## Capabilities

DataGrail's Salesforce integration provides the following capabilities:

| Product | Capability |
| --- | --- |
| [Request Manager](https://docs.datagrail.io/docs/request-manager/getting-started) | Request Types | Access, Deletion, Do Not Sell/Share |
| Identifier Categories | Email |
| [Live Data Map](https://docs.datagrail.io/docs/ldm/ldm-overview) | System Detection, Data Discovery |

## Before You Start

To successfully configure this integration, please ensure you have sufficient privileges:

- **DataGrail User Role:** Super Admin, Connections Manager
- **Salesforce User Role:** Admin

## Create a Connected App

DataGrail offers a [Salesforce AppExchange](https://appexchange.salesforce.com/listingDetail?listingId=a0N3A00000FeGT4UAN) app to provide the best experience connecting Salesforce to DataGrail.

1. Find the DataGrail App in [Salesforce AppExchange](https://appexchange.salesforce.com/listingDetail?listingId=a0N3A00000FeGT4UAN).
2. Select **Get It Now**.
3. Select **Install in Production** or **Install in Sandbox**.
4. Agree to the Terms and Conditions, and then select **Confirm and Install**.
5. Select **Install for Admins Only** and then **Install**.
6. Please wait for the app to install. Full installation may take up to 10 minutes.

### Installing For Non-Administrators

To install Salesforce for non-privileged users, the non-administrator users must have the following permissions in their profile:

- `API Enabled`
- `Customize Application`
- `Manage Package Licenses`
- `View All Data`

These permissions enable Access, System Detection, and Responsible Data Discovery features.

To enable the deletion feature, the user must have administrator rights to have write access to all objects defined in [Deletion](https://docs.datagrail.io/docs/integrations/api-documentation/salesforce#deletion).

## Connect to DataGrail

1. In DataGrail, navigate to **Integrations** and select **Configure New Integration** to search for **Salesforce**.
2. Select your **Environment**, either **Production** or **Sandbox**, based on your selection in the [AppExchange App](https://docs.datagrail.io/docs/integrations/connection-instructions/salesforce/#create-a-connected-app).
3. Optionally, setup custom **Opt-out field API name** (`HasOptedOutOfEmail` by default).
4. Select **Login to Configure**.
5. Log in to Salesforce if prompted and authorize the necessary permissions to DataGrail:

### Required OAuth Scopes

- `refresh_token`
- `api`

### Anonymization vs. Deletion

By default, DataGrail attempts to **delete entire records** in your Salesforce instance that contain PII for data subjects. This process can fail when DataGrail doesn't have permission to delete privileged objects (like admins) or when dependent objects block deletion.

You can configure Salesforce to use **anonymization** instead of deletion. With anonymization, DataGrail anonymizes PII fields rather than deleting entire objects. This approach eliminates common deletion errors while preserving non-PII data for reporting purposes.

**Anonymization setup process:**

1. Contact **[support@datagrail.io](mailto:support@datagrail.io)** to request anonymization configuration for your Salesforce integration.
2. DataGrail will crawl your Salesforce instance and generate a report of fields in scope for anonymization.
3. Review the report, remove any non-PII fields, and confirm any additional fields to include.
4. DataGrail will implement the final anonymization configuration.

## Next Steps

Now that you've successfully connected the integration, check out the following resources:

- [Access Request Lifecycle](https://docs.datagrail.io/docs/request-manager/request-processing/privacy-right/access)
- [Deletion Request Lifecycle](https://docs.datagrail.io/docs/request-manager/request-processing/privacy-right/deletion)
- [Request Manager Overview](https://docs.datagrail.io/docs/request-manager/getting-started)
- [Customizing Intake Forms](https://docs.datagrail.io/docs/request-manager/request-intake/privacy-request-center#customization)

## Troubleshooting

If you are unable to successfully connect the integration, review these common troubleshooting steps:

- **Ensure You Are Logged in to Salesforce**  
Connecting users must be logged in to an admin account in Salesforce before selecting **Login to Configure** in DataGrail. This is required to grant the necessary permissions to DataGrail.

- **Ensure Required Permissions Are Granted on API Keys/Resources**  
DataGrail checks required permissions and scopes on API keys/resources used by each integration. If all necessary permissions are not granted, new connections will fail.

- **Review Required Account Types and User Roles**  
If users do not have the necessary permissions or the minimum required user role in the connecting system, the connection to DataGrail will fail. Additionally, connections will fail if your account type does not match the one required by the integration.

See [Before You Start](https://docs.datagrail.io/docs/integrations/connection-instructions/salesforce/#before-you-start) to review these requirements.

## Technical Details

The Salesforce integration uses the [Salesforce REST API](https://developer.salesforce.com/docs/atlas.en-us.api_rest.meta/api_rest/intro_what_is_rest_api.htm):

| Access Type | Synchronous |
| Deletion Type | Synchronous |

## API Documentation

Learn more about this API implementation and DataGrail functionality in our [API Integration Documentation](https://docs.datagrail.io/docs/integrations/api-documentation/salesforce).

Need help?  
If you have any questions, please reach out to your dedicated Account Manager or contact us at [support@datagrail.io](mailto:support@datagrail.io).

_Disclaimer: The information contained in this message does not constitute legal advice. We would advise seeking professional counsel before acting on or interpreting any material._