Salesforce Trust Center: What It Is, How It Works, and Its Limitations

Salesforce Trust Center is Salesforce's public transparency portal for platform availability, security, and compliance information, at trust.salesforce.com. It publishes real-time service status, incident detail, maintenance schedules, and downloadable audit certifications across Salesforce products, and the public site needs no login.

Its most practical job is answering one question quickly: is this problem Salesforce's or ours? That question matters because Salesforce orgs hold sensitive customer data, financial records, and business-critical workflows. When performance degrades or an auditor asks for a current SOC 2 report, teams need an authoritative answer in minutes rather than a support ticket and a three-day wait.

Does Salesforce have a Trust Center?

Yes, Salesforce Trust Center is the company's official transparency portal, available at trust.salesforce.com without a login.

The site is organized around four areas linked from its home page: Status, Security, Compliance, and Availability. Status covers live service health and incidents. Security and Compliance cover Salesforce's own controls, certifications, and audit documentation.

Salesforce also runs an authenticated version called My Trust Center at my.trust.salesforce.com, which narrows the same information down to your specific orgs and products. The public site answers questions about Salesforce. The authenticated site answers questions about your orgs.

What is the Salesforce Trust Center?

Salesforce describes trust as its number one value, and the portal is where that claim becomes auditable. Four groups use it regularly: admins and IT check service status during incidents, security teams reference platform controls, compliance teams download certifications during audits, and procurement and vendor management teams verify sub-processors and data center locations.

The portal covers Salesforce's side of the shared responsibility model. It documents what Salesforce operates and secures, and it reports nothing about what happens inside your org. Trust Center is a reporting surface for Salesforce's platform, not a management console for your environment.

What are the key features of Salesforce Trust Center?

The table below summarizes each capability and where to find it.

Trust Status dashboard: real-time service availability

The Trust Status dashboard at status.salesforce.com displays current operational status for Salesforce products including Sales, Service, Industries, Agentforce, MuleSoft, Tableau, Slack, Commerce, Marketing, and Heroku. To use it, you first need your instance name. Find it in Setup under Company Information in the Instance field, or enter your My Domain into the search box at the top of status.salesforce.com.

Salesforce Help defines four statuses an instance can have. Informational messages appear alongside them as announcements, not as an instance status.

The dashboard also separates incidents affecting a single instance from incidents affecting a product across all instances. Instance-specific incidents surface only for customers on that instance. That distinction tells you immediately whether to investigate your own configuration or wait for Salesforce to resolve a platform issue.

Incident detail pages carry an incident ID, the affected services and instances, start and end times, running updates, and a root cause analysis after resolution where one is published. Salesforce advises that if you are experiencing an issue with the core service that has lasted more than 10 minutes and nothing appears on the status site, you should contact Salesforce Support. Check the status page before you troubleshoot, but do not treat a green board as proof that nothing is wrong.

Trust Status notification configuration

Salesforce offers email notifications for incidents and maintenance, set up as described in the Trust notification user guide. Subscriptions can be filtered by instance, by service, and by event type.

Enterprise teams managing several orgs usually tier subscriptions by environment rather than routing everything to one inbox:

• Production instances route to an incident management platform such as PagerDuty or ServiceNow for on-call response
• Sandbox instances route to a distribution list for review during business hours
• Development instances receive notifications only for the most severe statuses

Compliance documentation portal: centralized audit resources

The compliance portal at compliance.salesforce.com centralizes certifications, audit reports, and attestations. Most documents require a sign-in before you can download them, using a Salesforce, Heroku, or Slack login, or an email address your account representative has pre-authorized.

This replaces the older process of requesting documentation through support tickets, which could take days. The portal also publishes sub-processor lists, data center and infrastructure documentation, and service coverage documents.

Read the service coverage documents closely. They list which products fall inside each certification's scope, and anything not listed falls outside it. Download the coverage document alongside the certificate, because auditors ask which services the certificate covers.

Audit and attestation standards

Audit standards provide third-party verification of Salesforce's security controls and operational processes. The portal publishes the major ones.

SOC 2 Type II reports cover a defined operating period, so compliance teams need to confirm the report period overlaps their audit period, and download two reports when an audit period spans cycles. SOC 2 reports also list complementary user entity controls, which are the security responsibilities that fall to you.

Salesforce controls physical data center access. You control authentication settings, session timeouts, and IP restrictions. Auditors expect evidence for both sides.

Certifications also do not extend to third-party AgentExchange (formerly AppExchange) packages installed in your org. Those carry their own certifications, or none at all. A Salesforce certificate covers Salesforce's services, not everything running inside your org.

Regulatory compliance frameworks

Beyond audit standards, the portal publishes documentation supporting specific regulatory regimes. Each one splits responsibility between Salesforce and the customer. For SOX audits, our roundup of Salesforce SOX compliance tooling covers the tools teams use to evidence their side.

Executing a HIPAA Business Associate Agreement does not make an org compliant on its own. Every framework here splits responsibility, and Trust Center documents only Salesforce's half. Your half includes data protection, which our backup and recovery guide covers.

What changed with My Trust Center in 2026?

My Trust Center is the authenticated, personalized version of the Trust experience. Salesforce renamed its Personalized Trust beta to My Trust Center in the Spring '26 release and introduced it to admins in April 2026. The Trust site now describes it as generally available, at my.trust.salesforce.com.

The public site reports at instance level, which means subscribers receive alerts for every product on an instance whether they use it or not. My Trust Center filters down to the tenants and products assigned to you, which is the main reason to move.

It adds capabilities the public site does not have:

• One full year of historical event data for your tenants
• Patch release information published four to five days before the patch goes live
• Patch releases and maintenance windows shown alongside incidents
• Tenant-level notification subscriptions filtered by event type
• Sandbox orgs, which Salesforce is adding now

Salesforce has been explicit that this is a transition rather than a switch. The public Trust and Status sites run in parallel for now, because not every product has migrated (Heroku and Slack among them), access for non-licensed users is still being built, and customers need time to move subscriptions and integrations.

Coverage is still growing. Salesforce's March 2026 FAQ lists Agentforce 360 Platform, Data 360, Salesforce AI, and Marketing Cloud Engagement, plus Agentforce Sales, Agentforce Service, and Salesforce Industries for production environments only.

Two migration items need planning. Legacy Trust notification subscriptions do not transfer automatically, and automated monitoring built against legacy Trust APIs will eventually need to point at My Trust Center instead. Keep using the public site, but start moving subscriptions and integrations now rather than during the eventual sunset.

How do you access Salesforce Trust Center?

The public portal requires no account. The compliance documents and the personalized experience both require authentication.

Access the public Trust site

1. Go to trust.salesforce.com.
2. Use the links on the home page to reach Status, Security, Compliance, or Availability.
3. On status.salesforce.com, enter your My Domain in the search box to identify your instance, or find it in Setup under Company Information.
4. Click an instance or an incident to see detail, affected services, and the maintenance calendar.

Download compliance documentation

1. Go to compliance.salesforce.com.
2. Sign in with a Salesforce, Heroku, or Slack login, or with an email address your account representative has pre-authorized.
3. Locate the certification or report you need and confirm its coverage period.
4. Download the document along with the matching service coverage document.

Set up My Trust Center

1. Go to my.trust.salesforce.com and register using your Trailblazer account.
2. Review Upcoming Maintenance for planned work over the next 90 days.
3. Select Tenants to see the orgs assigned to you, then View Details for past, current, and future events.
4. Open Subscriptions, click Subscribe to Tenant, and choose the event types you want to receive.

How does Trust Center fit into security operations?

Trust Center sits on Salesforce's side of the shared responsibility model. Salesforce operates and secures the platform, and Trust Center is where it reports on that work. Customers configure access, data protection, and application controls, and Trust Center reports nothing about those.

In practice the dashboard functions as a triage gate. During any incident, checking status first separates platform problems from org problems before anyone starts investigating configuration.

A green board is not proof of platform health, though. Salesforce may not have detected or posted an emerging incident yet. Corroborate with other signals: whether other customers on your instance report the same symptoms, what your own Event Monitoring data shows, and whether the issue spans multiple unrelated orgs.

If every org on an instance shows identical symptoms at the same time, that pattern points to a platform incident regardless of what the board displays. Use Trust Status to rule causes out quickly, not to declare the platform healthy.

Common Trust Center usage scenarios

Scenario 1: Mass login failures. Users across the org cannot log in, so check the status dashboard for your instance. A Service Disruption listing authentication among the affected services confirms a platform issue. Communicate the incident ID and estimated resolution to users, monitor the incident page, and hold off on internal authentication troubleshooting.

Scenario 2: Slow report performance. Dashboards that used to load in seconds now take far longer. The status board shows everything available with no active incidents, which points to an org-level cause. Investigate query performance, selective filters, record volumes and data skew, and scheduled report subscriptions running at peak hours.

Scenario 3: Intermittent API failures. Integration monitoring shows an elevated error rate against a previously stable baseline. The status board shows Degradation for your instance, meaning the service is reachable but impaired. Add or increase retry logic, extend timeouts temporarily, and monitor for the resolution notice.

Scenario 4: Audit documentation request. An auditor asks for evidence of SOC 2 coverage across a specific period. Authenticate at compliance.salesforce.com, open the SOC 2 section, confirm the report period covers the audit window, then download the report and the service coverage document. If the audit period spans two reporting cycles, download both reports.

Where does Trust Center's role end?

Trust Center reports on Salesforce's platform. It does not manage security inside your org.

It cannot tell you whether a specific user accessed customer records outside business hours, whether anyone changed profile permissions in the last 30 days, or whether last night's deployment introduced a misconfiguration. Those are org-layer questions, and they need org-layer tools.

The table below maps Trust Center against the Salesforce products that answer those questions.

Trust Center tells you what Salesforce did. Everything else on that list tells you what your users and your releases did.

Trust Center vs. the Salesforce Known Issues site

Known Issues is a separate Salesforce site, now folded into Salesforce Help, where Salesforce publishes confirmed software defects with their current status and any documented workarounds. Trust Center covers service availability and incidents, meaning something that was working has stopped. Known Issues covers defects, meaning something behaves incorrectly by design flaw rather than by outage.

During troubleshooting, check Trust Center first for an active incident. If the board is clear and one specific feature is misbehaving, search Known Issues before opening a support case.

What are Trust Center's limitations?

Trust Center publishes incident-level information, not aggregate performance metrics. It does not report mean time to resolution, service level objective compliance, or comparative uptime trends.

Salesforce does not publish aggregate uptime figures publicly because service level commitments vary by contract, edition, and negotiated terms. Those commitments live in individual Master Subscription Agreements rather than in public documentation. Customers who need documented uptime guarantees for compliance or vendor management should raise it with their account team, ideally as part of a renewal conversation.

Programmatic access is another gap. A community-known Trust Status API endpoint exists, but it is not officially supported, so integrations built on it can break without notice. Treat Trust Center as an authoritative source for what happened, not as a metrics platform or a stable API.

How do you use Trust Center effectively?

The teams that get the most out of Trust Center treat it as a step inside existing workflows rather than a site to visit when something breaks.

How do you close the gap Trust Center leaves?

The risk sits inside the org. Trust Center confirms that Salesforce's infrastructure remains secure and certified. It says nothing about whether last week's release introduced a permission change nobody reviewed, or whether configuration drift has widened access between audits.

Closing that gap takes deployment governance: version control over metadata, approval gates before changes reach production, and audit trails that outlast native retention windows. Event Monitoring covers user activity inside the org. Deployment controls cover the changes that alter what users can do in the first place.

Flosum is an end-to-end enterprise DevSecOps platform purpose-built for Salesforce, with three deployment options (Salesforce-native, Flosum-hosted cloud, and customer-hosted) so teams can match governance to their architecture rather than the other way around. Flosum Trust Center adds security monitoring, change auditing, and access remediation across your Salesforce environments. Book a demo to see how deployment governance complements the platform transparency Trust Center already provides.

FAQs

‍