What controls do you need to keep Salesforce AI data sovereign?

Data sovereignty isn’t optional for enterprises handling regulated data. Salesforce gives you several controls that decide where your AI data is processed, who keeps it and who can see it, but none of them are set for sovereignty by default.

This post maps the controls that matter, separates the two different “BYO Key” ideas, and shows how they combine with your Hyperforce region and governance settings.

What does “BYO Key” mean in Salesforce AI?

Salesforce documentation and partner conversations use “BYO Key” (or BYOK) in two distinct contexts. Always be clear which one you mean:

• Bring your own LLM key: you connect your own account with a model provider such as Azure OpenAI, AWS Bedrock, Google Vertex AI or Anthropic, and Salesforce sends prompts to that model instead of a Salesforce-managed one. Your contract with that provider governs how the data is handled.
• BYOK for Shield Platform Encryption: you manage your own encryption keys for data at rest inside Salesforce. This is separate from model choice. It protects stored records but does not control where prompts and responses travel during inference.

Most of this post is about the model path, with notes on where Shield encryption fits.

Is your Salesforce data used to train AI models?

Salesforce says it doesn’t currently use customer data to train generative AI models, and its contracts with the LLM providers it uses require zero data retention. Check the generative AI data collection and feedback settings in Setup so they match your policy, and read the current Product Terms, since Salesforce says any future change would show up there.

What does the Einstein Trust Layer protect?

The Trust Layer sits between your org and the model. Two of its protections matter most for sovereignty:

• Zero data retention. Zero data retention comes from Salesforce’s contracts with the LLM providers it manages. It isn’t a switch you flip. It doesn’t apply when you bring your own model: then your own contract with that provider decides retention.
• Data masking. Masking replaces sensitive values (such as names, card numbers or custom patterns) before a prompt leaves Salesforce. Note: Salesforce turned data masking off for Agentforce agents. It still applies to generative features outside agents, such as Service Replies and prompt templates run from Prompt Builder or Flow. For agents, control exposure with permissions, the agent user’s access and guardrails.

How do you bring your own model with a regional endpoint?

The strongest control over where inference happens is using a model under your own provider account, in a region you choose:

1. Set up the model in your provider account, in the region your residency rules require (for example, Azure OpenAI in an EU region).
2. Connect your provider account in Model Builder (Einstein Studio in Data 360).
3. Select that model in your Prompt Builder templates.

Check the current docs for which agent features can use a BYO model; the agent’s reasoning engine uses Salesforce-managed models.

This puts model processing in the provider region and under the contract you choose. Requests still pass through Salesforce on the way. Your Hyperforce region decides where the Salesforce side of the workload runs, but the model call itself is what determines inference jurisdiction.

Does Shield Platform Encryption keep AI prompts private?

Not on its own. Shield Platform Encryption with customer-managed keys protects data at rest, which is still essential for end-to-end control:

• Encrypt fields that feed into AI prompts (Case descriptions, Opportunity notes, custom objects).
• Use key rotation policies that meet your compliance cadence.

Encryption does not stop a model provider from seeing plaintext during inference. That job belongs to your model choice and region.

How does Data 360 fit into data residency?

Data 360 (formerly Data Cloud) is often where the data that feeds AI prompts is unified. It includes:

• Data Spaces to separate data and access by brand, region or business unit (logical separation; location comes from your Hyperforce region).

Pair this with your model choices so the data selected for AI prompts already lives where your rules require.

How do you control which models your teams can use?

Finally, restrict which providers and regions your teams can use:

• Limit which models your prompt templates and agents can use, and keep a list of approved providers and regions.
• Log model calls through Event Monitoring or your SIEM.
• Require approval before anyone connects a new model or Named Credential that points outside approved jurisdictions.

Sovereignty checklist

• [ ] Review generative AI data collection and feedback settings, and read the current Product Terms
• [ ] Confirm which models are Salesforce-managed (zero retention) and which run under your own provider contract
• [ ] Configure data masking for prompt templates and Service Replies, and plan agent permissions separately
• [ ] Use your own model for prompt templates where your residency rules require it
• [ ] Enable Shield Platform Encryption with customer-managed keys on AI source fields
• [ ] Define Data Spaces aligned to how you separate data and access
• [ ] Restrict model use to approved providers and regions
• [ ] Log model calls and require approval for new model connections

What’s the bottom line?

Salesforce gives you the controls, but sovereignty is not the default. Combining your own model in the right region, the Trust Layer, Shield encryption, your Hyperforce region and Data 360 governance lets you keep both inference and stored data under your jurisdiction.

It’s common to find only one or two of these controls turned on. Audit your current configuration against the checklist above before your next compliance review.

FAQ

Does Salesforce train AI models on my data?

Salesforce says it doesn’t currently use customer data to train generative AI models. Any future change would appear in its Product Terms, so check them as part of your review.

Does zero data retention apply if I bring my own LLM?

No. Zero data retention comes from Salesforce’s contracts with the model providers it manages. With your own model, your contract with that provider decides retention.

Is data masking used by Agentforce agents?

No. Salesforce turned data masking off for Agentforce agents. It still applies to Service Replies and to prompt templates run from Prompt Builder or Flow.

Is Shield BYOK the same as bringing your own LLM key?

No. Shield BYOK means you manage the encryption keys for data stored in Salesforce. Bringing your own LLM key means prompts go to a model under your own provider account.

Does Data 360 decide where my data is stored?

No. Data Spaces separate data and access logically. Where the data is stored comes from your Hyperforce region.

Need help mapping these controls to your Salesforce AI setup? Book an intro call.