# Let your team use AI on Salesforce, with the controls you need. > SyncOnAI 360 for IT and platform leaders brings the Salesforce estate under one set of controls. Every org is scored for health and audited, every change ships as a validated proposal with two-person approval for production, every deploy leaves a receipt, AI tools are scoped and logged, and CRM records are never stored. Source: https://synconai360.com/solutions/salesforce-it-leaders ## Key facts - **2**: People on every production change in multi-admin workspaces - **0**: CRM records stored - **Every**: Deploy recorded with its approver - **12**: Audit sections scored per org ## Why AI on Salesforce worries IT leaders Teams are already pasting org details into AI tools and asking them to write Apex and Flows. The productivity is real, and so are the questions: what data left the building, who approved the change, and how would anyone undo it. - **Shadow AI.** Configuration and code are copied into general chat tools with no record of what was shared or what came back. - **No single change path.** Changes reach production from Setup, IDEs, change sets and vendors, each with its own level of control. - **Risk you cannot see.** Org health, security exposure and technical debt are known only when someone runs a one-off assessment. - **Audit questions without answers.** Who approved this change and what was it meant to do is answered by searching emails. ## How do you see the health of the whole Salesforce estate? Every connected org is synced and scored on each refresh, with confidence and coverage reported separately so a score is never more certain than its data. The audit scores twelve sections, including permissions and security, automation, code and limits, with evidence behind each finding and an estimated cost to fix. The Command Center shows the portfolio side by side with an action queue and activity feed, and reports state how much of the estate each figure covers. - Health, confidence and coverage per org - Twelve audited sections - Portfolio view with an action queue ## What controls apply to Salesforce changes? Nothing reaches a customer org except through a proposal. Each one runs named pre-flight checks and is validated against the target org; production needs an approved proposal, and in workspaces with two or more admins the approver must be someone other than the author. A deploy policy adds freeze windows, required approvers and auto-approval for low-risk work, and can never let through a change that failed its checks. Every deploy leaves a receipt with rollback to the recorded previous version. - One governed path to production - Maker-checker approval - Freeze windows and policy - Receipts and rollback ## How is AI governed on Salesforce? The AI reads the synced org rather than receiving pasted extracts, and any change it drafts becomes a proposal like any other. Specialist agents list their tools and whether each reads or writes; any tool can be allowed, denied or held for confirmation, and every tool call is recorded. External AI clients such as Claude Desktop and Cursor connect through a read-only, scoped and logged connection. Anthropic and OpenAI do not train on API traffic, and anonymous Apex that changes data never runs without a person pressing Allow. - AI changes become proposals - Agent tools allowed, denied or held - Read-only, logged MCP access - No training on API traffic ## What data does SyncOnAI 360 hold? Org metadata: configuration and the source of code and automation. CRM records are not stored; record queries run live when a question needs them. Secrets are held in a cloud key management service, and each workspace is isolated from every other customer at the database level. The Trust Center and security overview set out each control, the subprocessors that handle data and the processing terms, including what each control does not cover. - Metadata, not CRM records - Secrets in a key management service - Workspace isolation in the database ## What evidence is there for an audit? Each deploy's receipt records what changed, the request behind it, the checks it passed, who approved it and when. The activity log records privileged actions across the workspace, deploys, refreshes, settings changes and connections, with filters for each. Two roles keep access simple to explain: admins approve production, manage connections and keys; members build, propose and deploy to sandboxes. - Receipts for every deploy - A filtered activity log - Two roles, simply explained ## How do you roll SyncOnAI 360 out across the estate? Start with a sandbox: nothing is written to any org without an approved proposal, so the first weeks are read-only in practice. Use the health score and audit to agree where the estate stands, then connect production orgs and set the deploy policy, freeze windows and agent permissions before the team starts proposing changes. Invite people as admins or members, scope any external AI tool tokens to the orgs they need, and review the activity log and receipts as the evidence of how the controls are working. - Sandbox first - Measure, then govern - Scoped tokens and two roles ## Bringing the estate under control 1. **Connect.** Connect a sandbox first, then production orgs. 2. **Measure.** Health and audit for every org, with evidence. 3. **Govern.** Set approval rules, freeze windows and agent permissions. 4. **Prove.** Receipts and the activity log answer audit questions. ## Salesforce and AI, ungoverned versus governed | Without | With SyncOnAI 360 | |---|---| | Org details pasted into chat tools | AI reading the synced org, with a record | | Many routes to production | One proposal path with approval | | Risk known after an incident | Health and audit on every refresh | | Who approved this? Search the inbox | Receipts and an activity log | | AI tools with full access | Scoped, read-only, logged connections | ## Who answers to you - **Platform teams.** Work from one shared picture of each org with AI that reads it, inside the controls you set. - **Release managers.** Run every change through one checked, approved, recorded path to production. - **Partners and consultancies.** Deliver in your orgs through the same proposals, approvals and receipts as your own team. - **Security and compliance.** Review access findings mapped to SOC 2, ISO 27001 and Essential Eight controls, and read the Trust Center. ## Frequently asked questions ### Does SyncOnAI 360 store our customer data? No CRM records are stored. It keeps org metadata, and record queries run live when needed. ### Can AI change production without approval? No. Every change is a proposal; production needs an approved proposal, from a second admin where the workspace has two or more. ### Do the AI providers train on our data? Anthropic and OpenAI do not train on API traffic. On the Free plan, AI runs on your own provider key and account. ### Is there an audit trail? Yes. Every deploy has a receipt, and privileged workspace actions are recorded in the activity log. ### Do you have SOC 2? Not yet. The security overview answers a standard questionnaire control by control, and the Trust Center lists subprocessors and processing terms. ### Is single sign-on available? Not yet. Single sign-on and SCIM provisioning are not available today. ### Where is data hosted? The application and database run in the United States. The subprocessors page lists each company that processes data and where. ### Can we limit what external AI tools see? Yes. MCP tokens are scoped to the orgs you choose, read-only, and every call is logged. ### Can we start without production access? Yes. Connect a sandbox first; nothing is written to any org without an approved proposal. ### Can we see which AI tools accessed an org? Yes. Every call through the MCP connection is logged with the tool and token used. ### Can partners work in our orgs through SyncOnAI 360? Yes. Invite them as members: they can build, propose and deploy to sandboxes, while production stays behind your admins' approval. ### How are roles assigned? Roles are chosen when someone is invited, and the first person in a new workspace is an admin.