---
schema_version: "1"
id: 79edec8b4dfe283d2724833070add3ea9e196d204747accc1b5bc6cd84ba5a2f
title: Shared Responsibility Model
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_shared_responsibility_model.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_shared_responsibility_model.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 3df53ca5fe92d01f29f9becadd9b1984ec593c8b7db7714e9dab463af9c5f0c8
description: B2C Commerce sites and platforms are attractive cyber attack targets. Cyber attackers look for locations where they can try to exfiltrate sensitive data, such as credit cards, personally identifiable information (PII), and credentials. The ordering workflow also offers an attractive attack surface for cybercriminals to try to enrich themselves. They can create fake orders, adjust coupons and promotions, and deny service to legitimate customers.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Shared Responsibility Model

B2C Commerce sites and platforms are attractive cyber attack targets. Cyber attackers look for locations where they can try to exfiltrate sensitive data, such as credit cards, personally identifiable information (PII), and credentials. The ordering workflow also offers an attractive attack surface for cybercriminals to try to enrich themselves. They can create fake orders, adjust coupons and promotions, and deny service to legitimate customers.

Salesforce takes security seriously and provides multiple security controls and settings that mitigate these risks. B2C Commerce uses a shared responsibility model in which the B2C Commerce platform and the customer have clearly defined roles and responsibilities.

As our customers’ trusted adviser in data security, we use and make available the following tools and practices to help strengthen their security.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
      <colgroup>
        <col>
        <col>
      </colgroup>
      <thead class="slds-text-title_caps ">
        <tr class="">
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d217919e40">Salesforce</th>
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d217919e43">Customers</th>
        </tr>
      </thead>
      <tbody>
        <tr class="">
          <td data-label="Salesforce" class="slds-cell-wrap" style="vertical-align:top;" headers="d217919e40 ">
            <ul>
              <li> Promote the secure design and implementation
                of Salesforce infrastructure, platform, and
                applications. </li>

              <li> Manage outbound and inbound firewall rules. </li>

              <li> Enforce two-factor authentication (2FA) on
                sensitive Salesforce assets. </li>

              <li> Enforce data isolation per tenant. </li>

              <li> Run proactive code scans and pen tests. </li>

              <li> Perform third-party security assessments and
                audits. </li>

              <li> Enforce controls to comply with industry
                standards. </li>

              <li> Ensure continuous monitoring and incident
                responses on Salesforce assets. </li>

            </ul>
          </td>

          <td data-label="Customers" class="slds-cell-wrap" style="vertical-align:top;" headers="d217919e43 ">
            <ul>
              <li> Enforce secure communication protocols such
                as HTTPS and Secure File Transfer Protocol (SFTP). </li>

              <li> Restrict application-level access controls,
                for example, using IP allowlisting and identity
                validation. </li>

              <li> Enforce 2FA on sensitive customer-managed
                interfaces. </li>

              <li> Assign proper roles and permissions along
                with robust user provisioning processes. </li>

              <li> Consume and analyze audit logs in a timely
                manner. </li>

              <li> Promote the secure design and implementation
                of custom code. </li>

              <li> Promote the secure sourcing, deployment, and
                maintenance of third-party integrations and
                extensions. </li>

              <li> Comply with relevant security standards and
                regulations. </li>

              <li> Ensure continuous monitoring and incident
                response on customer and custom third-party
                integration assets. </li>

              <li> Deploy anti-abuse, fraud detection, and
                prevention measures. </li>

            </ul>
          </td>

        </tr>
      </tbody>
    </table>