Loading
Feature Degradation | Agentforce Voice Read More
Get Started with B2C Commerce
Table of Contents
Filter by (0)Add
Select Filters

          No results
          No results
          Here are some search tips

          Check the spelling of your keywords.
          Use more general search terms.
          Select fewer filters to broaden your search.

            Search all of Salesforce Help
            Search all of Salesforce Help
            Shared Responsibility Model

            You are here:

            1. Salesforce Help
            2. Docs
            3. B2C Commerce for Merchandisers and Administrators

            Shared Responsibility Model

            Ecommerce sites and platforms are attractive cyber attack targets. Cyber attackers look for locations where they can try to exfiltrate sensitive data, such as credit cards, personally identifiable information (PII), and credentials. The ordering workflow also offers an attractive attack surface for cybercriminals to try to enrich themselves. They can create fake orders, adjust coupons and promotions, and deny service to legitimate customers.

            Salesforce takes security seriously and provides multiple security controls and settings that mitigate these risks. B2C Commerce uses a shared responsibility model in which the B2C Commerce platform and the customer have clearly defined roles and responsibilities.

            As our customers’ trusted adviser in data security, we use and make available the following tools and practices to help strengthen their security.

            Salesforce Customers
            • Promote the secure design and implementation of Salesforce infrastructure, platform, and applications.
            • Manage outbound and inbound firewall rules.
            • Enforce two-factor authentication (2FA) on sensitive Salesforce assets.
            • Enforce data isolation per tenant.
            • Run proactive code scans and pen tests.
            • Perform third-party security assessments and audits.
            • Enforce controls to comply with industry standards.
            • Ensure continuous monitoring and incident responses on Salesforce assets.
            • Enforce secure communication protocols such as HTTPS and SFTP.
            • Restrict application-level access controls, for example, by using IP allowlisting and identity validation.
            • Enforce 2FA on sensitive customer-managed interfaces.
            • Assign proper roles and permissions along with robust user provisioning processes.
            • Consume and analyze audit logs in a timely manner.
            • Promote the secure design and implementation of custom code.
            • Promote the secure sourcing, deployment, and maintenance of third-party integrations and extensions.
            • Comply with relevant security standards and regulations.
            • Ensure continuous monitoring and incident response on customer and custom third-party integration assets.
            • Deploy anti-abuse, fraud detection, and prevention measures.
             
            Loading
            Salesforce Help | Article