# Can you license your company's Salesforce data to AI companies?

URL: https://sellmydatatoai.net/data-rights/salesforce
Reviewed: 2026-11-08
Covers: Salesforce Sales Cloud, Service Cloud and other Salesforce orgs

Section 6.3 of the Salesforce Main Services Agreement says "SFDC acquires no right, title or interest from Customer" in Customer Data beyond what it needs to run the service. We found no clause in the agreement or Salesforce's AI Acceptable Use Policy that restricts licensing exported CRM data for AI training. Privacy law and customer contracts are the real limits. Confirm your position with your own counsel.

## Salesforce data rights at a glance

| Data available | Export method | Plan needed | AI-training restriction in the terms |
| --- | --- | --- | --- |
| Standard and custom object records | Data Export Service, CSV files in zip archives | Weekly: Enterprise, Performance, Unlimited. Monthly: all except Database.com | No: no AI clause found. MSA §6.3: "SFDC acquires no right, title or interest from Customer" |
| Files, attachments and documents | Data Export Service with file options selected | Same as records | No: no AI clause found in the MSA |
| Chatter posts and comments | Data Export Service, up to 1,000 characters per item | Same as records | No: no AI clause found in the MSA |

## Who owns your Salesforce data under Salesforce's terms?

Your company owns its Salesforce data. Section 6.3 of the [Salesforce Main Services Agreement](https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/salesforce_MSA.pdf) (September 15, 2025 version) says "SFDC acquires no right, title or interest from Customer" in Customer Data, apart from the limited license it needs to host and run the services.

Section 1 defines Customer Data as "electronic data and information submitted by or for Customer to the Services." Section 3.4 restricts what you do with the service itself, for example you may not access it to "build a competitive product or service," but it does not restrict reuse of your records.

Section 2.2 gives you a retrieval window: Salesforce will make data available on a request made "within 30 days after the effective date of termination," after which it may delete it. Our guide on [whether you can legally sell company data](https://sellmydatatoai.net/guides/can-you-legally-sell-company-data-for-ai) covers the rights questions ownership does not answer.

## What can you export from Salesforce, and on which edition?

The Data Export Service is the built-in Salesforce route. Salesforce's [Data Export Service help article](https://help.salesforce.com/s/articleView?id=sf.admin_exportdata.htm&type=5) says:

- Weekly exports are available in Enterprise, Performance and Unlimited Editions. Monthly exports are available in every edition except Database.com
- You can run an export once every 7 days (weekly) or every 29 days (monthly)
- Data arrives as CSV files in zip archives of about 512 MB each, with optional images, documents, attachments and Salesforce Files
- Formula and roll-up summary fields are always excluded, and Chatter posts export up to 1,000 characters
- Zip files are deleted 48 hours after the notification email, not counting weekends

## Do Salesforce's terms restrict AI training on CRM data?

Salesforce's terms, as we read them, do not restrict AI training on your exported data. Section 3.3(d) of the MSA requires you to follow the [Artificial Intelligence Acceptable Use Policy](https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Agreements/policies/ai-acceptable-use-policy.pdf), which in its August 5, 2025 version lists prohibited uses of Salesforce's AI services, such as automated decisions with legal effects, social scoring and weapons development. It does not prohibit training a model on your own exported data.

The [Acceptable Use and External-Facing Services Policy](https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Agreements/policies/ExternalFacing_Services_Policy.pdf) (July 8, 2025) restricts web scraping of third-party properties and mining for email addresses, not reuse of your CRM records. We found no AI-training clause in the MSA itself.

That is not clearance for your case. Many Salesforce customers sign negotiated order forms, and CRM records describe your customers and their staff, so privacy law and customer contracts usually decide the answer.

## Which Salesforce edition and admin rights do you need?

Running the Data Export Service needs the Weekly Data Export permission, which only the System Administrator profile has by default.

- An active user account, since inactive users cannot run exports
- Enterprise, Performance or Unlimited Edition for weekly exports. Professional and Developer Editions are limited to monthly
- Someone ready to download within 48 hours of the notification email

## What personal data is in a Salesforce export?

CRM data is business-contact data about identifiable people: names, job titles, work emails, phone numbers, call notes, email logs and deal histories. Service Cloud cases add customer complaints in the customer's own words.

### The US position

In the US, start with California. The CCPA defines a sale as making personal information available "for monetary or other valuable consideration" (Cal. Civ. Code § 1798.140(ad)(1)), and a license fee from an AI buyer fits that wording on its face. Employee and business-contact data have been in scope since January 1, 2023, when the temporary exemptions expired.

Data counts as deidentified under § 1798.140(m) only if you take reasonable measures so it "cannot be associated" with a person, publicly commit to keep it that way and contractually bind every recipient. Our [de-identification guide](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data) explains how to meet that standard, and our [guide to the CCPA and state privacy laws](https://sellmydatatoai.net/guides/gdpr-and-selling-data-for-ai-training) covers the other states.

Other comprehensive state privacy laws, including those in Virginia, Colorado and Texas, define sales and exemptions in their own words, and several treat employee data differently from California. Map where the people in your export live before you rely on any one state's rules.

If the export could hold health information from a HIPAA covered entity or business associate, HHS recognizes two de-identification methods under 45 CFR 164.514(b): Expert Determination, and Safe Harbor, which removes 18 types of identifiers. Financial institutions under the Gramm-Leach-Bliley Act must explain customers' right to opt out of certain sharing with nonaffiliated third parties, according to the FTC.

Your own privacy promises still bind you. FTC staff wrote on February 13, 2024 that adopting more permissive data uses, such as AI training, through a "surreptitious, retroactive amendment" to terms or a privacy policy could be unfair or deceptive. Check the privacy notice, employee handbook and customer contracts in force when the data was collected.

### If you hold UK or EU data

UK GDPR and EU GDPR treat names, email addresses and message content about identifiable people as personal data. Licensing it for AI training is a new purpose, so you need a lawful basis under Article 6 and a compatibility assessment under Article 6(4), which the ICO covers in its guidance on compatibility and the reuse of personal information. This page is general information, so confirm your position with your own counsel.

## What third-party content is in a Salesforce export?

A Salesforce org holds records about other companies and their staff, and often data you bought from list vendors or enrichment services. Those vendor contracts may bar relicensing, so tag vendor-sourced fields and check each contract.

Contracts with your own customers may also restrict use of their information. Buyers of [CRM and sales data](https://sellmydatatoai.net/buy-ai-training-data/crm-and-sales-data) will ask how you cleared both.

## How do you prepare a licensable Salesforce export?

Preparing a Salesforce export for a buyer starts with the extraction route and ends with a manifest. Work through these steps in order.

1. **Schedule the export**: Confirm your edition supports weekly export, include files and attachments, and assign someone to download within 48 hours.
2. **Separate enrichment data**: Tag fields and records that came from data vendors and exclude them unless the vendor contract allows relicensing.
3. **Check order forms**: Read your order form and any negotiated terms for restrictions the standard MSA does not show.
4. **Remove third-party content**: Take out vendor-sourced records and data about customers whose contracts restrict reuse unless the other party has agreed in writing, and keep privileged legal material out entirely.
5. **De-identify and test**: Replace names, user IDs and email addresses across the Salesforce export, then run a re-identification test on a random sample, as our [de-identification guide](https://sellmydatatoai.net/guides/de-identification-for-ai-training-data) describes.
6. **Write the manifest**: Record record counts, date ranges, systems, exclusions and the export method in a [data manifest](https://sellmydatatoai.net/guides/how-to-build-a-data-manifest) that matches what you deliver.
7. **Get counsel's sign-off**: Ask your own counsel to review the Salesforce terms, your order form and your privacy notices together before any buyer sees a sample.

If you want a view on whether your Salesforce data is licensable and what buyers might pay, start with a [data valuation](https://sellmydatatoai.net/data-valuation). We are a broker, not a law firm, so take independent legal advice before you sign any license.

## Frequently asked questions

### Does Salesforce restrict training AI on exported CRM data?

We found no such clause. The Salesforce Main Services Agreement (September 15, 2025) and the Artificial Intelligence Acceptable Use Policy (August 5, 2025) restrict how you use Salesforce's services and AI features, not what you do with your own exported records. Many customers sign negotiated order forms, though, and CRM records describe identifiable people. Ask your own counsel to review your contract and privacy notices before you license.

### Which Salesforce editions get weekly data exports?

Salesforce's help center says weekly exports are available in Enterprise, Performance and Unlimited Editions, and monthly exports in every edition except Database.com. Professional and Developer Editions are limited to one export every 29 days. The user needs the Weekly Data Export permission, which only the System Administrator profile has by default, and the zip files are deleted 48 hours after the email.

### Is B2B contact data in a Salesforce export covered by the CCPA?

Yes, for California residents. The CCPA's temporary exemptions for employee and business-to-business data expired on January 1, 2023, so work contacts in your CRM count as personal information. The CCPA defines a sale as sharing personal information for monetary or other valuable consideration, which a license fee can meet. Other state privacy laws treat business contacts differently, so check each state with your own counsel.

### How long can I get my data after leaving Salesforce?

Section 2.2 of the Salesforce Main Services Agreement says Salesforce will make Customer Data available on a request made within 30 days after the effective date of termination. After that window Salesforce has no obligation to keep it and will delete it unless the law prevents that. Run a full Data Export Service export before your contract ends.

## Sources

- [Main Services Agreement](https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/salesforce_MSA.pdf), Salesforce, accessed November 2026
- [Artificial Intelligence Acceptable Use Policy](https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Agreements/policies/ai-acceptable-use-policy.pdf), Salesforce, accessed November 2026
- [Acceptable Use and External-Facing Services Policy](https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Agreements/policies/ExternalFacing_Services_Policy.pdf), Salesforce, accessed November 2026
- [Export Backup Data from Salesforce](https://help.salesforce.com/s/articleView?id=sf.admin_exportdata.htm&type=5), Salesforce Help, accessed November 2026
- [California Consumer Privacy Act of 2018, Civil Code section 1798.140](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf), California Privacy Protection Agency, accessed November 2026
- [California Consumer Privacy Act employee and B2B exemptions expire January 1, 2023](https://www.morganlewis.com/pubs/2022/10/california-consumer-privacy-act-employee-and-b2b-exemptions-expire-january-1-2023), Morgan Lewis, accessed November 2026
- [AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive), Federal Trade Commission, accessed November 2026
- [Guidance Regarding Methods for De-identification of Protected Health Information](https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html), U.S. Department of Health and Human Services, accessed November 2026
- [Gramm-Leach-Bliley Act](https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act), Federal Trade Commission, accessed November 2026
- [Compatibility and the reuse of personal information](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/compatibility-and-the-reuse-of-personal-information/), Information Commissioner's Office, accessed November 2026
- [Regulation (EU) 2016/679 (General Data Protection Regulation)](https://eur-lex.europa.eu/eli/reg/2016/679/oj), EUR-Lex, accessed November 2026

---

Get a data valuation: https://sellmydatatoai.net/data-valuation