Salesforce

Connect Salesforce to collect crm evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Salesforce:

   1. Make sure the Salesforce user you will connect with has the API Enabled user permission (and View Setup and Configuration, see below).
   2. Install or update Salesforce CLI.
   3. Run sf org login web (for a sandbox add --instance-url https://MyDomainName--SandboxName.sandbox.my.salesforce.com); a browser opens to https://login.salesforce.com.
   4. In the browser, log in as that user and click Allow to allow access.
   5. Run sf org display --target-org <username> and copy the long Access Token value from the output. To get a new token after it expires, run the same command again.
   6. From Setup, in the Quick Find box, search for and select Permission Sets, click New, enter a label and description, and click Save.
   7. In the permission set, use the Find Settings box to locate and enable the API Enabled and View Setup and Configuration user permissions, then save.
   8. On the permission set's overview page, click Manage Assignments, then Add Assignment, select the integration user, click Next, then Assign.

   Where to find the other values:

   • Instance URL: The Instance Url line of sf org display --target-org <username> output (for example https://MyDomainName.my.salesforce.com).
   • Access token: The Access Token line of sf org display --target-org <username> output.

   Salesforce's public documentation does not cover every step.

   Sourced from Salesforce's REST API Developer Guide (Version 68.0, Winter '27) Quick Start 'Get an Access Token with Salesforce CLI' and the Trailhead 'Creating and Assigning a Permission Set' unit. API access requires an edition with API access (Enterprise, Unlimited, Developer, or API access purchased as an add-on); otherwise requests fail with API_DISABLED_FOR_ORG. Access tokens from the CLI expire (the output shows an Expiration Date) and must be refreshed by re-running sf org display. Not sourced: the click path for creating an External Client App with the 'api' OAuth scope (Salesforce Help pages for 'Create an External Client App' render only in a browser and developer.salesforce.com returned HTTP 403); creating new connected apps is restricted as of Spring '26 and Salesforce recommends external client apps instead. The exact screen within a permission set that lists the API Enabled and View Setup and Configuration system permissions was not quoted in a fetched page beyond the Find Settings box.

   Source: resources.docs.salesforce.com, trailhead.salesforce.com, checked 2026-10-07.

   The permissions Safeguard needs: api, View Setup and Configuration. Needs Salesforce's Enterprise (or API enabled) plan. Optional, broader than read-only: Manage Multi-Factor Authentication in API. Without it, the checks that need it show an error naming it. Safeguard only reads with it.

2. On Compliance › Connectors, open Salesforce, click Connect, choose API token and fill in:

   Field	What to enter
   Instance URL	Required. For example: https://acme.my.salesforce.com
   Access token	Required. Stored encrypted and never shown again.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Salesforce and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• CRM connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks