Salesforce Data Detect Reaches General Availability on Data 360

Executive Summary

• Salesforce announced that Shield: Data Detect for Data 360 is now generally available, giving organisations unified visibility into sensitive data held across the platform, according to Salesforce Blog.
• The tool applies 21 predefined sensitive data categories and supports up to 10 custom patterns, scanning up to 100 Data Lake Objects per run across standard text fields, Salesforce Blog states.
• Salesforce positions discovery as a pre-agent step, allowing teams to identify sensitive records before they reach generative AI models, the company says.
• Scan results can inform data masking, active monitoring, audit records and compliance evidence for GDPR, CCPA and other standards, per the announcement.

Key Takeaways

• Salesforce has moved Shield: Data Detect for Data 360 into general availability, shifting sensitive data discovery from a manual exercise to a native capability inside the platform.
• Detection is scoped to standard text fields and point-in-time snapshots, with a defined ceiling of 100 Data Lake Objects per run rather than unlimited scanning.
• Salesforce frames discovery as a prerequisite for AI agent deployments, arguing that unmanaged exposure creates compliance risk before data reaches generative models.
• Scanning consumes credits tracked in the Digital Wallet, making discovery a metered operational cost rather than a flat platform feature.

Salesforce Expands Data Detect to General Availability on Data 360

Salesforce's Shield: Data Detect for Data 360 is now generally available, the company said in its announcement. The product gives organisations a single control plane for tracking sensitive data, so governance teams can move between their core Salesforce environment and Data 360 without switching tooling. The stated purpose is straightforward: enterprises have been moving data onto Data 360 to meet data protection and privacy regulations, and that migration expands the surface area they must monitor.

The company's argument is that the blocker is not the presence of sensitive data but the ability to locate and govern it quickly enough. For buyers evaluating Data 360 as a system of record for regulated workloads, native discovery removes a common objection: that visibility tools sit outside the platform and lag behind ingestion.

Salesforce Targets Pre-Agent Discovery to Reduce AI Compliance Risk

Salesforce places discovery before agent deployment in the data lifecycle. The company describes sensitive data discovery on Data 360 as a critical pre-agent step that identifies sensitive records before they reach generative AI models, which it says helps avoid expensive compliance issues and builds AI initiatives on trusted data.

That framing matters commercially. Organisations rolling out agents face a governance question their AI vendors generally do not answer: what exactly can the agent retrieve. Salesforce is not claiming detection prevents exposure on its own. It is claiming visibility is the precondition for controls, and that unmanaged exposure puts AI programmes at risk. The claim that discovery reduces compliance cost is Salesforce's stated intended benefit, not a measured outcome.

Salesforce Details Detection Scope and Architectural Design

The published specifications are narrow enough to plan against. Detection uses 21 predefined sensitive data categories plus up to 10 custom patterns — covering classification needs beyond basic PII scanning — and scans up to 100 Data Lake Objects per run across standard text fields using point-in-time snapshots.

Three architectural choices shape how teams will run it. Scans execute in an isolated, tenant-specific clean room environment, which Salesforce says supports strict regulatory requirements including HIPAA and FINRA because sensitive scans never cross tenant boundaries. Scans also run fully asynchronously and scale dynamically, so they do not block workflows. Results export via SOQL or as a .csv file of up to 10 million results per job session.

Related: Health In Tech Signals InsurTech Evolution at Davos Summit

The interim constraint is coverage: standard text fields and a per-run object limit mean large or unusually structured estates may need multiple runs, and the source does not state how non-standard fields are handled.

Salesforce Ties Scan Results to Masking, Monitoring and Audit Records

Salesforce positions scan output as input to downstream controls rather than as a standalone report. Findings feed classification decisions that guide data masking and active monitoring, and repeat scans build an auditable record of where sensitive data resides — evidence Salesforce says provides proof of compliance with GDPR, CCPA and other key standards.

A results dashboard shows aggregate data, status indicators for every scanned Data Lake Object, and supports direct queries. For security and compliance teams, the practical value is defensibility: a recurring, timestamped record of discovery activity is easier to present to auditors than ad hoc scans run in separate tools.

For deeper context, see our Fintech analysis: "USTR Extends China Tariff Exclusions as Stripe and Adyen Adjust Costs".

Salesforce Adds Credit-Based Cost Tracking to Sensitive Data Scanning

Salesforce says Shield: Data Detect scans in Data 360 consume credits that customers can monitor in the Digital Wallet. That makes discovery a measurable line item rather than an unlimited platform capability, and it gives finance and platform owners a usage signal tied directly to scan frequency.

The source does not disclose credit rates, so total cost of ownership cannot be calculated from the announcement. The operational implication is that scan cadence — how often teams re-run detection to keep audit records current — now carries a direct, monitorable cost alongside its governance benefit.

Salesforce Signal Map

Geography is not addressed in the supplied source, so no country or regional detail is assigned to any row.

Additional coverage: OpenAI & Anthropic Signal Tensions at India AI Summit 2026

What This Means for Practitioners

For security, data governance and platform teams already running or evaluating Data 360, discovery becomes a native step inside the same control plane rather than a separate tooling purchase, which simplifies enforcement and audit trails. The trade-off is scope discipline: 100 Data Lake Objects per run, standard text fields and point-in-time snapshots mean teams should map their estate before assuming one scan covers everything. Because scans draw on credits visible in the Digital Wallet, cadence decisions now have a measurable cost. The practical sequence is to inventory sensitive data first, then certify records for agent consumption.

Salesforce Implementation Risks

Three risks follow directly from the announcement. First, coverage limits: scanning is confined to standard text fields and up to 100 Data Lake Objects per run, and the source does not describe how non-standard or nested fields are handled, so unverified areas may remain invisible. Second, cost opacity: Salesforce confirms scans consume credits monitorable in the Digital Wallet but publishes no rate, leaving teams unable to forecast spend from the source alone. Third, the compliance claim is directional. Salesforce states that scan results support audit readiness and that clean-room isolation meets strict requirements such as HIPAA and FINRA, but the announcement provides no certification or third-party validation. Practitioners should treat these as vendor-stated capabilities to verify in their own regulatory context.

Editorial independence disclosure: This article is based solely on the supplied source material and was written without input from or approval by the company discussed. Source note: Salesforce Blog, Shield: Data Detect for Data 360 announcement.