5.3 Einstein Trust Layer Security and Privacy Features
Key Takeaways
- Under zero data retention, third-party LLM providers don't retain Salesforce prompt data or use it for model training.
- Secure data retrieval grounds prompts only with data the executing user can access, preserving role-based controls and field-level security.
- Pattern-based and field-based LLM data masking is disabled for agents, while embedded features such as Service Replies can use masking.
- Toxicity detection on responses is on by default and can't be changed; toxicity detection on prompts is a beta feature that's off by default.
- Prompts, responses, and trust signals are logged as audit and feedback data in Data 360, and Salesforce also keeps that data for 30 days for compliance.
5.3 Einstein Trust Layer Security and Privacy Features
Quick Answer: The Einstein Trust Layer is Salesforce's secure AI architecture: agreements, security technology, and data and privacy controls that apply to generative AI and Agentforce features. Its main features are zero data retention, dynamic grounding with secure data retrieval, prompt defense, data masking (disabled for agents), toxicity detection, the LLM gateway, citations, and audit and feedback logging in Data 360.
The Journey Through the Trust Layer
Salesforce describes three stages: the prompt journey (from CRM apps through the Trust Layer to the LLM), response generation, and the response journey back through the Trust Layer to the app.
| Stage | Feature | What it does |
|---|---|---|
| Prompt journey | Secure data retrieval and dynamic grounding | Grounds the prompt with record fields, flows, Apex, Data 360 DMOs, and related lists, using only data the executing user can access. Role-based controls and FLS are preserved |
| Prompt journey | Data masking | Detects sensitive data and replaces it with placeholders before it reaches the model. Pattern-based masking uses regex, context words, and machine learning (for names); field-based masking uses Shield Platform Encryption or data classification metadata |
| Prompt journey | Prompt defense | System policies instruct the LLM to behave safely, such as not answering what it doesn't know, and help defend against jailbreaking and prompt injection. Prompt injection detection adds another layer |
| Generation | LLM gateway | A unified, secure way to reach multiple model providers, with TLS encryption in transit |
| Generation | Zero data retention | External providers don't retain data sent from Salesforce; it's deleted after the response returns |
| Response journey | Toxicity detection | Scores the response for harmful content, and the scores are stored in Data 360 |
| Response journey | Demasking | Replaces placeholders with the original values so the response is useful |
| Response journey | Citations | Links responses to the source content used, so users can verify accuracy |
| Response journey | Feedback and audit | Captures explicit and implicit feedback plus the original prompt, masked prompt, toxicity scores, raw output, and demasked output |
Zero Data Retention
Salesforce partners with external model providers, such as OpenAI, to enforce a zero-data retention policy:
- No data is used for LLM model training or product improvements by third-party LLMs.
- No data is retained by third-party LLMs.
- No human at the provider looks at the data unless Salesforce grants access in response to documented suspicion of illegal activity or significant usage-policy violations.
Trust boundaries differ by model source:
| Model source | Where it's hosted |
|---|---|
| Built or fine-tuned by Salesforce | Inside the Salesforce trust boundary |
| External models from third-party providers such as OpenAI | A shared trust boundary, under zero data retention |
| Salesforce-managed Anthropic models on Amazon Bedrock | Traffic stays inside Salesforce's VPC. Salesforce describes this as the first LLM provider fully inside the Salesforce trust boundary |
| Models you build and maintain (BYO) | Your infrastructure |
Data Masking and Agents: A High-Value Exam Point
Data masking through the Einstein Trust Layer is disabled for agents. Salesforce explains that masking can remove context an agent needs. For example, if a user asks for accounts similar to a reference account and that account's details are masked, the LLM can't find similar ones.
Key details:
- Pattern-based and field-based LLM data masking are both disabled for agents.
- Embedded generative AI features such as Einstein Service Replies and Einstein Work Summaries can use masking, which you configure in Einstein Trust Layer setup (you choose what to mask).
- A prompt template used directly (for example in service replies) applies masking per the Trust Layer configuration, but when that same template runs through an agent action, masking is disabled.
- Agents stay protected by zero data retention, secure data retrieval, prompt defense, toxicity detection, and, for Service agents, final response validation.
- When an action uses a Salesforce-managed model hosted inside the Salesforce trust boundary, such as Anthropic Claude on Salesforce's Bedrock instance, data doesn't leave the boundary. Masking stays disabled, and zero data retention still applies.
- Field-based masking supports only merge fields referenced in record merge fields and related lists.
- No detection model guarantees 100% accuracy, and cross-region use cases can reduce detection.
Toxicity Detection
| Setting | Default |
|---|---|
| Toxicity detection in responses | On by default and can't be changed |
| Toxicity detection in prompts (beta) | Off by default. You can turn it on for your org |
Toxicity models recognize five categories: Violence, Sexual, Profanity, Hate, and Physical (illicit substances, self-harm, or physical harm). Each category is scored from 0 to 1, where 1 is most toxic, plus an overall score. Scores are logged in the audit trail in Data 360 and shown in prebuilt reports and dashboards. When toxicity is detected, features such as Prompt Builder show a warning, though not every AI feature displays one.
Content Safety and Prompt Injection
Salesforce's content safety policies target harmful content, which LLMs can produce because of prompt wording, training data, contextual patterns, or fine-tuning. Prompt injections are attempts to make the LLM do something it wasn't designed to do, such as overriding system policies. Salesforce combines system policies with prompt injection detection and applies prompt injection defense consistently to user prompts in Agentforce and embedded AI apps.
Audit and Feedback Data
| Data type | Source | Examples collected | Includes user data? |
|---|---|---|---|
| Generative AI audit data | LLM gateway | Prompt template ID, hydrated prompt, masked prompt, retrieved data, LLM response, unmasked response, safety and toxicity scores, model and temperature | Yes |
| Feedback data | Feedback API | Thumbs up/down with reason, accept/regenerate/modify/decline, modified final response | No |
To use it, turn on Einstein generative AI data collection and storage and install the report package. Data goes to the default data space in Data 360, data streams refresh hourly, you control retention in your Data 360 instance, and Salesforce also stores audit and feedback data for 30 days for compliance. You can delete it by removing the data lake objects from data spaces.
Scenario Practice
| Scenario | Trust Layer answer |
|---|---|
| Legal asks whether OpenAI can train on prompts containing customer data | Zero data retention: no training, no retention |
| A rep shouldn't see salary data in AI summaries they can't see in the UI | Secure data retrieval respects FLS and sharing |
| Compliance needs to prove what was sent to the model and what came back | Audit trail in Data 360 (masked prompt, response, scores) |
| A team expects SSNs to be masked in agent conversations | Masking is disabled for agents. Protect sensitive fields with FLS, filters, and action design |
| Monitor harmful language trends in generated responses | Toxicity scores in audit data and Trust Layer dashboards |
| Users need to verify where an answer came from | Citations |
Exam Traps
- Masking is not an agent protection. Choose FLS, least-privilege agent users, and secure retrieval instead.
- Response toxicity detection can't be turned off.
- Audit data lives in Data 360 and requires data collection to be turned on.
- Zero data retention covers external providers, and the Trust Layer applies to generative AI and Agentforce features, not to all Salesforce features.
A compliance officer assumes the Einstein Trust Layer masks Social Security numbers in Agentforce Service agent conversations. What is accurate?
Which statement about Einstein Trust Layer toxicity detection is accurate?
A company's legal team asks whether an external model provider can retain prompts sent from Salesforce or train on them. Which Trust Layer feature answers this?
An auditor needs to see the masked prompt, the LLM response, and toxicity scores for a generative AI feature. Where is this information stored?