS evidence

Similar vendors (shared product tags or the CRM category) whose PCI DSS row is verified or vendor-stated, ranked by similarity.

No CRM vendor has PCI DSS evidence in the index yet.

Understand PCI DSS evidence

All articles