Types of Salesforce Data Security Model

Salesforce has a strong and flexible system to keep your data safe at different levels. It also has tools that let you share data securely based on what your business needs. This system controls what data a user can see and edit, depending on their profile, role, and sharing settings. It also makes sure users are who they say they are and keeps your Salesforce organization safe from unauthorized access.

Different Levels of Data Access in Salesforce

Data access on Salesforce is divided into four levels, which are:

1. Organization Level security
2. Object Level security
3. Field Level security
4. Record Level security
5. Organization Level

Organizational level security in Salesforce controls who can access your Salesforce org, as well as when and from where they can access it. You can set IP restrictions to limit the IP addresses from which users can log in and use access permissions to control user sessions. At this level, you can maintain a list of authorized users for your organization, set password policies, and restrict logins to certain hours and locations.

Object Level security

Object-level security is the easiest way to control which users have different types of access to each object. By setting permissions on a specific type of object, you can stop a group of users from creating, viewing, editing, or deleting any records of that object.

Object-level access can be managed in two ways:

1. Profiles
2. Permission Sets.  

1. Profiles

Every user in Salesforce has a profile. This profile defines their role in the organization and controls what they can do with the records they can access. It determines which objects a user can access and what actions they can take with those objects. Profiles are also used to set things like page layouts and login IP restrictions. However, for setting up object and field security, it’s best to configure profiles for minimum access and use permission sets to add additional permissions.

2. Permission Sets

Permission Sets give users extra permissions and access settings. With Permission Sets, you can only add permissions for users; you can’t take away any permissions that were already given to them through their profile. Also, Also, Permission Sets can only be assigned to individual users and cannot be assigned to profiles.

Additionally, organizations can have many roles and a variety of permission sets. To manage such cases, permission set groups come in handy. Multiple permission sets that are combined are called permission set groups.

Field Level security

Field-level security in Salesforce manages whether a user can view or edit a specific field on an object’s record. Unlike page layouts, which only control field visibility on detail and edit pages, field-level security affects visibility in all parts of the app, including related lists, list views, reports, and search results.

Profiles and permission sets in Salesforce also control field-level access. An admin can grant read and write permissions for individual fields or set a field to hidden, which completely removes access to that field for the user. When a field is hidden through field-level security, it cannot be accessed through any entry points, such as APIs.

How do you set field-level security in Salesforce?

Step 1. Access Profiles or Permission Sets

First, go to the Setup menu in the Salesforce user interface. Next, use the Quick Find box to search for “Profiles” or “Permission Sets.”

Step 2. Choose the Profile or Permission Set

Click on either “Profiles” or “Permission Sets,” depending on where you want to change field-level security.

Then, choose the specific profile or permission set you want to edit.

Step 3. Locate Field-Level Security Settings

In the profile or permission set details, find the section labeled “Custom Field-Level Security” or “Field-Level Security.”

Step 4. View and Edit Field Permissions

Click “View” next to the object or field you want to adjust. This will show a table with all the fields related to that object. Locate the field you want to modify and click the “Edit” link next to it.

Step 5. Set Field Access Permissions

You will see a dropdown menu for each permission level (Read, Edit, Read Only, etc.). Select the access level you want users with this profile or permission set to have for this specific field.

Read: Users can view the field value but cannot edit it.

Edit: Users can view and modify the field value.

Read Only: This option allows users to see the field value but prevents them from editing it.

Step 6. Save Your Changes

Record Level security

Record-level security in Salesforce controls which specific records within each object users can view and edit based on their profile. Access to a record is determined by a combination of object-level, field-level, and record-level security permissions. If there’s a conflict between object-level and record-level permissions, the most restrictive settings take precedence.

Salesforce lays down five ways to control record-level access. These are:

• Organization-wide defaults
• Role hierarchies
• Sharing rules
• Manual sharing

Organization-Wide Defaults

OWD (Organization-Wide Defaults) sets the baseline access level for all users to records within an object. The options are:

• Public Read/Write: Everyone can view and edit the records.
• Public Read Only: Everyone can view the records but cannot edit them.
• Private: Access is limited to the record owner and users above them in the role hierarchy.

These are the general configuration steps:

Step 1: Define the default sharing setting for an object.

Step 2: Go to Setup > Sharing Settings.

Step 3: Choose the desired sharing setting (Private, Public Read-Only, Public Read/Write, or Public Full Access) for the object.

Step 4: These settings establish the baseline level of record access for all users.

Role Hierarchy

Every Salesforce organization has a role hierarchy that defines the structure of users within the organization. This role hierarchy helps extend record access automatically, so a manager always has access to the same data as their employees, regardless of the org-wide default settings.

If your sharing settings are not set to “Private,” users at higher levels in the hierarchy will have the same access permissions to data records as those below them, based on your sharing settings. Make sure the “Grant Access Using Hierarchy” checkbox is checked to let users access data based on their role in the hierarchy.

Setup->Sharing Settings->Edit-> Grant access Using Hierarchies on targeted objects.

Creating a Role Hierarchy in Salesforce involves these steps:

Step 1: Go to Setup by clicking the gear icon in the top-right corner of the Salesforce dashboard.

Step 2: Use the Quick Find box to search for “Roles” and choose “Roles.”

Step 3: Click the “New Role” button to start creating a new role.

Step 4: Enter a name for the new role and set its position in the role hierarchy.

Step 5: If applicable, specify a parent role and then save your changes.

Sharing Rules

This method creates exceptions to Org-Wide Defaults (OWDs) and grants access to specific groups or users based on defined criteria. It is useful when certain user groups need access to records beyond their usual permissions.

Salesforce has two types of sharing rules:

• Based on record ownership.
• Based on criteria.

Setup->Sharing Settings->Go to Object Related List->Click New-> Create

Creating a sharing in Salesforce involves the following steps:

Step 1: Create sharing rules to extend access based on record criteria.

Step 2: Go to Setup > Sharing Settings > Sharing Rules.

Step 3: Set up rules to share records that meet certain criteria with a group of users, based on ownership or specific conditions.

Manual sharing

In Salesforce, Manual Sharing allows you to share individual records with other users by using the share button on the record. This is useful when you cannot define a consistent group of users who need access to a specific record. Manual sharing rules let users manually share a record with individuals who do not have access to it through other means.

Share this article
• Facebook
• Twitter
• LinkedIn