Priya, her company, and that Thursday afternoon are made up. She's a composite of situations Salesforce admins run into all the time. The product details and numbers come from the official Contour page linked below.
4:47 PM on a Thursday
Priya was halfway through a cold chai when Slack pinged.
It was the head of customer service. "We switch on the new Agentforce agent for the support team on Monday. It can't see anything it shouldn't, right?"
Priya has been a Salesforce admin for nine years. She types fast and answers faster. Her fingers had already written "Should be fine!" before the rest of her brain caught up.
Should be fine. Those three words have started more incident reports than any other sentence in IT.
She deleted the message. Then she opened a Contact record in production, picked an account at random, and scrolled. Social Security number, in plain digits. Full card number. Date of birth. Personal email. Phone.
Next she opened the permission set the new AI agent would run under, and her stomach dropped a little. If a permission set can read a field, the agent can read that field. It doesn't know the data is private. It only knows the door is unlocked.
Nine years of tidy org-building, and she had no real answer to the most basic question in Salesforce data security: who can see what, and where is all of it hiding?
Why "just hide the field" doesn't work
The on/off problem
Here's the catch with field-level security in Salesforce. It's brilliant, and it's blunt. For every field, a profile or permission set either can see it or can't. Visible or hidden. On or off.
That's fine until the business says, "Our service agents need to confirm the last four digits of a customer's SSN, but they must never see the whole number."
Now you have a problem. Hide the field and agents can't do their jobs. Show it and every digit is exposed to every person (and every AI agent) with that access. There's no native middle setting, no "show a little."
The manual workaround
So admins improvise. They write a formula field that returns only the last four characters. They hide the original from most profiles. They edit page layouts, then Lightning pages, then permission sets, one at a time. It's careful, tedious, fragile work.
Priya knew the recipe by heart:
"***-**-" & RIGHT(SSN__c, 4)
One field. Five minutes to write.
But a masked field is only masked if the original is locked down everywhere it appears: every layout, every Lightning page, every profile, every permission set. Miss one and your mask is decoration.
The math that made her put the chai down
She opened a spreadsheet and did something she'd avoided for two years. She estimated the job.
Where private information hides
An org like hers can easily run past 400 objects. Private information doesn't only live in the obvious places. It hides in a custom object somebody built in 2017. It hides in a free-text Notes field. It hides in the Description box where a rep once pasted a customer's card number "just to save it." Finding all that sensitive data by hand means opening objects one by one and squinting at field labels.
The cost of doing it by hand
Then comes the fixing. Masking a single field the manual way takes about an hour of metadata surgery: formula, layout, FLS. Multiply by hundreds of fields and you land at 200 to 400 hours. Concretio puts that at $15K to $60K per masking project at standard admin billing rates.
The part with no undo
The part that really scared her was this: there's no undo.
One wrong FLS change can break an integration, a report, or half the layouts in the org. Nobody wants to be the person who "fixed" Salesforce data security on Friday and spent Saturday explaining why the billing sync stopped working.
That's the quiet reason so many orgs never do this work. It isn't that nobody cares. Everybody's afraid to touch it.
Priya closed the spreadsheet. Monday was four days away.
What Salesforce data masking actually means (and what it doesn't)
At 6 PM on a Thursday, Priya did what every admin does. She googled.
The three layers
She learned that "data masking" means different things depending on who's talking, and that mixing them up is how gaps appear. Think of it as three layers:
- The database layer. Encryption at rest. Salesforce Shield lives here, along with Event Monitoring. It protects data sitting in storage.
- The sandbox layer. When production gets copied into a sandbox, developers shouldn't receive real customer records. Salesforce's own Data Mask & Seed covers this.
- The display layer. What a human, a report, or an AI agent actually sees on screen in production.
The hole in the middle
Her org already had the first two. Shield was installed and sandboxes were scrubbed. Yet she was looking at a full SSN on a live record.
The display layer was the hole. Most masking tools only work in sandboxes, during a data copy. Very few answer the question she actually had: how do I show a service agent ***-**-4321 in production, while the compliance team still sees the real number, on the very same record?
It wasn't an encryption problem. It was a Salesforce data governance problem, and it needed a different kind of tool.
Meet Contour: five steps instead of four hundred hours
Late that evening she landed on Concretio's Salesforce data masking solution, a product called Contour. It's a second-generation managed package you install from AppExchange. It runs inside your org, with no external APIs and no data exports.
She expected a wall of marketing. What she found was a workflow short enough to memorize.
The five-step workflow
Step 1: Scan
Contour reads field names, labels, and the actual record data to find private information. It's a two-pass scanner that checks metadata and records, and it can flag sensitive data even in generic text fields across seven pattern categories. You can scan the Full Org, pick Custom objects, or run a Persona-Based scan scoped to what one role can access. Priya started narrow, which is the sensible way in.
Step 2: Discover
For each flagged field, it shows every page layout, Lightning page, profile, and permission set that references it. This is the map Priya never had time to build herself, and the one that makes the rest of the process safe.
Step 3: Mask
You choose from six templates: Last 4, Last 2, Full Mask, Email, Card number, and National ID. Different fields call for different shapes. A card number and an email address shouldn't be hidden the same way.
Step 4: Deploy
One click updates page layouts, Lightning pages, profile field-level security, and permission set FLS, with a full audit trail. This is the step that used to eat entire weeks.
Step 5: Rollback
Every change is captured, and one click restores the exact prior state. Priya read the five steps twice. This was the one she couldn't stop thinking about.
How the original data stays safe
The clever bit is how it handles the original data. Masked formula fields are created alongside the originals, not instead of them. The real value is never modified, and existing formulas that reference the original keep working. FLS then decides who sees the original and who sees the mask. Salesforce itself doesn't offer that third option natively.
The part that earned her trust: rollback
Every admin knows the dread of a big permissions change. It isn't the work that's scary. It's not knowing what the change will touch.
Contour answers that in two ways. Before anything deploys, the reference scanner shows exactly which layouts, Lightning pages, profiles, and permission sets will change. Nothing happens until you've seen the preview. And if something does go sideways, the rollback restores layouts, FLS, and Lightning pages to their exact earlier state, and deletes the formula fields it created.
Then there's the profile problem. Updating 30 profiles used to mean 30 manual trips through Setup for every single field. Contour handles profiles and permission sets in separate batch steps of the same deployment, and both get restored on rollback.
Priya realized how much of the paralysis around Salesforce data security came from missing safety nets rather than missing skills. She knew how to mask a field. She just couldn't afford to be wrong. With a rollback she could finally be wrong safely, and that makes people brave enough to start.
Same record, two realities
This is the demo that sold her. Picture one Contact record, viewed by two people.
What the service agent sees
- SSN:
***-**-4321 - Credit card:
****-****-****-1234 - Email:
j*****@g****.com
What the compliance officer sees
- SSN:
555-12-4321 - Credit card:
4111-1111-1111-1234 - Email:
jane@gmail.com
Same object. Same record. Different permission sets, different view. Nobody is blocked from doing their job, and nobody sees more than the job requires. For the first time, sensitive data in her org had levels instead of an on/off switch.
What this means for the AI agent
Now back to Monday's problem.
Here's what makes AI agents different from human users. A person might glance at an SSN and keep scrolling. An agent can pull that value into a summary, a suggested reply, or a case note, and it can do it a thousand times an hour. As Concretio puts it, Salesforce data governance is a prerequisite for Agentforce, not a nice-to-have.
The fix turned out to be almost boring, which is exactly what you want from a security fix:
-
Agents inherit field access from permission sets. If the permission set can read Email, the agent reads Email. Give the agent access to
Email_Mask__cinstead, and it seesj*****@g****.com. - No code changes to the AI. The backend integration keeps full access through a separate permission set. There's no Trust Layer workaround. It's plain field-level security, the way Salesforce already works.
- Same record, different visibility. The compliance user sees the full value, and the AI agent sees the masked one.
Priya laughed out loud at her desk. The "AI problem" she'd been dreading was a permission set problem, and she'd been solving those for nine years.
It also changed how she thought about Salesforce data security going forward. The question was no longer just "can a user see this?" It became "can a user, a report, or an AI agent see this?" Three audiences, one set of controls.
The compliance angle she hadn't planned on
She started the evening worried about an AI agent. By midnight she was thinking about audits.
Her company handles payments and health-adjacent data, so Salesforce compliance isn't optional. It's a calendar of recurring headaches. Concretio's page lines up its masking features against several of them.
The regulations on the list
-
PCI-DSS v4.0, Requirement 3.4.1. The primary account number must be masked when displayed, and this has been mandatory since April 2024. Contour's Card Masking template renders
****-****-****-1234and produces audit evidence. - HIPAA's minimum necessary standard. Service agents see masked patient data while compliance roles see the full record. Each role gets only what it needs.
- GDPR Article 25. Data protection by design. Role-based masking plus field-level governance metadata helps demonstrate ongoing compliance.
- SOX and CCPA are also on the list.
The paper trail
The piece that matters most at audit time is the evidence. Every deployment is logged with timestamps and field counts. The detailed event records are saved as Salesforce Files (ContentVersion), so they can be downloaded and shared, and they survive even if the log record gets deleted. Anyone who has chased screenshots through a Setup menu at 11 PM before an auditor visit knows what that's worth.
Good Salesforce data governance isn't only about stopping leaks. It's about proving, calmly and on demand, that you stopped them.
Three mistakes Priya almost made
Mistake one: treating FLS as the whole answer
Plain field-level security can hide a field, but it can't show half of one. If on/off is your only tool, your agents will end up either blind or over-exposed. Plan a masked version of every important field from day one.
Mistake two: only protecting the obvious fields
The SSN field is easy to spot. The real risk is sensitive data pasted into a notes box or a custom text field nobody remembers. Scan the records, not just the labels, or you'll protect the wrong things and call the job done.
Mistake three: protecting everything and documenting nothing
An auditor doesn't care how careful you were. They care what you can show. Salesforce compliance lives in evidence, so keep logs, keep dates, and keep the before-and-after states. Teams that treat Salesforce compliance as a once-a-year scramble end up paying for it twice.
Underneath all three sits one idea: Salesforce data governance is a habit, not a project. Whether it's field-level security on a new field or sensitive data arriving through a new integration, decide who sees what before the data shows up, not after.
Counting the savings (with a grain of salt)
These numbers come from Concretio's own page, so treat them as vendor estimates and run your own math. Their claims:
- 200 to 400 hours of admin time saved per masking project, worth roughly $15K to $60K.
- $12K to $32K saved per audit cycle, with audit prep going from about three weeks to on-demand.
- 30+ profiles updated in one click instead of one by one.
- One-click full rollback of layouts, FLS, Lightning pages, and formula fields.
Even if your org is smaller, the pattern holds. Manual masking costs the most in hours and in fear, and fear is hard to put on an invoice. Hidden Salesforce compliance risk isn't on any invoice either, until the day it is.
Questions Priya asked before installing
She's an admin, so she was skeptical. These were her questions, with the answers from Concretio's page.
Will it break my page layouts or integrations?
The reference scanner maps every layout, Lightning page, profile, and permission set that uses the field before deployment. You see what will change, and rollback restores everything if needed.
We already have Shield. Why add this?
Shield encrypts data at rest. Contour masks data on screen, in reports, and for AI agents. They protect different surfaces, and together they cover storage and display.
What is Salesforce data masking in production, exactly?
Many tools only work on sandboxes during a data copy. Contour masks at the display layer in production, using formula fields with role-based FLS, and the original data is never modified.
What happens to formulas that reference the original field?
They keep working. The masked field sits alongside the original rather than replacing it.
Does it handle permission sets, or just profiles?
Both. They're updated in one deployment, and both are restored on rollback.
Has it passed security review?
Concretio describes it as a 2GP managed package distributed through AppExchange. Service classes enforce with sharing and USER_MODE data access, and a dedicated permission set (Masker_Admin_User) controls who can use it. Per the vendor, nothing leaves your org.
If you want to know what field-level security can and can't do on its own, remember it's binary: visible or hidden. Everything above is about adding the missing middle option.
A checklist you can steal
Whether or not you use Contour, this is the order Priya followed. Steal it.
- Inventory first. You can't protect what you haven't found. Scan field names and record contents, because private values love generic text fields.
- Classify. Decide which fields hold sensitive data, and which need partial visibility rather than full hiding.
- Map every reference. Layouts, Lightning pages, profiles, permission sets. Know the blast radius before you click anything.
- Pick the right mask per field. Last 4 for SSNs, a card template for PANs, an email template for addresses.
- Split your permission sets. Make one for human agents, one for AI agents, one for compliance, and one for backend integrations. Don't let the agent's permission set quietly inherit everything.
- Pilot narrow, then expand. Start with one persona or a handful of objects, then widen the scan.
- Keep your evidence. Save logs somewhere durable. Your future self, mid-audit, will be grateful. This is the heart of practical Salesforce data governance.
- Plan your exit. Make sure every change can be undone before you make it.
If your org touches payments or health information, running this checklist is also the shortest path to calmer Salesforce compliance reviews. And if you want to see how automated Salesforce data masking compares to the manual route, run a small pilot on one object and time it against your own estimate.
Monday morning
Friday had been the longest day. She'd expected the scan to take hours. It took far less, and what it found made her wince: a card number in a Description field, a national ID in a custom "Verification Notes" box, a handful of personal emails sitting in a field called "Misc 3." Nobody had done anything wrong, exactly. Data just drifts. Years of quick fixes had left private values in places no checklist would ever have reminded her to look.
She spent Saturday reviewing the reference maps and Sunday evening deploying masked fields to the service and AI agent permission sets. She didn't sleep much that weekend, but not from worry.
At 9:02 on Monday the AI agent went live. Its first summary of a customer case referenced the account holder's SSN as ***-**-4321.
The head of customer service pinged her on Slack. "All good on your end?"
Priya looked at the clean audit log, the rollback option she hadn't needed, and her chai, still hot this time.
"Yes," she typed. "And this time I can prove it."
The takeaway
Most Salesforce data security stories start with an incident. Priya's started with a question she couldn't answer, and she got to fix it before it became one. The stack is simple once you see it: Shield protects data in storage, Data Mask & Seed protects your sandboxes, and the display layer protects what users and AI agents see in production. That last layer is the one most orgs have left open.
If your org has private fields, an Agentforce rollout coming, or an audit on the calendar, take a look at Concretio's Salesforce data masking solution. You can book a 30-minute demo, where they scan a sample org live and show how Contour finds, masks, and rolls back changes.
Then ask yourself Priya's Thursday question honestly: if an AI agent opened one of our records right now, what could it read?
If the honest answer is "everything," you've got a Monday morning of your own coming. Do it now, while Salesforce compliance is still a plan rather than a deadline, and while Salesforce data governance is still your call rather than an auditor's.