## SALESFORCE.COM ("SALESFORCE") PLATFORM SECURITY OVERVIEW

Salesforce understands that the confidentiality, integrity, and availability of customers' information are vital to such customer's business operations and Salesforce's own success. Salesforce uses a multi-layered approach to protect that key information, constantly monitoring and improving its application, systems, and processes to meet the growing demands and challenges of security.

## SECURE DATA CENTERS.

Salesforce's Service is co-located in dedicated spaces at top-tier data centers. These facilities provide carrier-level support, including:

## 1. Access control and physical security.

- 24-hour manned security, including foot patrols and perimeter inspections
- Biometric scanning for access
- Dedicated concrete-walled Data Center rooms
- Computing equipment in access-controlled steel cages
- Video surveillance throughout facility and perimeter
- Building engineered for local seismic, storm, and flood risks
- Tracking of asset removal

## 2. Environmental controls.

- Humidity and temperature control
- Redundant (N+1) cooling system

## 3. Power.

- Underground utility power feed
- Redundant (N+1) CPS/UPS systems
- Redundant power distribution units (PDUs)
- Redundant (N+1) diesel generators with on-site diesel fuel storage

## 4. Network.

- Concrete vaults for fiber entry
- Redundant internal networks
- Network neutral; connects to all major carriers and located near major Internet hubs
- High bandwidth capacity

## 5. Fire detection and suppression.

- VESDA (very early smoke detection apparatus)
- Dual-alarmed, dual-interlock, multi-zone, pre-action dry pipe water-based fire suppression

## 6. Secure transmission and sessions.

- Connection to the Salesforce environment is via SSL 3.0/TLS 1.0, using global step-up certificates from Verisign, ensuring that Our Users have a secure connection from their browsers to Our Purchased Services

* * *

- Individual User sessions are identified and re-verified with each transaction, using a unique token created at login

## 7. Network protection.

- Perimeter firewalls and edge routers block unused protocols
- Internal firewalls segregate traffic between the application and database tiers
- Intrusion detection sensors throughout the internal network report events to a security event management system for logging, alerts, and reports
- A third-party service provider continuously scans the network externally and alerts changes in baseline configuration

## 8. Disaster Recovery.

- The Salesforce service performs real-time replication to disk at each data center, and near real-time data replication between the production data center and the disaster recovery center
- Data are transmitted across encrypted links
- Disaster recovery tests verify our projected recovery times and the integrity of the customer data

## 9. Backups.

- All data are backed up to tape at each data center, on a rotating schedule of incremental and full backups
- The backups are cloned over secure links to a secure tape archive
- Tapes are not transported offsite and are securely destroyed when retired

## 10. Internal and Third-party Testing and Assessments.

Salesforce tests all code for security vulnerabilities before release, and regularly scans its network and systems for vulnerabilities. Third-party assessments are also conducted regularly for:

- Application vulnerability threat assessments
- Network vulnerability threat assessments
- Selected penetration testing and code review
- Security control framework review and testing

## 11. Security Monitoring.

Our Information Security department monitors notification from various sources and alerts from internal systems to identify and manage threats.