Salesforce Data Security and Access Control
Data is one of the most popular and valuable commodities today. Data is not only vital for most types of businesses, but it has also become a critical component of operations for a business, regardless of the frequency of each other's operations. For example, a computer's ability to access, retrieve, and edit data that is stored across many different locations will affect how easily other users will be able to retrieve and share their data with computer users (and vice versa).
What is Data Security in Salesforce?
As one of the largest and most widely used Cloud CRMs, Salesforce provides a dynamic and extensible architecture for protecting the integrity of electronic record structures while allowing for the collection and processing of information by users from various locations on a global basis. Understanding how to protect Salesforce's data and how to grant others access to that data is especially important for administrators and developers new to Salesforce or looking to enter the job market as a Salesforce professional.
Key Layers of Salesforce Security
Salesforce security can be broadly divided into four main layers:
1. Organization Level Security
This is the first level of security. It controls user authentication and access to the system.
- User Authentication: Login IP ranges and login hours can restrict when and where users can access Salesforce.
- Password Policies: Strong password requirements help prevent unauthorized access.
- Two-Factor Authentication (2FA): Adds an extra layer of security.
Example: A company can restrict users from logging in only during office hours and from company networks.
2. Object Level Security
Object-level security determines whether a user can access a specific object (like Account, Contact, Opportunity).
Controlled using Profiles and Permission Sets:
- Create (C)
- Read (R)
- Edit (E)
- Delete (D)
Example: A sales user can view and edit Opportunities but cannot delete them.
3. Field Level Security
Even if a user has access to an object, you can restrict access to specific fields.
- Field visibility (visible or hidden)
- Read-only access
Example: Salary field in an Employee object can be hidden from most users except HR.
4. Record Level Security
This controls access to individual records within an object.
This is the most important and complex layer.
Record-Level Security Components
a) Organization-Wide Defaults (OWD)
OWD defines the default level of access for records.
Types:
- Private
- Public Read Only
- Public Read/Write
- Controlled by Parent
Example:
If OWD is Private, users can only see their own records.
b) Role Hierarchy
Role hierarchy allows users higher in the hierarchy to access records owned by users below them.
Example:
The manager can view the records of team members.
c) Sharing Rules
Used to extend access beyond OWD settings.
Types:
- Owner-based sharing rules
- Criteria-based sharing rules
Example:
Share all Accounts from the "Mumbai" region with a specific group.
d) Manual Sharing
Users can manually share records with others.
Example:
A sales rep can share a deal with another colleague.
e) Apex Sharing
Developers can create custom sharing logic using Apex.
Example:
Automatically share records based on complex business logic.
Profiles vs Permission Sets
Profiles
- Mandatory for every user
- Define baseline permissions
Permission Sets
- Additional permissions
- Used to extend access without changing profiles
Best Practice:
Use minimal permissions in profiles and extend access using permission sets.
Field-Level vs Object-Level vs Record-Level
Level
Controls What?
Example
Object Level
Access to the object
Can the user access the Account object?
Field Level
Access to fields
Can the user see the Salary field?
Record Level
Access to specific records
Can the user view this Account?
Data Security Best Practices
- Follow the Principle of Least Privilege
- Give users only the access they need.
- Use Role Hierarchy Carefully
- Avoid giving too much visibility.
- Prefer Permission Sets over Multiple Profiles
- Makes management easier.
- Regular Security Audits
- Review user permissions periodically.
- Use Field-Level Security for Sensitive Data
- Protect confidential fields.
- Enable Audit Trail
- Track changes made by users.
Scenario Example
Consider a Healthcare Management System:
- Doctors may see patient files but cannot delete the file itself.
- Patient files may be created by Receptionists, but they cannot be able to retrieve that patient’s medical history.
- All records can be viewed by an Administrator.
Implementation will consist of the following:
- Use Profiles for general access.
- Use Field-Level Security for the security of the medical data itself.
- Set the OWD to Private.
- Use Sharing Rules to share departments.
Salesforce has a very powerful and flexible security model that provides multiple layers of protection for your Salesforce applications. The use of organization-level security, object-level security, field-level security, record-level security, and other layers of security, allows Managers to create a very secure environment for your business.
Author Name:
Komal Wavare
Related Links:
Advantages and Disadvantages of AI
Do visit our channel to know more: SevenMentor
Komal Wavare
Expert trainer and consultant at SevenMentor with years of industry experience. Passionate about sharing knowledge and empowering the next generation of tech leaders.