Salesforce’s half: the platform
Security on any cloud platform is shared. This is the half Salesforce does, and it is a level of investment no single charity could fund alone.
Independently audited
Salesforce’s infrastructure is certified against the main international security standards and audited by outside assessors, with the results published on its public trust site.
Encrypted and monitored
Data is encrypted on the way to and from Salesforce and, on Salesforce’s Hyperforce infrastructure, where it is stored, under a key Salesforce manages. The platform is monitored around the clock by a dedicated security team. Shield goes further, encrypting the fields you choose under keys your charity controls.
Open about incidents
Salesforce publishes its status and security notices at trust.salesforce.com, so when something happens in the wider world you can see quickly whether it touches your platform. The Beacon incident and the PHP2Shell website flaw did not.
Your half: what you already have as standard
These controls come with every Salesforce edition at no extra cost. They are the half that matters day to day, and getting them right comes before buying anything.
Multi-factor authentication
Required for every Salesforce user, with phishing resistant options such as passkeys and security keys. It is the single control that stops most stolen passwords being useful.
The Salesforce Security Health Check
A free score of your security settings against Salesforce’s recommended baseline, with a list of what to fix. Ten minutes to run, and the first thing we look at.
Permissions and field-level security
Every person and every connected tool sees only the objects and fields their job needs. This is also what keeps Agentforce within bounds, because an agent can only reach what the signed-in person can.
Connected tools under control
Every website, donation platform and integration acts as a Salesforce user. Salesforce lets you give each its own user, limit it to the records it needs, tie it to a location and revoke it in a minute.
A record of changes
Salesforce keeps six months of configuration changes and, on the fields you choose (up to 20 per object), 18 months of who changed what. Enough for most charities; Shield extends it.
The Einstein Trust Layer
For Agentforce, Salesforce masks sensitive data in prompts, keeps an audit trail of every interaction and holds zero data retention agreements with the model providers. Read more about the Einstein Trust Layer.
We switch these on, check them and keep them up through the Managed Service.
What Salesforce Shield adds
Shield is Salesforce’s paid security suite. It does not replace the standard controls; it adds stronger locks and longer records on top of them. Four products, each useful on its own.
Platform Encryption
Encrypts the fields you choose with keys your charity controls, so that even someone with access to the database sees nothing useful.
Who needs this
Charities holding safeguarding notes, health information or other special category data in Salesforce, or with a funder or regulator asking for encryption under your own keys.
Event Monitoring
A record of who viewed, exported, downloaded or signed in, and the ability to block risky actions as they happen. Without it, Salesforce can tell you who changed a record but not who read or exported it.
Who needs this
Any charity that would need to answer “what was taken?” after an incident, or that wants to be alerted when a large export happens.
Field Audit Trail
Keeps the history of changes on many more fields and for as long as your policy requires, up to ten years, rather than 18 months on 20 fields.
Who needs this
Charities with funders, auditors or regulators who ask for a full change history, and grant makers who need to show how a decision record evolved.
Data Detect
Scans your records for sensitive data that has ended up in the wrong place, such as a bank account number typed into a notes field, so it can be moved or removed.
Who needs this
Charities with years of free text notes and no certainty about what is in them.
Salesforce also sells Security Center separately, a single view of security settings and alerts across one or more Salesforce environments. It is useful for federated charities running several environments and for anyone who wants the Health Check, permissions and alerts on one screen.
Does your charity need Shield?
Most charities need at least one part of Shield. Which parts, and whether the full suite is worth it, depends on your data and who asks you to account for it. The signs that point to each:
Platform Encryption: you hold safeguarding, health or other special category data in Salesforce, or a funder, regulator or the Data Security and Protection Toolkit asks for encryption under your own keys.
Event Monitoring: a trustee has asked who viewed or exported supporter data and you could not answer, or you have several administrators, several integrations or a public portal, so there are more ways in to watch.
Field Audit Trail: a funder, auditor or regulator asks for a change history longer than 18 months, or you make decisions about people and grants that you need to show the history of.
Data Detect: you have years of free text notes and no certainty about what is in them.
The full suite: you are planning Artificial Intelligence on sensitive data and want encryption, the record of what it reached and the audit trail together.
Whichever parts apply, the standard controls above come first; they cost nothing and they are where most of the protection is. We will tell you which parts of Shield apply, and in what order, in Discovery and Planning.
What it costs
Shield is priced as a percentage of what you pay Salesforce for the products it protects, not per user, and the four products can be bought separately or as a suite. Because the first ten Nonprofit Cloud licences are free under the Power of Us Programme and charity licences are discounted, the cost is usually smaller than charities expect. Ask us for a figure for your environment and we will confirm it with Salesforce.
How we help, at every stage
Security runs through the way we already work, so there is nothing separate to buy.
Step one
Discovery and Planning: is it set up well, and is Shield worth it?
For charities already on Salesforce, Discovery and Planning includes a security review: the Salesforce Security Health Check, who has access, what is connected, and a plain recommendation on Shield (yes, which parts, or not yet). You get the findings and the fixes in the roadmap.
Step two
Programmes: put the basics right, switch Shield on where it earns its place
A security block, usually two to four weeks, puts the standard controls right and, where you need it, configures Shield: the fields to encrypt, how long to keep history, the alerts that matter, and your administrator trained to read them.
Step three
Managed Service: the housekeeping, month after month
Access reviews, connected tools audits, credential rotation and the Health Check, planned into your monthly time at your request. Where Event Monitoring is in place, reading it and acting on it is part of the same housekeeping, because logs nobody reads protect nobody.
For your Salesforce administrator
Where the standard controls live in Setup, so you can check them today:
Multi-factor authentication: Identity Verification and Session Settings
Security Health Check: Setup, Health Check
Who can see what: Profiles, Permission Sets and Field-Level Security
Connected tools: Connected Apps OAuth Usage, External Client App Manager and each integration user’s Login History
Changes: Setup Audit Trail and Field History Tracking
Locations: Login IP Ranges on the profile (IP meaning Internet Protocol address)
Frequently asked questions
Is Salesforce secure?
Do we need Shield to be secure?
Does Shield cover Agentforce?
Can we buy part of Shield?
Who reads the Event Monitoring logs?
Stories from charities like yours
Nonprofit Cloud
Home Advantage: How Chelsea FC Foundation Put Its Community Mission on One Platform
In one year, Chelsea FC Foundation launched its first fundraising function, formalised grant-giving, stood up a volunteering programme and moved the Chelsea Players’ Trust onto secure case management - all on one Salesforce platform, built with Cirrico. A blueprint for what a club foundation can be.
Learn more
Age UK: Transforming services for older people across a national network
Over three years, Cirrico has helped Age UK harness Salesforce across its national network - joining up data across 120+ brand partners and enabling a personalised, person-centred approach to supporting older people.
Learn more
Nonprofit Cloud
WaterAid: Fundraising efficiency transformed, donor engagement deepened
A Nonprofit Cloud fundraising transformation gave WaterAid a clearer view of supporters, deepening donor engagement and streamlining operations across teams.
Learn more