When Does Einstein Trust Layer Mask Data
Quick answer
When Does Einstein Trust Layer Mask Data
Masking stays on for Einstein gen-AI outside Agentforce. Salesforce disabled Trust Layer masking for agents. GPTfy 4-layer masks on the BYOM path.
Last updated:
Masking stays on for Einstein generative AI outside Agentforce: Service Replies, Field Summaries, Prompt Builder, and Flow. Salesforce disabled Trust Layer masking for Agentforce agents because of latency and accuracy. GPTfy 4-layer masks on the BYOM path.
Source: LLM Data Masking (Salesforce, 2025-06-10), and Trailhead. GPTfy does not wrap or replace the Einstein Trust Layer.
When does Einstein Trust Layer mask data?
When the generative AI interaction is outside Agentforce. Service Replies, Field Summaries, Prompt Builder, and Flow keep Trust Layer masking on. That is Salesforce's rule of thumb in the 2025-06-10 blog: if it is not Agentforce, masking works as it did.
When the interaction is an Agentforce agent, Trust Layer masking is disabled. Salesforce's stated reasons are latency and accuracy.
Susannah Plaisted, accepted 2025-04-21 on 0D5KX00000MaYJs0AN: masking is off when a prompt template runs as an Agentforce action; on when it runs outside Agentforce (Prompt Builder, Flows) as configured in Setup.
Sources for this split: live Salesforce Help, the June 2025 blog, and the Privacy FAQ.
What did Salesforce disable, and what did it not disable?
Salesforce disabled Trust Layer masking for Agentforce agents. It did not disable zero data retention (ZDR), grounding, Salesforce permissions, or audit for those agents.
If Agentforce doesn't mask, why not just call ChatGPT cheaper?
Masking is disabled for agents. ZDR, grounding, Salesforce permissions, and audit are not. A raw ChatGPT call has none of those, and none of GPTfy's 4-layer BYOM mask.
Does GPTfy replace the Einstein Trust Layer?
No. GPTfy 4-layer masks on the BYOM path. It does not wrap Trust Layer. It does not pass prompts "into the Trust Layer." It does not replace Trust Layer.
Where does GPTfy mask?
On the BYOM path, in four layers, before the prompt reaches the model you configured. That is not "data stays in your org."
FAQ
When does Einstein Trust Layer mask data?
Masking stays on for Einstein generative AI outside Agentforce: Service Replies, Field Summaries, Prompt Builder, and Flow. Salesforce disabled Trust Layer masking for Agentforce agents because of latency and accuracy. Susannah Plaisted, accepted 2025-04-21 on 0D5KX00000MaYJs0AN: masking is off when a prompt template runs as an Agentforce action; on when it runs outside Agentforce (Prompt Builder, Flows) as configured in Setup.
Does Einstein Trust Layer mask Agentforce agents?
No. Salesforce disabled Trust Layer masking for Agentforce agents (latency and accuracy). ZDR, grounding, Salesforce permissions, and audit are not disabled. Source: Salesforce blog, 2025-06-10.
If Agentforce doesn't mask, why not just call ChatGPT cheaper?
A raw ChatGPT call has no ZDR, no Salesforce grounding, no Salesforce permissions, no audit, and none of GPTfy's 4-layer BYOM mask. Masking is the piece Salesforce turned off for agents. The rest is not off.
Does GPTfy wrap or replace the Einstein Trust Layer?
No. GPTfy 4-layer masks on the BYOM path. It does not wrap Trust Layer and it does not replace it.
Want to learn more?
View the Datasheet
Get the full product overview with architecture details, security specs, and pricing, with a built-in print option.
Watch a 2-Minute Demo
See GPTfy in action inside Salesforce - from prompt configuration to AI-generated output in real time.
Ready to see it with your data? Book a Demo
Explore GPTfy