Salesforce maintains a comprehensive set of compliance certifications and attestations to validate our #1 value of Trust.
Vulnerability/Penetration Report Summary - Quip
Attestation of the latest vulnerability test. It does not contain details of vulnerabilities or findings and is intended only to provide information on the tests performed and scope of testing. Vulnerabilities discovered during testing are tracked and resolved in accordance with corporate policy and industry best practice. A third party assessment of vulnerability management and resolution process can be found in the SOC 2 report.