Open any Salesforce org that has been running for a few years and you will find the same thing. Social security numbers sitting in plain text. Phone numbers visible to every sales rep. Card details in a field someone created in 2019 and forgot about.
Nobody planned it that way. It just piled up. A new campaign needed a new field. A quick integration needed a new object. A consultant added a few custom fields and moved on to the next project. Years later, the org holds a huge amount of personal and financial information, and nobody can say with confidence who can see what.
Then an audit is announced, or a customer asks a hard security question, or a new compliance rule lands on your desk. Suddenly the quiet mess becomes a real problem.
That is exactly the situation Contour was built for. In this guide, we will walk through why sensitive data gets exposed in Salesforce, why the built in tools are not always enough, and how Contour gives admins a safer and far more organized way to protect it.
Why sensitive data ends up exposed in Salesforce
Salesforce is built to be open and flexible. That is a big reason companies love it. Admins can add fields in minutes, developers can build custom objects, and business teams can shape the platform around how they work.
But that flexibility has a cost. Every new field is a new place where sensitive data might live, and every new layout, profile or permission set is a new way for that data to be shown to the wrong person.
Here are the most common ways exposure happens.
- Field sprawl. Over the years, orgs collect hundreds or even thousands of custom fields. Some hold things like national IDs, bank details or health notes. Nobody keeps a clean list of them.
- Broad profiles. Early in a Salesforce rollout, teams often give users wide access to keep things moving. Those permissions rarely get tightened later.
- Duplicated layouts. The same field can appear on many page layouts and Lightning pages. Hide it in one place and it may still show up in another.
- Free text fields. Notes and description fields quietly collect whatever users type, including data they should never store there.
- Staff changes. People change roles, join new teams or move on, and their access does not always change with them.
None of these are signs of a careless team. They are just what happens when a platform grows with a business. The real question is how to fix it without causing chaos.
What is Salesforce data masking?
Salesforce data masking means hiding the real value of a field from people who do not need to see it, while keeping the data useful for the people who do.
Think about a support agent on a call. They may need the last four digits of a phone number or card to confirm they are talking to the right customer. They do not need to see the full number. A manager reviewing an account might need a little more. A compliance officer might need the full value for an investigation.
Masking lets each person see the right amount, and nothing extra. It is a simple idea with a big impact. If a user account is ever compromised, or someone with access makes a mistake, the damage is limited because the sensitive part was never on screen in the first place.
Good masking also supports a principle you will hear often in privacy circles: people should only access the minimum data needed to do their job. We will come back to that idea when we talk about compliance.
Why Field Level Security and layouts alone are not enough
If you have worked in Salesforce for a while, you may be thinking, "We already have Field Level Security. Why do we need anything else?"
It is a fair question. Field Level Security, or FLS, is a core part of the platform and it works well. It lets you control whether a profile or permission set can read or edit a field. Page layouts and Lightning pages let you decide which fields appear where.
The trouble starts when you try to protect sensitive data at scale using only those tools by hand.
It is all or nothing. FLS usually decides whether someone can see a field, not how much of it they can see. If you want a rep to see only the last four digits, plain FLS cannot do that on its own.
It is easy to miss something. A single field can be referenced by many layouts, Lightning pages, profiles and permission sets. If you update nine of them and forget the tenth, the data is still exposed.
It is hard to predict the impact. Hiding a field can break a page that depends on it. Without a clear picture of where the field is used, admins often hesitate, and sensitive data stays exposed simply because nobody wants to risk breaking things.
There is no easy way back. If a change causes problems, undoing it by hand means remembering every setting you touched. That is stressful, and it is where mistakes happen.
It does not scale. Doing this once for a few fields is manageable. Doing it across a large org with years of history is a serious project that can take weeks of careful work.
This is the gap Contour fills. It does not replace the tools you already know. It organizes them and makes them safer to use.
The kinds of data worth protecting
Before looking at the tool, it helps to know what we are actually trying to protect. While every business is different, these categories show up in almost every Salesforce org.
- Personal identifiers. Names combined with national ID numbers, passport numbers, dates of birth and home addresses.
- Contact details. Personal emails and phone numbers, especially when they are tied to individuals instead of companies.
- Financial information. Card numbers, bank account details, billing data and credit related notes.
- Health information. Medical notes, treatment details, insurance information and anything linked to a patient or member.
- Sensitive business data. Contract values, pricing terms and negotiation notes that only a small group should see.
If your org holds any of these, masking is not a nice to have. It is part of running Salesforce responsibly.
Meet Contour
Contour is a native Salesforce managed package, built as a 2GP package and installed straight from AppExchange. It runs entirely inside your org. There are no external callouts and no third party processing your data. For many security teams, that single point decides whether a tool is even allowed through the door.
The idea behind Contour is simple. Instead of masking fields one at a time and hoping you did not break something, it walks you through a clear workflow that finds the data, shows you the impact, applies the protection, and keeps a way back open.
Because it is native, there is also nothing strange to learn about where your data goes. Your data stays in Salesforce. Contour just helps you control how it is shown.
The five step Contour workflow
Let us walk through the workflow in more detail, because this is where the tool really earns its place.
1. Scan
Everything starts with finding the data. Contour scans your org to locate sensitive information, so you are not relying on memory or an old spreadsheet. This matters more than it sounds. In many orgs, the biggest risk is not a field you know about, it is the one you forgot existed.
2. Discover
Once you know which fields matter, the next question is where they are used. Contour shows how that data appears across layouts, Lightning pages, profiles and permission sets. This gives you a complete picture before you touch anything, which removes most of the guesswork.
3. Mask
Now comes the protection. Contour offers customizable masking templates, so you can decide how each field should appear. A phone number can show only the last few digits. An ID can be partly hidden. Different fields can use different templates depending on how sensitive they are and who needs to see them.
4. Deploy
When you are happy with the plan, changes go live with a single click. There is no need to manually edit dozens of layouts and permission settings one by one. What could have taken days of careful clicking becomes a controlled, repeatable action.
5. Rollback
If something does not look right, you can undo it. Every deployment is logged, and Contour provides a one click rollback that restores affected settings to their earlier state. We will look at this more closely in a moment, because it is the feature that makes the whole process feel safe.
Knowing the impact before you change anything
Here is where admins usually get nervous. You change a field's visibility and something else quietly breaks. A report stops working. A layout looks empty. A user cannot finish their task and sends you an urgent message.
Contour tackles this with full reference mapping. Before any masking or field level security change is deployed, it builds a map of every layout, Lightning page, profile and permission set that references the fields you are targeting. You get to preview the impact first, then decide.
This changes the whole feel of a masking project. Instead of asking "What if this breaks something?" you can ask "Here is everything this touches, is that what we want?" That is a much better place to make decisions from.
It also helps with communication. When you need to explain a change to a sales director or a compliance lead, you can point to a clear list of what will be affected. People tend to approve changes much faster when they can see the full picture.
A real safety net: precision rollback
Every admin has a story about a change that went wrong at the worst possible time. A rollback plan is not a luxury. It is what separates a confident team from a frightened one.
With Contour, each deployment is carefully logged. If you need to reverse a change, a single click restores the affected layouts, field level security settings and Lightning pages to what they were before.
This matters for three reasons.
- It lowers the fear of acting. Teams stop postponing data protection work because they are afraid of breaking something.
- It supports testing. You can try a masking approach, see how users react, and step back if needed.
- It creates a clear record. Logged deployments give you something concrete to show when someone asks what changed and when.
That safety net changes how confident a team feels. You stop treating the project like open heart surgery.
Role based partial visibility
Not every user needs the same view of the same field. A manager might need the full value while a rep sees only part of it. A support agent might need just enough to verify a customer.
Contour supports role based partial visibility to make this possible. Under the hood, it does this through custom formula fields combined with standard Salesforce field level security. That detail is worth appreciating. Contour is not adding a mysterious new layer on top of your org. It uses the platform's own building blocks, just in a far more organized way.
That has a practical benefit. Because the approach is built on standard Salesforce features, your admins can understand what is happening, and your org stays easy to maintain.
Built with compliance in mind
If you work in healthcare, finance or anywhere that handles customer identity, you already know the alphabet soup of regulations. Contour is designed around requirements like HIPAA, PCI-DSS v4.0 and GDPR.
Here is what that looks like in plain language.
- HIPAA is about protecting health information. A core idea is the minimum necessary standard, which says people should only access the amount of health data they need to do their job.
- PCI-DSS v4.0 covers how payment card data is handled and displayed. Limiting who can see full card numbers is a central part of it.
- GDPR puts strong emphasis on data protection by design, meaning privacy should be built into systems from the start instead of added later.
Masking supports all three ideas. When sensitive values are hidden by default and revealed only to people who truly need them, you are practicing minimum necessary access and protection by design in a very direct way.
A quick note of honesty here. No tool makes an organization compliant on its own. Compliance depends on your policies, your people and your processes as a whole. What Contour does is give you a practical, well organized way to handle one important piece of that puzzle: controlling how sensitive data is displayed inside Salesforce.
Working alongside Salesforce Shield
Many teams already use Salesforce Shield for things like encryption and event monitoring. Contour is designed to work well alongside it, not compete with it.
A helpful way to think about it is in layers. Encryption protects data at the database level. Masking protects what people see on screen. Sandbox protection covers what happens to data in your test environments. Together, these layers give you protection across the database, display and sandbox sides of your setup.
If you already invest in Shield, Contour adds the display layer that is often left to manual work. If you do not use Shield, Contour still gives you a strong starting point for controlling visibility.
Best practices before you start a masking project
Whatever tool you use, a little preparation goes a long way. Here is a simple approach that works for most teams.
- List what you hold. Make a rough inventory of the sensitive data your business collects. Involve people from sales, support, finance and legal, since they often know about fields the admin team has never seen.
- Decide who needs what. For each type of data, write down which roles need full access, which need partial access, and which need none. Keep it simple and based on actual job tasks.
- Start with the highest risk fields. Do not try to fix everything in one week. Begin with the data that would hurt most if exposed, such as national IDs, card details and health information.
- Test in a sandbox first. Try your masking plan in a safe environment and ask a few real users to check their daily work.
- Communicate early. Tell teams what is changing and why. People are far more accepting of limited visibility when they understand the reason.
- Review regularly. Masking is not a one time job. New fields appear all the time, so schedule a recurring check.
Contour supports this process naturally, since its scan and discovery steps help you with the inventory and its rollback keeps testing low risk.
Common mistakes to avoid
Even careful teams run into the same few problems. Watch out for these.
- Hiding too much. If users cannot do their jobs, they will find workarounds, like copying data into spreadsheets, which is worse than the original problem.
- Forgetting free text fields. Notes and descriptions often contain sensitive details that structured fields never show.
- Ignoring integrations. Think about where else the data flows, such as reports, exports and connected systems.
- Treating it as a one time fix. Orgs change constantly. Protection needs ongoing attention.
- Skipping documentation. Write down what you masked and why. Future you, and any auditor, will be grateful.
Who should consider Contour?
Contour is a strong fit in a few common situations.
- You are preparing for a HIPAA, PCI or GDPR review and need a clear record of what changed.
- Your org has years of custom fields and nobody is sure which ones hold sensitive data.
- Your security team will not approve tools that send data outside Salesforce.
- Your admins want to mask data without fearing they will break layouts and permissions.
- You want a repeatable process instead of a risky one time cleanup.
Frequently asked questions
Does Contour send my data outside Salesforce?
No. It is a native managed package that runs inside your org, with no external callouts and no third party data processing.
How do I get Contour?
It is a 2GP managed package that you install from AppExchange.
Can I undo a masking change?
Yes. Every deployment is logged, and a one click rollback restores affected layouts, field level security and Lightning pages to their previous state.
Can different users see different amounts of the same field?
Yes. Role based partial visibility lets you control how much of a value each group sees, using custom formula fields and standard field level security.
Will I know what a change affects before I deploy it?
Yes. Contour maps the layouts, Lightning pages, profiles and permission sets that reference the targeted fields, so you can preview the impact first.
Does it work with Salesforce Shield?
Yes. Contour is designed to work alongside Shield, helping you cover the database, display and sandbox layers of protection.
Final thoughts
Data protection often gets postponed because it feels risky and time consuming. Teams know the problem is there, but the fear of breaking something keeps it at the bottom of the list.
Contour removes much of that fear. It finds the sensitive data, shows you exactly what a change will touch, applies masking through flexible templates, lets you deploy in one click, and gives you a way back if you need it. And it does all of this natively, without your data ever leaving Salesforce.
If you want to see how this could work for your org, take a look at our Salesforce data masking solution. And if you would like help planning a masking strategy from the ground up, the Concretio team works on Salesforce security and compliance projects every day. Reach out and we will help you figure out where to start.