Organisations that use Salesforce may be exposed to material investigative and compliance risk because the platform’s standard configuration prioritises day-to-day operation over long-term data preservation, a specialist consulting note has warned.
Operational defaults can leave gaps when it matters
FTI Consulting highlights that several of Salesforce’s out‑of‑the‑box behaviours can mean key information does not exist when an investigation or regulatory inquiry begins. Two practical examples underline the point: login history is retained for only six months in a standard installation, and change-tracking without additional configuration is limited to 20 fields per object at no extra cost.
| Setting | Default/limit |
|---|---|
| Login tracking retention | Six months |
| Field change tracking at no extra cost | 20 fields per object |
Those constraints matter because records can be deleted, retention windows can lapse and activity that was never recorded cannot later be reconstructed. By the time a firm realises it needs a forensic record, the opportunity to preserve or recover evidence may already have closed.
What leaders should be asking
FTI recommends senior executives, in-house lawyers and compliance teams interrogate how their Salesforce estate is configured before an incident arises. Two of the specific questions it highlights are:
- Can we identify who has been logging into our Salesforce instance, from where, and by what means, and how far back that history goes?
- Do we know what critical data has changed, who changed it, and when?
These are practical, forensic questions. They are not academic: failing to answer them can hamper an organisation’s ability to explain past activity to regulators or in court, or to carry out credible internal investigations. That increases the likelihood of prolonged enquiries, legal fees and disruption to business operations.
Why this matters for jobs, wages and corporate costs
Missing or incomplete records are not merely an IT headache. They can affect the bottom line and, in time, employment. If firms face extended regulatory probes or litigation because they cannot produce required evidence, management attention is diverted, legal spending rises and strategic projects may be paused. That combination can depress profitability and constrain hiring or wage growth. Smaller organisations with limited compliance resource are particularly exposed.
Equally, overly permissive administrative access is a concern. Administrators and superusers frequently command wide-reaching privileges; without appropriate monitoring, those accounts can create blind spots. The inability to answer even basic questions such as who accessed what, when and why can leave executives unable to limit reputational or regulatory damage effectively.
Practical steps firms can take
FTI’s note underlines that the default settings are not immutable. Organisations must make deliberate choices about retention, tracking and monitoring if they want to be investigation-ready. Practical responses include extending retention windows, enabling or purchasing additional audit features, and implementing targeted monitoring of privileged accounts.
For many businesses, those actions will mean additional cost — either in platform licensing, third-party tooling or internal resource. But those investments are a trade-off: the expense of better record-keeping should be weighed against the potential cost of protracted legal disputes, regulatory fines and the operational disruption of drawn-out inquiries.
In short, companies that treat Salesforce as solely an operational tool risk finding themselves short of evidence when it matters most. Firms that adopt a more forensic mindset now are likely to face fewer surprises later.
