InCountry Data Residency for Salesforce

About InCountry

InCountry provides the data residency services to companies looking to comply with local country regulations and requirements for storing sensitive and regulated data. InCountry has designed a fully-fledged and robust solution for managing and storing this data in over 90 countries. You no longer need to build manual solutions for each country you are operating in.

Introduction to the InCountry Data Residency for Salesforce

Salesforce is the leading customer relationship management (CRM) platform for businesses of any size and specialization. All your marketing, sales, commerce, service, and IT teams can collaborate and communicate with your customers in one place and in different ways.

Regulated data storage in Salesforce

Salesforce-hosted data centers are located in 6 countries. This is not sufficient for the world-wide companies and corporations that manage regulated data of customers. InCountry expands the list to over 90 countries where you can store regulated data and be sure that you do not violate any local laws or regulations.

With the InCountry Data Residency for Salesforce solution, you can have a single Salesforce instance to store regulated data in over 90 different countries. You do not need to have a dedicated Salesforce instance for each country or region to comply with all sorts of regulations you have to adhere to.

By default, Salesforce does not restrict the visibility of regulated data in the Salesforce instance for agents that work from other countries and are not allowed to view this data. The InCountry Data Residency for Salesforce package addresses this problem and provides configuration that can restrict the visibility of regulated data to agents working in the origin country only.

Data flow

InCountry Data Residency for Salesforce allows customers to separate the streams of regulated and non-regulated data and store each one in different places. This way you store the non-regulated data in Salesforce, and regulated data on the InCountry platform in the specific country.

All the regulated data stored on the InCountry platform is encrypted on the fly with the customer-owned key, so the data is kept secure and safe.

Data Regulation Models for Salesforce

In the standard Salesforce application architecture, all of the data is stored and processed in the cloud and can be viewed by anyone with sufficient permissions, regardless of which country they are attempting to access the data from.

When integrated with the InCountry Data Residency for Salesforce package, a Salesforce organization can be configured to store regulated data according to one of the three standard data regulation models described below:

Data Handling	Salesforce without InCountry	InCountry Data Residency Model
		Replication	Restriction	Redaction
Storage	Outside Only	Inside & Outside	Inside Only	Inside Only
Processing	Outside Only	Outside	Outside	Inside Only
Viewing	Inside & Outside	Inside & Outside	Inside & Outside	Inside Only

In the following sections, we will describe the data flow specific to these data regulation models and outline the advantages and disadvantages of each one.

Replication

The replication model requires that regulated data is first written to a data store inside the country from which data originates. Once this requirement is fulfilled, then regulated data can be written to the Salesforce cloud database hosted outside the country of origin. Whenever records that include regulated data are created, updated, or deleted, they are synchronized with the InCountry platform. When a user wants to view the data or a server outside the country needs to process this regulated data, then it fetches the copy of this data hosted in the Salesforce cloud database.

Restriction

The restriction model requires that regulated data is stored inside the country of origin ONLY. Therefore, it is necessary to store a one-way hash in the Salesforce cloud database outside the country of origin in place of regulated data. However, the cross-border transfer of regulated data is still allowed for processing and viewing. Whenever records that include regulated data are created, updated, or deleted, they are synchronized to the InCountry platform. When a user wants to view regulated data or a server outside the country needs to process this data, it must read the data from the InCountry platform, perform the necessary action, and then drop the data.

Redaction

The redaction model requires that regulated data is stored inside the country of origin ONLY. Therefore, it is necessary to store a one-way hash on the Salesforce cloud server outside the country in place of regulated data. Furthermore, the cross-border transfer of regulated data for processing and viewing is NOT permitted. Whenever records that contain regulated data are created, updated, or deleted, the request must go directly from the application interface inside the country to the InCountry point of presence inside the country. When users inside the country want to view regulated data, they must read the data from the InCountry platform. Regulated data cannot be transferred outside the country for processing, so any server-side processing must be re-implemented as serverless functions. These serverless functions can perform simple validations and manipulation of regulated data fields and then return non-regulated values, like true/false, to the cloud application server. Due to the effort required for implementing serverless functions for all the necessary workflows, it is very important to define what is regulated data as narrowly as possible in the Redaction model.