"The Agentic Enterprise."
Salesforce Agentforce is a platform for CRM-adjacent AI agents in sales, customer service, field service, commerce, and internal processes. Agents operate based on Salesforce data, workflows, Data Cloud, Knowledge, APIs, and integrations.
Salesforce Agentforce
The Agentic Enterprise
Location: Germany ⓘ Salesforce, Inc., 415 Mission Street, 3rd Floor, San Francisco, CA 94105, USA. German company: Salesforce.com Germany GmbH, Erika-Mann-Str. 31, 80636 Munich, Germany.
Includes selected core Agentforce features such as Agent Builder, Prompt Builder, Agent Script, Agentforce Coworker, and Agentforce Vibes for eligible Salesforce editions. Other Conversations Consumption model for customer-oriented agent conversations.
Per-User Licenses User-based licensing for selected Agentforce and Salesforce editions.
Agentforce 1 Editions More comprehensive Salesforce editions with AI, agent, Data Cloud, and industry-specific features.
Agentforce for Service Service agents with templates, actions, omnichannel communication, and Service Cloud integration.
Professional Services Consulting, implementation, data preparation, governance, and agent development.
Target audience
Salesforce Agentforce is aimed at sales, service, marketing, commerce, and operations teams that want to integrate AI agents directly into their CRM processes. The tool is particularly relevant for organizations that already use Salesforce in production.
Outstanding features
Agentforce connects CRM data, knowledge, workflows, Data Cloud, and external systems with AI agents. These can process leads, categorize support cases, prepare responses, update records, and carry out tasks across multiple systems.
Main use cases
Typical use cases include sales, lead qualification, customer service, case handling, field service, commerce, internal service processes, CRM maintenance, knowledge access, and automation of follow-up actions.
Usage & notes
Agentforce should not be introduced without a clean Salesforce data model, role-based permissions, prompt/agent guidelines, and human-in-the-loop approvals. Especially for pricing decisions, HR data, customer communication, and automated CRM changes, traceable processes are required.
| Target audience | Assessment |
|---|---|
| Private individuals | No – clearly geared toward Salesforce customers and business processes. |
| Self-employed / freelancers | Conditionally – only relevant with existing Salesforce usage or consulting projects. |
| SMEs | Conditionally to yes – useful for growing CRM, support, and sales teams. |
| Large enterprises | Very well suited – core target group for CRM agents, Data Cloud, and complex workflows. |
| Sales | Very well suited – lead qualification, CRM maintenance, quote and customer communication. |
| Customer service | Very well suited – autonomous service agents, case handling, and omnichannel support. |
| Developers / admins | Yes – Agent Builder, Prompt Builder, Agent Script, APIs, and Salesforce integrations. |
| Privacy-sensitive organizations | Well suited with EU Hyperforce configuration – data residency, Trust Layer, and DPA are strong advantages. |
Hosting & Data
1) On-prem / local hosting
Meaning: The company operates the solution on its own hardware or within its own infrastructure. In the strictest sense, not only the application runs locally, but ideally the model as well.
2) Private cloud / data center
Meaning: The solution runs in a dedicated or more clearly separated cloud environment, often with a hosting provider or hyperscaler, but in a German data center or in a particularly controlled environment.
3) EU SaaS / managed
Meaning: The provider operates the solution itself as a service. The company uses the tool as a ready-made cloud service, ideally with EU data residency.
4) Hybrid
Meaning: One part of the processing remains internal / local / in a private cloud, while another part runs in an external cloud or EU SaaS.
5) AVV / DPA
Meaning: This is the data processing agreement or Data Processing Addendum. It governs that the provider processes personal data on behalf of the customer and is bound by the customer's instructions.
6) No training
Meaning: The provider does not use your prompts, uploads, attachments, chat histories, or outputs for training or improving the general model — ideally excluded by contract.
7) Open-source / transparency path
Meaning: There is a path toward greater technical transparency and sovereignty, for example through:
- open models
- documented components
- self-hostable parts
- traceable architecture
- export / switching options
| On-prem / local hosting | ❓ |
| Private cloud / data center | ⚠️ |
| EU SaaS / Managed | ✅ |
| Hybrid | ⚠️ |
| DPA / AVV | ✅ |
| No training on customer data | ✅ |
| Open source / transparency path | ❓ |
On-Prem / local hosting: indirect / not available
An on-premise/local self-hosting option for Agentforce is not indicated on the Salesforce website. Cloud/Hyperforce and BYO-LLM options are documented, but not operation on the customer's own hardware.
Private cloud / data center: partial
With Hyperforce Operating Zone, a more strongly isolated regional environment is documented, in which data, according to Salesforce, is processed and stored strictly within the EU and Switzerland. However, a dedicated single-tenant private cloud for each customer is not evidenced on the website found.
EU SaaS / managed: covered
Salesforce describes Hyperforce Operating Zone as a provider-operated cloud option with processing and storage strictly within the EU and Switzerland region as well as EU-based support. This is a clear EU/EEA-relevant SaaS/managed path.
Hybrid: partial
A hybrid path is indirectly documented through 'Bring Your Own LLM': customers can configure their own model or their own instances with supported providers, while requests continue to run through the Salesforce Models API and Trust Layer. However, a classic locally internal hybrid architecture with demonstrably local model operation is not evidenced on the website.
DPA / DPA: covered
Salesforce offers a Data Processing Addendum; for Agentforce, the Privacy FAQ explicitly states that everything under the Agentforce brand is covered by the DPA. In addition, Salesforce describes contractual obligations toward subprocessors.
No training: covered
Salesforce describes a zero-data-retention policy for Agentforce/Einstein Trust Layer with respect to third-party LLMs. According to the website, information transmitted to external LLMs is not stored, viewed, or used for training after the response is returned; the DPIA document also states that customer data is not used for training third-party models.
Open-source / transparency path: indirect / not available
An open-source path for Agentforce is not indicated on the website. While there is documentation, export/integration and BYO-LLM starting points, there is no evidenced open-source basis or self-hostable open-source components for Agentforce itself.
Data processing
The documentation found describes Agentforce as a cloud service operated by Salesforce on the Salesforce platform. For EU/EEA requirements, the Hyperforce Operating Zone is particularly relevant, which according to Salesforce enables processing and storage of customer data strictly within the EU and Switzerland. At the same time, Salesforce notes in the general privacy policy that personal data may also be processed or stored in the US and other jurisdictions. For Agentforce itself, the FAQ and DPIA document refer to the respective 'Infrastructure & Sub-processors Documentation' for subprocessors and hosting locations.
Conclusion
For an EU/EEA register, I would not classify Salesforce Agentforce as unconditionally GDPR-compliant across the board, but rather as conditional: there is a clearly documented EU data residency/EU SaaS path via Hyperforce Operating Zone as well as DPA, subprocessors, transfer mechanisms, and no-training commitments for third-party LLMs. Without appropriate configuration and contract review, however, the standard situation remains complex, particularly due to possible international transfers and the use of external LLM providers. An on-premise alternative is not evidenced on the website.
Sources
- https://www.salesforce.com/company/legal/privacy/?bc=OTH
- https://www.salesforce.com/privacy/products/?bc=OTH
- https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Privacy/agentforce-privacy-FAQ.pdf?bc=OTH
- https://www.salesforce.com/platform/public-cloud-infrastructure/operating-zone/
- https://www.salesforce.com/platform/security-privacy-compliance-platform/?bc=OTH
- https://compliance.salesforce.com/en/documents/a00Kd00000z7FAnIAM
- https://developer.salesforce.com/docs/ai/agentforce/guide/trust.html
- https://developer.salesforce.com/docs/ai/agentforce/guide/supported-models.html?sec_ak_reference=18.c58c655f.1758162783.1df32a8e
- https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Privacy/dpia-and-salesforce-services.pdf
- https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/misc/hyperforce-security-privacy-and-architecture.pdf?bc=OTH
Strengths & weaknesses at a glance
| Strengths | Weaknesses |
|---|---|
| • Very strong CRM, sales, and service focus | • Particularly useful within an existing Salesforce ecosystem |
| • Deep Salesforce, Data Cloud, and workflow integration | • Complex licensing, credit, and data model logic |
| • Agents for Sales, Service, Field Service, and Commerce | • No traditional on-premises operation |
| • Trust Layer with data masking and controlled model integration | • Data protection depends on the Hyperforce region, model choice, configuration, and data sources |
| • Enterprise contract and compliance structures |
Reviews
0 reviews in total
There are no confirmed reviews for this tool yet.
Submit review
Your review will only become visible after email confirmation. This protects the portal against abuse.
Report review
Please select the reason why this review should be checked.
GDPR-compliant usage possible?
Salesforce documents several central building blocks for GDPR-compliant use of Agentforce in the EU/EEA region: a privacy policy, a data processing agreement, documented subprocessors, transfer mechanisms, zero-data-retention commitments for used third-party LLMs, as well as an EU/Switzerland option via Hyperforce Operating Zone. At the same time, standard use is not automatically completely unproblematic, because Salesforce itself describes international transfers, processing outside the country, and the use of third-party LLMs on its website. Therefore, compliant use from an EU/EEA perspective is possible, but typically only with the deliberate selection of suitable product/hosting options and contractual configurations.
Positive
Positively documented are: an existing privacy policy; Data Processing Addendum with SCCs or Processor Binding Corporate Rules; according to the FAQ, Agentforce is covered by the DPA; subprocessors and hosting countries are disclosed via the Infrastructure-&-Sub-processors documentation; Hyperforce Operating Zone offers processing and storage strictly within the EU and Switzerland region; zero-data-retention commitments are described for third-party LLMs; relevant certifications for Agentforce or the platform are listed, including ISO 27001, 27017, 27018, as well as SOC 2/SOC 3.
Negative
Negative or limiting factors are: Salesforce itself states on its website that personal data may be transferred to and stored in the USA and other jurisdictions; Agentforce can use third-party LLMs; specific default server locations for each Agentforce deployment are not directly stated on the product page, but instead outsourced to linked documentation; a true local on-premise/self-hosting option for Agentforce is not indicated on the website.
Server location
For Agentforce-specific hosting countries, Salesforce refers to the 'Infrastructure & Sub-processors Documentation'. The website also documents the Hyperforce Operating Zone for the EU and Switzerland; according to Salesforce, customer data there can be processed and stored strictly within the EU and Switzerland region. At the same time, the general privacy policy states that personal data may also be processed and stored in the USA, as well as via affiliates and third parties outside one's own country or jurisdiction.
