Salesforce, Inc.

United States · owned by Independent (United States) · www.salesforce.com · 37 vendors

Salesforce is a global leader in customer relationship management (CRM) technology. It provides cloud-based applications for sales, service, marketing, and more, helping companies connect with their customers in a new way.

Resilience scores

Disruption prediction

Salesforce, Inc. has a 100% probability of disruption in the next 6 months.

22 of Salesforce, Inc.'s 37 vendors monitored for disruptions.

Technology vendors

Services catalogue

25 services in catalogue across 4 categories; runs on 37 sub-vendors.

Insights

Last updated 2026-09-13 · revision 7

37 direct vendors, 391 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Salesforce exhibits exceptionally high migration readiness, primarily due to its highly modern, cloud-native, and multi-cloud oriented tech stack. The company actively utilizes public cloud platforms (AWS, GCP, Azure) through its Hyperforce initiative, demonstrating a strategic commitment to cloud infrastructure. Its internal stack leverages containerization (Kubernetes, Docker), microservices architectures (gRPC, GraphQL, REST APIs), and advanced data streaming technologies (Apache Kafka, Spark, Flink), which are all hallmarks of highly portable and migratable systems. Furthermore, Salesforce's comprehensive data residency solutions, including Hyperforce EU Operating Zone, participation in data privacy frameworks (EU-U.S. DPF), and a global network of 90+ offices for data localization, significantly mitigate data residency challenges often associated with large-scale migrations. The company's robust regulatory compliance posture, with established adherence to GDPR, HIPAA, SOC2, and ISO 27001, ensures that legal and compliance requirements are well-managed during any migration process, reducing potential roadblocks. While the 'Total Vendors: 0' data point is ambiguous, the reported vendor geographic diversity across 6 countries suggests a distributed vendor base, which generally reduces vendor lock-in risks and enhances migration flexibility. However, the 'Vendor Lock-in Risk: Unknown' prevents a definitive assessment. The absence of financial stability data (revenue concentration, growth history) means the ability to fund a large-scale migration cannot be fully assessed, though as a major technology company, it's likely well-resourced.

Compliance

14 in-scope frameworks identified; showing 3.

NIS2 (source) — Assessment Required

NIS2 Directive (EU) 2022/2555 applies to 'Important Entities' in the category of 'Digital Providers' — specifically cloud computing service providers, online marketplaces, and online search engines — operating in the EU. Salesforce is unambiguously a cloud computing service provider with significant EU operations, EU-established legal entities (Salesforce.com EMEA Ltd and EU subsidiaries), and EU revenue far exceeding the €10M threshold. Risk is Medium because: (1) NIS2 is relatively new (transposition deadline October 2024) and enforcement is still maturing across EU member states; (2) Salesforce's existing ISO 27001, SOC 2, and GDPR compliance programs provide a strong foundation; (3) however, NIS2-specific registration, incident reporting (24-hour early warning, 72-hour notification), and supply chain security requirements may require additional compliance work; (4) penalties can reach €7M or 1.4% of global annual turnover for Important Entities.

Evidence: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022L2555, https://trust.salesforce.com/en/compliance/, https://www.salesforce.com/eu/, https://www.salesforce.com/company/legal/

PCI DSS (source) — Compliant

Risk is Low because: (1) Salesforce Commerce Cloud and other payment-processing-adjacent services maintain PCI DSS compliance; (2) Salesforce is certified as a PCI DSS Level 1 Service Provider — the highest level of PCI compliance; (3) annual QSA (Qualified Security Assessor) audits are conducted; (4) Salesforce's Attestation of Compliance (AoC) is available to customers; (5) PCI DSS compliance is critical for Salesforce's e-commerce and financial services customers.

Evidence: https://trust.salesforce.com/en/compliance/, https://www.salesforce.com/commerce/, https://www.salesforce.com/company/legal/compliance/

FedRAMP — Compliant

Risk is Low because: (1) Salesforce Government Cloud and Government Cloud Plus have achieved FedRAMP authorization, enabling Salesforce to serve US federal government customers; (2) FedRAMP authorization requires rigorous third-party assessment by a 3PAO (Third Party Assessment Organization); (3) continuous monitoring requirements are met; (4) FedRAMP authorization is publicly listed on the FedRAMP Marketplace; (5) this demonstrates Salesforce's ability to meet the highest US government security standards.

Evidence: https://marketplace.fedramp.gov/products/SF-1116-816621, https://www.salesforce.com/solutions/government/fedramp/, https://trust.salesforce.com/en/compliance/

Financials

Three-year financials

Financial Resilience Score: 8/10

Salesforce demonstrates strong financial resilience anchored by its position as the #1 CRM software vendor globally for 10+ consecutive years and a highly predictable subscription-based revenue model where approximately 93%+ of revenue is recurring subscription and support. The company generates substantial cash flow, with operating cash flow exceeding $10B in both FY24 and FY25 and free cash flow margins in the high-20s to 30% range. Its balance sheet is robust with an investment-grade credit rating, roughly $14B in cash/equivalents/investments, and manageable long-term debt of $8-9B. Under activist investor pressure (Elliott, Starboard, ValueAct, Inclusive Capital, Third Point), Salesforce dramatically expanded margins, with GAAP operating income growing roughly 7x from FY23 to FY25 and non-GAAP operating margins reaching ~33%. The company initiated its first-ever dividend in FY2025 and has executed over $20B in cumulative buyback authorizations, signaling capital-allocation maturity. However, revenue growth has decelerated from historical 20%+ rates to high single digits, and the company faces intensifying competition from Microsoft Dynamics 365 + Copilot, HubSpot, and ServiceNow. Large goodwill (>$48B) from prior acquisitions creates impairment risk, and stock-based compensation historically running ~10%+ of revenue remains a real economic cost.

Key strengths: #1 global CRM market share for 10+ consecutive years, 93%+ recurring subscription revenue with high renewal rates, Operating cash flow >$10B annually in FY24 and FY25, Investment-grade credit rating with ~$14B in cash/investments, GAAP operating income grew ~7x from FY23 to FY25, Non-GAAP operating margin expanded to ~33%, Initiated first-ever dividend in FY2025 and $20B+ in buybacks, Deep ecosystem lock-in via AppExchange, Trailhead (19M+ learners), AI positioning through Agentforce and Data Cloud (fastest-growing segment), No single customer represents >10% of revenue

Risk factors: Revenue growth decelerated from 20%+ historically to 9% in FY25, Intensifying competition from Microsoft, HubSpot, and ServiceNow, Large goodwill (>$48B) creating impairment risk, Stock-based compensation historically ~10%+ of revenue, Enterprise IT spend sensitivity to customer layoffs and macro conditions, FX exposure with 30%+ of revenue international, Regulatory/data privacy compliance costs (GDPR, AI regulation), Uncertainty around AI monetization (Agentforce, Data Cloud) reaccelerating growth, Past M&A integration questions, particularly Slack

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report