> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/sensitive-data-movement/salesforce-playbooks-for-sensitive-data-movement.md).

# Salesforce playbooks for sensitive data movement

To mitigate the risk associated with sensitive data movement in Salesforce, you can define automated workflows for these use cases: 

* [Notify on bulk actions in Salesforce](#notify-on-bulk-actions-in-salesforce)
* [Notify on sensitive report exported by terminated employee](#notify-on-sensitive-report-exported-by-terminated-employee)

## Notify on bulk actions in Salesforce

If a Salesforce user who is about to be terminated, or they are an integration partner or guest, performs a bulk query action, then the Security team and the user's manager are notified in Slack.

1. In Workflows, select **Playbooks**.

2. Filter the playbooks according to sensitive data movement, and select the **Notify on bulk actions in Salesforce** playbook. 

3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FywMcPVI0iHzoFmljlLgN%2FSalesforce%20PB%20sensitive%20data%20mvt.png?alt=media&amp;token=71c7524f-748a-4543-8bc7-e0291b39ff36" alt=""><figcaption></figcaption></figure>

4. Customize the Salesforce event trigger (`bulk API result`) for a Salesforce user performing a bulk action.

5. Customize the **Conditional** step: is the user about to be terminated?

6. If **true**, and the user is about to be terminated:
   * Customize the **Get user metadata** step to retrieve employee data from your integrated HRIS app (HiBob or Workday).
   * Send a message to the Security team via the **Notify in Slack** step, informing them that the user just performed a bulk query action in Salesforce.
   * Send a message to the user's manager via the **Notify in Slack** step, informing them that the user just performed a bulk query action in Salesforce.
   * Customize the **Send logs** step to send a log record to your Datadog platform over HTTP.

7. If **false**, customize another **Conditional** step: is the user a guest?
   * If **true**, and the user is a guest: Send a message to the Security team via the **Notify in Slack** step, informing them that the user just performed a bulk query action in Salesforce.
   * Customize the **Send logs** step to send a log record to your Datadog platform over HTTP.

8. If **false**, customize another **Conditional** step: is the user an integration partner?
   * If **true**, link to the **Notify in Slack** step.
   * If **false**, End the workflow.

## Notify on sensitive report exported by terminated employee

If a Salesforce user, who is about to be terminated, exports a Salesforce report, then inform the Security team and the user in Slack.

1. In Workflows, select **Playbooks**.

2. Filter the playbooks according to sensitive data movement, and select the **Notify on sensitive report exported by terminated employee** playbook.&#x20;

3. Give an action name.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F0WltVJC6q6eCxyYVoQ27%2FSalesforce%20PB%20sensitive%20report.png?alt=media&amp;token=4a2fdd5d-7c35-4dfd-881c-b736bebe234f" alt=""><figcaption></figcaption></figure>

4. Customize the Salesforce event trigger (`Report exported`) for a Salesforce user exporting a report.

5. Customize the **Conditional** step: is the user about to be terminated?

6. If **true**, and the user is about to be terminated:
   * Customize the **Get user metadata** step to retrieve employee data from your integrated HRIS app (HiBob or Workday).
   * Send a message to the Security team via the **Notify in Slack** step, informing them that the user, who is about to be terminated, just exported a Salesforce report.
   * Send a message to the user via the **Notify in Slack** step, informing them that they recently exported a Salesforce report, and that company policy does not permit the export of reports.
   * Customize the **Send logs** step to send a log record to your Datadog platform over HTTP.

7. If **false**, and the user is not about to be terminated:\
   End the workflow.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/sensitive-data-movement/salesforce-playbooks-for-sensitive-data-movement.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.