CRM · CIK 1108524
What Salesforce, Inc. told the SEC could break it.
Salesforce depends on infrastructure it doesn't own: it relies on third-party data-center hosting facilities and cloud-computing platform providers in the U.S. and abroad, along with the underlying networks of the Internet, to deliver its products and run critical systems, so disruptions or capacity shortfalls could impair service. It is also exposed to shifting and uncertain sanctions and export/import controls, driven by tariff-policy changes, increasing government regulation of AI and cloud services, and geopolitics including U.S.–China relations and Russia sanctions, amid heightened enforcement. And it carries concentration in its strategic investment portfolio, which invests primarily in enterprise-cloud companies and technology startups, exposing it to sector-correlated valuation swings.
3 self-disclosed vulnerabilities, pulled from its own filings, each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Regulatory & policy
- sanctions/export-control change and AI/cloud regulation (US-China, Russia)medium
Sanctions and export/import control regulations are subject to change and uncertainty — driven by tariff-policy changes, increased AI/cloud-service regulation, and US-China relations, Russia sanctions and Middle East conflict — with regulators signaling heightened enforcement and self-disclosure pressure.
“Sanctions and export and import control regulations in the United States and other countries are subject to change and uncertainty, including as a result of tariff policy changes, rapidly evolving technology, increased government regulation of AI and cloud service solutions, and geopolitical developments such as events affecting relations between the United States and China, multi-jurisdictional sanctions on Russia, the war in Ukraine and regional conflict in the Middle East.”
SEC filing →As of 2026
Supplier concentration
- dependence on third-party data-center hosting and cloud-computing platform providersmedium
Salesforce relies on third-party data center hosting facilities and cloud computing platform providers (in the U.S. and abroad) plus the underlying networks that power the Internet to deliver its products and run critical systems; disruptions or capacity shortfalls could impair service delivery.
“We rely on third-party data center hosting facilities and cloud computing platform providers located in the United States and other countries, as well as the many different underlying networks and services that power the Internet, to deliver our products and services and operate critical business syste”
SEC filing →As of 2026
Other disclosures
- strategic-investment-portfolio concentration in enterprise cloud/technology companieslow
Salesforce is exposed to concentrations of risk in its strategic investment portfolio, which primarily invests in enterprise cloud companies and technology startups within specific industries, exposing it to sector-correlated valuation swings.
“The Company is also exposed to concentrations of risk in its strategic investment portfolio, including within specific industries, as the Company primarily invests in enterprise cloud companies, technology st”
SEC filing →As of 2026
The hidden graph
Who it depends on, and who depends on it.
Relationships surfaced from filings, including ones disclosed by the other side, which is how the non-obvious ones come to light.
Its customers
“Fundamental elements of the nCino Platform are built on the Salesforce Platform and we rely on our agreement with Salesforce to use the Salesforce Platform in conjunction with these solutions, including for hosting infrastructure and data center operations.”
Cited →“For Veeva CRM and certain of our multichannel CRM applications, we currently utilize the hosting infrastructure provided by Salesforce.”
Cited →
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch