International Data Governance
A reference design for international Salesforce deployments: where data is hosted on Hyperforce, how to classify it, plan transfers, and control access and retention.
International data governance for Salesforce starts with a simple question that has a complicated answer: where does each piece of customer data live, who can reach it, and which country's rules apply? Hyperforce lets you choose where a Salesforce org is hosted, but residency is only one part of the answer. Integrations, engagement platforms, support access, AI services and backups all move data too. This page is a reference design; we validate the APIs, edition and permissions for each implementation. It is not legal advice: plan for the rules below and check your approach with your legal adviser.
Business context
Teams expanding into new countries tend to ask for "data in-country" and stop there. In practice regulators and customers care about the whole path: collection and consent, storage, transfers to processors, access by staff in other countries, retention and deletion. A design that covers the path, not just the region, is easier to defend and to change when laws move.
What Salesforce says about Hyperforce locations
- Salesforce's Infrastructure and Sub-processors document (published 19 December 2025) lists AWS hosting locations for Salesforce Services on Hyperforce. Among the countries we checked, these include the United States, Canada, Australia, India, Japan, Singapore, the UAE, the UK, Germany and Ireland. It does not list Thailand, Taiwan, the Netherlands, New Zealand or Malaysia. Salesforce has announced it will bring Hyperforce to Saudi Arabia, but current availability there is not confirmed.
- For the EU, the Hyperforce Operating Zone (formerly the EU Operating Zone) is a paid offering that stores data in Germany or Switzerland, with EU-based support.
- The same document says "not all Covered Services hosted on Hyperforce are available in every location". A Hyperforce region does not guarantee that every product, or support access, stays in-country.
- Salesforce announced Data Cloud (now Data 360) on Hyperforce for UK customers for 31 July 2024.
- At Dreamforce 2026, Salesforce announced Hyperforce on Google Cloud, with North America GA planned for November 2026 and Germany and wider expansion in 2027.
Locations and product availability change, so confirm both for your org with your Salesforce account team before you commit.
International data governance reference architecture
Reference architecture: a reusable pattern, not a live client integration
Select a component to see what it is responsible for and how data moves to and from it.
Components and data flows (text version)
| Component | Type | Responsibility |
|---|---|---|
| Customers by regiondata subjects | People | Give consent and exercise rights under their own country's rules. Their region is recorded on the profile. |
| Source systemsweb, apps, ERP, files | External or custom system | Every system that sends personal data in. Each is listed in the data inventory with its location. |
| Regional consent rulesby country and purpose | Identity, policy and governance | Captures consent and preferences with the wording and legal basis that apply to the person's region. |
| Data classificationinventory and tags | Identity, policy and governance | Tags fields as personal, sensitive or regulated and records where each is stored and sent. Shield Data Detect can help find sensitive data. |
| Users by regionroles and permission sets | People | Staff and partners get least-privilege access by role and region; cross-border access is a transfer to plan for. |
| Salesforce orgchosen Hyperforce location | Salesforce product | Hosts CRM data in the selected location. Product availability varies by location, so check each product you license. |
| Data 360location per org | Data and analytics | Unified profiles and insights. Confirm that Data 360 and its features are available in your chosen location. |
| Shield and Guardian controlsencryption, monitoring, audit | Identity, policy and governance | Platform Encryption, Event Monitoring, Field Audit Trail and Data Detect, plus Guardian add-ons such as Privacy Center and Backup and Recover. |
| Integration layerwhere it runs matters | Integration layer | Moves data between systems. Its hosting location, logs and queues are part of the transfer picture. |
| Other processorsengagement, warehouse, AI | External or custom system | Platforms such as Braze, a warehouse or AI services, each with its own hosting location and terms. |
| Retention and deletionpolicies and jobs | Identity, policy and governance | Deletes or archives data on schedule and carries erasure requests to every system that holds a copy. |
Data flows
- Customers by region → Regional consent rules: consent captured. Consent recorded with region, purpose, wording version and time.
- Source systems → Data classification: field inventory. New sources are classified before go-live, not after.
- Regional consent rules → Salesforce org: consent records. Stored in the org's consent objects or Data 360 consent DMOs.
- Data classification → Data 360: policies and tags. Classification drives which fields are ingested, masked or excluded.
- Users by region → Salesforce org: least-privilege access. Permission sets and sharing by role and region, reviewed regularly.
- Salesforce org → Data 360: data streams. CRM data into Data 360 in the same location, where available.
- Salesforce org → Shield and Guardian controls: encryption and logs. Encryption at rest for chosen fields and event logs for access review. Shield is a separate licence.
- Salesforce org → Integration layer: outbound data. Every outbound flow is listed with destination country, fields and transfer mechanism.
- Data 360 → Other processors: activations and data shares. Activations to supported targets and zero copy data shares leave Data 360 directly and are transfers too. Platforms with no native target, such as Braze, go through the integration layer.
- Integration layer → Other processors: processor transfers. Only the fields needed, to processors under contract, in the region agreed.
- Salesforce org → Retention and deletion: retention rules. Scheduled deletion or archiving per data class.
- Retention and deletion → Other processors: erasure requests. Deletion requests sent to each processor, for example the Braze user deletion endpoint, and confirmed.
Component responsibilities
| Component | Responsible for | Evidence to keep |
|---|---|---|
| Data inventory and classification | Knowing what personal data exists and where | Field-level inventory with locations |
| Regional consent | Lawful basis and preferences by country | Consent records with wording versions |
| Hyperforce location | Where the core org is hosted | Contract and location confirmation |
| Access control | Who can see what, from where | Permission set reviews |
| Transfer register | Every flow out of the org | Destination, fields, mechanism, owner |
| Shield and Guardian | Encryption, monitoring, audit, privacy tools | Configuration and log reviews |
| Retention and deletion | Removing data on time everywhere | Job logs and erasure confirmations |
Cross-border rules to plan for (check with your legal adviser)
| Country | Point to plan for |
|---|---|
| India | DPDP Act duties, including cross-border rules, phase in by May 2027. Transfers are allowed unless the government restricts a country by notification; sector rules such as RBI's for payments data still apply |
| United Kingdom | The Data (Use and Access) Act 2025 introduced a "not materially lower" test for international transfers. The regulator became the Information Commission on 30 September 2026 |
| Singapore | Overseas recipients must be bound to a comparable standard of protection, for example by contract |
| Japan | Consent-based transfers require telling people the destination country, its protection system and the importer's safeguards |
| United Arab Emirates | Transfers to adequate jurisdictions or under exceptions; details await the Executive Regulations |
| Thailand | Transfers need an adequate destination, approved binding corporate rules or safeguards such as ASEAN model clauses or SCCs |
| United States | No federal general privacy law; state laws such as California's CCPA apply |
Data flow, step by step
- A source is proposed. Its fields are classified and its location recorded before any data moves.
- Consent is captured with regional wording and stored in the org.
- Data lands in the org and Data 360 in the chosen Hyperforce location.
- Each outbound flow, such as an activation to an engagement platform, is checked against the transfer register.
- Retention jobs delete or archive data on schedule, and erasure requests reach every processor.
Trust boundaries and authentication
The main boundary is the org's hosting location, but there are others: the integration layer's hosting, each processor's region, and staff access from other countries. Engagement platforms often have regional endpoints: Braze runs instance-specific REST endpoints (for example US and EU instances) and its MCP server has US and EU endpoints, either of which can reach any cluster, so the MCP endpoint does not decide where data is held; Marketing Cloud Engagement's MCP server uses tenant-specific US and EU endpoints. Choose regions deliberately and record them. For AI features, the Einstein Trust Layer includes zero data retention agreements with LLM providers; confirm where processing happens for each feature you enable. Use Data Mask and Seed, a Guardian add-on, so sandboxes do not hold real personal data.
Failure scenarios and how to handle them
| Scenario | Effect | Handling |
|---|---|---|
| Product not available in your location | Data processed elsewhere | Check availability per product before contracting |
| Undocumented integration | Unplanned transfer | Transfer register reviewed at every change |
| Full production copy in a sandbox | Personal data in a less controlled environment | Mask data in sandboxes |
| Erasure request misses a system | Data kept after deletion | Erasure workflow with confirmations from each processor |
| Support or admin access from abroad | Unplanned access transfer | Access policy and logging, reviewed with your legal adviser |
Operational monitoring
Review Event Monitoring and Setup Audit Trail for unusual access, track retention and erasure job outcomes, and review the transfer register and permission sets each quarter. Winter '27 adds User Field History Tracking for up to 20 User fields, kept for 18 months, which helps audit permission changes. Our security and governance service covers these reviews.
Alternative approaches and trade-offs
- One global org in one location. Simplest to run; relies on transfer mechanisms for other regions.
- Regional orgs. Stronger separation, at the cost of integration and duplicated configuration. See the multi-cloud architecture.
- Minimise rather than localise. Send processors only the fields they need, which often reduces the transfer problem more than moving hosting.
Implementation checklist
- 01
Build the data inventory
Classify fields and record where each is stored and sent.
- 02
Confirm hosting
Check Hyperforce location and product availability with your account team.
- 03
Write the transfer register
List every outbound flow with destination, fields and mechanism.
- 04
Design regional consent
Capture wording and legal basis by country, reviewed by your legal adviser.
- 05
Set access by role and region
Least-privilege permission sets with regular reviews.
- 06
Define retention
Periods per data class, with deletion jobs and erasure workflows.
- 07
Protect sandboxes
Mask or seed data so test environments hold no real personal data.
Related services and solutions
Data governance solutions
Policies, ownership and controls
→Security and governance service
Access, Shield and audit reviews
→Identity and consent architecture
Consent system of record and sync
→Shield and Guardian
Salesforce security add-ons explained
→Locations
How we work remotely with teams worldwide
→Security and data handling
How GeekMidst handles your data
→Questions we hear
Does Hyperforce keep all our data in-country?
Which countries have Hyperforce hosting?
Is Thailand or Taiwan a Hyperforce location?
Can GeekMidst confirm we are compliant?
Sources
- https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/misc/salesforce-infrastructure-and-subprocessors.pdf
- https://www.salesforce.com/platform/public-cloud-infrastructure/
- https://www.salesforce.com/news/stories/data-cloud-hyperforce-uk-availability/
- https://www.salesforce.com/platform/shield/
- https://www.dlapiperdataprotection.com/?t=law&c=IN
- https://www.cliffordchance.com/insights/resources/blogs/talking-tech/en/articles/2026/02/key-aspects-of-the-data--use-and-access--act-take-effect.html
Plan an international Salesforce deployment
We can map your data, hosting, transfers and retention into one design for you and your legal adviser to review. Consultations are remote, from India.
