Salesforce Sovereignty & Compliance Audit (EU, 2026)

Salesforce, Inc. is incorporated in the United States (San Francisco, California).

**GDPR**: Salesforce provides a comprehensive Data Processing Addendum and has invested significantly in GDPR compliance infrastructure. Hyperforce enables customers to deploy on EU infrastructure (AWS/GCP EU regions). Salesforce Shield offers platform encryption, event monitoring, and field audit trail. However, GDPR compliance does not address jurisdictional exposure.

**CLOUD Act / Extraterritorial Access**: As a US company, Salesforce can be compelled to produce customer CRM data regardless of where it is stored. CRM data typically includes customer contact details, sales communications, deal information, and business intelligence—all potentially valuable in government investigations and commercially sensitive.

**NIS2**: Organisations using Salesforce for critical business operations should assess supply chain risk. CRM system unavailability or data breach could impact essential service delivery for organisations in scope.

**DORA**: Financial entities must evaluate Salesforce as a critical ICT third-party service provider. Concentration risk is heightened given Salesforce's dominance in financial services CRM.

**Vendor lock-in**: Salesforce creates very high lock-in through custom objects, Apex code, Flow automations, AppExchange integrations, and deeply embedded business processes. Most organisations with mature Salesforce deployments have invested years of customisation that cannot be easily replicated elsewhere.

**Auditability**: Salesforce Shield (add-on) provides platform encryption, comprehensive event monitoring, and field audit trail. Standard editions offer basic audit capabilities. Shield encryption uses Salesforce-managed keys, though Bring Your Own Key (BYOK) is available—but Salesforce retains key access for platform operations.

**Lawful access exposure**: CRM data is particularly sensitive: customer lists, deal values, communication history, and business forecasting data. This information has both regulatory (GDPR) and strategic (competitive) implications if exposed through lawful access.

**Switching cost implications**: Salesforce migration is among the most expensive and risky technology transitions. Custom business logic, data migration, integration rebuilding, and user retraining typically require 12-18 months for mature deployments.

European CRM alternatives exist but with significant trade-offs:

**SuiteCRM** (UK, open-source): Fork of SugarCRM, self-hostable on EU infrastructure. Full sovereignty when self-managed. Trade-off: requires significant implementation effort, less polish, smaller ecosystem. Migration feasibility: hard.

**Odoo** (Belgium): Open-source ERP/CRM suite with EU jurisdiction. Growing enterprise adoption. Trade-off: CRM module less specialised than Salesforce, different UX paradigm. Migration feasibility: hard.

**SAP CRM / SAP Sales Cloud** (Germany): EU-headquartered enterprise CRM. Strong in large enterprise. Trade-off: complex implementation, high cost, different market positioning. Migration feasibility: hard.

**Hubspot** (US-headquartered, not EU): Often mentioned as alternative but is also US-jurisdictioned, so does not resolve sovereignty concerns.

**Twenty** (France, open-source): Emerging open-source CRM. Early stage but EU-jurisdictioned. Trade-off: early maturity, limited enterprise features. Migration feasibility: hard.

CRM migration from Salesforce is among the most challenging sovereignty transitions. No European alternative offers feature parity for complex deployments.

**Fractional CTOs and technical advisors**: Salesforce sovereignty is a high-stakes conversation. The combination of deep lock-in and high sensitivity data means recommendations must be carefully calibrated to client context and risk tolerance.

**Engineering leaders**: Teams maintaining Salesforce integrations, custom Apex code, and data pipelines should document dependencies to support future sovereignty assessments and exit planning.

**Procurement and due diligence**: Salesforce contract renewals are strategic moments for sovereignty assessment. Multi-year commitments should factor in evolving regulatory requirements (NIS2, DORA timelines).