Changes to Salesforce Integration with Universal Consent & Preference Management

Salesforce is updating the way third‑party partners integrate with its platform to improve security, strengthen data protection, and reduce the risk of vulnerabilities introduced through external API‑based workflows. These changes follow tightening of AppExchange and ISVForce security standards, including mandatory security reviews and stricter OAuth governance. Recent incidents, such as the 2025 Salesloft/Drift OAuth breach, demonstrated how attackers abused OAuth tokens associated with third‑party apps to pivot into Salesforce customer orgs, highlighting risks in connector‑model integrations.

Why Salesforce Is Making These Changes

Strengthening Security Controls

Salesforce now enforces more robust requirements for applications accessing customer data, including mandatory AppExchange security reviews and detailed testing of OAuth flows and external data transfer paths.

Reducing Vulnerability Risks

The Salesloft/Drift incident showed attackers exploiting OAuth and refresh tokens through a connected app, demonstrating why Salesforce is tightening governance around connected apps, token lifecycle management, and API security.

Introducing API-Based Integration Pricing

Under the ISVForce program, partners distributing API‑based integrations must purchase ISVForce Services or Annual Fee bundles, ensuring that API usage is governed and aligned with Salesforce’s partner ecosystem standards.

What This Means for OneTrust Customers

OneTrust is transitioning from legacy connector approaches to a Salesforce‑approved, security‑reviewed native application model.

The new integration aligns with Salesforce’s mandatory security and packaging standards, reducing exposure to OAuth‑based risks.

Existing integrations continue functioning today, but long‑term Salesforce governance favors reviewed, packaged integrations and customers will be required to download the OneTrust manage package in their Salesforce instance.

OneTrust will provide advance notice, migration guidance, and continuity of service throughout the transition.