# Einstein Trust Layer security and privacy

*Agentforce Specialist Study Guide · Prompt Engineering · Last updated October 15, 2026 · https://www.certifyforce.com/study-guide/agentforce-specialist/prompt-engineering/einstein-trust-layer-security-and-privacy*

What each Einstein Trust Layer feature does on the prompt and response journey (secure data retrieval, data masking, prompt defense, the TLS-secured LLM gateway, zero data retention, toxicity scoring, demasking and the audit trail in Data 360), and the exam's favourite exception: data masking is disabled for agents.

- Certification: Salesforce Agentforce Specialist
- Exam section: Prompt Engineering
- Study guide: https://www.certifyforce.com/study-guide/agentforce-specialist

**Official exam objective:**

> Identify the security and privacy features of the Trust Layer.

## What the exam expects

- Trace a prompt through the Trust Layer and name what happens at each stage, out to the model and back.
- Match a security or compliance concern to the feature that addresses it: zero data retention, data masking, prompt defense, the LLM gateway, toxicity scoring or the audit trail.
- Explain how masking detects sensitive data (pattern-based, machine learning, field-based) and how demasking restores it.
- Recognise where the Trust Layer stops: masking is disabled for agents, it applies only to generative AI and Agentforce features, and it does not replace field-level security or Shield encryption.
- Key terms: **Einstein Trust Layer** (Salesforce's set of agreements, security technology and data and privacy controls around generative AI); **zero data retention** (providers keep nothing and train on nothing); **data masking** (replacing sensitive values with placeholders before the prompt leaves); **prompt defense** (system policies added to the prompt); **LLM gateway** (the single governed, TLS-encrypted channel to model providers); **audit trail** (prompts, responses and trust signals stored in Data 360).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Scope | Trust Layer capabilities apply only to generative AI and Agentforce features | [Designed for Trust](https://help.salesforce.com/s/articleView?id=ai.generative_ai_trust_arch.htm&language=en_US&type=5) |
| Masking and agents | Data masking for LLMs is disabled for agents | [Set up Einstein Trust Layer](https://help.salesforce.com/s/articleView?id=ai.generative_ai_trust_setup.htm&language=en_US&type=5) |
| Masking default | Enabled by default; entities or categories can be turned on or off | [Set up Einstein Trust Layer](https://help.salesforce.com/s/articleView?id=ai.generative_ai_trust_setup.htm&language=en_US&type=5) |
| Masking detection | Pattern-based (regex, context words, ML) and field-based (Shield or data classification metadata) | [Designed for Trust](https://help.salesforce.com/s/articleView?id=ai.generative_ai_trust_arch.htm&language=en_US&type=5) |
| Context window with masking | Limited to 65,536 tokens | [Supported Models](https://developer.salesforce.com/docs/ai/agentforce/guide/supported-models.html) |
| Zero data retention | Not retained, not used for training, deleted after the response returns | [Einstein Trust Layer](https://help.salesforce.com/s/articleView?language=en_US&id=sf.generative_ai_trust_layer.htm&type=5), [Designed for Trust](https://help.salesforce.com/s/articleView?id=ai.generative_ai_trust_arch.htm&language=en_US&type=5) |
| Gateway | Governs provider interactions; TLS encryption in transit | [Designed for Trust](https://help.salesforce.com/s/articleView?id=ai.generative_ai_trust_arch.htm&language=en_US&type=5) |
| Toxicity score | Five categories; overall score 0 to 1, 1 most toxic | [Follow the Response Journey](https://trailhead.salesforce.com/content/learn/modules/the-einstein-trust-layer/follow-the-response-journey) |
| Audit storage | Prompts, responses, trust signals and feedback in Data 360, with prebuilt reports | [Einstein Trust Layer](https://help.salesforce.com/s/articleView?language=en_US&id=sf.generative_ai_trust_layer.htm&type=5) |
| Audit prerequisite | Turn on generative AI data collection and storage; install the report package | [Audit Trail](https://help.salesforce.com/s/articleView?id=ai.generative_ai_audit_trail.htm&language=en_US&type=5) |

## Check yourself

- Why can one user's summary omit a field another user's includes?
- When does Trust Layer data masking not protect a prompt?
- Which two methods detect data to mask?
- Where are toxicity scores stored?

## Sources

- [Einstein Trust Layer](https://help.salesforce.com/s/articleView?language=en_US&id=sf.generative_ai_trust_layer.htm&type=5)
- [Einstein Trust Layer: Designed for Trust](https://help.salesforce.com/s/articleView?id=ai.generative_ai_trust_arch.htm&language=en_US&type=5)
- [Prompt Template Run-time Execution](https://help.salesforce.com/s/articleView?id=ai.prompt_builder_runtime.htm&language=en_US&type=5)
- [Set up Einstein Trust Layer](https://help.salesforce.com/s/articleView?id=ai.generative_ai_trust_setup.htm&language=en_US&type=5)
- [Audit Trail](https://help.salesforce.com/s/articleView?id=ai.generative_ai_audit_trail.htm&language=en_US&type=5)
- [Trust Layer](https://developer.salesforce.com/docs/ai/agentforce/guide/trust.html)
- [Follow the Response Journey](https://trailhead.salesforce.com/content/learn/modules/the-einstein-trust-layer/follow-the-response-journey)
- [Explore Large Language Model Data Masking](https://trailhead.salesforce.com/content/learn/modules/llm-data-masking-in-the-einstein-trust-layer/explore-llm-data-masking)
- [Supported Models](https://developer.salesforce.com/docs/ai/agentforce/guide/supported-models.html)
- [Prompt Builder Limitations](https://help.salesforce.com/s/articleView?id=ai.prompt_builder_limitations.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 9 linked practice questions, and unlimited timed mock exams are included with the Agentforce Specialist pack (USD $19): https://www.certifyforce.com/practice-exams