Patrick Shaw’s Weblog

Ah - an open ended question that has a series of nuanced answers - so here we go!

• Yes. You can review their security and privacy statements to see what they are saying.
• Yes . . . but. A nice article from E-Week about Salesforce security, as well as how to evaluate similar tools.
• Yes . . . And Salesforce does some self reporting - you can read what their alerts say about phishing.
• Yes . . . but the broader community has some suggestions for next steps, while they welcome Salesforce to the big time target pool, just like eBay and PayPal and a few others. Read what zdnet has to say.
• Not as secure as the server you have under lock and key that isn’t available over the internet!

So What Now?

1. Salesforce, Convio, eTapestry, SharePoint, your email client and any other hosted solution means you have a security risk. You can alleviate that risk by changing your passwords regularly, by using strong passwords, by limiting access based on the IP address of the computer/originating network, and by making sure that your user name and password aren’t on a sticky note on your computer monitor!
2. And don’t forget to asess your risk level frequently. Remember: a risk and the likelihood of that risk being exploited can be different - and can change over time!