Salesforce is the world’s number one customer relationship management solution, bringing companies and customers together more efficiently than businesses ever thought possible. It’s a single global integrated CRM platform that unites all your departments and lets them collaborate on marketing, sales, commerce, and service while keeping a single, shared view of every customer.
Despite being ideal from every point of view, it does have one issue that makes it problematic to use in some countries with stringent data compliance legislation, like Russia.
Why using Salesforce Cloud in Russia is non-compliant
Salesforce Cloud is available for companies all over the world, but its servers hosting the application and operation data are only available in a limited range of countries: the United States of America, Japan, Germany, the United Kingdom, and France. While Salesforce Hyperforce is expanding the list of server hosting countries, it is not a short-term solution to the problem, and for Russia’s compliance legislation, still is not acceptable.
The Russian Federal Law on Personal Data (No. 152-FZ) has established requirements for the retention of customer data for companies and enterprises that run their business on the territory of the Russian Federation. The personal data of Russian customers, as well as the personal data of foreign customers that are processed by Russian companies, must first be localized and stored in data centers within the Russian Federation. Once this requirement is fulfilled, you can then replicate personal data to any other country for further processing or aggregation, as long as the original copy stays within Russian borders.
When using SaaS platforms like Salesforce, fulfilling such strict data retention requirements is almost impossible, as you cannot ask the Salesforce team to set up your instance in Russia. As a potential workaround here, you can use Hyperforce with the expanded geography of available locations. But here you should consider that multinational organizations are not supported due to its substantial limitation: one customer in one country.
Data residency solutions for Salesforce
This problem has not passed unnoticed in the Salesforce market, as there are other solutions to resolve data residency within Russia (and other countries where Salesforce data localization is not typically present) for your favorite customer relationship platform. These solutions, although attempting to solve the data residency problem, have not caught on in the larger business sphere because they are often unsustainable, expensive, and backbreaking to maintain.
Today we want to evaluate, assess, and compare the InCountry data residency platform to legacy solutions, so you can better understand how to localize and distribute regulated and sensitive data in Salesforce Cloud to ultimately do business in Russia safely.
We will compare solutions against multiple criteria and will reveal their advantages and disadvantages, as well as their limitations.
Quick overview of solutions
InCountry Data Residency for Salesforce is a native Salesforce app for regulated data localization and distribution from InCountry, a 3-year-old startup focusing exclusively on solving the most complicated global data sovereignty problems when it comes to the personal data of your customers. InCountry provides a data residency-as-a-service platform that bundles a wide range of products for integrating data residency services into your systems or applications. The InCountry solution for Salesforce lets you store and/or process the original regulated data of your customers on a local instance of the InCountry platform, and, if needed, save its replica to the Salesforce Cloud database. By only saving regulated data governed by legislation on the InCountry side, the platform ensures load speeds will not drastically be affected.
Other legacy solutions out there only focus on certain countries, or even just one in some cases, making it difficult to scale with a growing company’s needs. Let’s take Russia for example: the solution is specifically designed to fulfill the requirements of the Russian Federal Law on Personal Data (No. 152-FZ) and anonymize the personal data of Russian citizens with tokenization. Tokenized values of personal data are saved to the Salesforce Cloud database, while clear-text values are saved to the proprietary database server that can either be managed by the customer or an unvetted third-party cloud provider.
Architecture
The InCountry Data Residency for Salesforce solution is based on the Salesforce package that integrates and communicates data with the InCountry platform through REST API. Regulated data is stored and/or processed on the InCountry platform within the country of origin that is identified from the field storing the country attribution.
The legacy solution provides the Salesforce package communicating regulated data through the processing service that either saves regulated data to the database or fetches records from it. Access to personal data is regulated by the browser extension, which customers are required to install and maintain on every user’s computer, or through a proxy server that is set up as part of your infrastructure. Personal data associated with Russian customers is communicated to the processing service that saves it on the database server within the Russian Federation, while tokenized data is returned to Salesforce.
Supported data regulation models
The InCountry Data Residency for Salesforce solution supports three data regulation models that provide a country-agnostic approach for handling regulated data depending on the local legislation of the country of origin. The following models are supported:
Replication – regulated data is written to the country of origin, and a replica of regulated data can be made afterward. Access to regulated data is available outside the country of origin with no limitations.
Restriction – regulated data is written and stored only in the country of origin, with access to the regulated data only available outside the country of origin for reading.
Redaction – regulated data is written and stored only in the country of origin, with access to regulated data completely unavailable outside the country of origin. Regulated data values are shown as redacted if trying to access them outside the country of origin.
| Data Handling | Salesforce without InCountry | InCountry Data Residency Model | ||
| Replication | Restriction | Redaction | ||
|---|---|---|---|---|
| Storage | Outside Only | Inside & Outside | Inside Only | Inside Only |
| Processing | Outside Only | Outside | Outside | Inside Only |
| Viewing | Inside & Outside | Inside & Outside | Inside & Outside | Inside Only |
If needed, InCountry’s offering can use a hybrid approach for handling regulated data and combine, for example, the replication and redaction data regulation models.
The legacy solution supports only the analog of the redaction model that tokenizes clear text values with regulated data. This makes the regulated data unusable when viewing it outside the country of origin or if the legacy solution experiences temporary availability issues.
The main difference here is that the InCountry Data Residency for Salesforce solution keeps a replica of regulated data in the Salesforce Cloud database, while the legacy solution merely keeps tokens there. The original regulated data is kept on the vendors’ premises (InCountry’s approach) or within the customer’s facility (the legacy solution’s approach).
Access to regulated data
Both solutions use the attribution of a regulated data record to a specific country of origin to regulate the user’s access to it.
The InCountry Data Residency for Salesforce package uses the IP-based geolocation to identify the user’s location and further decide whether regulated data can be shown or not. In the case of Russian compliance regulations, this is not a problem as a replica of regulated data can be viewed outside Russia.
The legacy solution uses the browser extension to detokenize regulated data and shows its clear-text values to end-users. Users that access this regulated data without the browser extension will see only tokens instead of clear-text values. This requires the creation of additional solution-specific accounts for users that will work with regulated data values through the vendor’s proprietary server.
Infrastructure setup
The InCountry Data Residency for Salesforce solution does not require any deployment of infrastructure from your side. You just create an account on the InCountry Portal, register a Salesforce integration, and supply OAuth credentials in the package. InCountry’s infrastructure in the Russian region is powered by secure and reliable Yandex.Cloud data centers.
In the legacy solution, you will either have to set up a physical or cloud server for running the application, set up a reverse proxy server, and install a browser extension for each user dealing with regulated data in Salesforce.
Configuration
The configuration of both solutions also has some differences. InCountry’s offering has a straightforward configuration flow:
Install the package into Salesforce.
Register the remote sites for data communication.
Define objects that contain regulated data.
The rest of the metadata and settings will be automatically set up by the package itself.
When using the legacy solution, you will have to perform the previous steps, set up a browser extension on each user’s machine, troubleshoot the connection to the system, and verify that regulated data is shown. For Salesforce objects (except Lead, Account, and Contact) you will need to set up triggers, as they are not created automatically. You will also have to explicitly specify fields that should not be synchronized for Salesforce objects with regulated data.
The setup and customization of the legacy solution will take more time when compared to the InCountry Data Residency for Salesforce solution.
Managing regulated data in Salesforce
The InCountry Data Residency for Salesforce solution supports multiple data regulation models. Each model impacts the management of regulated data in Salesforce.
In the replication model, the application uses the two-phase commit method that first writes data to the InCountry platform, then writes tokens to the Salesforce Cloud database, verifies the regulated data was successfully written to the InCountry side, and finally writes clear-text data to the Salesforce Cloud database. When viewing Salesforce records, regulated data is displayed as-is (clear-text values).
When using the restriction model, the application shows regulated data as clear-text values, but only users accessing Salesforce from the country of origin can edit the values. Users from other countries will only be able to view record values.
In the redaction model, the application will show the REDACTED label for records if the user’s location differs from the country of origin of regulated data records. The editing of records will work the same way.
Moreover, the InCountry Data Residency for Salesforce solution can combine multiple data regulation models, so you can flexibly process the personal data of customers from different countries according to the compliance requirements imposed by each country.
The legacy solution regulates data visibility through the browser extension that de-tokenizes data upon the user’s request to view or edit regulated data values. Users that access Salesforce without the browser extension will only see tokenized values. The editing of records is handled similarly.
If comparing the two solutions, we can see that the regulated data of Russian citizens is handled differently by both. The InCountry Data Residency for Salesforce solution saves the original dataset to the InCountry platform, and a replica is saved to the Salesforce Cloud database. The legacy solution saves regulated data to the customer’s server and tokenized values to Salesforce.
From the compliance perspective, both solutions meet the requirements of the Russian Federal Law on Personal Data (No. 152-FZ).
Security
The InCountry platform has passed SOC2, ISO, and PCI DSS audits in addition to having full compliance with the 152-FZ requirements. All the data communications between components are performed through secure HTTPS connections and authorization of data requests is exercised through OAuth2. The solution does not use a browser extension for data detokenization, which fortifies the overall protection of regulated data.
The legacy solution uses the browser extension that is provided per customer request. However, browser extensions are easy to hack or inject malicious code into. Alternatively, instead of the browser extension, you can use a reverse proxy. In this case, you should acknowledge that users who deal with the regulated data of Russian citizens will not work directly with Salesforce itself, but through the middleware that will proxy data requests between the user’s browser and Salesforce Cloud.
Speed and response
The InCountry Data Residency for Salesforce solution slightly increases the data loading time in the visual interface of Salesforce. This is caused mainly by security requirements and the necessity to perform additional security checks for users accessing data.
The legacy solution does not have a response lag as all data is processed by the browser extension that de-tokenizes data. Unfortunately, the drawback of such a solution is lower security. When you deal with the personal data of your customers, it’s up to you to decide what is more important to you and your brand’s reputation.
Solution distribution
The InCountry Data Residency for Salesforce solution is distributed as a standard package on Salesforce AppExchange. This is a native solution that passed the Salesforce team review and proved to be compatible with the Salesforce platform and compliant with their security and third-party solution requirements.
The legacy solution is not available on AppExchange due to its approach for data security and tokenization, which does not comply with internal Salesforce requirements. The package is provided by the vendor per request.
Pricing
The InCountry Data Residency for Salesforce solution provides flexible pricing that scales with the number of records with regulated data you store on the InCountry platform.
The legacy solution is licensed based on the number of users that will work with regulated data, but the final pricing depends on the used components, infrastructure setup, and maintenance services imposed by the vendor, making each quote individual.
Comparison of both solutions
| Legacy solution | InCountry Data Residency for Salesforce |
|---|---|
| ADVANTAGES | |
| 1. No pre-commit/post-commit. 2. Slightly better response at the price of data security. | 1. Better security of personal data. 2. Native solution for Salesforce. 3. Our solution meets the requirements of Salesforce Sharing and Visibility. 4. Zero infrastructure maintenance. 5. No hybrid model for different countries. 6. Validation of entered data. 7. Replica of personal data is retained in Salesforce. 8. Usage of non-reverted hashes or random values instead of tokens. 9. Better user experience for end-users. |
| DISADVANTAGES | |
| 1. Solution architecture is front-end based, making configuration and maintenance a complex process. 2. Browser extensions can be hacked. 3. Non-native Salesforce solution.. 4. Need support for different browser versions. 5. Maintenance of additional infrastructure. 6. Additional manipulations for cross-border data transfers. 7. Dual account management (Salesforce accounts and legacy solution accounts). 8. Data in Salesforce will be invalid if you decide to stop using the solution. 9. Tokens can be de-tokenized if acquiring the key. | 1. Slightly lower response due to additional security checks. 2. The solution architecture is more complex. |
Long-term strategy and evolution
Our passion for data security and compliance constantly drives us to acquire more verified certifications and compliance attestations, as well as to expand the presence of our data residency-as-a-service platform in more and more countries and regions around the world. Our dedicated compliance team is comprised of highly skilled professionals that are doing their best to monitor, track, and review the new data governance laws and regulations appearing every year and resolve any arising compliance questions before they might affect your business, your brand, or your customers.
Moreover, our team is hard at work on growing and nurturing our partnership with global SaaS platforms and services, so that more and more customers can use native integrations for efficient, secure, and compliant collaboration with their customers without sacrificing their user experience or functional capabilities. Right now, in addition to Salesforce, you can connect the InCountry platform to these prominent platforms:
InCountry has established strong cooperation and partnership connections with the consulting and professional services giants Accenture and Deloitte. They continue to extensively use the InCountry platform for designing and implementing full-fledged engineering solutions and addressing common and customer-specific data residency issues in Salesforce. Our collaboration with these corporations let us identify business-critical enhancements and incorporate them into our data residency platform, which in turn have simplified the overall user experience, and added more value to our customers while reducing their associated costs.
Secure. Affordable. Robust… All three at once
In most cases when you deal with SaaS platforms you need to compromise on something, whether security, performance, or the resulting cost. We at InCountry have put our many years of expertise into designing, engineering, and developing a data residency-as-a-service platform that meets all the critical demands of modern businesses and delivers the best-in-class user experience with data localization and distribution in multiple geographically dispersed regions. We fully acknowledge that there is always room for improvement and we will forge your path to compliance and data security by delivering new and unparalleled capabilities in upcoming releases.
If you’re still hesitant about whether the InCountry platform can fully meet your constantly changing and transforming requirements for data residency, please give our service professionals a chance to answer all your questions and ease your worries about data governance and compliance regulations. With the InCountry data residency-as-a-service platform, your journey to the world of data security and compliance will be safe and simple.