Salesforce's Transparency Report (2021)

·Transparency Report

·Published: September 16, 2022

·Background

·Like many other technology companies, Salesforce may on occasion receive a request from a law enforcement or other government agency seeking access to certain data. Our goal is always to protect our customers' data, while complying with applicable laws. Below we provide information regarding requests we have received from government agencies during the period from July 1, 2021, to December 31, 2021 (the "Covered Period").

·Our Policies and Process

·At Salesforce, trust is our number one value. The protection of our customers' data is paramount to us. Our privacy and security programs are designed to protect our customers' privacy and protect data submitted by or for our customers to our services against unauthorized access or disclosure. For that reason, every government request for customer data that Salesforce receives is carefully reviewed, consistent with the laws in the relevant jurisdiction(s), to ensure the requesting government agency is entitled to the data sought with the type of process utilized. Where we believe a government request for customer data is invalid or unlawful, we will try to challenge it. We aim to fully meet our legal obligations while honoring the faith that our customers place in us.

·Trust starts with transparency. Unless prohibited by law, Salesforce notifies a customer when it receives a request for that customer's data, including a government request. If we receive a government request for customer data and we are prohibited by law from notifying the affected customer, we use best efforts to request that the confidentiality requirement be waived.

·Salesforce receives relatively few government requests for customer data. We are primarily a business-to-business company, which historically receive far fewer requests than do business-to-consumer services. When we do receive such requests, if permitted by law, we endeavor to refer the requesting agency to the customer themselves. Salesforce is not the owner of customer data, and we strongly believe that any government agency seeking access to customer data should address its request directly with that customer, where possible.

·Figures

·Types of Legal Processes Received

·The figures below represent the total numbers of various forms of government requests for customer data, or their local equivalents, received for the Covered Period. Any requests that do not pertain to customer data are not included in these figures.

·Requests by Country

·Although Salesforce is headquartered in the U.S., we provide service in jurisdictions around the world and have a corporate presence in several countries. Salesforce complies with the law in all jurisdictions where we operate and is thus required to respond to requests in all the countries that have legal jurisdiction over our operations. When we receive requests from governments in any country, we evaluate them carefully for validity and applicability before responding.

·The figures below represent the total number of government requests for customer data received for the Covered Period, organized by country of origin. Any requests that do not pertain to customer data are not included. Note that any potential requests made under the CLOUD Act in the U.S. are included in the figures below.

11 This category includes, for example, grand jury, administrative, and civil subpoenas issued by a government agency, as well as their equivalents in other jurisdictions.

22 This category includes, for example, pen register and trap and trace orders, and orders authorized under 18 U.S.C. § 2703(d), as well as their equivalents in other jurisdictions. Country | Number of Requests Received United States | 16 India | 1 Spain | 1 Total Requests Received | 18

·Requests by Response

·U.S. National Security Requests

·In the United States, companies are legally prohibited from disclosing the precise number of received National Security Letters (NSLs) and court orders under the Foreign Intelligence Surveillance Act (FISA). However, the USA Freedom Act enables us to report such requests (including both NSLs and FISA orders) in broad ranges, which we do below. No inferences should be drawn from the limits of the below ranges and, as previously stated, Salesforce receives relatively few government requests of any kind.