On this page
1. 🌍 Introduction#
Replacing the foundation under a building while everyone inside keeps working, without a single one of them noticing — that's roughly the scale of what Salesforce has spent the last several years doing to its own platform. This is a layer-by-layer look at what actually changed.
Salesforce pioneered multitenant cloud computing over two decades ago and has since grown into a full enterprise platform serving hundreds of thousands of businesses. Driven by public cloud adoption, the AI/agentic shift, data residency regulation, real-time scale needs, and demand for a resilient integrated suite, Salesforce has rebuilt its platform from the ground up. The Agentforce launch at Dreamforce 2024 marked the culmination of this effort — 95%+ of customers have already migrated to the new platform.
Core architectural principles:
Enterprise-Grade Trust — trust is priority #1; built-in compliance and security controls.
Multitenant — shared infrastructure across customers, a common high bar for availability and security.
Metadata-Driven — everything is customized and extended via metadata.
API First — everything doable in the UI is available via API.
Open & Interoperable — integrates with any enterprise architecture.
Agentic — the platform is becoming agent-first across the entire suite.
Since the 2008 Force.com debut, the major recent shifts include: adoption of Hyperforce (cloud-based infrastructure), moving from a monolith to independent services, introducing Data 360/Lakehouse alongside the relational store, and deep AI/agentic integration — all achieved with minimal customer disruption, thanks to abstractions strong enough to absorb the change underneath them.
2. 🏗️ Platform Architecture Layers#
The platform is a stack of layers, each building on the one below:
| Layer | What it does |
|---|---|
| Hyperforce | Cloud-based infrastructure foundation (compliant, available, cost-efficient) |
| Metadata Framework | Stable abstraction (ORM, order of execution, "Core" runtime) |
| Data | Multitenant relational DB + petabyte-scale Lakehouse |
| AI | Predictive + generative AI powering agentic experiences |
| App Platform Services | Tools for admins/devs/ISVs to build and customize apps |
| Business Capabilities | Domain-specific functionality |
| APIs & API Management | Exposes all capabilities as APIs |
| User & Developer Experience | UI + low-code-to-pro-code dev tooling |
| Integration | Connectors, zero-copy data integration |
| Apps & Industries | Customizable apps and industry solutions with embedded AI agents |
3. ☁️ Hyperforce (Infrastructure Layer)#
Nearly 25 years of Salesforce data-center experience, now re-platformed onto multiple public clouds for elastic B2C scale, data residency, and compliance across 20+ regions.
Architectural principles adopted for portability across hyperscalers:
Infrastructure as Code — declarative, immutable, automated (Kubernetes, Service Mesh).
Zero-Trust Security — identity, authentication, network isolation, least privilege, encryption everywhere.
Managed Services — multitenant/multi-cloud portability (commercial, government, air-gapped).
Built-in Resilience — multi-AZ, availability tiering.
Fully Observable — logs, metrics, alerts, tracing, standardized.
Automated Operations — AIOps for lifecycle management and degradation detection.
Automated Scale — abstracts cloud-provider account limits.
FinOps Aware — an efficiency-driven culture without sacrificing trust.
Hyperforce Topology#
Hyperforce Instance → grouped optionally into Operating Zones for residency needs; maps to one Availability Region; data replicated across ≥3 Availability Zones.
Functional Domains — clusters of services (Foundational: security/auth/logging; Business: Sales Cloud, Service Cloud, etc.).
Cells — the traditional "Salesforce instance/pod"; a scale unit and a blast-radius boundary.
Supercells — a logical grouping of cells sharing services (larger blast radius).
Customers never see physical details — traffic is always routed via stable My Domains (e.g.,
acme.my.salesforce.com).
Domain Security#
Each domain is secured at the perimeter; services are grouped into Security Groups (only the "edge" group faces the internet).
The Hyperforce Edge Functional Domain terminates TLS and applies a programmable WAF per region.
PII in logs is anonymized (GDPR).
A Hyperforce Grid groups instances sharing a control plane, isolating sensitive workloads with zero data leakage across grids.
Control Plane: source code is scanned, packaged into signed containers, and deployed via authorized CD pipelines; an Airgapped Control Plane covers restricted environments; IAM enforces just-in-time access and full audit trails.
Cost Management & Sustainability#
Cloud accounts are organized hierarchically, with granular resource tagging and Tableau/Slack dashboards for real-time cost visibility.
A mix of Compute Savings Plans, Spot Capacity, and On-Demand Capacity Reservations (ODCR).
The Hyperforce Unit Cost Explorer and the "COIN" (Cloud Optimization Index) score drive continuous efficiency.
Sustainability goal: reduce unit Carbon to Serve.
4. 🛡️ Security & Compliance#
Built-in and automatically enforced through shared services — individual teams benefit without extra effort. Salesforce adheres to 40+ standards (PCI/DSS, GDPR, HIPAA, FedRAMP, and more).
Zero Trust Architecture (ZTA) + PKI: continuous authentication and validation regardless of location; robust certificate revocation; mTLS between services with short-lived keys and just-in-time access.
Encryption: TLS with perfect forward secrecy in transit; per-tenant keys (HSM-backed) at rest; multi-source entropy for key generation; memory encryption against cold-boot attacks.
Custom JDK for FIPS compliance — converts non-compliant code to compliant code without a rewrite; also blocks XXE.
Frameworks against XSS, CSRF, and SQL injection are baked into the SSDL; centralized secrets management (RBAC) plus code scanning round out the pipeline.
Phishing-resistant MFA (hardware keys, secure kernel) aligned to CISA Zero Trust principles.
SIEM, vulnerability management, WAF, network segmentation/micro-segmentation, and a dedicated incident-response plan complete the posture.
5. ⚙️ High Availability#
A three-step approach at scale: define architecture standards, enforce them via automated inspection and architecture review, then bake the resulting solutions into Hyperforce by default.
Key standards follow from that approach: redundancy with automated failover; a deliberately limited blast radius (the Cell is the classic example); compartmentalized failures so one service's problem doesn't cascade into another's; automatic scaling that goes up fast and down slow; fast rollbacks, measured in minutes and feature-flag driven; every API surface protected with load-shedding, WAFs, and tenant fair limits; dependencies softened wherever possible, often through caching; a preference for asynchronous, brokered communication; fault-tolerant calls with timeouts, circuit breakers, and retries with backoff; and centrally managed quotas and constraints.
Observability & AIOps#
Metrics: OpenTSDB/HBase (real-time) + Trino/Iceberg (batch) — 2B+ metrics/minute.
Logs: Splunk. Events: Apache Druid. Tracing: OpenTelemetry + ElasticSearch.
AIOps Agent — a modular, reactive multi-agent toolkit that auto-detects, triages, and remediates incidents:
91% of core CRM incidents proactively detected (via the open-source Merlion ML library — Isolation Forests, Random Forests, LSTM).
79% of incidents auto-resolved by the agent.
Remaining incidents are triaged to the right team using the fine-tuned XGenOps model → 2,800+ engineering hours saved per week.
Continuous Deployment#
~250,000 production changes per week, managed via a custom blue/green CD system: mandatory test evidence, canary testing, staggered/controlled blast-radius rollout, soak/health checks, and moratorium/incident conflict checks.
CI runs millions of AI-selected tests to cut regression risk while enabling fast releases.
6. 🧠 Metadata-Driven Architecture#
The core platform principle: apps are collections of metadata over multitenant services — "everything is accessed with metadata." Structured, strongly-typed metadata (entities, fields, and records via sObject APIs) abstracts customers from the underlying storage technology, so Salesforce can swap storage engines without breaking apps.
Layered Extension Model#
Four personas build on the same app independently, thanks to strict versioning and backward-compatibility guarantees:
- Salesforce Engineering — native apps (Sales/Service Cloud).
- External Partners (ISVs) — schema extensions, validation rules, packaged for resale.
- Org IT Admins/Developers — org-specific customization.
- End Users — personal UI preferences.
The Record Save Order of Execution ensures business logic from all four layers applies in a predictable, overridable sequence.
Core Runtime#
A proprietary multitenant ORM over a relational database gives shared memory state, referential integrity, and transactional commits.
As of October 2025: 85,000+ Salesforce-defined entities, 300M+ customer-defined custom entities.
Core remains the single system of record for metadata, even though runtime execution is now spread across hundreds of independent services, with metadata synced to local caches.
7. 🗄️ Data Layer#
Data flows from System-of-Record (SOR) transactional stores into big-data platforms for AI and analytics. SalesforceDB handles the transactional side; Data 360 handles AI, analytics, and unstructured data.
SalesforceDB (Transactional Database)#
Cloud-native, extends PostgreSQL; separates compute from storage; built on Kubernetes and cloud storage.
1.1 trillion transactions per month; runs across 3 Availability Zones (1 primary + 2 standby compute clusters).
System of record = cloud storage (e.g., S3), accessed through distributed storage caches (separate for logs vs. data files).
Uses a Log-Structured Merge Tree (LSM): writes go to a transaction log, then memory, then get compacted into key-ordered, immutable data files. This eliminates concurrent-update conflicts and enables uncoordinated reads, simple backups, and storage virtualization.
Automated failover via quorum-monitoring cluster management — the same mechanism used during routine patching, so restarts go unnoticed by users.
3 major + weekly minor schema updates per year, all zero-downtime.
Ransomware protection: full and incremental backups in a separate account, pre-configured (but inactive) restore infrastructure, lineage tracking, and ongoing index/table consistency checks.
Horizontal scaling: virtually unlimited cloud storage, auto-scaling caches, and compute nodes that read shared immutable storage without coordination.
Multitenancy: tenant ID is part of the primary key, clustering data by tenant in the LSM structure — enabling per-tenant encryption, easy tenant copy/move, and combining the low overhead of tenant-per-row with the isolation of tenant-per-schema.
Data 360 (AI & Analytics Platform)#
Built on Hyperforce to break down data silos and power AI, analytics, and real-time operations. Capabilities include: no-code ingestion, real/near-real-time data, zero-copy federation, data prep and harmonization, unified query over structured and unstructured data, ML/AI model development, data-triggered actions, RAG support, and policy-based governance.
Ingestion: an ELT pattern; real-time (APIs/streams) plus near-real-time (usage data); hundreds of connectors; integrates natively with Sales/Service/Marketing/Commerce Cloud.
Lakehouse — a native architecture on Iceberg/Parquet, built from layered abstractions:
- Parquet File Abstraction (raw files in S3/Blob)
- Iceberg Table Abstraction (folders + snapshot metadata)
- Salesforce Cloud Table Abstraction (adds semantic metadata, abstracts Snowflake/Databricks etc.)
- Lake Access Library (unified data and metadata access)
- Big Data Service Abstraction (Trino/Hyper for query, Spark for processing)
Low Latency Store (LLS) — a petabyte-scale NVMe/SSD durable cache layer sitting between memory and the Lakehouse. Recent session data (e.g., agent conversation history) is flushed here for millisecond access before eventually landing in the Lakehouse long-term.
Security/Governance: Tenant-Level Encryption (customer-managed keys) plus Attribute-Based Access Control (ABAC) using the CEDAR policy language, alongside automated data classification. The governance lifecycle runs Tagging/Classification (Policy Information Point) → Authorization Service (Policy Enforcement Point) → Policy Evaluation Engine (Policy Decision Point).
Zero-Copy Federation — connects to Snowflake, Redshift, BigQuery, Databricks, Azure Fabric, SQL databases, Excel, and unstructured sources (Slack, Google Drive) via live query pushdown and file-based federation; every federated object appears as a Salesforce object.
CDP & Real-Time Layer: identity resolution (exact and fuzzy matching) builds unified B2B/B2C profiles; enterprise data graphs (JSON, e.g. the "Profile" graph) ground generative AI prompts; the real-time layer processes clickstream, cart, and checkout events at millisecond latency to update profiles for sub-second personalization.
Personalization Services Platform — orchestrates decisioning via A/B/n and multi-armed-bandit experimentation, with out-of-the-box recommendation and pricing models.
Compute: elastic multitenant and dedicated clusters; BYOC (Java/Python/Spark, including custom LLMs); the Data Processing Controller (DPC) is a unified Job-as-a-Service orchestrator across Spark (EMR on EC2/EKS) and Kubernetes workloads.
Query & Unstructured Data: SQL over structured and unstructured data via Trino/Hyper, extensible via Table Functions.
Unstructured indexing pipeline: Parsing → Pre-Processing → Chunking → Post-Processing → Embedding → keyword and vector indexing (vector engine: Milvus).
Document AI reads invoices, resumes, lab reports, and purchase orders — both interactively and in batch.
Semantic Layer (headless, similar to Tableau Next) translates business-taxonomy queries into SQL for native and federated sources.
8. ⚡ Caching — Vegacache#
A Salesforce-managed, Redis-based, multitenant caching service exposed to developers via Apex (Put/Get/Delete on Apex Objects and SOQL results). It runs in Kubernetes across multiple Availability Zones, handles 2 trillion+ requests per day at sub-millisecond latency, and guarantees per-customer cache size while protecting against noisy neighbors.
9. 🔄 Asynchronous Processing#
Async processing evolved from message queues (Bulk API, Async Apex) to log-organized event streams on internally managed Apache Kafka, productized externally as Platform Events (a pub/sub model). Versioned event schemas let different runtimes evolve independently and absorb load spikes.
10. 🔍 Search — SeaS (Search as a Service)#
Built on Solr, heavily extended by Salesforce; compute/storage separation with automatic sharding, zero-downtime upgrades, and around 6,000 Solr nodes globally.
A learning-to-rank relevance pipeline, continuously refined via A/B testing.
A vector search engine for semantic/AI use cases (Deep Fusion Ranker, Autodrop for low-relevance filtering).
Adapting for LLM consumers (longer queries, chunk-based results) to power Agentic Search — agents use search inside a reasoning loop.
Deeply integrated with Data 360 connectors (e.g., Google Drive) and Prompt Builder for grounding.
11. 🤖 AI & Agentforce#
Salesforce has led enterprise AI since 2013, starting with Einstein Predictive AI and evolving into Agentforce, which merges predictive and generative AI. Agentforce 3.0 runs on a Python, event-driven framework with built-in conversation history, end-to-end session tracing, voice support, and a custom-reasoning "Bring Your Own Planner" capability.
Its core principles: Data Security and Ethics, Transparency and Explainability, Flexibility and Customization, Seamless Integration, Scalability, Consistent Experiences, and Comprehensive Observability, the last delivered via Agentforce Interaction Explorer.
AI Stack:
AI Platform — trains, fine-tunes, and serves predictive and generative models (out-of-the-box or bring-your-own).
AI Foundational Services — AI Gateway, Feedback Framework, RAG, Agentic Orchestration, Agent Evaluation/Reasoning.
AI-Powered Experiences — built-in cloud AI apps, or custom via Flow/Apex/LWC.
Agentforce Studio — Agent Builder, Prompt Builder, Testing Center, Model Builder (plus "Next Gen Authoring," SFDX-compatible).
The Trust Layer covers six areas: Data Privacy (masking), Security, Trust (no third-party AI storage), Guardrails (behavioral consistency), Accuracy (grounding), and Content Moderation (PII/PCI/PHI masking, toxicity classification).
AI Gateway — a unified interface abstracting multiple LLM providers and predictive models, with cost controls.
Feedback Service — collects and analyzes user feedback to retrain and refine models.
RAG — retrieves grounding data from Data 360 and a vector database, improving accuracy, speed, and trust through source citations; heavily used in Agentforce for Service and Sales.
Planner Service — interprets intent, builds a plan, and launches actions, directly or via other services.
Agent workflow: the agent activates, understands and responds using NLP and the knowledge base, hands off to a human when it hits real complexity, and keeps learning from every interaction.
Agentforce 3.0 advancements:
Asynchronous, event-driven architecture (Python) enabling scalable multi-agent systems that communicate via events.
Multimodal voice — telephony/WebRTC integration, ASR/TTS services for contact-center use cases.
Agentforce Script & Determinism — state-machine interception constrains agent behavior for deterministic, auditable execution on critical business processes.
12. 🧩 App Ecosystem#
Five foundational capabilities of App Platform Services:
- Tenancy — logical data/metadata separation (the "Salesforce Org").
- Entities — abstracted DB tables (fields, data types, query/write-ability).
- Access Controls — permission sets built from rules and feature toggles, assigned to identities.
- Layered Extension — as described above, via save orders and metadata namespaces.
- Packaging — bundles metadata for distribution across tenants without rebuilds.
Also included: Data Runtime/Query (via sObject), Flow/Workflow/Formulas, Apex, Heroku (cloud-native infrastructure), Events/Notifications, Globalization, Licensing/Provisioning, Lightning Web Stack, Sites+CDN, Security/Compliance, and Data Loss Prevention.
Heroku#
A managed cloud app platform (runtimes, data stores, queues, eventing) that lets developers use any language or framework while still accessing full Salesforce data, business logic, and third-party integrations — infrastructure concerns abstracted away.
Process Automation#
Addresses manual, error-prone workflows via a no-code Flow Builder (drag-and-drop) backed by the Core Flow Engine:
Record-Triggered, Scheduled/Event-Driven, Screen Flows (guided UI), Orchestrator Flows (multi-step).
Offline Flow Engine (Field Service mobile) and High-Scale Flow Engine (B2C marketing volume).
Supports advanced logic (loops, decisions, wait conditions), data transformation, and integrates via APIs/MuleSoft/External Services.
Agentforce Integration adds AI-driven lead routing/campaign triggers; Platform Synergy links automation across Sales/Service/Commerce/Marketing Cloud.
Apex#
An object-oriented pro-code language — 350 billion+ transactions per month (October 2025). Used for trigger-based automation, custom REST/SOAP web services and APIs, Visualforce/LWC backend logic, and asynchronous processing (future methods, Queueable, Scheduled Apex).
13. 🎨 User Experience#
Salesforce Lightning Design System (SLDS): design patterns, CSS "styling hooks," a reusable base component library, built-in WCAG accessibility, responsive layouts, and governance tooling.
Lightning Web Stack:
Lightning Web Components (LWC) — standards-based (HTML/JS/W3C).
Lightning Web Security — browser-side JS virtualization/sandboxing.
Lightning Data Services — efficient server-data interaction.
Lightning Web Runtime — consistent rendering across clients.
Salesforce participates in roughly 20 W3C working groups.
Mobile#
A native mobile app auto-generates from browser Lightning apps; custom-native tooling includes:
Mobile SDK (auth, session/token management, API access)
Mobile Native Runtime (metadata-driven native rendering)
Branding (Mobile Publisher Pipeline)
Offline Capabilities
Mobile Customization Framework (MCF): metadata-driven, supports runtime experimentation, extensible components, and real-time UI personalization.
Offline-first stack: Cache-First Experience, Cache Management, Shared Cache (native and hybrid).
Nimbus — a production bridge between JS and native mobile code, giving hybrid apps standardized access to camera, mic, geolocation, LiDAR, and more.
On-device AI: Small Language Models (SLMs) for efficient, private, offline inference; native speech-to-text/text-to-speech/speaker diarization for zero-latency, fully private voice interactions.
Collaboration#
Slack is the platform's collaboration layer — DMs and channels tied to workflow data (e.g., a case discussion thread). Deeper platform integration is planned.
14. 🛠️ Developer Experience#
Low-Code: Schema Builder, Flow, AppBuilder.
Pro-Code: Salesforce Code Builder (cloud IDE), CLI, APIs, Heroku deployment.
ALM: scratch orgs (dev) plus full sandboxes (production-like testing).
<br />
AI Developer Tools:
ApexGuru Insights (launched January 2024) — flags anti-patterns and hotspots. In its first year: 2,800+ orgs, 22,000+ recommendations implemented, 28,000 CPU-hours saved per week, 135 kg CO₂ reduced per week.
Agentforce for Developers (2024) — VS Code/Code Builder extensions: inline code suggestions and generation (Apex, LWC), code explanation/docs, unit-test generation, multi-turn IDE chat, and YAML-based Agent generation/testing. 42,000+ monthly active developers, 17.6M lines of code accepted (October 2025).
<br />
Model Context Protocol (MCP) — Salesforce is natively integrating this open standard for secure agent-tool interaction:
Local MCP Server — build, test, and debug agentic integrations in-IDE (mobile dev, accessibility testing, Aura→LWC migration, "vibe coding").
Custom MCP Server for Salesforce APIs — exposes Salesforce APIs, Data 360 objects, and Flows as MCP tools for external agents, with access control and monetization potential.
Native External MCP Connectivity — securely connect to any MCP-compliant external server.
15. 🏢 Application Clouds & Business Capabilities#
Sales, Service, Marketing, Revenue, and Commerce Cloud are all built on this shared platform, delivering seamless cross-cloud integration, end-to-end customizability, agent-assisted/autonomous AI workflows, real-time data (via Data 360), unified analytics, strong security/compliance, consumer-grade UX, high reliability, elastic scalability, and continuous improvement without disruption.
Performance & Scale: dedicated performance labs replicate production with synthetic data to test parallel user journeys; predictive autoscalers anticipate load rather than just reacting to it; scale-up is fast, while scale-down is deliberately slow, protecting trust over pure cost savings.
Common Data Model: Account, Product, and other entities are shared across all Clouds (Sales, Service, Revenue, Commerce, Marketing, Industries), enabling consistent behavior, cross-cloud data/UI/logic sharing, and simpler upgrade paths — while still supporting Data 360 federation for the complex partner-integration needs that fall outside the common model.
Source: adapted from Salesforce's official Platform Transformation whitepaper, by Emin Gerba, Chief Architect, Salesforce.
