{
"canonical_url": "salesforce.com/government",
"category": "Government service agents",
"commercial": true,
"compliance": [
{
"certificate_id": "salesforce.com, inc.",
"covers_resource": "unknown",
"credited": true,
"detail": {
"note": "From the STAR Registry index card; STAR Level 1 is a self-assessment (CAIQ), Level 2 a third-party certification or attestation.",
"organization": "Salesforce.com, Inc.",
"terms": [
"star_level_1",
"star_for_ai_level_1",
"partner_entries",
"caiq",
"ai-caiq",
"eu-cloud-coc",
"iso-iec-42001"
]
},
"display": "STAR for AI: found in CSA STAR Registry on 2026-10-26",
"evidence_url": "https://cloudsecurityalliance.org/star/registry/salesforce.com, inc.",
"framework": "csa_star",
"issued": "2016-03-13",
"issuer": "Cloud Security Alliance",
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "51c7c3cba565bd44fb1a057b2b3d9312894a56c98eab49f361756b0b3c868a15",
"period_end": null,
"retrieved_at": "2026-10-26T12:25:43Z",
"review_reason": "entity 1.00 (index card)",
"reviewer": null,
"scope": "entity",
"source": "csa_star",
"status": "active",
"tier": 1,
"valid_until": null,
"variant": "STAR_FOR_AI"
},
{
"certificate_id": "salesforce.com, inc.",
"covers_resource": "unknown",
"credited": true,
"detail": {
"note": "From the STAR Registry index card; STAR Level 1 is a self-assessment (CAIQ), Level 2 a third-party certification or attestation.",
"organization": "Salesforce.com, Inc.",
"terms": [
"star_level_1",
"star_for_ai_level_1",
"partner_entries",
"caiq",
"ai-caiq",
"eu-cloud-coc",
"iso-iec-42001"
]
},
"display": "STAR Level 1: found in CSA STAR Registry on 2026-10-26",
"evidence_url": "https://cloudsecurityalliance.org/star/registry/salesforce.com, inc.",
"framework": "csa_star",
"issued": "2016-03-13",
"issuer": "Cloud Security Alliance",
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "51c7c3cba565bd44fb1a057b2b3d9312894a56c98eab49f361756b0b3c868a15",
"period_end": null,
"retrieved_at": "2026-10-26T12:25:43Z",
"review_reason": "entity 1.00 (index card)",
"reviewer": null,
"scope": "entity",
"source": "csa_star",
"status": "active",
"tier": 1,
"valid_until": null,
"variant": "STAR_LEVEL_1"
},
{
"certificate_id": "FR1818161169",
"covers_resource": "partial",
"credited": true,
"detail": {
"cso": "MuleSoft Government Cloud",
"csp": "MuleSoft",
"deployment_model": "Government Community Cloud",
"fedramp_status": "FedRAMP Authorized",
"impact_level": "Moderate"
},
"display": "FedRAMP Moderate: FedRAMP Authorized (FedRAMP Marketplace, 2026-10-26)",
"evidence_url": "https://marketplace.fedramp.gov/products/FR1818161169",
"framework": "fedramp",
"issued": "2019-07-31",
"issuer": "Agency / 3PAO Coalfire Systems, Inc.",
"match_confidence": 0.933,
"next_check": "2026-11-02",
"payload_hash": "64bc98d4cebbc137a6e7b94442b8678790eefa29e4347928a0de8620b56a168a",
"period_end": null,
"retrieved_at": "2026-10-26T12:24:34Z",
"review_reason": "entity 1.00, offering 0.85",
"reviewer": null,
"scope": "product",
"source": "fedramp",
"status": "active",
"tier": 1,
"valid_until": null,
"variant": "FEDRAMP_MODERATE"
},
{
"certificate_id": "salesforce.com, inc.",
"covers_resource": "unknown",
"credited": true,
"detail": {
"note": "From the STAR Registry index card; STAR Level 1 is a self-assessment (CAIQ), Level 2 a third-party certification or attestation.",
"organization": "Salesforce.com, Inc.",
"terms": [
"star_level_1",
"star_for_ai_level_1",
"partner_entries",
"caiq",
"ai-caiq",
"eu-cloud-coc",
"iso-iec-42001"
]
},
"display": "ISO 42001: Found in CSA STAR Registry on 2026-10-26",
"evidence_url": "https://cloudsecurityalliance.org/star/registry/salesforce.com, inc.",
"framework": "iso42001",
"issued": "2016-03-13",
"issuer": "Cloud Security Alliance",
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "51c7c3cba565bd44fb1a057b2b3d9312894a56c98eab49f361756b0b3c868a15",
"period_end": null,
"retrieved_at": "2026-10-26T12:25:43Z",
"review_reason": "entity 1.00 (index card)",
"reviewer": null,
"scope": "entity",
"source": "csa_star",
"status": "active",
"tier": 1,
"valid_until": null,
"variant": "ISO42001"
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "EU AI Act: Art. 50 statement (vendor statement, 2026-10-26)",
"evidence_url": "https://www.salesforce.com/company/legal/compliance/?bc=HL",
"framework": "eu_ai_act",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "6f7a005021d188e87aa1d76d5835a851e00d5900fb9e38d72eac0e6001c88d26",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:56Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": "ART50_STATEMENT"
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "DPA available: Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://www.salesforce.com/company/legal/privacy/?bc=HL",
"framework": "gdpr",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "bdb7b403d8cfb69b2959721341a0d2ffc1f82571c13829d765965e1152334f6e",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:56Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": "DPA_AVAILABLE"
},
{
"certificate_id": null,
"covers_resource": "unknown",
"credited": true,
"detail": {
"pages_visited": 6
},
"display": "DPF active: Vendor-claimed (vendor page, 2026-10-26)",
"evidence_url": "https://www.salesforce.com/company/legal/privacy/?bc=HL",
"framework": "gdpr",
"issued": null,
"issuer": null,
"match_confidence": 1.0,
"next_check": "2026-11-02",
"payload_hash": "bdb7b403d8cfb69b2959721341a0d2ffc1f82571c13829d765965e1152334f6e",
"period_end": null,
"retrieved_at": "2026-10-26T12:30:56Z",
"review_reason": "framework named on the vendor's own page",
"reviewer": null,
"scope": "entity",
"source": "vendor_trust_centers",
"status": "active",
"tier": 4,
"valid_until": null,
"variant": "DPF_ACTIVE"
}
],
"deployment": "Salesforce Government Cloud",
"description": "CRM/service agent workflows for public-sector use cases.",
"disclaimer": "Reference implementation by Hemant Naik. Compliance information is compiled from the sources shown as of the date shown. It is not an assessment, certification, legal opinion or recommendation. Confirm current status with the vendor and the issuing body.",
"domains": {
"business": {
"components": {
"adoption": 24.0,
"docs": 9.0,
"domain_fit": 100.0,
"ecosystem": 14.0,
"governance": 25.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso42001": 0.5
},
"profile": "general",
"rank": 47,
"recomputed": 90.1,
"score": 83.6,
"score_version": "sar-score-2.0",
"seed_rank": 47,
"seed_score": 90.1,
"source": "seed_xlsx",
"unknown": []
},
"cybersecurity": {
"components": {
"adoption": 24.0,
"docs": 9.0,
"domain_fit": 100.0,
"ecosystem": 14.0,
"governance": 30.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso42001": 0.5
},
"profile": "security",
"rank": 59,
"recomputed": 79.6,
"score": 81.8,
"score_version": "sar-score-2.0",
"seed_rank": 59,
"seed_score": 79.6,
"source": "seed_xlsx",
"unknown": []
},
"data": {
"components": {
"adoption": 24.0,
"docs": 9.0,
"domain_fit": 100.0,
"ecosystem": 14.0,
"governance": 20.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso42001": 0.5
},
"profile": "data",
"rank": 84,
"recomputed": 83.8,
"score": 88.7,
"score_version": "sar-score-2.0",
"seed_rank": 84,
"seed_score": 83.8,
"source": "seed_xlsx",
"unknown": []
},
"finance": {
"components": {
"adoption": 24.0,
"docs": 9.0,
"domain_fit": 100.0,
"ecosystem": 14.0,
"governance": 20.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso42001": 0.5
},
"profile": "regulated",
"rank": 73,
"recomputed": 74.6,
"score": 77.8,
"score_version": "sar-score-2.0",
"seed_rank": 73,
"seed_score": 74.6,
"source": "seed_xlsx",
"unknown": []
},
"government": {
"components": {
"adoption": 24.0,
"docs": 9.0,
"domain_fit": 100.0,
"ecosystem": 14.0,
"governance": 50.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"fedramp": 1.0,
"iso42001": 0.5
},
"profile": "regulated",
"rank": 25,
"recomputed": 93.1,
"score": 82.3,
"score_version": "sar-score-2.0",
"seed_rank": 25,
"seed_score": 93.1,
"source": "seed_xlsx",
"unknown": []
},
"healthcare": {
"components": {
"adoption": 24.0,
"docs": 9.0,
"domain_fit": 100.0,
"ecosystem": 14.0,
"governance": 20.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso42001": 0.5
},
"profile": "regulated",
"rank": 67,
"recomputed": 74.6,
"score": 77.8,
"score_version": "sar-score-2.0",
"seed_rank": 67,
"seed_score": 74.6,
"source": "seed_xlsx",
"unknown": []
},
"insurance": {
"components": {
"adoption": 24.0,
"docs": 9.0,
"domain_fit": 100.0,
"ecosystem": 14.0,
"governance": 16.7,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso42001": 0.5
},
"profile": "regulated",
"rank": 62,
"recomputed": 74.6,
"score": 77.3,
"score_version": "sar-score-2.0",
"seed_rank": 62,
"seed_score": 74.6,
"source": "seed_xlsx",
"unknown": []
},
"legal": {
"components": {
"adoption": 24.0,
"docs": 9.0,
"domain_fit": 100.0,
"ecosystem": 14.0,
"governance": 20.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso42001": 0.5
},
"profile": "regulated",
"rank": 63,
"recomputed": 74.6,
"score": 77.8,
"score_version": "sar-score-2.0",
"seed_rank": 63,
"seed_score": 74.6,
"source": "seed_xlsx",
"unknown": []
},
"regulatory": {
"components": {
"adoption": 24.0,
"docs": 9.0,
"domain_fit": 100.0,
"ecosystem": 14.0,
"governance": 20.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso42001": 0.5
},
"profile": "regulated",
"rank": 68,
"recomputed": 74.6,
"score": 77.8,
"score_version": "sar-score-2.0",
"seed_rank": 68,
"seed_score": 74.6,
"source": "seed_xlsx",
"unknown": []
},
"sales": {
"components": {
"adoption": 24.0,
"docs": 9.0,
"domain_fit": 100.0,
"ecosystem": 14.0,
"governance": 23.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"gdpr": 0.15,
"iso42001": 0.5
},
"profile": "commercial",
"rank": 64,
"recomputed": 81.9,
"score": 84.8,
"score_version": "sar-score-2.0",
"seed_rank": 64,
"seed_score": 81.9,
"source": "seed_xlsx",
"unknown": []
},
"supply_chain": {
"components": {
"adoption": 24.0,
"docs": 9.0,
"domain_fit": 100.0,
"ecosystem": 14.0,
"governance": 25.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso42001": 0.5
},
"profile": "operations",
"rank": 62,
"recomputed": 78.8,
"score": 86.0,
"score_version": "sar-score-2.0",
"seed_rank": 62,
"seed_score": 78.8,
"source": "seed_xlsx",
"unknown": []
},
"technology": {
"components": {
"adoption": 24.0,
"docs": 9.0,
"domain_fit": 100.0,
"ecosystem": 14.0,
"governance": 30.0,
"health": 20.0,
"trust": 19.0
},
"components_version": "components-from-signals-1.0",
"confidence": 1.0,
"evidence_coverage": 1.0,
"governance_credited": {
"csa_star": 0.5,
"iso42001": 0.5
},
"profile": "technology",
"rank": 81,
"recomputed": 90.3,
"score": 87.7,
"score_version": "sar-score-2.0",
"seed_rank": 81,
"seed_score": 90.3,
"source": "seed_xlsx",
"unknown": []
}
},
"external_ids": {},
"first_seen": "2026-10-26T12:11:40Z",
"governance": {
"certification_disclaimer": true,
"claims": [],
"evidence_urls": []
},
"id": "res_eac59c87fdc35644",
"identity": {
"evidence": [
"vendor_domain_product_page"
],
"rules_version": "identity-1.1",
"tier": 2
},
"issues": {
"advisories": 0,
"cves": 0,
"incidents": 0,
"links": [],
"regulator_actions": 0,
"withdrawn_certificates": 0
},
"last_seen": "2026-10-26T12:11:40Z",
"license": "Commercial",
"name": "Salesforce Government Cloud / Agentforce",
"news": [],
"news_checked": true,
"protocols": {
"a2a": {
"checked_at": "2026-10-26T12:23:55Z",
"parser_version": "a2a-0.3+1.0",
"status": "not_found"
},
"ard": {
"checked_at": "2026-10-26T12:23:52Z",
"parser_version": "ard-0.91",
"status": "not_found"
},
"mcp": {
"checked_at": "2026-10-26T12:23:56Z",
"parser_version": "mcp-2025-06-18",
"status": "not_found"
}
},
"publisher_domain": "salesforce.com",
"resource_type": "agent",
"scope": "public",
"security": {
"advisories": 0,
"checked_at": "2026-10-26T12:32:16Z",
"cves": 0,
"source": "nvd",
"tier": 1
},
"seed": {
"last_verified": "2026-09-25",
"snapshot_date": "2026-09-25"
},
"seed_components": {
"adoption": 24.0,
"docs": 9.0,
"domain_fit": 100.0,
"ecosystem": 14.0,
"governance": 45.0,
"health": 20.0,
"trust": 25.0
},
"signals": {
"observed_popularity": "Commercial"
},
"slug": "salesforce-salesforce-government-cloud-agentforce",
"sources": [
{
"payload_hash": "21e631796cf67b4821a3da36438a09e6f81fa5659eb7a37fa9929e25c6800ce0",
"retrieved_at": "2026-10-26T12:11:40Z",
"system": "seed_xlsx",
"url": "https://www.salesforce.com/government/"
}
],
"tags": [],
"tenant": null,
"traces": [
{
"checked_on": null,
"date": "2025-09-25",
"format": "report",
"id": "tr_forcedleak_agentforce_2025",
"kind": "red_team",
"notes": null,
"observed": {
"actions": [
"processed the poisoned lead when an employee asked about it",
"queried CRM lead records",
"emitted an image/link to an attacker-controlled domain that was still on the content security allowlist"
],
"approval": false,
"egress": true,
"entry": "indirect prompt injection via a public lead-capture form",
"outcome": "Lead data exfiltrated; Salesforce enforced Trusted URL allowlists for Agentforce and Einstein AI and re-secured the expired domain",
"refused": false,
"secrets_touched": true
},
"reviewer": null,
"scenario": "Instructions placed in a Web-to-Lead form field are later processed by an Agentforce agent, which queries lead records and sends them to an expired, re-registered Salesforce-allowlisted domain",
"scope": "platform",
"source": "Noma Security; reported by The Hacker News",
"tier": 3,
"title": "ForcedLeak: indirect prompt injection through Web-to-Lead exfiltrates CRM data from Agentforce (CVSS 9.4)",
"url": "https://thehackernews.com/2025/09/salesforce-patches-critical-forcedleak.html",
"vendor_response": "Salesforce patch (Trusted URLs enforcement), September 2025"
}
],
"trust": {
"compliance": 1,
"identity": 2,
"issues": 1,
"protocols": 5,
"security": 1,
"traces": 3,
"vendor_compliance": 1
},
"url": "https://www.salesforce.com/government/",
"vendor": "Salesforce"
}