Salesforce security and compliance for regulated organisations.

If you are in financial services, healthcare or anything regulated, the platform decision is only half of it. Someone will want to know where the data sits, who at your supplier can see it, and what evidence exists when an auditor asks. This page is those answers in one place, so due diligence does not become the thing that delays the project. The result is a due-diligence questionnaire your team can answer from evidence rather than memory.

The security questionnaire is where projects stall.

The pattern is familiar. The business case is agreed, the partner is chosen, and then the security questionnaire arrives and nothing moves for six weeks. Not because anything is wrong, but because nobody assembled the answers in advance.

Ignyto has delivered into FCA and Central Bank supervised firms, pharmaceutical and biotech companies, care providers and critical infrastructure. The compliance conversation happens at scoping rather than at the end, and the evidence is produced in the form your auditor will accept.

If your organisation has a supplier due diligence pack, send it early. It is quicker to complete it properly once than to answer the same questions across four separate calls.

Regulation shapes the data model from the first workshop.

In lending, advice and wealth management, Consumer Duty evidence and suitability records shape the data model from the first workshop. In pharmaceutical and medtech, validated integrations and controlled document handling do the same. In care provision, consent and record-sharing rules decide what the platform is allowed to do.

Treating that as a compliance review at the end produces rework. Ignyto designs against it from the start, which is slower to scope and considerably faster to deliver.

Salesforce Shield, Experience Cloud access models and integration governance are all in-house rather than subcontracted, so the security answer does not depend on a third party you have not met.

Where is our Salesforce data held?

Salesforce runs UK and EU regions on its Hyperforce infrastructure, so a UK instance can be hosted in the UK, and Irish or European instances in the EU. Which region your own Salesforce actually sits in depends on how and when it was provisioned, so this is a question for Salesforce rather than for us. Ignyto will help you establish the answer and what it means for your build, but data residency is Salesforce’s commitment under your contract with them — confirm it directly with Salesforce and do your own due diligence rather than relying on any supplier’s summary, including ours.

Is Ignyto GDPR compliant?

Ignyto operates under UK GDPR as a data processor on client projects, works to documented access control and least-privilege rules, and signs a data processing agreement before any access is granted. Named individuals are recorded against each engagement.

Do your consultants get access to our production data?

Only where the work genuinely requires it, and only for as long as it does. Ignyto works in sandboxes wherever possible, uses anonymised or subset data for build and test, and requests production access explicitly rather than holding it by default.

Can you get us through a security review or audit?

We cannot promise you a pass, and no supplier honestly can. What Ignyto can do is configure what the platform actually offers — field audit trail, event monitoring, encryption scope, access logs — so your evidence is a report rather than a description, and answer due-diligence questions about our own access and working practices. Ignyto has delivered into FCA and Central Bank supervised firms, pharmaceutical companies and NHS-adjacent providers. But the outcome of a review rests on your own controls and on what Salesforce is capable of, and neither of those is ours to guarantee. Where your obligation needs something the platform does not do, we will say so rather than work around it.

What does Salesforce Shield actually give us?

Platform encryption for data at rest, field audit trail for a long-term history of what changed, and event monitoring for who did what and when. Shield is not automatically the right answer — part of the conversation is whether your obligations require it or whether standard controls already satisfy them.

How do you handle security when AI is involved?

Agentforce runs inside your own Salesforce, so the sharing model, field-level security and audit trail you already have apply to every answer an agent gives. It is also worth being clear about what the platform underneath is: every Salesforce customer sits on the same enterprise infrastructure and the same security architecture relied on by defence and government bodies, some of the world’s largest banks, and healthcare and other heavily regulated industries. There is no lesser tier for smaller customers. Salesforce states that under the Einstein Trust Layer prompts are not retained by the model provider or used to train third-party models. Ignyto’s part is the configuration — setting the topics, actions and prohibitions explicitly and documenting them before anything is switched on. The platform commitments are Salesforce’s rather than ours, so verify them directly for your own compliance position.