Salesforce

This Integration requires Fides Cloud or Fides Enterprise. For more information, talk to our solutions team. (opens in a new tab)

Salesforce (opens in a new tab) is a cloud-based customer relationship management (CRM) platform that helps businesses manage sales, marketing, and customer service interactions in a unified system.

Prerequisites Permalink for this section

To integrate with Salesforce, we require our customers to use a Connected App. This ensures exclusive data control, enhances security by reducing unauthorized access risks, and allows customization of scopes and permissions to suit your business needs and policies.

To configure a Connected App, please follow this Salesforce guide (opens in a new tab) and complete the following steps, at minimum:

1. Configure Basic Connected App Settings
2. Uncheck Require Proof Key for Code Exchange (PKCE) Extension for Supported Authorization Flows
3. Enable OAuth Settings for API Integration and assign the following scopes
   • Manage user data via APIs (api)
   • Perform requests at any time (refresh_token, offline_access)
4. Enter the callback URL using your Fides Redirect URL (typically {{your-fides-domain}}/api/v1/oauth/callback)

Once you have this configured, you'll need to collect the following information:

Your Salesforce access token will need the following scopes: Manage user data via APIs (api) and Perform requests at any time (refresh_token, offline_access)

Integrating with Salesforce Permalink for this section

To integrate an existing system with Salesforce:

1. Navigate to Data map → View Systems and choose the system that you want to connect.
2. Click on the Integrations tab.
3. Pick the vendor or system type that you want to integrate with from the Connection type drop-down menu.
4. Complete the required fields for the integration and click Save.

To authorize the integration so that it can connect to Salesforce:

1. Click on Authorize integration to be redirected to the Salesforce authorization screen
2. Enter your Salesforce credentials and click Log in. You will automatically be redirected back to the Fides UI using the Redirect URL that was provided in the form in the previous step.

You may now confirm your connection is working using the Test connection button, if desired.

To learn more, please see our guide for Managing Integrations.

Technical detail Permalink for this section

Fides utilizes API endpoints to access the API service for a SaaS application. An API service is the programmatic interface through which Fides can query and update data within an application to access, rectify, or delete personal information. Each SaaS tool will have a unique set of endpoints to enable privacy functions.

Salesforce endpoints Permalink for this section

In the table below, you can find which endpoints are used for each type of privacy function. Clicking on the endpoint will take you to the documentation for that endpoint.

Required Policy Updates Permalink for this section

Due to widespread field restrictions in Salesforce, the following erasure policy changes should be made when using this integrations. Reference the guide on strategies when making these changes.

• Update the default_erasure_policy to use the random_string_rewrite strategy with a length of 20

• Create a new policy for location data using the null_rewrite strategy

• Remove user.location from the default policy targets and add to the new null_rewrite target list

• Create a new policy using the random_string_rewrite strategy for a formatted email, with the suffix format of a valid email (i.e. @masked.com)

• Create a new policy using the string_rewrite strategy for a phone number, with the format of a valid phone number (i.e. 5555551111)

• Remove user.contact from the default erasure policy and re-apply the following data categories:

• user.contact.address

  • user.contact.organization
  • user.contact.url
  • user.name

• Add user.contact.email as a target to the email random_string_rewrite policy

• Add user.contact.phone_number and user.contact.fax_number as targets to the phone number string_rewrite policy