PII Masking for Salesforce AI: Keep Personal Data Out of Prompts

The first question a data protection officer asks about AI in Salesforce is simple: does personal data leave the CRM? Sales data is full of it: email addresses, phone numbers, postal addresses, sometimes tax or national IDs.

PII masking is the answer AI Engine gives. Before a request leaves Salesforce, personal values are replaced with placeholders such as EMAIL_1 or PHONE_2. The AI can still reason about the record, and AI Engine puts the real values back into the answer before the user sees it.

This article explains what gets masked, how it works, and, just as important, what masking does not cover.

Masking is on by default

Masking is controlled by a single Allow PII toggle in the AI Engine Org Profile. It is off by default, which means masking is on. An admin has to switch it on deliberately to send personal values to the AI provider.

Three layers of masking

Masking applies to the chat, record actions, meeting prep, AI scoring, prompt templates and their data sources.

Why placeholders instead of deleting data

Removing personal fields would break many useful questions. Placeholders keep the structure:

• The same value always gets the same placeholder within one request. The AI can still count, group and compare, for example "three contacts share EMAIL_2".
• The mapping exists only in memory, for the single request being processed. It is not saved anywhere and is discarded when the request ends.
• Real values come back in the answer. Tables and cards are built from Salesforce directly, so users see real data.

Masking is not encryption. Its job is to keep identifiable values out of the request that goes to the AI provider.

What masking does not cover

A privacy control is only trustworthy if its limits are stated plainly. Masking does not catch everything:

• Names, job titles and company names are sent as they are. They are needed for the AI to write useful answers and emails.
• Phone numbers typed into free text, such as a description or a note, are not detected by pattern. Phone numbers in Phone-type fields are masked.
• Personal data in plain text fields, such as a national ID stored in a text field or separate street and city fields, is masked only if an admin marks the field as PII.
• Photos cannot be masked. A business card photo shows a name, phone number and address as an image. The note typed alongside it is still checked for patterns.
• Web search needs real names. Instead of placeholders, AI Engine limits which facts are sent to web search. A company check sends the company name, website and location; a person's name, title, email and phone are only included when Allow PII is on.

The practical consequence: choose carefully which objects and fields the AI can use at all. An admin allowlist decides that, and it is the first line of defence.

Masking is one layer of several

PII masking works together with the other controls in AI Engine:

• Admin allowlist. The AI can only use objects and fields an admin enabled.
• User permissions. Queries run with the user's sharing rules, object permissions and field-level security.
• Your own provider account. Requests go to your own OpenAI, Anthropic or Azure OpenAI account through a Salesforce Named Credential. Cloud Connected does not receive your data.
• No stored conversations. AI Engine does not store the full text of prompts and answers. The activity log keeps usage metadata, plus a short error message when a call fails.

For teams that need AI processing in a specific region, Azure OpenAI keeps requests in your own Azure resource. See Azure OpenAI in Salesforce.

Setting it up

1. In the AI Engine admin panel, open Agent Objects and select the fields the AI may use.
2. For each selected field that holds personal data and is not an Email, Phone or Address field, click Mask as PII.
3. In the Org Profile, list any further personal-data fields under Custom PII fields.
4. Check that Allow PII is off, then save.

Email, Phone and Address fields do not need to be marked; they are masked by type.

Summary

• Personal values are replaced with placeholders before a request leaves Salesforce and restored in the answer.
• Email, Phone and Address fields are masked automatically; admins mark other fields; patterns such as IBANs and card numbers are caught in free text.
• Masking is on by default.
• It has clear limits: names, free-text phone numbers, unmarked text fields and photos. Combine it with a tight field allowlist.

This is not legal advice; check the setup against your own data protection policy. Want to review it with your DPO? We are happy to walk through the data flow on a call.