InCountry Data Residency for Salesforce - FAQ

This page contains answers to the frequently asked questions about the InCountry Data Residency for Salesforce package.

Can I regulate the order of executing data regulation policies for a Salesforce object?

Yes, in the replication data regulation model you can regulate the order of executing data regulation policies at the record level. For the details on this functionality, please check our documentation.

Can the InCountry Data Residency for Salesforce package have a significant impact on any of my organization’s existing API limits?

Below you can find details on the consumption of Salesforce resources during the execution of specific actions within the package. The numbers within the table are approximate, so we recommend that you measure the actual consumption on your Salesforce in the UAT environment before installing the package on production instances.

For the replication model

Action	Transaction #	SOQL	SOQL Rows	Callouts within Salesforce	External callouts	DML	DML Rows
User creates a record	1	3	3
	2	2	11		1	1	1
	3	5	13		1
	4	2	13		1
	5	0	13		1
	Total	13	53	0	4	1	1
User updates a record	1	3	3
	2	2	11		1	1	1
	3	5	13		1
	4	2	13		1
	5	0	13		1
	Total	12	53	0	4	1	1
User deletes a record	1	3	15
	2		9		1
	Total	3	24	0	1	0	0

For the redaction and restriction models

Action	Transaction #	SOQL	SOQL Rows	Callouts within Salesforce	External callouts externa	DML	DML Rows
User views a record in the Record Details view	1	6	60
	2	4	61
	3	0	5
	4	4	61
	Total	18	187	0	0	0	0
User updates a record in the Record Details view	Total	2	61	0	0	0	0
User views a record on the record header block	1	6	60
	2	1	0
	3	0	5
	4	2	61
	5			0
	6			1
	Total	9	187	1	0	0	0
User deletes a record on the record header block	1			1
	2	4	61			1	1
	3				1
	Total	4	61	1	1	1	1
User views records in the Records List view	1	1	1
	2	6	60
	3	1	1
	4		5
	5	2	1
	6			1
	7			0
	8			1
	9			0
	10	2	159
	11			0
	12			1
	Total	12	227	1	0	0	0
User scrolls records in the Records List view	Total	8	89	0	0	0	0
User updates a filter in the Records List view	1	2	56	2
	2			0
	3	2	2			3	3
	Total	4	58	2	0	3	3
User creates a new list view in the Records List view	Total	1	1	2	0	0	0
User exports a CSV file in the Records List view	Total	8	60	0	0	0	0
User viewes attachments stored on the InCountry platform	1	8	60
	2	1	1
	3	3	58
	Total	12	119	0	0	0	0
System checks record duplicates on the Record Duplicates page	Total	1	6	0	1	0	0
Uses views related records on the Related Record page	1	9	106
	2	9	108
	3	8	53
	4		5
	5	8	61
	Total	34	333	0	0	0	0
User views the settings of the package	1			1
	2		5
	3		2
	4	1
	Total	1	7	1	0	0	0
Administrator adds a new object policy on the Settings page	1	1
	2	1
	3	1	9			1	1
	Total	3	9	0	0	1	1
Admiistrator n adds a new PII field on the Settings page	1		5			1	1
	2	1
	3	1	1
	Total	2	6	0	0	1	1
Administrator updates the InCountry flag on the Settings page	1		1	2
	2		5
	Total	0	6	2	0	0	0
User creates a new InCountry Endpoint on the Settings page	Total	0	0	4	0	0	0
User views the reports list on the InCountry Reports page	Total	1	2	0	0	0	0
User views a particular report on the InCountry Reports page	1	1	1
	2	1	2
	3		1
	4			0
	5	3	60
	Total	5	64	0	0	0	0
User views Activity Details on record header block and in the Activity Details component	1	2	2
	2	0	129
	3	2	2
	4	0	53
	5		5
	6	8	61
	7	2	2
	8			3
	Total	14	254	3	0	0	0

Can I get information about the number of data records from Salesforce stored on the InCountry platform?

You can use the InCountry REST API to retrieve the record statistics about the Salesforce objects. For example, you can find how many regulated records of the Account type are stored on the InCountry platform.

Prerequisites

1. You need to acquire the .CRT and .KEY certificate files from the InCountry team for your production or sandbox instances. If you do not already have these two files, please request them from the InCountry team.

2. Postman is installed on your desktop.

Retrieving record statistics from the InCountry platform

1. Open Postman.

2. Copy this link to the Postman collection to your clipboard: https://www.getpostman.com/collections/702ed0584b9ff9e17fcd

3. On the menu, select File, then click Import.

   

4. In the Import form, select the Links tab.

5. In the Enter a URL box, paste your link to the Postman collection.

   

6. Click Continue, then click Import.

   

7. The imported collection appears in the Collections section.

   

8. Select the imported collection and switch to the Variables tab.

   

9. Copy the InCountry Rest API endpoint to the clipboard. You can find out your current REST API endpoint in the Salesforce org where the InCountry Data Residency package is installed. Then navigate to Setup > Custom Metadata Types > InCountryRestApiEndpoint > Manage Records > [country code].

10. Paste your endpoint into the endpoint environment variable and save the collection.

    

11. Ensure that other variables are set as follows:

    1. requestNumber=1
    2. offset=0
    3. limit=100
    4. totalRecords=1

    

12. Navigate to Settings.

    

13. In the Settings form, select the Certificates tab.

14. In the Host box, paste your endpoint address.

    

15. Add the imported InCountry Rest API certificates. Click Select File and select your .CRT and .KEY certificate files in the corresponding boxes.

16. Save the certificate and close the Settings form.

17. Within the collection, locate and select the Find records request.

    

18. Within the opened request, switch to the Body tab.

19. Within the request body, locate the country parameter and correct it to the ISO code of the country where regulated data records are stored.

    

20. Switch to the Tests tab. There you can find a JavaScript script that aggregates information about data records stored on the InCountry platform in a particular country. You can modify this script depending on your needs.

    

21. On the menu, select View, then click Show Postman Console. After the script execution, results will be outputted to the Postman console.

    

22. To capture the information, open the collection and click Run. The Runner tab opens.

    

23. On the Runner tab, click Run InCountry Rest API.

    

24. In the Postman console, you will see the debug information about requests to the InCountry Rest API.

    

25. Once the script execution has been completed, you will see the aggregated results on the Environment tab. The Variable name represents the Salesforce object type. For example, 001 is a Salesforce Account (4147 Accounts are stored on the InCountry platform according to the image below). You can find the prefixes for standard Salesforce objects at this resource (actually it always includes the first 3 characters of your record Id).

    

26. You can modify the script to print additional information about your data records. For example, lines 28-30 in the screenshot below print identifiers of regulated Account records to the Postman console.

    if (prefix === '001') {
        console.log('Regulated account Id = ' + record.profile_key);
    }
    

    

27. You will see the output in the Postman console.

    

28. If necessary, you can export the output results to a file. Click Export results.

    

How do I make the InCountry Data Residency package work with the Salesforce Community user licenses?

The InCountry Data Residency package supports the generic Salesforce user licenses, as well as Salesforce Community user licenses. For some license types, you may need to make slight modifications to your Salesforce configuration.

Instead of using the default InCountry User permission set, you need to apply the InCountry Community User permission set that supports the Salesforce Community user licenses. Several license types are not supported by the InCountry permission sets.

The following table shows the appropriate permission set to use with specific Salesforce user licenses. If the permission set does not support a specific license type, you can use a proposed workaround.

User License / Profile	InCountry User permission set	InCountry Community User permission set	Workaround
Partner Community Login / Partner Community Login User	❌	❌	Workaround for external users: Navigate to the user profile. Check if the Profile has at least the read access on the following two objects: Object Relationships and Object Relationship Fields. If the Profile has no read access on these objects, clone it and add the read access. Set the Public Read only default external access for the Object Relationship object and recalculate sharing rules (Organization-wide defaults).
Customer Community Login / Customer Community Login User	❌	✔️
Customer Community / Customer Community User	❌	✔️
Customer Community Plus / Customer Community Plus User	❌	❌
Customer Community Plus Login / Customer Community Plus Login User	❌	❌
Customer Portal Manager Custom / Customer Portal Manager Custom	❌	❌	Workaround for external users: Navigate to the user profile. Check if the Profile has at least the read access on the following two objects: Object Relationships and Object Relationship Fields. If the Profile has no read access on these objects, clone it and add the read access. Set the Public Read only default external access for the Object Relationship object and recalculate sharing rules (Organization-wide defaults).
Customer Portal Manager Standard	❌	❌
External Apps Login / External Apps Login User	❌	✔️
External Identity / External Identity User	❌	✔️
Partner Community / Partner Community User	❌	✔️	Workaround for external users: Navigate to the user profile. Check if the Profile has at least the read access on the following two objects: Object Relationships and Object Relationship Fields. If the Profile has no read access on these objects, clone it and add the read access. Set the Public Read only default external access for the Object Relationship object and recalculate sharing rules (Organization-wide defaults).
Silver Partner / Silver Partner User	❌	❌
Gold Partner / Gold Partner User	❌	❌
High Volume Customer Portal / High Volume Customer Portal User	❌	✔️
Company Communities / Company Communities User	✔️	✔️
Force.com - Free / Force.com - Free User	❌	✔️
Force.com - App Subscription / Force.com - App Subscription User	✔️	✔️
Partner App Subscription / Partner App Subscription User	✔️	✔️
Salesforce Platform / Standard Platform User	✔️	✔️
Work.com Only / Work.com Only User	❌	✔️
Salesforce / Minimum Access - Salesforce	✔️	✔️
Salesforce / ReadOnly	✔️	✔️
Salesforce / Marketing User	✔️	✔️
Cross Org Data Proxy / Cross Org Data Proxy User	✔️	✔️
Identity / Identity User	✔️	✔️

Can I use Salesforce Connect to localize and distribute regulated data in Salesforce?

Technically, yes. You can use Salesforce Connect to read and write data from the remote data store located in a country different from the one where your Salesforce instance resides. The main limitation of Salesforce Connect is that it works with external objects only, which makes it impossible to localize information of standard and custom Salesforce objects. Considering this Salesforce Connect cannot be used as a full-fledged data residency solution as it does not support localization of standard and custom Salesforce objects, which makes the entire solution useless for data compliance purposes.

Parameter	InCountry Data Residency	Salesforce Connect
Infrastructure
Storage development	Already available	Design and development by Customer
Management	InCountry	Customer
Storage security	InCountry	Customer
Maintenance & update	InCountry	Customer
Operations on regulated data
Read	✔️	✔️
Write	✔️	✔️
Update	✔️	✔️
Automatic data backup	✔️	❌ (Customer needs to implement data backup)
Automatic system failover	✔️	❌ (Customer needs to implement system failover)
Supported data regulation models
Redaction	✔️	❌ (data always goes through Salesforce backend)
Restriction	✔️	✔️
Replication	✔️	❌
Search capabilities
Search options	Out-of-the-box search	Implement search for each external object
Fuzzy search	✔️	✔️
Supported Salesforce objects
Standard objects	✔️ some Salesforce objects may be locked for third-party packages	❌
Custom objects	✔️	❌
External objects	❌	✔️
Data communication and connection
OData application development and support	Not needed	Required
Country support	90+ countries	Support for each country is added individually
Data connection	No limits	20,000 connection limits
Maximal number of external records	No limits	Limited (inappropriate for complex integrations due to connection limits)
Geo IP detection	✔️	❌

How to track the current hashing status for protected fields of the record?

The InCountry Data Residency for Salesforce package allows you to track the current hashing status for the record’s protected fields. This may be required when the record is being synchronized between Salesforce and the InCountry platform for some time. The field indicates the current hashing status on the record’s detail page.

Prerequisites

1. You need to create a custom field of the checklist type (for example, name it as Hashing in Progress).

2. Add this custom field to the Salesforce object page.

3. Ensure that an Apex trigger is configured for the current Salesforce object.

Creating a data regulation policy for the Salesforce object

1. On the Settings tab, click Add Policy.

2. In the Add Policy form, specify the following information:

   1. Type - select object or record.

   2. Behavior - select the data regulation model.

   3. Destination Country - select the country for storing data records.

   4. State Field - select the field of the checklist type that you have added.

      

3. When complete, click Save.

Tracking the hashing status for protected fields

Create a new record for which you created a data regulation policy.

While the package hashes the record’s regulated data fields, this box is shown as checked. Once the hashing is finished the box is cleared. In the {Object} History block, you can view the current hashing status of the record and how it changes.

What features are supported in Salesforce Mobile?

Feature	Support	Clarification
Configuration of the package	Not supported	The Settings pages is not adapted for the mobile form factor.
Reading Salesforce records	Supported
Creating Salesforce records	Partially supported (minor UI issue)	Not supported for the Opportunity object.
Updating Salesforce records	Supported
Deleting Salesforce records	Supported
CRUD-operations on records via API	Supported	CRUD API operations are handled by Apex trigger running on the Salesforce application server.
Mobile-specific quick actions	Not supported
Chatter for Mobile	Not supported
InCountry-specific search	Not supported	The Find in InCountry page is not adapted for the mobile form factor.

How to disable the field-level security for the pre-commit phase of record creation/update?

1. Grant the edit access to the regulated field if the pre-commit phase must be executed with the User context.

2. Add a statiс flag into the InCountryTriggerHandler class that will allow the skipping of the isUpdateable() check when necessary.

The following line of code should be added prior to the SDK call execution:

testIncountry1.InCountryReplicationTriggerHandler.skipIsUpdateableCheck = true;

As the result, your program code should be similar to the following one:

testInCountry1.InCountryReplicationTriggerHandler handler = new testInCountry1.InCountryReplicationTriggerHandler(objectType.getDescribe().getName());
testIncountry1.InCountryReplicationTriggerHandler .skipIsUpdateableCheck = true;
handler.handleBeforeInsert();