Salesforce DSR integration

Missing an action you need, or an integration we don't support yet? Contact your Customer Success Manager.

This integration automates privacy requests for Salesforce. MineOS finds the records that match the requester's email address, then lets you preview, delete, anonymize or copy them.

To scan Salesforce for personal data, see Salesforce data classification integration.

How It Works

• Preview: before MineOS deletes or copies anything, you can preview the data it found for the requester.
• Delete: MineOS uses Salesforce's search endpoint to find every record that matches the requester's email address, and deletes those records and their associated records. User records are skipped and never deleted.
• Anonymize: MineOS finds the records that match the requester's email address and redacts the basic fields that contain personal data, such as Name, FirstName, LastName, FullName, Phone, PhoneNumber, MobilePhone, Email, EmailAddress, Street, City and Website.
• Custom Anonymization: you choose which fields to anonymize on Lead, Contact and Account records, including your own custom fields.
• Get a copy: MineOS sends the requester a copy of the User, Lead and Contact records found for their email address.

Choose the right integration type

Before You Start

MineOS needs API access to your Salesforce org to find and process the requester's records. You can grant it in one of two ways:

We recommend Option 1.

Option 1: Dedicated integration user (recommended)

You need to be a Salesforce admin to complete these steps.

1. Create the user. In Salesforce, go to Setup → Users → New User. Set User License to Salesforce Integration and Profile to Minimum Access - API Only Integrations. Use a name that's easy to recognize, such as MineOS Integration.
2. Assign the permission set license. On the user's record, assign the Salesforce API Integration permission set license.
3. Create a permission set and assign it to the user. Enable:
   • API Enabled
   • View and Edit Converted Leads
   • Read, Edit and Delete on Lead, Contact and Account, and Delete on any related objects whose records should be deleted with them
   • Field-level access on every field MineOS should read or anonymize, including custom fields
4. Create an External Client App. Go to Setup → External Client App Manager → New External Client App, and:
   • Enable OAuth and add the Manage user data via APIs (api) scope.
   • Enable the Client Credentials Flow.
   • On the Policies tab, set Run As to the integration user.
5. Copy the app's credentials. Keep the Consumer Key, Consumer Secret and your My Domain URL at hand. You'll enter them in MineOS during setup.

📘

Keep access to a minimum

Don't give the integration user the System Administrator profile or the Modify All Data permission. Granting only what MineOS needs limits what the credentials can do.

📘

Using a sandbox

External Client Apps aren't copied when a sandbox is created or refreshed. Create the app separately in each sandbox you connect.

Option 2: Connect with your own account

• The person who clicks Connect must have API access and permission to approve connected apps. If Salesforce blocks the connection, ask your Salesforce admin to give that user the Approve Uninstalled Connected Apps permission.
• For Custom Anonymization, the person who connects must be a Salesforce admin.
• MineOS requests these Salesforce permissions:
  • Access the identity URL service
  • Manage user data via APIs
  • Perform requests at any time
• If you grant access through a permission set, enable API Enabled and View and Edit Converted Leads in it.

Setting Up

If you're using a dedicated integration user (Option 1), enter the Consumer Key, Consumer Secret and My Domain URL from your External Client App when MineOS asks you to connect, instead of signing in with your own account.

Delete and Anonymize

1. Log in to MineOS. On the left sidebar, click Inventory → Data Sources. Click Add Data Source, search for Salesforce and click Add.

2. Open the Salesforce data source → Integrations tab → Request Handling section → select Integration, and choose an integration type.

3. If you're connecting a sandbox account, type TEST in the sandbox field. For a production account, leave it empty.

4. Click Connect and follow the on-screen instructions to grant MineOS the required permissions. A Success message appears once the connection is made.

5. Click Save.

You're done! MineOS has been connected to your Salesforce account.

Custom Anonymization

1. Log in to MineOS. On the left sidebar, click Inventory → Data Sources, and open the Salesforce data source.
2. Go to the Integrations tab → Request Handling section → select Integration.
3. Choose Custom Anonymization, or Custom Anonymization (Sandbox) to test with a sandbox account first, and click Set up integration.
4. Click Connect on the Salesforce connection and allow MineOS access. A confirmation page appears when the connection succeeds.
5. Click Next to open the Salesforce Fields page.
6. Configure the fields you want to anonymize for Lead, Contact and Account records, using each field's Salesforce API name (for example LinkedIn_URL__c).
7. Finish the setup.

When you configure the fields:

• Account email field: Account records have no native email field, so MineOS searches Accounts by a custom email field. Enter it in Account Email Search Field, for example Email__c.
• Don't add Email to the custom fields. Email is always anonymized automatically, as {timestamp in milliseconds}_{anonymized email}, for example [email protected].
• Masking value: we recommend anonymizing with a string of 14 asterisks (**************).

Using the Integration in Requests

To handle requests automatically, add the Salesforce integration to the workflows of the privacy rights it should handle, such as deletion or get a copy.

Need Help?

If you need any help with this integration, please contact your Customer Success Manager. They will be happy to assist you!