Compliance engineered for the Cloud

Salesforce maintains a comprehensive set of compliance certifications and attestations to validate our #1 value of Trust.

B2C Commerce / Commerce Cloud

Applicable to the services branded as B2C Commerce/Commerce Cloud, Einstein Predictive Sort.

Some specific certifications and reports may not apply to all services in the above list. Please refer to the "Audits and Certifications" section of the "Salesforce Security, Privacy and Architecture" document for any limitations.

Applicable documents by category

Filter this list

Sort by Updated On
Name Salesforce EU Processor Binding Corporate Rules	Updated On 2023-06-02	Infrastructure First party, AWS, Hyperforce	Category Salesforce BCRs
Name Salesforce Distributed Denial of Service (DDoS) Risk Mitigation Overview	Updated On 2023-05-17	Infrastructure First party, AWS	Category FAQ's and White Papers
Name Salesforce Ransomware Mitigation Summary	Updated On 2023-04-13	Infrastructure First party, AWS, Hyperforce	Category FAQ's and White Papers
Name Salesforce UK Processor Binding Corporate Rules	Updated On 2023-04-11	Infrastructure First party, AWS, Hyperforce	Category Salesforce BCRs
Name SOC 1 Bridge (Gap) Letter - Commerce Cloud	Updated On 2023-03-31	Infrastructure First party	Category SOC 1
Name ISO Statement of Applicability - v3.2 (English)	Updated On 2023-02-07	Infrastructure First party, AWS, Hyperforce	Category ISO 27001
Name ISO Statement of Applicability - V3.2 (French)	Updated On 2023-02-07	Infrastructure First party, AWS, Hyperforce	Category ISO 27001
Name ASIP Santé HDS Certificate	Updated On 2023-02-06	Infrastructure First party, AWS, Hyperforce	Category ASIP Santé HDS
Name ISO 27001:2013 Certificate	Updated On 2023-02-06	Infrastructure First party, AWS, Hyperforce	Category ISO 27001
Name ISO 27017:2015 Certificate	Updated On 2023-02-06	Infrastructure First party, AWS, Hyperforce	Category ISO 27017
Name ISO 27018:2019 Certificate	Updated On 2023-02-06	Infrastructure First party, AWS, Hyperforce	Category ISO 27018
Name NEN 7510-1:2017 Certificate	Updated On 2023-02-06	Infrastructure First party, AWS, Hyperforce	Category NEN 7510
Name HITRUST Certificate - Salesforce Services on Hyperforce	Updated On 2022-12-15	Infrastructure Hyperforce	Category HITRUST
Name Salesforce Vulnerability Management Program Overview	Updated On 2022-12-12	Infrastructure First party, AWS, Hyperforce	Category FAQ's and White Papers
Name SOC 1 Report - Commerce Cloud	Updated On 2022-12-05	Infrastructure First party	Category SOC 1
Name SOC 1 Report - Corporate Services	Updated On 2022-12-05	Infrastructure First party, AWS, Hyperforce	Category SOC 1
Name SOC 2 Report - Commerce Cloud	Updated On 2022-12-05	Infrastructure First party	Category SOC 2
Name SOC 2 Report - Corporate Services	Updated On 2022-12-05	Infrastructure First party, AWS, Hyperforce	Category SOC 2
Name SOC 3 Report - Commerce Cloud	Updated On 2022-12-05	Infrastructure First party	Category SOC 3
Name Vulnerability/Penetration Report Summary - Commerce Cloud Order Management + OCI	Updated On 2022-11-08	Infrastructure First party	Category External Security Assessments
Name Salesforce Security (Incident) Response Plan	Updated On 2022-11-01	Infrastructure First party, AWS, Hyperforce	Category FAQ's and White Papers
Name Salesforce Security (Incident) Response Plan (Japanese)	Updated On 2022-10-04	Infrastructure First party, AWS, Hyperforce	Category FAQ's and White Papers
Name Salesforce Third Party Risk Management Overview	Updated On 2022-09-29	Infrastructure First party, AWS, Hyperforce	Category FAQ's and White Papers
Name Vulnerability/Penetration Report Summary - B2C Mobify	Updated On 2022-08-10	Infrastructure AWS	Category External Security Assessments
Name UK Cyber Essentials Plus Certificate	Updated On 2022-08-08	Infrastructure First party, AWS, Hyperforce	Category UK Cyber Essentials Plus
Name Security Perspective on the Shared Responsibility Model (Japanese)	Updated On 2022-08-02	Infrastructure First party, AWS, Hyperforce	Category FAQ's and White Papers
Name PCI Responsibility Matrix - Commerce Cloud	Updated On 2022-08-01	Infrastructure First party	Category PCI DSS
Name PCI Attestation of Compliance (AoC) - Commerce Cloud	Updated On 2022-07-20	Infrastructure First party	Category PCI DSS
Name Vulnerability/Penetration Report Summary - 1CB2C (One Commerce)	Updated On 2022-07-12	Infrastructure First party	Category External Security Assessments
Name Vulnerability/Penetration Report Summary - B2C Business Manager + OCAPI	Updated On 2022-05-12	Infrastructure First party, AWS	Category External Security Assessments
Name Security Perspective on the Shared Responsibility Model	Updated On 2022-03-10	Infrastructure First party, AWS, Hyperforce	Category FAQ's and White Papers
Name SOC 2 Report - Mobify (Commerce Cloud Managed Runtime)	Updated On 2022-01-18	Infrastructure First party	Category SOC 2
Name SOC 2 Report - Commerce Cloud Order Management	Updated On 2021-12-14	Infrastructure First party	Category SOC 2
Name SOC 3 Report - Commerce Cloud Order Management	Updated On 2021-12-14	Infrastructure First party	Category SOC 3
Name Vulnerability Management and Response Plan Summary	Updated On 2021-09-27	Infrastructure First party, AWS, Hyperforce	Category FAQ's and White Papers
Name Vulnerability/Penetration Report Summary - Omni Channel Inventory	Updated On 2021-09-01	Infrastructure AWS, Hyperforce	Category External Security Assessments
Name Salesforce Secure Development Lifecycle Overview	Updated On 2021-05-25	Infrastructure First party, AWS, Hyperforce	Category FAQ's and White Papers
Name BCP Summary	Updated On 2020-12-08	Infrastructure First party, AWS, Hyperforce	Category Disaster Recovery & BCP
Name International Transfers of EU Personal Data to Salesforce's Services FAQ	Updated On 2020-07-16	Infrastructure First party, AWS, Hyperforce	Category Privacy Shield
Name APEC Processor Seal - Salesforce	Updated On 2020-07-10	Infrastructure First party, Hyperforce	Category APEC Certification for Processors and Controllers
Name DR/BCP Summary - Commerce Cloud	Updated On 2020-04-13	Infrastructure First party	Category Disaster Recovery & BCP
Name [Whitepaper] Salesforce And The HIPAA Security Rule: Securing EPHI In The Cloud	Updated On 2019-11-01	Infrastructure First party, AWS, Hyperforce	Category HIPAA
Name [Video] Salesforce And The HIPAA Security Rule: Securing EPHI In The Cloud	Updated On 2019-01-16	Infrastructure First party, AWS, Hyperforce	Category HIPAA
Name GDPR - Data Protection Impact Assessments & Salesforce Services	Updated On N/A	Infrastructure First party, AWS, Hyperforce	Category GDPR