Trust Boundary for AI on Salesforce Data: Two Paths

A blanket security promise tells a reviewer nothing. A trust boundary is described per data path, and Funnel Economics has two. Funnel Economics Core calculates in your Salesforce org. Funnel Economics Strategist is an optional add-on: the prepared context passes through a service we operate to your chosen language model. Whoever approves assesses each path on its own: which data, processed where, under whose agreement, with which control.

A trust boundary applies per data path, not per product

In this whitepaper, a trust boundary is the point at which data leave an area that you control yourself. Beyond that point, someone else processes the data: on other infrastructure, under another agreement, with other controls. A trust boundary is therefore not a property of a product. It sits on a data path.

For Salesforce data, the starting point is your Salesforce org. Your roles, your permissions and your terms with Salesforce apply there. As soon as an AI assistant works with these data, one question arises: does the data flow leave the org, and if so, where?

The question rarely has just one answer. A product can have several components, and each component can have a data path of its own. A sentence such as “your data are safe” merges these paths and makes them impossible to check. A reviewer can check a path: its start, its stations, its end. A promise can only be believed.

Funnel Economics has two components, and their data paths are not the same. Funnel Economics Core is the foundation; there is no Funnel Economics without Core. Funnel Economics Strategist is an optional add-on and not active by default.

This whitepaper describes the two paths separately. It also states what is not yet in force and what we decided against. The whitepaper does not replace an AI governance framework. It supplies the things such a framework, and an AI data security review, ask a vendor for: data path, agreement and control.

A trust boundary sits on a data path, not on a product. Two components with two paths need two assessments.

Four questions before any approval

Before an AI assistant is approved for Salesforce data, four questions apply per data path: which data, processed where, under whose agreement, with which control. The order is deliberate. Each question builds on the answer to the one before.

1. Which data go on the path? This means the content: metrics, names of people, names of opportunities, links to records. Only this answer shows whether personal data are involved.

2. Where are the data processed? This means the stations: your org, a vendor's service, a language model. At every station outside your org, the trust boundary has been crossed.

3. Under whose agreement does each station work? A station without an agreement is an open position. It also matters who the contracting party is: you or the vendor of the product.

4. Which control governs the path, and what is its status? A control can be in force, built and not yet in force, or deliberately absent.

The fourth question has two parts, and the second is easily lost. “Is there a switch?” is a different question from “Which component honours that switch today?”. The following chapters answer the four questions for each of the two paths.

Path 1: Funnel Economics Core in your Salesforce org

Funnel Economics Core calculates in your Salesforce org. For dashboard commentary, Core can call a language model. This AI data transfer is off by default and is enabled per org and per user; the package masks personal values before the call.

Funnel Economics Core is a managed package that runs in your Salesforce org. The prerequisite is Salesforce Enterprise Edition; Data Cloud is not required.

Which data go where?

The calculation takes place in your org. The point at which this path leaves the org is the call to a language model for dashboard commentary. As long as the AI data transfer is off, this call does not take place.

Before the call, the package replaces personal values with placeholders and restores them inside your org. With Agentforce, the Einstein Trust Layer applies on top.

Under whose agreement does the language model work?

Core's callouts for dashboard commentary can be run through native Agentforce. On this path, your terms with Salesforce for Agentforce govern the language model.

Which control governs the call?

Two package controls govern the call: the org-level opt-in and the per-user permission. Your administrator grants the permission through a permission set of the package; it enables Core's AI data transfer for individual users. Both are in force for Core. If your administrator switches the org's AI data transfer off, Core's calls stop.

What does Core write in Salesforce?

Core writes only its own package objects, never standard objects such as Opportunities.

The calculation logic is compiled code in the package's protected namespace. Neither your users nor your administrators can inspect or modify it.

Path 2: Funnel Economics Strategist through our service to the language model

Funnel Economics Strategist is an optional add-on. The prepared context passes through a service we operate to the language model you have chosen, with rep names, opportunity names and record links. The service keeps no result store of its own.

Which data pass through which stations?

Strategist's path has two stations outside your org. The first is the service we operate: it reads from your org and prepares the context. The second is your chosen language model: it receives the context and writes the answer.

Strategist's Salesforce access is read-only.

The language model is yours to choose. The technical precondition is an environment that can attach an MCP server.

The Einstein Trust Layer applies to Core through Agentforce. It does not apply to Strategist. On Strategist's path there is no additional layer.

Under whose agreement do the two stations work?

Two stations need two contractual relationships. The leg through our service requires a data-processing agreement, which we are preparing. The language model processes the data under your own agreement with the provider. What follows from that is set out in the chapter on agreements.

Which control governs access?

Strategist requires a per-user authorisation that your Salesforce administrator controls and can revoke. The authorisation is a per-user OAuth authorisation for the External Client App in your Salesforce. It is not the same as the permission on path 1, which is granted through the package's permission set. Without that authorisation for their own user, nobody reaches the service.

Which controls are in force and which are not

A control has a status, and the status is part of the answer. At Funnel Economics there are three: in force, built and not yet in force, deliberately absent.

What is in force

For Core, the org-level opt-in and the per-user permission are in force, and the package masks personal values before the call.

For Strategist, the per-user authorisation that your Salesforce administrator controls and can revoke is in force. Your administrator also decides which profiles or permission sets may authorise at all. You make this assignment on the External Client App. It is not the permission that the package's permission set grants for Core.

What is built and not yet in force

The package's AI switch and permission set do not stop Strategist yet — the server-side check is built but not in force. A central switch-off in Funnel Economics does not exist yet.

The controls are the org-level opt-in and the per-user permission; the server-side check of that permission is built and becomes effective with the package endpoint it needs.

A permission nobody re-checks is a configuration, not a barrier. As long as the check is not in force, the protection of Strategist hangs on the clean assignment of the package's permission in your org. That comes on top of the per-user authorisation, which holds.

What is deliberately absent

Strategist does not mask or pseudonymise the names of sales staff and opportunities. This is a decision, not a gap. The next chapter gives the reason.

Only its status turns a control into an answer: in force, built and not yet in force, or deliberately absent.

Personal data: masked in Core, with names in Strategist

In Core, the package masks personal values before the call. In Strategist, the names of sales staff and opportunities reach the model by design, because evaluating results by person and by deal is the purpose. Strategist does not mask or pseudonymise them. This is a decision, not a gap.

Why the names go along in Strategist

Rep names, opportunity names and record links go along by design: an answer with placeholders would be useless. A manager cannot coach a pseudonym.

The difference from Core lies in the construction. In Core, the package restores the names inside your org before any text reaches the reader. In Strategist, the language model writes the answer directly. There is no point on Strategist's path at which a placeholder could be turned back into a name.

The protection therefore sits in the agreement with the language model provider, not in the transferred data.

One narrow exception

There is one narrow exception. A session recognised as a sales rep does not receive its colleagues' names from one tool. That is one of eleven tools that carry rep names — not a general property.

What this means for your approval

On Strategist's path, personal data of your sales staff are part of the context. Whoever approves Strategist approves that as well. The questions to ask of this path are therefore the agreement and the group of authorised users.

Agreements and responsibilities

Strategist's path needs two contractual relationships with two different counterparties: one with us, one with the language model provider. The leg through our service requires a data-processing agreement, which we are preparing. The language model processes the data under your own agreement with the provider.

What lies with us

The data-processing agreement for our leg is on our side. It is not a recommendation to you but an obligation we have to meet.

What lies with you

The agreement with the language model provider is your agreement. Funnel Economics is not a party to it.

There we strongly recommend an enterprise agreement with a data-processing agreement that excludes training use; a recommendation, not a precondition. Strategist runs without that agreement as well.

The training clause has a reason of its own. An enterprise tier alone settles the commercial terms. What happens to the content afterwards is settled only by excluding training use. The exclusion has to come from your agreement with your provider.

Also with you are the choice of language model, granting and revoking the per-user authorisation, and enabling Core's AI data transfer.

What no product can do on its own

Compliance with GDPR or CCPA is a property of your configuration, roles and agreements — not something a product can guarantee on its own.

Two stations, two contractual relationships: our leg requires a data-processing agreement. The language model works under your own agreement with the provider.

Where the product stands

Funnel Economics is entering its beta phase. During the beta, you start by running it against a Salesforce sandbox.

The AppExchange security review is planned after the beta phase.

These sentences describe a status. They change as soon as a milestone is reached. The same holds for the sentence on the data-processing agreement and for the sentences on the server-side check.

All data paths, the controls and their status are set out on the Security & Trust page. That page is authoritative for the current status. The short version for the approval is on the page AI Data Privacy: What Leaves Your Salesforce Org. For anything beyond them, ask us directly.

Trying Funnel Economics

Discover is meant for trying Funnel Economics before any installation. It is built on a demo org. Discover is not a trial of Strategist.

Method and data basis

This whitepaper describes data paths, controls and agreements. It measures nothing. The statements come from the architecture and security documentation of Funnel Economics, read on October 5, 2026.

One rule applies to the security statements: what the documentation does not carry as a statement, this whitepaper does not claim. The same applies to the statements on product status.

What the three statuses mean

• In force: the control takes effect today on the path named.
• Built and not yet in force: the control is developed and does not yet take effect on the path named.
• Deliberately absent: we decided against the control and state the reason.

What the example shows and what it does not

The numbers in the example are invented. They are counts of people and show who triggers what on which path and who revokes it. No reference value for the number of authorised users can be derived from the example.

Which metric is calculated on which path?

Funnel Economics Core calculates bEFV and a simplified rEFV in your Salesforce org. Funnel Economics Strategist calculates BPV and cEFV.

Which questions the metrics answer in day-to-day operations is described on the page Sales Pipeline Metrics for RevOps: One Number per Stage.

Scope

This whitepaper contains no measured values of any organisation and no external market figures. The glossary explains the metrics bEFV, rEFV, BPV and cEFV. This whitepaper states only which module calculates them.

This whitepaper is not an AI governance framework and not legal advice. It gives you the information your own review needs.

Assess each data path on its own: which data, processed where, under whose agreement, with which control and in which status.