EXACTTARGET SECURITY, PRIVACY, AND
ARCHITECTURE
Last Updated: May 6, 2016 Salesforce’s Corporate Trust Commitment
Salesforce is committed to achieving and maintaining the trust of our customers. Integral to this mission is providing a
robust security and privacy program that carefully considers data protection matters across our suite of services, including
data submitted by customers to our services (“Customer Data”). Services Covered
This documentation describes the architecture of, the security and privacy-related audits and certifications received for, and
the administrative, technical, and physical controls applicable to the services branded as ExactTarget or Salesforce
Marketing Cloud (the “ET Services”), but excluding those services branded as Buddy Media, Predictive Email, Predictive
Intelligence (previously branded as iGoDigital), Predictive Web, Radian6, Social Studio, Social.com, Web & Mobile
Analytics, or Web Personalization. Salesforce Infrastructure Salesforce owns or controls access to the infrastructure that Salesforce uses to host Customer Data submitted to the ET
Services. Currently, the infrastructure hosted by Salesforce in the provisioning of the ET Services is located in the United
States. Third-Party Architecture Salesforce may use one or more third-party content delivery networks to provide the ET Services and to optimize content
delivery via the ET Services. Content items to be served to subscribers or end-users, such as images or attachments
uploaded to the ET Services, may be stored with such content delivery networks to expedite transmission. Information
transmitted across a content delivery network may be accessed by that content delivery network to enable these functions. Copyright 2000 – 2016 salesforce.com, inc. All rights reserved. Salesforce is a registered trademark of
salesforce.com, inc., as are other names and marks. Other marks appearing herein may be trademarks of their
respective owners. Audits and Certifications
E
The following security and privacy-related audits and certifications are applicable to the ET Services: ●
EU/US and Swiss/US Safe Harbor self-certifications: Customer Data submitted to the ET Services is within the
scope of an annual self-certification to the EU/US and Swiss/US Safe Harbor frameworks as administered by the
U.S. Department of Commerce. The current self-certification is available at https://safeharbor.export.gov/list.aspx
by searching for “ExactTarget.” ●
ISO 27001 certification: Salesforce is subject to an information security management system (ISMS) in accordance
with the ISO 27001 international standard. Salesforce has achieved ISO 27001 certification for its ISMS from an
independent third party. The scope of Salesforce’s ISO 27001 certification applicable to ET is available here. ●
Service Organization Control (SOC) reports: Salesforce’s information security control environment applicable to
the ET Services undergoes an independent evaluation in the form of a SOC 2 report. ●
TRUSTe Privacy Seal: Salesforce has been awarded the TRUSTe Privacy Seal signifying that the ExactTarget
Web Site Privacy Statement and associated practices related to the ET Services have been reviewed by TRUSTe for
compliance with TRUSTe’s program requirements, including transparency, accountability, and choice regarding the
collection and use of personal data. The ET Services undergo security assessments by internal personnel and third parties, which include infrastructure
vulnerability assessments and application security assessments, on at least an annual basis. Security Controls
The ET Services include a variety of security controls. These controls include:
●
Login IP Whitelisting – Customers of the ET Services have the option to define the range of IP addresses from
which their users may access the ET Services. Unauthorized users outside of the customer organization will not be
able to log in when this control is enabled. ●
Data Encryption Options – Provides several encryption and decryption options for data used to construct your email
messages and landing pages. ●
Two Factor Authentication / Identity Validation Option – Customers with this option enabled are required to
perform identity validation involving a machine-specific fingerprint to help protect against unauthorized access to
their user accounts. ●
Email Export Whitelist - Enables customers to define which users are able to receive exported material via email
from the ET Services. ●
Customer Configurable Security – Customers have the option to vary the complexity, expiration, and challenge
questions regarding password security, and to define additional security settings such as account lockout and session
timeouts. ●
Customer Configurable Roles and Permissions – Customers have the option to manage their application users,
define roles, and apply permissions and rights within their implementation of the ET Services. 2
Copyright 2000 – 2016 salesforce.com, inc. All rights reserved. Salesforce is a registered trademark of
salesforce.com, inc., as are other names and marks. Other marks appearing herein may be trademarks of their
respective owners. ●
Single Sign-On – Enables single sign-on authentication to the Salesforce
Marketing Cloud application by using any
E
third-party identity provider with SAML 2.0 support to authenticate users. Security Procedures, Policies and Logging
The ET Services are operated in accordance with the following procedures to enhance security: ●
User passwords are never transmitted unencrypted.
●
User access log entries will be maintained, containing date, time, URL executed or identity ID operated on,
operation performed (viewed, edited, etc.) and source IP address.
●
Logs will be stored in a secure centralized host to prevent tampering.
●
Passwords are not logged under any circumstances.
●
Watchdog Behavioral Analysis Program logs anomalous behavior within the ET Services.
Intrusion Detection Salesforce, or an authorized independent third party, will monitor the ET Services for unauthorized intrusions using
network-based intrusion detection mechanisms. Salesforce may analyze data collected by users’ web browsers (e.g., device
type, screen resolution, time zone, operating system version, browser type and version, system fonts, installed browser plugins, enabled MIME types, etc.) for security purposes, including to detect compromised browsers, to prevent fraudulent
authentications, and to ensure that the ET Services function properly.
Security Logs All Salesforce systems used in the provision of the ET Services, including firewalls, routers, network switches and
operating systems, log information to their respective system log facility or a centralized syslog server (for network
systems) in order to enable security reviews and analysis. Incident Management
Salesforce maintains security incident management policies and procedures. Salesforce promptly notifies impacted
customers of any actual or reasonably suspected unauthorized disclosure of their respective Customer Data by Salesforce or
its agents of which Salesforce becomes aware to the extent permitted by law. 3
Copyright 2000 – 2016 salesforce.com, inc. All rights reserved. Salesforce is a registered trademark of
salesforce.com, inc., as are other names and marks. Other marks appearing herein may be trademarks of their
respective owners. User Authentication
E
Access to the ET Services requires a valid user ID and password combination, which are encrypted via TLS while in
transmission, as well as machine specific information for two factor identity validation as described under “Security
Controls,” above. Following a successful authentication, a random session ID is generated and stored in the user’s browser
to preserve and track session state. Physical Security
Production data centers used to provide the ET Services have access control systems. These systems permit only authorized
personnel to have access to secure areas. These facilities are designed to withstand adverse weather and other reasonably
predictable natural conditions, are secured by around-the-clock guards, two-factor access screening, including biometrics,
and escort-controlled access, and are also supported by on-site back-up generators in the event of a power failure. Reliability and Backup
All networking components, SSL accelerators, load balancers, Web servers and application servers are configured in a
redundant configuration. All Customer Data submitted to the ET Services is stored on a primary database server with
multiple active clusters for higher availability. All Customer Data submitted to the ET Services is stored on carrier-class
disk storage using redundant disks and multiple data paths to ensure reliability and performance. All Customer Data
submitted to the ET Services, up to the last committed transaction, is automatically replicated on a near real-time basis at
the database layer and is backed up on a regular basis. Backups stored on backup media are encrypted and retained for up to
24 weeks, after which time the data is overwritten or deleted. Backups are verified for integrity and stored at Salesforce’s
data centers and/or secure off-site location. Disaster Recovery
Salesforce has disaster recovery plans in place for the ET Services and tests them at least once per year. The ET Services
utilize secondary facilities that are geographically remote from their primary data centers, along with required hardware,
software, and internet connectivity, in the event Salesforce production facilities at the primary data centers were to be
rendered unavailable. The ET Services’ disaster recovery plans currently have the following standard target recovery objectives: (a) restoration of
the ET Services (RTO) within 132 hours after Salesforce’s declaration of a disaster; and (b) maximum Customer Data loss
(RPO) of 72 hours; excluding, however, a disaster or multiple disasters causing the compromise of both data centers at the
4
Copyright 2000 – 2016 salesforce.com, inc. All rights reserved. Salesforce is a registered trademark of
salesforce.com, inc., as are other names and marks. Other marks appearing herein may be trademarks of their
respective owners. same time, and excluding development and test bed environments, such as E
the Sandbox service. Viruses
The ET Services have controls in place that are designed to prevent the introduction of viruses to the ET Service platform.
ET Services are able to scan for known viruses that could be included in attachments or other Customer Data uploaded into
the ET Services by a customer. Uploaded attachments that are found to contain a virus will not be executed in the ET
Services. Data Encryption
The ET Services use industry-accepted encryption products to protect Customer Data and communications during
transmissions between a customer's network and the ET Services, including 128-bit TLS Certificates and 2048-bit RSA
public keys at a minimum. Return of Customer Data
The ET Services allow import, export or deletion of Customer Data by authorized users. Following the termination or
expiration of the contract, the customer has 30 days to access its account and download or export Customer Data. For
questions regarding the return of your Customer Data, contact the Relationship Manager or ET Support at
[email protected]. Deletion of Customer Data
After contract termination, following the 30-day period set forth above, Customer Data submitted to the ET Services is
retained in inactive status within the ET Services for 90 days, after which it is securely overwritten or deleted from the ET
Services. In accordance with the Reliability and Backup section above, Customer Data submitted to the ET Services
(including Customer Data retained in inactive status) may be stored on backup media for up to an additional 168 days after
it is securely overwritten or deleted from the ET Services. This process is subject to applicable legal requirements. Without limiting the ability for customers to request return of their Customer Data submitted to the ET Services, Salesforce
reserves the right to reduce the number of days it retains such data after contract termination. Salesforce will update this ExactTarget Security, Privacy, and Architecture Documentation in the event of such a change. 5
Copyright 2000 – 2016 salesforce.com, inc. All rights reserved. Salesforce is a registered trademark of
salesforce.com, inc., as are other names and marks. Other marks appearing herein may be trademarks of their
respective owners. E
Sensitive Personal Data
Important: The following types of sensitive personal data may not be submitted to the ET Services: government-issued
identification numbers; payment cardholder data and authentication data, credit or debit card numbers, any related security
codes or passwords, and bank account numbers. For clarity, the foregoing restrictions do not apply to financial information provided to Salesforce or ET for the purposes of
checking the financial qualifications of, and collecting payments from, its customers, the processing of which is governed
by the ExactTarget Web Site Privacy Statement. Tracking and Analytics
Salesforce may track and analyze use of the ET Services for purposes of security and helping Salesforce improve both the
ET Services and the user experience in using the ET Services. Without limiting the foregoing, Salesforce may share
anonymous data about Salesforce’s customers’ or their users’ use of the ET Services (“Usage Statistics”) to Salesforce’s
service providers for the purpose of helping Salesforce in such tracking or analysis, including improving its users’
experience with the ET Services, or as required by law. Except when required by law, any such sharing of Usage Statistics
to Salesforce’s service providers will not include any identifying information about Salesforce’s customers or customers'
users. Interoperation with Other Salesforce Services
The ET Services may interoperate with other services provided by Salesforce. The Security, Privacy and Architecture
documentation for such services is available in the Trust and Compliance Documentation section of help.salesforce.com. 6
Copyright 2000 – 2016 salesforce.com, inc. All rights reserved. Salesforce is a registered trademark of
salesforce.com, inc., as are other names and marks. Other marks appearing herein may be trademarks of their
respective owners. ">
