Is It Safe to Send Salesforce Data to an LLM?

It can be. Sending CRM records to a large language model means handing them to a third party, and it is as safe as the terms that govern that party and the controls you put in front of the call. Under their API and enterprise terms, OpenAI, Microsoft, Anthropic, Google and Amazon Web Services each state that they do not train models on your prompts by default. Where they differ is retention, human review, processing location, and the terms of the healthcare contracts they offer.

This page covers API and enterprise access only, which is how a Salesforce integration calls a model. Consumer chat apps run under separate terms; Anthropic, for example, publishes separate articles for its consumer plans. Do not read the provider table below as a statement about consumer products.

Safety here is not a yes-or-no property of the model. It is the sum of four answers, and you can check each one yourself.

1. Does the provider train on your data?

This is usually the first question, and for API traffic it is the least likely to be the problem. All five providers in the table below state that API or enterprise inputs and outputs are not used to train their models by default. Check the exceptions: OpenAI's statement applies unless you explicitly opt in to share data, and Anthropic says feedback you choose to submit, such as a thumbs up or down rating, can be used.

2. How long does it keep prompts and outputs, and who can see them?

Not training on data is not the same as not keeping it. Most providers keep some prompts for abuse monitoring by default. OpenAI keeps abuse monitoring logs, which can contain prompts and responses, for up to 30 days. Anthropic deletes API inputs and outputs within 30 days unless an exception applies. On Google's platform, prompts can be logged for up to 90 days when its safety classifiers flag suspicious activity, for customers on Google Cloud's online terms.

Each provider offers a zero-retention or modified abuse monitoring arrangement, usually on application or by configuration rather than by default. Read what remains even then: Anthropic still keeps safety classifier results and requires 30-day retention for its Covered Models, and on Azure™, automated review can still run after human review is switched off.

3. Where is it processed?

Location matters for residency commitments and for regulators. Azure OpenAI processes prompts within the customer-specified geography unless you choose a Global or DataZone deployment, in which case processing can happen in any geography where the model is deployed, or anywhere within the data zone. OpenAI offers data residency controls per project for eligible customers. Amazon Bedrock stores content at rest in the Region you use, but cross-region inference can process a request in another Region, and any retained inputs and outputs are then stored in the Region where the request was processed. Pick the deployment type deliberately.

4. What are you sending, and under what contract?

The control you own outright is the prompt. Send only the fields the task needs, and mask identifiers before the call so the provider never receives them. Masking does not replace the contract, and the contract does not replace masking: a retention agreement governs what the provider keeps, while masking governs what it receives. See PII masking for the definition.

Then put the terms in writing. Providers publish data processing terms, such as Microsoft's Products and Services Data Protection Addendum, Google's Cloud Data Processing Addendum and Anthropic's Data Processing Addendum. If you are a HIPAA covered entity or business associate and protected health information can reach the model, HHS guidance says you need a business associate agreement with that provider first. That is covered below.

API and enterprise terms only, as each provider publishes them. Consumer chat apps are excluded. Each cell paraphrases the provider's own documentation; follow the source link before you rely on it, because these pages change without notice.

Three notes on reading the table. Google's documentation now lists Vertex AI Platform under the name Gemini Enterprise Agent Platform, so older references to Gemini on Vertex AI mean the same service. Microsoft states that models sold by Azure, including Azure OpenAI, do not interact with services operated by OpenAI, such as the OpenAI API. And AWS states that Bedrock inputs and outputs are not shared with model providers, while ZDR eligibility for Claude models on Bedrock is managed by Anthropic.

None of these rows describes your org until you check which product, tier and configuration your calls use. A model reached through Salesforce's managed service, for instance, is governed by Salesforce's contract with that provider, or, for a model Salesforce hosts inside its own trust boundary, by Salesforce's own zero-retention policy. That is the next section.

If you use Salesforce's own generative AI features, the Einstein Trust Layer™ sits between your org and the model. Salesforce describes it as a set of protections: grounding in CRM data, masking of sensitive data, toxicity detection, an audit trail, and zero-retention agreements with third-party model providers.

On retention, Salesforce Help states that it has a zero-retention policy with external model providers such as OpenAI and Azure OpenAI, under which data sent to the model from Salesforce is not retained and is deleted after the response is sent back. On access, secure data retrieval means a prompt is grounded only with data the executing user can access.

Masking works in two ways. Pattern-based detection uses regular expressions, context words and machine learning models; field-based detection uses fields classified through Shield Platform Encryption or data classification. Detected values are replaced with placeholder text before the prompt reaches an external model.

There is one scope limit to record. Salesforce documents that LLM data masking through the Einstein Trust Layer is disabled for Agentforce™ agents, covering both pattern-based and field-based masking. The zero-retention agreements, toxicity detection and audit trail still apply to agent traffic (Salesforce stores the prompts, responses and trust signals in Data 360), so data sent to an external model is still subject to Salesforce's zero-retention contract with that provider, but the data an agent grounds on is sent to the model as retrieved. Contractual control and masking are different controls. See does the Einstein Trust Layer mask Agentforce data for the detail and Salesforce's stated reasons, and which LLM Agentforce uses for which provider handles the traffic.

Under the HIPAA rules, a business associate is a person or organisation that creates, receives, maintains or transmits protected health information on behalf of a covered entity. HHS guidance on cloud computing says that when a covered entity uses a cloud service provider to process or store electronic PHI, the provider is a business associate, and the two must enter into a business associate agreement (BAA). The BAA establishes the permitted and required uses and disclosures of the PHI and contractually requires the provider to safeguard it.

Two points in the same guidance matter for model calls. First, encryption does not remove business associate status: a provider that holds only encrypted ePHI without the key is still a business associate. Second, a provider that receives only information de-identified under the Privacy Rule is not a business associate. De-identification has a defined test. The Safe Harbor method requires removing 18 categories of identifiers, including biometric identifiers such as finger and voice prints and full-face photographs, with no actual knowledge that what remains could identify someone. The alternative is a documented expert determination.

That is why masking reduces exposure but does not remove the obligation. Masking most identifiers is not the same as Safe Harbor de-identification, so if PHI could still reach the model, treat the call as a PHI disclosure: sign the provider's BAA, confirm the specific features you use are covered, and apply any HIPAA configuration it requires. All five providers in the table offer a BAA on some terms. GPTfy, for reference, masks 16 of the 18 HIPAA PHI identifiers; it cannot mask biometric identifiers or full-face photographs. See AI for healthcare for GPTfy's healthcare configuration.

This is a summary of public guidance, not legal advice. Your privacy officer or counsel decides how it applies to your organisation.

Eight checks you can run before any CRM data reaches a model:

1. List every prompt, flow and agent that calls a model, and the objects and fields each one can reach. Grounding in Salesforce follows the running user's permissions, so check who each one runs as.
2. For each call, identify the provider and whose contract governs it: a Salesforce-managed model, or your own API account.
3. Confirm the training terms for that exact product and tier. API and enterprise terms are not consumer terms.
4. Find the default retention period and decide whether you need a zero-retention or modified abuse monitoring arrangement. Apply early, because most providers approve these case by case.
5. Verify the setting after approval. OpenAI shows a Data Retention tab under organization data controls, Anthropic shows the data retention period under privacy controls, Azure shows ContentLogging set to false on the resource, and Bedrock returns the current mode from its data retention API.
6. Pin the processing location: choose the Azure deployment type, OpenAI data residency region, Google endpoint or Bedrock cross-region setting that matches your residency commitments.
7. Minimise and mask. Send only the fields the task needs and mask identifiers before the call, paying most attention to free-text fields, where values have no predictable pattern.
8. Sign the paperwork and keep the evidence: the provider's data processing terms, a BAA before any PHI, and an audit record of what was sent. Re-check the provider pages at least quarterly.

GPTfy runs inside your Salesforce org and applies masking in its own request path, before the model call. Four layers are available: field-level rules, regular expressions, blocklists, and Apex for cases the first three cannot express. A blocklist masks a matched term; the prompt still runs.

Raw data remains in Salesforce, and only masked data reaches your AI provider, through admin-controlled callouts via Named Credentials. With bring your own model, you connect your existing OpenAI, Azure, Google Cloud or AWS agreement, so the training, retention and BAA terms in the table above are the terms of your own contract, and you configure zero retention with your AI provider directly. Each call writes a Security Audit Record.

More on data masking, bringing your own model and audit trails and governance.

Book a demo

Every statement about a provider, Salesforce or HIPAA on this page comes from one of these. Provider documentation is updated without notice, so re-check it rather than relying on the date on this page.

• OpenAI: Data controls in the OpenAI platform
• Microsoft Learn: Data, privacy, and security for Models sold by Azure
• Microsoft Learn: Abuse monitoring
• Microsoft Learn: HIPAA and the HITECH Act
• Anthropic Privacy Center: Is my data used for model training?
• Anthropic Privacy Center: How long do you store my organization's data?
• Anthropic Privacy Center: ZDR agreements, which products they apply to
• Anthropic Privacy Center: Business Associate Agreements for commercial customers
• Anthropic Privacy Center: Data retention practices for Covered Models
• Google Cloud: Gemini Enterprise Agent Platform and zero-retention (ZDR) guidance
• Google Cloud: Abuse monitoring
• Google Cloud: Name changes from Vertex AI
• Google Cloud: HIPAA compliance on Google Cloud
• AWS: Amazon Bedrock FAQs
• AWS: Amazon Bedrock data retention
• AWS: Amazon Bedrock abuse detection
• AWS: HIPAA Eligible Services Reference
• AWS: HIPAA compliance
• Salesforce Help: Einstein Trust Layer, Designed for Trust
• Agentforce Developer Guide: Trust Layer
• Salesforce Help: Data Masking Limitations in Agentforce
• Salesforce Help: Trust and Agentforce
• HHS: Guidance on HIPAA and Cloud Computing
• 45 CFR 160.103: Definitions (business associate)
• 45 CFR 164.514: De-identification of protected health information

This comparison is based on publicly available documentation as of 19 October 2026. Features and pricing subject to change. Salesforce, Agentforce, Einstein, and related marks are trademarks of Salesforce, Inc. Microsoft, Copilot, and related marks are trademarks of Microsoft Corporation. GPTfy is an independent product available on AppExchange and Microsoft AppSource and is not affiliated with or endorsed by Salesforce, Inc. or Microsoft Corporation beyond marketplace partner status. Azure is a trademark of Microsoft Corporation. OpenAI, Anthropic, Claude, Google, Gemini, Amazon Web Services and Amazon Bedrock are trademarks of their respective owners. Last reviewed 19 October 2026.