Salesforce - Marketing Cloud

Marketing Cloud is a leading global provider of cross-channel digital marketing software-as-a-service solutions that empower organisations of all sizes to communicate with their customers through email, mobile, social, ads, and web experiences. ©SFDCGC102018


  • Email creation and deployment, Digital advertising, Landing page creation
  • Mobile SMS and push message creation and deployment
  • Social media listening, monitoring, engagement, publishing, and advertising.
  • No-code & Low-code declarative configuration, Open API integration, Training included.
  • Complex case-flow & Kanban, Citizen centric view, Chatbots, Engagement Timeline.
  • Analyze digital marketing through reporting and analytics
  • Automated marketing journeys and campaign management
  • Single subscriber view across multiple data sources and channels
  • Drag-and-drop audience segmentation tools
  • Social Collaboration, omni-channel engagement, Mobile ready, Knowledge base, Analytics, AI


  • Cross-channel campaign management with single subscriber view
  • Automation of marketing campaigns and real-time communications
  • Highly scalable and modular software-as-a-service architecture
  • Open and flexible cloud-based platform
  • Compliance with complex deliverability and regulatory standards
  • Deliver highly personalized, relevant messages across digital marketing channels
  • GDPR compliant
  • Visual planning, collaboration across teams, access via web or mobile,
  • True 1:1 customer journey management utilising multi channel communications
  • Email, Mobile, Social, Web and Advertising in a single platform


£720.10 per unit per year

Service documents

G-Cloud 10


Peter Corpe

07748 105 950

Service scope

Service scope
Software add-on or extension Yes, but can also be used as a standalone service
What software services is the service an extension to Salesforce services including Sales Cloud, Service Cloud, Commerce Cloud, IoT Cloud, Community Cloud, and App Cloud.
Salesforce Marketing Cloud can also be integrated with third-party CRM systems.
Cloud deployment model Public cloud
Service constraints Marketing Cloud is only available as a cloud / SaaS solution.
Marketing Cloud hardware is co-located in third-party operated hosting facilities.
The Marketing Cloud hosting facilities are in the United States.
There is currently no European Marketing Cloud Data Centre
System requirements
  • Marketing Cloud is a software-as-a-service application
  • On-demand and web-based using HTTP and HTTPS ports
  • Supports the latest versions of IE, Firefox, and Chrome browsers

User support

User support
Email or online ticketing support Email or online ticketing
Support response times Through online ticketing or by phone. Standard Success customers receive a response from Global Support within two business days.

Shorter response times are available up to two hours with paid support tiers.

Case escalation is executed based on the impact and urgency of the issue, and case progressions are based on the support entitlement level as well as the severity of the issue.
User can manage status and priority of support tickets Yes
Online ticketing support accessibility None or don’t know
Phone support Yes
Phone support availability 24 hours, 7 days a week
Web chat support No
Onsite support Yes, at extra cost
Support levels Every Salesforce service includes community-based support. This can be enhanced with guaranteed response times through Premier and Premier+. For more critical applications we provide Signature Success which provides Salesforce staff with a knowledge of a specific customers applications and configurations and an initial response from your designated support team in as little as 15 minutes, with personalised updates every 30 minutes.
Support available to third parties No

Onboarding and offboarding

Onboarding and offboarding
Getting started Marketing Cloud has training courses and online help sites.

Salesforce's Customers for Life is designed to help customers be successful and get up and running quickly. A dedicated group is available for new customers to engage by asking questions, giving feedback, and sharing experiences. There is also specific Training Material built on the needs of customers. See also:

Bespoke training courses are also available as required.
Service documentation Yes
Documentation formats HTML
End-of-contract data extraction During the contract term, customers may export a copy of any Customer Data that is made available for export through the Covered Services. Within 30 days of termination of the applicable Covered Service, customers may 1) request return of Customer Data submitted to Advertising Studio or Social Studio by contacting; 2) access their account to export or download Customer Data submitted to ExactTarget; or 3) contact their account manager to download or export reports generated by Predictive Intelligence and engage Salesforce professional services to recover any raw data processed by Predictive Intelligence that has not already been deleted.
End-of-contract process After termination of the Advertising Studio, Predictive Intelligence or Social Studio services, to request deletion of Customer Data submitted to such service, contact After termination of the ExactTarget service, following the 30-day period for return of Customer Data, Customer Data submitted to ExactTarget is retained in inactive status for up to 90 days, after which it is securely overwritten or deleted from ExactTarget. For Advertising Studio and ExactTarget, back-up data may be retained for an additional 6 months after deletion of Customer Data, after which it is securely overwritten or deleted. For Predictive Intelligence and Social Studio, back-up data will be deleted within
90 days of Customer Data being deleted.

Using the service

Using the service
Web browser interface Yes
Supported browsers
  • Internet Explorer 9
  • Internet Explorer 10
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
Application to install No
Designed for use on mobile devices Yes
Differences between the mobile and desktop service The Marketing Cloud mobile application provides more limited functionality than the desktop application.

The Marketing Cloud mobile application includes a calendar; the ability to send, pause, reschedule, and cancel emails; the ability to track and see performance metrics.
Accessibility standards None or don’t know
Description of accessibility Not applicable
Accessibility testing Not applicable
What users can and can't do using the API Approximately 95% of the functionality in the Marketing Cloud application is available via API.

For documentation of our APIs please see:
API documentation Yes
API documentation formats HTML
API sandbox or test environment Yes
Customisation available Yes
Description of customisation Clients and partners can build applications using a set of Developer Tools, including APIs, UX components and Marketing Cloud application integration tools


Independence of resources The current daily transaction average for our platform is regularly 6 billion, consistently at sub 250ms response time within the Salesforce environment. Within each logical system, we use load balancers to distribute load among multiple web and application servers for additional scalability and redundancy. The multitenant application design, combined with the fastest servers and high-performance networking infrastructure available, guarantees fast performance.


Service usage metrics Yes
Metrics types The standard infrastructure metrics provided at cover MC instance and API performance. Trust includes uptime and transaction volumes. At Premier+ and higher support levels, a custom report can be created.
Reporting types Real-time dashboards


Supplier type Not a reseller

Staff security

Staff security
Staff security clearance Other security clearance
Government security clearance Up to Developed Vetting (DV)

Asset protection

Asset protection
Knowledge of data storage and processing locations Yes
Data storage and processing locations EU-US Privacy Shield agreement locations
User control over data storage and processing locations Yes
Datacentre security standards Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency At least every 6 months
Penetration testing approach Another external penetration testing organisation
Protecting data at rest
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Scale, obfuscating techniques, or data storage sharding
Data sanitisation process Yes
Data sanitisation type Deleted data can’t be directly accessed
Equipment disposal approach Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data importing and exporting
Data export approach Data can be exported via scheduled or ad-hoc flat file transfer to FTPs or via ad-hoc or scheduled API call.
Data export formats
  • CSV
  • Other
Other data export formats
  • A file export wizard for a CSV or TXT file
  • An FTP export as either an automated or batch process
  • Via an Application Programming Interface or API call
Data import formats
  • CSV
  • Other
Other data import formats
  • A delimited file (.txt, comma or other delimiter).
  • SOAP-based API.

Data-in-transit protection

Data-in-transit protection
Data protection between buyer and supplier networks
  • TLS (version 1.2 or above)
  • Other
Other protection between networks By default, customers connect to the service over the public Internet with all transmissions between the user and the Salesforce Services secured using TLS 1.1 or higher and encrypted using 256 or 128-bit encryption. The Services use International/Global Step Up SSL certificates with 2048-bit Public Keys. Web Service callouts can be secured using TLS, as well as with two-way TLS,

In addition, customers can partner with a selection of supported ISPs for a more direct connection to the Salesforce service. In the UK, BT are one such ISP. This service is known as Salesforce Express Connect.
Data protection within supplier network IPsec or TLS VPN gateway

Availability and resilience

Availability and resilience
Guaranteed availability The Salesforce Services are designed with the concept of continuous improvement and Trust (e.g. Availability, Performance and Security) in the infrastructure. Salesforce uses commercially reasonable efforts to make its on-demand services available to its customers 24/7, except for (minimal) planned downtime, for which Salesforce gives customers prior notice, and force majeure events.
Excellent availability statistics (historically 99.9%) are critical to Salesforce's customers’ success and to the success of Salesforce as a company. Salesforce generally does not focus on a specific percentage, as we do not believe our job on availability will ever be “complete”. Live and historical statistics on Salesforce system performance are publicly published at:, and further detail can be shared upon request and NDA.
Approach to resilience To maximise availability, the service is delivered using a world-class data centre infrastructure consisting of a primary production data centre, a full capacity secondary data centre for hosting the service provided to customers.The infrastructure utilises carrier-class components designed to support millions of users. Extensive use of high availability servers and network technologies, and a carrier-neutral network strategy, help to minimise the risk of single points of failure, and provide a highly resilient environment with maximum uptime and performance.
Outage reporting Outage escalation policies are established and maintained as Salesforce's goal is to rapidly restore service. In the event of an extended outage, periodic updates are provided in near real time to customers via the dashboard site and in addition, service notifications are provided to nominated contacts via various channels such as email. Update frequency for notifications is dependent on the customer support service plan.

Identity and authentication

Identity and authentication
User authentication needed Yes
User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
Other user authentication Access to Marketing Cloud requires a valid user ID and password combination, which are encrypted via SSL while in transmission. Following a successful authentication, a random session ID is generated and stored in the user's browser to preserve and track session state.
Access restrictions in management interfaces and support channels Management access for service support and delivery is done through multiple layers of controls including, but not limited to, multiple 2-factor authentication, bastion host and proxy control and segregation of duties. These controls are in scope for SSAE-18 auditing and evidences through the SOC 2/ISAE3402 report.

Access to the management interface for the customer to configure their salesforce environment, is configured by the customer themselves. The options are outlined in the above response. Robust application design and testing ensures that users without administrative access rights cannot access more sensitive areas of the application.
Access restriction testing frequency At least once a year
Management access authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
  • Other

Audit information for users

Audit information for users
Access to user activity audit information Users have access to real-time audit information
How long user audit data is stored for User-defined
Access to supplier activity audit information Users contact the support team to get audit information
How long supplier audit data is stored for At least 12 months
How long system logs are stored for At least 12 months

Standards and certifications

Standards and certifications
ISO/IEC 27001 certification Yes
Who accredited the ISO/IEC 27001 Brightline
ISO/IEC 27001 accreditation date 21/12/2017
What the ISO/IEC 27001 doesn’t cover The only ISO27001 control not included in our Statement of Applicability is A.14.2.7 - Outsourced Development. This is not covered as Salesforce does not perform outsourced system development.
ISO 28000:2007 certification No
CSA STAR certification No
PCI certification No
Other security certifications Yes
Any other security certifications
  • Cyber Essentials
  • SOC 2,3 Reports,
  • EU standard Contract Clauses
  • ISO: 27018,
  • ISO:27001

Security governance

Security governance
Named board-level person responsible for service security Yes
Security governance certified Yes
Security governance standards
  • ISO/IEC 27001
  • Other
Other security governance standards ISO/IEC 27001
ISO/IEC 27018
UK Cyber Essentials
Information security policies and processes Marketing Cloud’s formally documented Security Program and associated controls are aligned with the ISO 27001 & 27002 standards.

Operational security

Operational security
Configuration and change management standard Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach Marketing Cloud has a 27001 based documented Change Management methodology and system for providing control over modifications and additions to its environment. These processes are followed for all changes made to the production environments and ensures changes to the production environments are authorised, tested, approved, implemented, and documented.
Vulnerability management type Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach Marketing Cloud contracts with a trusted third-party to conduct bi-annual, in-depth ‘ethical hacking” assessments, which includes vulnerability scans of both our application and of the network and infrastructure on which it runs.
Protective monitoring type Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach Internal system scanning is performed using tools such as Nexpose on a continuous weekly basis (internal scans are 'credentialed scans' for maximum assurance).
Incident management type Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach Salesforce has a formal Incident Management Process that guides the Salesforce Computer Security Incident Response team in investigation, management, communication, and resolution activities.

Salesforce will promptly notify the customer in the event of any security breach of the Service resulting in an actual or reasonably suspected unauthorised disclosure of Customer Data. Notification may include phone contact by Salesforce support, email to customer's administrator and Security Contact and public posting on is a member of the prestigious Forum of Incident Response and Security Teams (FIRST) and complies with the FIRST framework and best practices for incident response.

Secure development

Secure development
Approach to secure software development best practice Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Public sector networks
Connection to public sector networks No


Price £720.10 per unit per year
Discount for educational organisations No
Free trial available Yes
Description of free trial Complete version limited by time only
Link to free trial Please contact us for the current trial link


Pricing document View uploaded document
Skills Framework for the Information Age rate card View uploaded document
Service definition document View uploaded document
Terms and conditions document View uploaded document
Return to top ↑