Salesforce
Salesforce, Inc., San Francisco; in Germany salesforce.com Germany GmbH, Munich ·www.salesforce.com· As of: 2026-09-28
Work through this tool with an AI
Our verdict
A well-run CRM is basic equipment in sales. Forecasting, pipeline hygiene and handovers between marketing, sales and service then run in a shape every successor knows. Competitors buy the same licence at the same list price. Differences arise in your own data model and the rules running on it, and those are built in the project. According to the vendor's own security documentation, the two low-priced suites sit outside its ISO, SOC and C5 attestations. And since 3 September 2026 the enterprise editions are called Core, Advanced and Max. Core and Advanced cost 20 and 45 US dollars more than Enterprise and Unlimited, while Max keeps the price of Agentforce 1.
Evidence:Main services agreement in its version of 1 September 2026: incorporation of the data processing agreement in section 2.2, acceptance of the agreement counting as signature of the standard contractual clauses, provision of customer data on request within 30 days of termination, AI features in section 2.5 with processing only on the customer's documented instructions and a reference to the Trusted AI resources, automatic one-year renewal with 30 days' notice and re-pricing on reduced volume in section 11.2Open sourceData processing agreement, revision August 2026: subprocessor documentation as the binding list with notification by subscription in section 5.2, 30-day objection period in section 5.3, government requests in section 8, the commitment to contest an order to cease operations in section 12.5, return and deletion per the security documentation in section 9, binding corporate rules and standard contractual clauses modules 2 and 3 in section 12.4, effectiveness under section 14, and the signature of salesforce.com Germany GmbHOpen sourceSecurity documentation of 22 September 2026: ISO 27001/27017/27018, SOC 1 to 3, C5, HITRUST and PCI DSS attestations with express exclusion of Salesforce Starter, Salesforce ProSuite and Salesforce Foundations as well as individual components such as Tableau Next and Backup and Recover, access logs and a 90-day minimum log retention, the Setup Audit Trail, return within 30 days and a deletion schedule of 120, 90 and 180 days including the proviso that it may be shortenedOpen sourceSubprocessor documentation of 22 September 2026: regions of the Salesforce Services with Germany as EU primary region and France as failover region, Account Intelligence and Einstein Opportunity Scoring on Amazon Web Services in the United States alone and on by default for new customers, OpenAI as generative AI provider located in the United States, notification through a formOpen sourceEinstein Platform Notices and License Information of 22 May 2026: contractual commitment by OpenAI, Azure, Google and Anthropic on AWS not to retain or use customer data beyond automated abuse screening, and the permission for the vendor's employees to review recordings and transcripts in Einstein Conversation Insights to improve and train the productOpen sourceEinstein Platform security documentation of 24 July 2026 with the ISO/IEC 42001 certification of Agentforce and EinsteinOpen sourceGerman pricing page: free suite, Starter Suite 25 euros, Pro Suite 100 euros, Core 195 euros, Advanced 395 euros and Max 550 euros per user per month, annual billing from Pro Suite upwards, APIs included from Core and available below that for 25 euros, Max with 2.75 million Flex Credits per org and year, a note on annual contracts and on the page serving information only; the FAQ on the same page still names Enterprise, Unlimited and Agentforce 1 SalesOpen sourceAnnouncement of 3 September 2026 on the new Core, Advanced and Max editions at 195, 395 and 550 US dollars, Max with zero pricing change against Agentforce 1, the Flex Credit allowances, and unchanged prices for existing customers on legacy editionsOpen sourcePrice change effective 1 August 2025: list prices for Enterprise and Unlimited of Sales Cloud, Service Cloud, Field Service and selected industry clouds up 6 per cent on average, no change for Foundations, Starter and ProOpen sourceShield pricing page stating 30 per cent of net spend for encryption, lifetime field audit trail and event monitoringOpen sourceVendor help article on Field Audit Trail: field history for 18 to 24 months and 20 fields per object, permanent field history with up to 200 fields per object with Shield or a separate Field Audit Trail licenceOpen sourceResults release of 25 February 2026 for fiscal 2026 with revenue of 41.5 billion US dollars and the figures on Informatica and AgentforceOpen sourceCompletion of the Informatica acquisition on 18 November 2025Open sourceRegister entry of salesforce.com Germany GmbH, Munich, Amtsgericht (local court) Munich HRB 158525Open sourceGoogle Threat Intelligence analysis of 26 August 2025 on data theft from Salesforce instances via stolen Salesloft Drift access tokens, expressly without a platform vulnerabilityOpen sourceGoogle Threat Intelligence analysis of 4 June 2025 on deceptive phone calls used to get a modified Data Loader app approved, expressly without a platform vulnerabilityOpen sourceAgreement announcement of 27 May 2025 on the acquisition of Informatica at around 8 billion US dollars equity value, net of the existing stake, and 25 US dollars per share in cashOpen sourceArchived US pricing page of 25 August 2026 with the predecessor prices Enterprise 175, Unlimited 350 and Agentforce 1 Sales 550 US dollars per user per monthOpen sourceThe vendor's Trusted AI resources, referenced by section 2.5 of the main agreement, with the ISO/IEC 42001 certification and its own model cardsOpen sourceAttio pricing page on 28 September 2026: Plus 31 euros and Pro 74 euros per user per month on annual billing (35 and 79 US dollars), custom objects, API and webhook access, automatic enrichment, advanced access permissions from Pro, SAML in the Enterprise tierOpen sourceHubSpot Marketing Hub: price by included marketing contacts and Core Seats per editionOpen source
Who it fits
Solo
suitable with caveats
There is a free suite and the Starter Suite at 25 euros per user per month, payable monthly or annually. For one person that works as contact management. The tool's strength, your own data model with rules on top, needs someone to maintain it, however, and the Starter Suite sits outside the vendor's security attestations. For one person a leaner CRM fits better.
Mid-market
suitable
The Pro Suite costs 100 euros per user per month on annual billing and adds quotes, forecasting and more customisation. Anyone who has to pass a vendor review with certificates ends up on Core at 195 euros, because the security documentation of September 2026 expressly excludes Starter and Pro Suite from the ISO 27001, SOC 2 and C5 attestations. For 20 users the difference comes to roughly 22,800 euros a year before implementation costs. The system needs a person who owns it.
Enterprise
suitable
According to the German pricing page, Core, Advanced and Max cost 195, 395 and 550 euros per user per month on an annual contract and bundle Agentforce, Slack, Tableau Next and the Premier Success Plan. SSO sign-in, the permission and approval model, sandbox environments, data processing under binding corporate rules and a network of implementation partners are part of the offer, and the attestations in the security documentation apply to these editions, with the exceptions listed there. Additional costs arise in the implementation project, in ongoing administration and in Shield, which costs 30 per cent of net spend for permanent field history and event logs.
Buy, switch or build
Off-the-shelf
HubSpot or Microsoft Dynamics 365 Sales as the established rivals
Salesforce is itself the standard product, so the comparison runs against the two other established routes. HubSpot fits where marketing and sales are meant to work in a single interface and nobody wants to build an administration team; according to the Marketing Hub pricing page, its price grows with the number of marketing contacts and seats (as of 28 September 2026). Microsoft Dynamics 365 Sales fits organisations whose identities, documents and reporting already sit with Microsoft. For corporates, two points speak for Salesforce. Administrators and implementation partners are widely available, and the permission and sharing model carries large sales organisations.
AI-native
Attio as a CRM with API and webhook access
Attio keeps companies, contacts and opportunities in a data model with custom objects, offers API and webhook access according to its pricing page, and enriches company and person records automatically. On 28 September 2026 list prices were 31 euros (Plus) and 74 euros (Pro) per user per month on annual billing, against 195 euros for Core. The pricing page lists advanced access permissions from Pro upwards and SAML sign-in in the Enterprise tier, which is quoted individually. On the Salesforce side stand sandbox environments, AppExchange and a permission and sharing model for large sales organisations. For teams below roughly a hundred salespeople (estimate) Attio can be the better fit.
Build it yourself
Building a lean CRM on your own database
The tables are built quickly: companies, contacts, opportunities and activities in Neon or Supabase, sign-in and roles through Ory, an interface with Lovable or Claude Code, events from website and product through RudderStack, automations in n8n. For a team of ten to twenty people with a simple sales process we expect 25 to 40 person-days to production (estimate). At a day rate of 1,200 euros (our assumption) that comes to 30,000 to 48,000 euros, roughly eight to twelve months of Core for twenty users, before operations. It gets hard in three places. The permission and approval model, who sees which customers and who approves which discount, looks like a spreadsheet while building and turns into a project with the first regional manager. The connections to mailbox, calendar, phone and quoting tool need maintaining. And if the person who built the system leaves, the knowledge of the rules the forecast runs on goes too.
Our advice
- Solo: A lean CRM is enough until a second salesperson joins.
- Mid-market: Settle before buying whether a vendor review demands certificates, because that decides whether Pro Suite suffices or Core is needed.
- Enterprise: Negotiate the implementation project, Shield and the renewal clause before discussing the list price.
Who is behind it
Staying power: Established
The company has been in the market since 1999 and is listed on the New York Stock Exchange. For the fiscal year ending January 2026 it reported, by its own account, revenue of 41.5 billion US dollars, ten per cent more than the year before. In November 2025 it completed the acquisition of Informatica, which had been agreed in May 2025 at around 8 billion US dollars equity value. In Germany it operates through salesforce.com Germany GmbH in Munich, which signs the data processing agreement as one of the contracting entities. The two incidents of 2025 affected customer systems through third-party apps and deceptive phone calls; in both cases Google's analysis expressly ruled out a vulnerability in the platform itself.
- Revenue for the fiscal year: Press release of 25 February 2026: revenue of 41.5 billion US dollars in fiscal 2026, up 10 per cent; fourth-quarter revenue of 11.2 billion US dollars, of which 399 million came from Informatica; Agentforce annual recurring revenue of 800 million US dollars by the vendor's own accountResults release of 25 February 2026 for fiscal 2026 with revenue of 41.5 billion US dollars and the figures on Informatica and AgentforceOpen source · As of 2026-09-28
- Acquisition completed: On 18 November 2025 the vendor announced completion of the Informatica acquisition; it had been agreed on 27 May 2025 at around 8 billion US dollars equity value, net of its existing stake, and 25 US dollars per share in cashAgreement announcement of 27 May 2025 on the acquisition of Informatica at around 8 billion US dollars equity value, net of the existing stake, and 25 US dollars per share in cashOpen source · As of 2026-09-28
- German entity: salesforce.com Germany GmbH, Munich, registered at the Amtsgericht (local court) Munich under HRB 158525; it signs the August 2026 version of the data processing agreement alongside other national entitiesRegister entry of salesforce.com Germany GmbH, Munich, Amtsgericht (local court) Munich HRB 158525Open source · As of 2026-09-28
- New editions: On 3 September 2026 the vendor replaced Enterprise, Unlimited and Agentforce 1 with Core, Advanced and Max at 195, 395 and 550 US dollars per user per month, with 500,000, 1 million and 2.75 million Flex Credits; Max without a price change against Agentforce 1, and according to the announcement existing customers keep their current pricesAnnouncement of 3 September 2026 on the new Core, Advanced and Max editions at 195, 395 and 550 US dollars, Max with zero pricing change against Agentforce 1, the Flex Credit allowances, and unchanged prices for existing customers on legacy editionsOpen source · As of 2026-09-28
- Documented incident via a third-party app: Google Threat Intelligence reported on 26 August 2025 on data theft from numerous Salesforce instances between 8 and 18 August 2025 using stolen access tokens of the third-party app Salesloft Drift; according to that analysis there was no vulnerability in the Salesforce platformGoogle Threat Intelligence analysis of 26 August 2025 on data theft from Salesforce instances via stolen Salesloft Drift access tokens, expressly without a platform vulnerabilityOpen source · As of 2026-09-28
- Documented incident via deceptive phone calls: On 4 June 2025 Google Threat Intelligence described a group that talked employees on the phone into approving a modified version of Data Loader as a connected app; according to the analysis every observed case relied on deceiving users, and it found no platform vulnerabilityGoogle Threat Intelligence analysis of 4 June 2025 on deceptive phone calls used to get a modified Data Loader app approved, expressly without a platform vulnerabilityOpen source · As of 2026-09-28
Cost of leaving: High
The data itself comes out. The main agreement commits to providing it on request within 30 days of termination, as CSV files with attachments according to the security documentation, and it can be pulled in full through the APIs beforehand. What stays behind is what has grown over the years. Custom objects, validation rules, flows, Apex code, approval routes, the permission and sharing model and reports run on the platform, even though their description can be exported as metadata. On top come the AppExchange applications tied to that environment, and the field history, which without Shield or Field Audit Trail is only kept for 18 to 24 months. Whoever leaves takes the tables along and rebuilds the business logic.
Regulation and data
| Data processing agreementdocumented, no condition attached: Auftragsverarbeitungsvertrag öffentlich abrufbar und ohne weitere Bedingung Bestandteil des Vertrags; oder er entfällt nachvollziehbar begründet, weil kein Anbieter Kundendaten verarbeitet.documented, tied to a condition: Vertrag existiert, ist aber an einen Tarif gebunden, nur nach Anfrage einsehbar oder allein in den Nutzungsbedingungen geregelt statt als eigenes Dokument.documented, but unfavourable: Kein Auftragsverarbeitungsvertrag im üblichen Sinn: entweder weil der Anbieter für das Kerngeschäft eigenständig Verantwortlicher ist und stattdessen eine andere Konstruktion gilt, oder weil öffentlich offen bleibt, ob überhaupt einer angeboten wird.open on a point that decides usability: Weder ein Vertrag noch ein dokumentierter Weg zu einem Vertrag; der Einkauf hätte nichts, worauf er sich stützen kann. | documented, no condition attachedseparate document, publicly available, incorporated through the main agreementMain services agreement in its version of 1 September 2026: incorporation of the data processing agreement in section 2.2, acceptance of the agreement counting as signature of the standard contractual clauses, provision of customer data on request within 30 days of termination, AI features in section 2.5 with processing only on the customer's documented instructions and a reference to the Trusted AI resources, automatic one-year renewal with 30 days' notice and re-pricing on reduced volume in section 11.2Open sourceThe data processing agreement is freely available, carries revision August 2026 on its cover and April 2026 in its footer. The main agreement in its version of 1 September 2026 expressly incorporates it in section 2.2 and treats acceptance of the main agreement as signature of the standard contractual clauses. The document itself describes a route via signature and email and in section 14 declares itself binding only afterwards; the execution section qualifies this where the main agreement expressly provides otherwise. Anyone wanting certainty additionally returns the pre-signed copy with their own signature.As of 2026-09-28 |
|---|---|
| Storage locationdocumented, no condition attached: EU-Speicherort ohne Zusatzkosten und ohne Tarifbindung, oder der Ort ist vollständig selbst bestimmbar, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: EU-Speicherort möglich, aber an einen Tarif, einen gesondert zu aktivierenden Zusatz oder einen Umzug in eine getrennte Umgebung gebunden; oder die EU-Region ist nicht die Voreinstellung.documented, but unfavourable: Kein EU-Speicherort, der Ort ist aber eindeutig benannt, sodass die Folgen bewertbar sind.open on a point that decides usability: Der Speicherort ist öffentlich nicht benannt oder vom Kunden nicht steuerbar, sodass sich die Verarbeitung nicht verorten lässt. | documented, tied to a conditionEU region selectable with Germany and France, some features switched on by default hosted in the US onlySubprocessor documentation of 22 September 2026: regions of the Salesforce Services with Germany as EU primary region and France as failover region, Account Intelligence and Einstein Opportunity Scoring on Amazon Web Services in the United States alone and on by default for new customers, OpenAI as generative AI provider located in the United States, notification through a formOpen sourceThe region is chosen by the customer or by sales when the environment is created. In the European Union Germany is the primary region and France the failover region, with Sweden, Italy, Switzerland and other countries also available. Two restrictions appear in the same subprocessor documentation of 22 September 2026. The features Account News, Account Logos, Account Autofill, Einstein Opportunity Scoring and Einstein Deal Insights run on Amazon Web Services in the United States alone and are switched on by default for all new customers. And generative AI runs, among others, through OpenAI with the United States as its only location. Anyone who has chosen the EU region therefore decides deliberately whether these functions stay switched on.As of 2026-09-28 |
| Subprocessorsdocumented, no condition attached: Vollständige öffentliche Liste der Unterauftragnehmer mit Zweck und Land; oder es gibt keine, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Liste existiert und ist benannt, aber nur nach Anfrage oder nach Zugang zu einem Vertrauensportal einsehbar, oder sie nennt Zweck und Land nicht vollständig.documented, but unfavourable: Keine geführte Liste; namentlich stehen nur einzelne Dienste in der Datenschutzerklärung, überwiegend solche der eigenen Website.open on a point that decides usability: Weder eine Liste noch eine Nennung der Verarbeiter des Produkts, und kein dokumentierter Weg, sie zu erfahren. | documented, no condition attachedpublic documentation per service with purpose, subprocessor and country, notification by subscriptionSubprocessor documentation of 22 September 2026: regions of the Salesforce Services with Germany as EU primary region and France as failover region, Account Intelligence and Einstein Opportunity Scoring on Amazon Web Services in the United States alone and on by default for new customers, OpenAI as generative AI provider located in the United States, notification through a formOpen sourceThe Infrastructure and Sub-processors documentation of 22 September 2026 lists, per service and per processing purpose, the subprocessor, the countries and additional details across roughly a hundred pages. Section 5.2 of the data processing agreement makes it the binding list and commits to advance notice of new subprocessors, though only for customers who have signed up through a form. Section 5.3 grants 30 days to object and then a partial termination right with a refund. Anyone who skips the form learns of changes only by rereading the document.As of 2026-09-28 |
| Third-country transferdocumented, no condition attached: Keine Übermittlung in ein Drittland, oder die Übermittlung findet statt und die Grundlage ist benannt und im Vertrag verankert, etwa Standardvertragsklauseln, Angemessenheitsbeschluss oder EU-US-Datenschutzrahmen.documented, tied to a condition: Übermittlung findet statt, eine Grundlage ist genannt, aber ohne Zuordnung, welcher Empfänger auf welcher Grundlage arbeitet.documented, but unfavourable: Übermittlung findet statt und die eigenen Unterlagen widersprechen sich, oder die genannte Grundlage bezieht sich erkennbar nur auf einen Randbereich wie die Marketing-Website.open on a point that decides usability: Übermittlung findet erkennbar statt und eine Grundlage wird nirgends genannt. | documented, no condition attachedprocessor binding corporate rules, standard contractual clauses modules 2 and 3, data privacy frameworkData processing agreement, revision August 2026: subprocessor documentation as the binding list with notification by subscription in section 5.2, 30-day objection period in section 5.3, government requests in section 8, the commitment to contest an order to cease operations in section 12.5, return and deletion per the security documentation in section 9, binding corporate rules and standard contractual clauses modules 2 and 3 in section 12.4, effectiveness under section 14, and the signature of salesforce.com Germany GmbHOpen sourceSection 12.4 of the data processing agreement names three bases with a fixed allocation: the processor binding corporate rules for the services listed in the appendix to those rules, the standard contractual clauses under Decision (EU) 2021/914 in module 2 where the customer is controller, and in module 3 where the customer is itself a processor. Section 12.1 clarifies that transfers to entities certified under the EU-US Data Privacy Framework do not count as third-country transfers. Section 8 governs government requests with a duty to challenge, and section 12.5 commits to contest in court any order to cease operations in Europe.As of 2026-09-28 |
| Training on customer datadocumented, no condition attached: Vertraglich oder in der Datenschutzerklärung ausdrücklich ausgeschlossen, mit Erstreckung auf die eingesetzten Modellanbieter; oder es gibt keine Datenübertragung an einen Anbieter.documented, tied to a condition: Ausschluss ab einem bestimmten Tarif, oder die Zusage steht nur auf einer Dokumentationsseite statt im Vertrag, oder die Frage stellt sich für das Werkzeug sachlich kaum und der Anbieter schweigt dazu.documented, but unfavourable: Nutzung ist die Voreinstellung und nur ein Widerspruch beendet sie; oder der Anbieter trainiert eigene Modelle auf bereinigten Kundendaten.open on a point that decides usability: Keine Aussage, obwohl das Werkzeug KI-Funktionen auf Kundeninhalten betreibt. | documented, tied to a conditionmodel providers contractually barred from retention and use, one exception for call recordingsEinstein Platform Notices and License Information of 22 May 2026: contractual commitment by OpenAI, Azure, Google and Anthropic on AWS not to retain or use customer data beyond automated abuse screening, and the permission for the vendor's employees to review recordings and transcripts in Einstein Conversation Insights to improve and train the productOpen sourceThe Einstein Platform Notices and License Information of 22 May 2026 state that OpenAI, Azure, Google and Anthropic on AWS scan inputs and outputs only automatically for policy violations and have contractually committed not to otherwise retain or use customer data. The legal documents reviewed contain no express statement that the vendor itself does not train models on customer data; section 2.5 of the main agreement permits processing of customer data by AI features only on the customer's documented instructions. The same notices page contains one exception. For Einstein Conversation Insights, vendor employees may view transmitted customer data, including recorded calls and transcripts, to improve and train the product.As of 2026-09-28 |
| Retention and deletiondocumented, no condition attached: Löschfristen nach Vertragsende beziffert und die Löschung oder Rückgabe zugesagt; oder die Fristen bestimmt der Betreiber selbst, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Löschung ist zugesagt, die Fristen sind aber nur teilweise beziffert, oder Sicherungskopien sind ausdrücklich ausgenommen.documented, but unfavourable: Nur der Grundsatz der Erforderlichkeit ohne jede Frist nach Vertragsende, oder Fristen sind allein für Randbereiche wie Website-Protokolle genannt.open on a point that decides usability: Keine Aussage zu Aufbewahrung und Löschung. | documented, no condition attachedreturn on request within 30 days, deletion on a stated schedule of up to 301 daysSecurity documentation of 22 September 2026: ISO 27001/27017/27018, SOC 1 to 3, C5, HITRUST and PCI DSS attestations with express exclusion of Salesforce Starter, Salesforce ProSuite and Salesforce Foundations as well as individual components such as Tableau Next and Backup and Recover, access logs and a 90-day minimum log retention, the Setup Audit Trail, return within 30 days and a deletion schedule of 120, 90 and 180 days including the proviso that it may be shortenedOpen sourceThe security documentation of 22 September 2026 states the entire route in numbers. Within 30 days of termination the customer can request return, as CSV files with attachments in their native format. After that the data sits inactive until day 120, is deleted or overwritten from production within a further 90 days and from backups within 180 days, up to day 301 in total. The main agreement clarifies that after the 30 days there is no longer any obligation to keep data. One proviso sits in the same paragraph: the vendor may shorten the post-termination periods and then updates the documentation. Sandboxes follow a rule of their own and can be deleted after 150 days without a login, following advance notice.As of 2026-09-28 |
| Certificationsdocumented, no condition attached: Mehrere anerkannte Nachweise, benannt mit Norm, Fassung und Geltungsbereich, und bezogen auf den Anbieter selbst.documented, tied to a condition: Ein anerkannter Nachweis für den Anbieter belegt, der Bericht aber nur auf Anfrage, oder der Nachweis hängt an einem Tarif, oder der Geltungsbereich bleibt teilweise offen.documented, but unfavourable: Nur pauschale Nennung ohne Norm-Fassung und Geltungsbereich, oder bloße Selbstauskunft, oder die Nachweise gehören dem Infrastrukturanbieter statt dem Anbieter, oder der Prüfzeitraum ist erkennbar veraltet, oder die eigenen Angaben widersprechen sich.open on a point that decides usability: Kein Nachweis genannt und keine Sicherheits- oder Vertrauensseite vorhanden. | documented, tied to a conditionISO 27001/27017/27018, SOC 1 to 3, C5 and more for the vendor, Starter and Pro Suite expressly excludedSecurity documentation of 22 September 2026: ISO 27001/27017/27018, SOC 1 to 3, C5, HITRUST and PCI DSS attestations with express exclusion of Salesforce Starter, Salesforce ProSuite and Salesforce Foundations as well as individual components such as Tableau Next and Backup and Recover, access logs and a 90-day minimum log retention, the Setup Audit Trail, return within 30 days and a deletion schedule of 120, 90 and 180 days including the proviso that it may be shortenedOpen sourceThe security documentation of 22 September 2026 names, for the Salesforce Services including Sales Cloud, the vendor's own ISO 27001 certification aligned to ISO 27017 and 27018, SOC 1, SOC 2 and SOC 3 reports, the German C5 attestation, HITRUST and PCI DSS, each downloadable through the vendor's compliance portal. The finding sits in the exclusion lists that every one of these attestations carries: Salesforce Starter, Salesforce ProSuite and Salesforce Foundations are expressly excluded from ISO, SOC, C5, HITRUST and PCI. For the two suites aimed at smaller companies, none of the attestations the vendor otherwise advertises therefore applies. Some components of the new editions, such as Tableau Next and Backup and Recover, also appear in these exclusion lists. Agentforce and the Einstein platform additionally hold an ISO/IEC 42001 certification.As of 2026-09-28 |
| EU AI Act, Article 50documented, no condition attached: Der Anbieter macht eine belegte Aussage, die die eigene Pflicht trägt, etwa Modelldokumentation und Zertifizierung nach ISO/IEC 42001; oder das Werkzeug enthält nachvollziehbar begründet kein KI-System im Sinne der Verordnung.documented, tied to a condition: Der Anbieter äußert sich zur Verordnung oder ordnet die eigene Funktion ein, eine benannte Zusage zu den Transparenzpflichten aus Artikel 50 fehlt aber; oder das Werkzeug enthält kein KI-System, das gegenüber Menschen auftritt, und der Anbieter schweigt.documented, but unfavourable: Das Produkt enthält KI-Funktionen, der Anbieter schweigt dazu oder trägt ein Selbstetikett ohne Nachweis; die Kennzeichnung ist vom Betreiber aber selbst setzbar.open on a point that decides usability: KI spricht im Produkt unmittelbar mit Endkunden und der Anbieter sagt zu Artikel 50 nichts; die Kennzeichnung lässt sich ohne Zusage des Anbieters nicht sicher setzen. | documented, no condition attachedISO/IEC 42001 for Agentforce and Einstein, model cards referenced by the main agreement, no named commitment on Article 50Einstein Platform security documentation of 24 July 2026 with the ISO/IEC 42001 certification of Agentforce and EinsteinOpen sourceThe Einstein Platform security documentation of 24 July 2026 lists an ISO/IEC 42001 certification of Agentforce and Einstein for artificial intelligence management systems. The certification relates to the vendor's AI management system. In addition, the vendor publishes model cards, referenced by section 2.5 of the main agreement. No named commitment on the transparency duties of Article 50 of Regulation (EU) 2024/1689 was found in the legal and security documents reviewed; the regulation appears on the AI compliance topic page only as a general explanation. What matters for the rating is who the AI faces. Agentforce for sales can write to prospects on its own, and the labelling towards the recipient then depends on the customer's role. The customer can set it in templates and agent instructions.As of 2026-09-28 |
| Audit loggingdocumented, no condition attached: Nachvollziehbares Protokoll über Zugriffe und Änderungen in allen Tarifen enthalten, mit benannter Frist und Ausleitung in eigene Systeme; oder die Nachvollziehbarkeit liegt vollständig in eigener Hand, weil das Werkzeug im eigenen Betrieb läuft.documented, tied to a condition: Protokoll vorhanden, aber an einen höheren Tarif oder einen kostenpflichtigen Zusatz gebunden, oder die Ausleitung fehlt in den unteren Stufen; Reichweite und Frist sind benannt.documented, but unfavourable: Protokolle sind nur anbieterseitig beschrieben, oder Reichweite und Frist bleiben offen, sodass sich Nachweispflichten nicht planen lassen.open on a point that decides usability: Öffentlich nicht belegt, ob der Kunde überhaupt ein auswertbares Protokoll erhält. | documented, tied to a conditionsetup audit trail and field history in the editions, permanent history with Shield or Field Audit Trail, event logs with ShieldVendor help article on Field Audit Trail: field history for 18 to 24 months and 20 fields per object, permanent field history with up to 200 fields per object with Shield or a separate Field Audit Trail licenceOpen sourceThe security documentation of 22 September 2026 commits to access logs with timestamp, user, operation and source address, keeps system and application logs for at least 90 days, and makes administrative changes visible and downloadable for administrators in the Setup Audit Trail. According to the vendor's help article, field history is kept for 18 to 24 months and limited to 20 fields per object. Permanent field history with up to 200 fields per object comes with Shield or a separate Field Audit Trail licence, the event logs for access and exports with Shield, which the vendor prices at 30 per cent of net spend. Anyone who has to keep evidence for years builds that surcharge into the price.As of 2026-09-28 |
What it really costs
Entry price
Six tiers per user per month. The free suite costs nothing, the Starter Suite 25 euros on monthly or annual billing, the Pro Suite 100 euros on annual billing. Since 3 September 2026 these are followed by Core at 195 euros, Advanced at 395 euros and Max at 550 euros, each on an annual contract and with an allowance of Flex Credits for the AI agents. The German pricing page states these amounts in euros, the announcement of 3 September 2026 the same figures in US dollars. The pricing page states expressly that it is for information only and that binding prices come from sales.German pricing page: free suite, Starter Suite 25 euros, Pro Suite 100 euros, Core 195 euros, Advanced 395 euros and Max 550 euros per user per month, annual billing from Pro Suite upwards, APIs included from Core and available below that for 25 euros, Max with 2.75 million Flex Credits per org and year, a note on annual contracts and on the page serving information only; the FAQ on the same page still names Enterprise, Unlimited and Agentforce 1 SalesOpen source
As of 2026-09-28
What gets expensive
Four items come on top of the list price. First, crossing the attestation line: anyone who needs certificates pays almost twice the Pro Suite price for Core. Second, Shield for permanent history and event logs, at 30 per cent of net spend. Third, renewal: the main agreement renews subscriptions automatically for one year unless cancelled 30 days in advance, and anyone reducing users or term at renewal is re-priced at list price, without any tie to the previous unit price. List prices for Enterprise and Unlimited rose by an average of 6 per cent on 1 August 2025, and in US dollars their successors Core and Advanced sit another 20 and 45 above that. Fourth, the implementation project, which appears on no pricing page. With custom objects and approval routes it exceeds the first year's licence (estimate).
What it displaces
- Customer list and pipeline in a spreadsheet everyone maintains differently
- A forecast from the head of sales' gut feeling at month end
- Handover from sales to service by email
Interfaces
- APIs for records, bulk loads and metadata; according to the pricing page included from Core upwards, available below that for 25 euros per user per month
- Platform and change data events for connected systems to subscribe to
- Connection to Gmail and Outlook for email, calendar and contacts
- AppExchange with third-party extensions that run inside your own environment
- MCP server for connecting AI agents, hosted on Amazon Web Services according to the subprocessor documentation
- Sign-in via SAML, OpenID Connect and OAuth
Matching methods
- MEDDIC / MEDDPICCThe method demands evidenced answers per opportunity on metrics, decision makers, paper process and competition; custom required fields and validation rules on the opportunity are where those questions must be answered before the next stage change.
- Funnel Math Instead of Close RateThe method works with conversion rates per stage and a single close rate as a cross-check; the stage history of opportunities provides these transitions with timestamps, as long as field history is kept long enough.
- Lead Scoring: Best Leads to Best ClosersThe method assigns scored leads to the salespeople whose measured close rate for that lead type is highest; assignment rules, queues and scoring fields are the form in which that rule applies day to day.
- GTM Stack Signal RoutingThe method defines which signal flows from which tool to where; the CRM is the place where signals from website, enrichment and product converge on one record and trigger a task.
Alternatives
- HubSpot
- Attio
Sources
- 1.Main services agreement in its version of 1 September 2026: incorporation of the data processing agreement in section 2.2, acceptance of the agreement counting as signature of the standard contractual clauses, provision of customer data on request within 30 days of termination, AI features in section 2.5 with processing only on the customer's documented instructions and a reference to the Trusted AI resources, automatic one-year renewal with 30 days' notice and re-pricing on reduced volume in section 11.2 (opens in a new tab)salesforce.com/…/salesforce_MSA.pdf · As of 2026-09-28
- 2.Data processing agreement, revision August 2026: subprocessor documentation as the binding list with notification by subscription in section 5.2, 30-day objection period in section 5.3, government requests in section 8, the commitment to contest an order to cease operations in section 12.5, return and deletion per the security documentation in section 9, binding corporate rules and standard contractual clauses modules 2 and 3 in section 12.4, effectiveness under section 14, and the signature of salesforce.com Germany GmbH (opens in a new tab)salesforce.com/…/data-processing-addendum.pdf · As of 2026-09-28
- 3.Security documentation of 22 September 2026: ISO 27001/27017/27018, SOC 1 to 3, C5, HITRUST and PCI DSS attestations with express exclusion of Salesforce Starter, Salesforce ProSuite and Salesforce Foundations as well as individual components such as Tableau Next and Backup and Recover, access logs and a 90-day minimum log retention, the Setup Audit Trail, return within 30 days and a deletion schedule of 120, 90 and 180 days including the proviso that it may be shortened (opens in a new tab)salesforce.com/… · As of 2026-09-28
- 4.Subprocessor documentation of 22 September 2026: regions of the Salesforce Services with Germany as EU primary region and France as failover region, Account Intelligence and Einstein Opportunity Scoring on Amazon Web Services in the United States alone and on by default for new customers, OpenAI as generative AI provider located in the United States, notification through a form (opens in a new tab)salesforce.com/…/salesforce-infrastructure-and-subprocessors.pdf · As of 2026-09-28
- 5.Einstein Platform Notices and License Information of 22 May 2026: contractual commitment by OpenAI, Azure, Google and Anthropic on AWS not to retain or use customer data beyond automated abuse screening, and the permission for the vendor's employees to review recordings and transcripts in Einstein Conversation Insights to improve and train the product (opens in a new tab)salesforce.com/… · As of 2026-09-28
- 6.Einstein Platform security documentation of 24 July 2026 with the ISO/IEC 42001 certification of Agentforce and Einstein (opens in a new tab)salesforce.com/… · As of 2026-09-28
- 7.German pricing page: free suite, Starter Suite 25 euros, Pro Suite 100 euros, Core 195 euros, Advanced 395 euros and Max 550 euros per user per month, annual billing from Pro Suite upwards, APIs included from Core and available below that for 25 euros, Max with 2.75 million Flex Credits per org and year, a note on annual contracts and on the page serving information only; the FAQ on the same page still names Enterprise, Unlimited and Agentforce 1 Sales (opens in a new tab)salesforce.com/de/sales/pricing · As of 2026-09-28
- 8.Announcement of 3 September 2026 on the new Core, Advanced and Max editions at 195, 395 and 550 US dollars, Max with zero pricing change against Agentforce 1, the Flex Credit allowances, and unchanged prices for existing customers on legacy editions (opens in a new tab)salesforce.com/news/stories/salesforce-simplifies-editions-2026 · As of 2026-09-28
- 9.Price change effective 1 August 2025: list prices for Enterprise and Unlimited of Sales Cloud, Service Cloud, Field Service and selected industry clouds up 6 per cent on average, no change for Foundations, Starter and Pro (opens in a new tab)salesforce.com/news/stories/pricing-update-2025 · As of 2026-09-28
- 10.Shield pricing page stating 30 per cent of net spend for encryption, lifetime field audit trail and event monitoring (opens in a new tab)salesforce.com/platform/cloud-data-security/pricing · As of 2026-09-28
- 11.Vendor help article on Field Audit Trail: field history for 18 to 24 months and 20 fields per object, permanent field history with up to 200 fields per object with Shield or a separate Field Audit Trail licence (opens in a new tab)help.salesforce.com/… · As of 2026-09-28
- 12.Results release of 25 February 2026 for fiscal 2026 with revenue of 41.5 billion US dollars and the figures on Informatica and Agentforce (opens in a new tab)salesforce.com/news/press-releases/2026/02/25/fy26-q4-earnings · As of 2026-09-28
- 13.Completion of the Informatica acquisition on 18 November 2025 (opens in a new tab)salesforce.com/…/salesforce-completes-acquisition-of-informatica · As of 2026-09-28
- 14.Register entry of salesforce.com Germany GmbH, Munich, Amtsgericht (local court) Munich HRB 158525 (opens in a new tab)northdata.com/salesforce.com%20Germany%20GmbH,%20M%C3%BCnchen · As of 2026-09-28
- 15.Google Threat Intelligence analysis of 26 August 2025 on data theft from Salesforce instances via stolen Salesloft Drift access tokens, expressly without a platform vulnerability (opens in a new tab)cloud.google.com/… · As of 2026-09-28
- 16.Google Threat Intelligence analysis of 4 June 2025 on deceptive phone calls used to get a modified Data Loader app approved, expressly without a platform vulnerability (opens in a new tab)cloud.google.com/…/voice-phishing-data-extortion · As of 2026-09-28
- 17.Agreement announcement of 27 May 2025 on the acquisition of Informatica at around 8 billion US dollars equity value, net of the existing stake, and 25 US dollars per share in cash (opens in a new tab)salesforce.com/… · As of 2026-09-28
- 18.Archived US pricing page of 25 August 2026 with the predecessor prices Enterprise 175, Unlimited 350 and Agentforce 1 Sales 550 US dollars per user per month (opens in a new tab)web.archive.org/…/pricing · As of 2026-09-28
- 19.The vendor's Trusted AI resources, referenced by section 2.5 of the main agreement, with the ISO/IEC 42001 certification and its own model cards (opens in a new tab)salesforce.com/…/salesforce-trusted-ai-resources.pdf · As of 2026-09-28
- 20.Attio pricing page on 28 September 2026: Plus 31 euros and Pro 74 euros per user per month on annual billing (35 and 79 US dollars), custom objects, API and webhook access, automatic enrichment, advanced access permissions from Pro, SAML in the Enterprise tier (opens in a new tab)attio.com/pricing · As of 2026-09-28
- 21.HubSpot Marketing Hub: price by included marketing contacts and Core Seats per edition (opens in a new tab)hubspot.com/pricing/marketing · As of 2026-09-28
Last reviewed: 2026-09-28 by Dr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.
From tool to decision
The offer that fits this tool
A tool profile tells you what the tool does and what it means for compliance. Whether it gets priority in your company is a management decision, and it takes one working day: the executive AI workshop ranks your initiatives by business value, risk, data readiness and ownership.