The Complete Guide to Salesforce Audit Evidence
- Apr 8
- 7 min read
Updated: 6 days ago
Salesforce data audit trails and audit evidence refer to the documented record of data changes, configuration modifications, access events, and data state at specific points in time that compliance teams use to satisfy SOX, HIPAA, GDPR, and CCPA requirements. Salesforce provides several native audit tools—including Field History Tracking, Setup Audit Trail, and Event Monitoring—but none of them deliver the retention periods, restore capabilities, or cross-object evidence collection that enterprise compliance workflows require. This guide covers what each Salesforce audit trail source captures, where native coverage ends, and how enterprise IT teams build complete audit evidence workflows for regulated environments.
Understanding Salesforce Audit Trail Sources
Salesforce includes four native audit mechanisms. Each captures a different type of activity, carries different retention limits, and serves different compliance purposes.
Setup Audit Trail
Setup Audit Trail records changes made to the Salesforce org's configuration by administrators: permission changes, profile modifications, field additions, workflow activations, and similar administrative events. The log is available in Salesforce Setup and covers the last 180 days by default, with a premium option extending coverage. Setup Audit Trail captures who made each change, when, and what the previous value was. For SOX compliance, this record demonstrates that configuration changes followed authorized change management processes. For GDPR compliance, it documents who activated or modified data processing configurations.
Field History Tracking
Field History Tracking records changes to specific field values on standard and custom objects. IT teams configure which fields to track (subject to Salesforce's per-object field limit), and Salesforce records the old value, new value, who made the change, and when. The retention window is 18 months. Field History Tracking does not capture the full record state at a point in time—only the changes to tracked fields. Records deleted during the tracking window do not retain their field history after deletion. For auditing specific field values over time, Field History Tracking is useful; for reconstructing a complete record state at a historical point in time, it is insufficient.
Event Monitoring
Event Monitoring captures system-level events: logins, API calls, report exports, record views, and similar platform activity. It is primarily a security and anomaly detection tool rather than a data audit tool. Event Monitoring logs show who accessed what, when, and from where. For HIPAA access logging requirements, Event Monitoring provides the audit trail that demonstrates authorized access to protected health information. Retention and access to Event Monitoring data requires a separate license addition in most Salesforce editions.
The Field Audit Trail Feature
Salesforce Field Audit Trail is a separate licensed feature that extends Field History Tracking retention from 18 months to up to 10 years for specific fields. Salesforce field audit trail data is stored within Salesforce's own infrastructure, which means the data is subject to Salesforce's data residency and access controls rather than the customer's. For organizations with data sovereignty requirements that specify customer-controlled storage, Field Audit Trail's vendor-hosted storage creates compliance exposure even with the extended retention window.
Where Native Salesforce Audit Capabilities Stop
Native Salesforce audit tools have four structural limitations that enterprise compliance workflows consistently expose.
Retention limits that predate most regulatory windows: Setup Audit Trail covers only 180 days and standard Field History Tracking only 18 months, while SOX requires seven years of records and HIPAA requires six — native retention expires long before compliance windows do.
No point-in-time record reconstruction: Field History Tracking logs individual field changes but never stores a full record snapshot, so there is no way to see exactly what a record looked like on a specific date.
No deleted record recovery evidence: once a record is deleted, its field history disappears with it, leaving no audit trail proving what the record contained before deletion — a gap covered by a dedicated Salesforce record recovery process.
Vendor-controlled data storage: even the extended Field Audit Trail feature keeps evidence inside Salesforce's own infrastructure, which fails data sovereignty requirements that mandate customer-controlled storage.
Building a Complete Salesforce Audit Evidence Workflow
Enterprise compliance teams build complete Salesforce audit evidence workflows by combining native Salesforce tools for real-time monitoring with a customer-hosted backup and audit solution for long-term evidence retention and point-in-time reconstruction.
Real-Time Access Monitoring
Event Monitoring handles real-time access logging: who logged in, which records they viewed, which reports they exported, which API calls executed against which objects. For HIPAA access controls and SOX user access reviews, Event Monitoring provides the current-window evidence. IT teams configure alert thresholds for anomalous access patterns—bulk record exports, off-hours logins, unusual API call volumes—to support both compliance and security operations.
Configuration Change Management
Setup Audit Trail handles administrative change logging for the current 180-day window. For SOX change management evidence beyond 180 days, IT teams export Setup Audit Trail records on a regular schedule and store them in a customer-controlled repository. This export should happen frequently enough that no audit-relevant window falls between exports.
Data State Capture and Long-Term Retention
Point-in-time data state capture—the ability to reconstruct what a record contained at any historical date—requires a backup solution that captures complete record snapshots, not just field-level change logs. Sesame Software's Salesforce Backup and Recovery solution captures record state on a customer-defined schedule, stores snapshots in a customer-controlled database (SQL Server, Oracle, or PostgreSQL), and retains them for the period the customer's compliance requirements mandate. For SOX seven-year retention, the backup solution stores seven years of snapshots. For HIPAA six-year retention, it stores six years.
Metadata types including Flows, Profiles, Permission Sets, Permission Set Groups, Apex Classes, Assignment Rules, Custom Labels, Dashboards, Email Templates, Layouts, Reports, Report Types, and Workflow Rules are captured alongside record data in each backup cycle. This means configuration state at any backed-up point in time is also available for compliance evidence, not just record state.
Evidence Collection for Compliance Workflows
Data auditing for SOX, HIPAA, and GDPR each requires different types of evidence collection. A well-designed Salesforce audit evidence workflow anticipates these requirements and automates evidence collection rather than waiting for an audit request to trigger manual extraction.
For SOX, the key evidence categories are: user access reviews (who had access to financial data and when), change management logs (what configuration changes occurred and whether they followed authorized procedures), and data state at period-end (what financial records contained at each reporting period close). Native Salesforce tools cover some of this; third-party backup with long-term retention covers the gaps.
For HIPAA, the key evidence category is access logging: who accessed PHI, when, and from what context. Event Monitoring covers this for the current period; customer-controlled backup provides the long-term record. Customer-hosted storage ensures PHI in audit logs does not cross into a third-party environment without a Business Associate Agreement.
For GDPR, the key evidence categories are data mapping (what personal data exists and where), access documentation (who can access personal data), and erasure evidence (proof that deletion requests were executed in both the live system and backup history). Sesame Software's GDPR Clean functionality addresses the erasure evidence requirement specifically by managing data subject deletion across backup snapshots.
Frequently Asked Questions About Salesforce Audit Trails
What is Salesforce Field Audit Trail?
Salesforce Field Audit Trail is a licensed feature that extends field-level change history retention from the standard 18 months to up to 10 years for specific fields on specific objects. It stores audit data within Salesforce's own infrastructure. Organizations with data residency requirements that mandate customer-controlled storage must supplement Field Audit Trail with a customer-hosted backup solution that stores evidence in the organization's own environment.
How to check audit trail in Salesforce
To check audit trail in Salesforce, navigate to Setup and search for "View Setup Audit Trail" in the Quick Find box. This displays the last 180 days of configuration changes made by administrators, including who made each change and what the previous value was. For field-level change history on individual records, view the record in Salesforce and check the History related list (available on objects where Field History Tracking is enabled). For access and system event logs, Event Monitoring data is available through Salesforce's API or third-party log management tools.
What is audit trail in Salesforce?
Audit trail in Salesforce refers to the collection of logs that record changes to data, configurations, and access within the org. The primary audit trail mechanisms are Setup Audit Trail (administrative configuration changes, 180-day retention), Field History Tracking (field-level record changes, 18-month retention), Event Monitoring (system access events, retention varies by edition), and the licensed Salesforce Field Audit Trail (extended field change history, up to 10 years). None of these mechanisms provides complete point-in-time record reconstruction or customer-controlled long-term storage without supplementary tools.
How to enable audit trail in Salesforce
To enable field-level audit trail in Salesforce, navigate to Setup, search for the object whose fields you want to track, click "Set History Tracking," and select the fields to monitor (subject to per-object field limits). Setup Audit Trail is enabled by default for all Salesforce organizations and captures administrative changes automatically. Event Monitoring requires a licensed add-on. Salesforce Field Audit Trail requires a separate license. For enterprise compliance, supplement these native tools with a third-party backup solution that provides customer-controlled long-term retention and point-in-time record reconstruction.
Take Back Control of Your Salesforce Compliance Evidence
A complete Salesforce audit evidence strategy requires the right Salesforce compliance tools for current-period monitoring combined with audit trail management infrastructure for long-term retention. Regulatory compliance demands evidence that covers years, not months. Native tools for current-period monitoring with customer-hosted backup and retention for long-term compliance. The gaps in native Salesforce audit capabilities—retention limits, vendor-controlled storage, incomplete record state capture—are well-defined problems with well-defined solutions. Sesame Software provides the customer-hosted backup and audit infrastructure that fills those gaps with SOC 2 Type II certification and more than 30 years of enterprise data governance experience.
Talk to a Data Expert and schedule a demo to see how Sesame Software fills the gaps in native Salesforce audit evidence.
Related Resources
