Environment & Release Management

May 2008

2

Safe Harbor Statement

“Safe harbor” statement under the Private Securities Litigation Reform Act of 1995: This presentation may contain forward-looking statements the achievement of which involves risks, uncertainties and assumptions. If any such risks or uncertainties materialize or if any of the assumptions proves incorrect, our results could differ materially from the results expressed or implied by the forward-looking statements we make.  All statements other than statements of historical fact could be deemed forward-looking, including any projections of subscriber growth, earnings, revenues, or other financial items and any statements regarding strategies or plans of management for future operations, statements of belief, any statements concerning new, planned, or upgraded services or technology developments and customer contracts or use of our services.

The risks and uncertainties referred to above include - but are not limited to - risks associated with the integration of Sendia Corporation’s technology, operations, infrastructure and personnel with ours; unexpected costs or delays incurred in integrating Sendia with salesforce.com, which could adversely affect our operating results and rate of growth; any unknown errors or limitations in the Sendia technology; any third party intellectual property claims arising from the Sendia technology; customer and partner acceptance and deployment of the AppExchange and AppExchange Mobile platforms; interruptions or delays in our service or our Web hosting; our new business model; breach of our security measures; possible fluctuations in our operating results and rate of growth; the emerging market in which we operate; our relatively limited operating history; our ability to hire, retain and motivate our employees and manage our growth; competition; our ability to continue to release and gain customer acceptance of new and improved versions of our CRM service; unanticipated changes in our effective tax rate; fluctuations in the number of shares outstanding; the price of such shares; foreign currency exchange rates and interest rates.

Further information on these and other factors that could affect our financial results is included in the reports on Forms 10-K, 10-Q and 8-K and in other filings we make with the Securities and Exchange Commission from time to time, including our Form 10-K for the fiscal year ended January 31, 2006. These documents are available on the SEC Filings section of the Investor Information section of our website at www.salesforce.com/investor.

Any unreleased services or features referenced in this or other press releases or public statements are not currently available and may not be delivered on time or at all.  Customers who purchase our services should make purchase decisions based upon features that are currently available.  Salesforce.com, inc. assumes no obligation and does not intend to update these forward-looking statements, except as required by law.

Agenda

Environment and Release Management

Refreshable Sandbox Environment:The Technology

Development

Training

Testing

Environment Capability Sandbox

Sandbox with Data• Production Copy - Full Configuration and Data can be promoted to Sandbox for testing and/or

training• Support – Sandbox receives the same world-class support as the Production environment.

Salesforce.com is available to address all customer issues associated with Sandbox• Sandbox Refreshment - Sandbox refresh is a batch process, similar to the customer experience

of loading leads, accounts or contacts. The customer will receive an automated email when their refresh request has been processed. Actually processing time will vary depending on the size of the customer’s production environment.

• Separate Hardware - Sandboxes exist on a completely separate set of Web, database, application, API, cache, and search servers in order to minimize any negative impact on the live production instances.

• Restricted End-User Access - To prevent users from inadvertently logging into or receiving email notifications from the sandbox environment, usernames and email addresses on those servers are automatically modified (with the exception of the user who requested the sandbox copy). Administrators can open up access to additional users if desired after the copy is made.

Sandbox Config Only• Config Only – With Summer 07 release, our UE customers are now able to have up to 5

configuration only sandboxes. The config only sandboxes are limited to 500MB storage

Single Click Force.com Sandbox

Move Your Apps’ Configuration and Code from Sandbox to Production

Multiple Sandbox Environments

Production Deployment

Develop

Test

Train

Version Control

IDE

CVS

Refreshable Sandbox Environment:The Process

One-Click Refresh

2. Refresh Sandboxes

3. Parallel Development in Config Only Dev Orgs

4. User Testing in Full UAT Sandbox5. Updated Production

ConfigurationSource Control

CVS

Environment Architecture - Example

Production

Production instance supporting all-end users deployed on main instance of salesforce.com

Pro

duc

tion

Salesforce.com Customer Systems

Middle Ware

MDM

3rd Party System

BW

Development

De

velo

pmen

t

Middle Ware

MDM

3rd Party System

BW

Development will be on a Sandbox Config only org. Data will be manually loaded through data loader as needed

QA/UATQA

/UA

T Middle Ware

MDM

3rd Party System

BW

QA/UAT will be on a Sandbox with Data org. Data will automatically be copied from the production org so it will simulate the user experience there

Environment Architecture – Example

TrainingTra

inin

g

No Integrations Needed for Training

Training will be on a Sandbox Config only org. Data will be manually loaded through data loader as needed

Foundation

Fou

ndat

ion

Foundation will be on a Sandbox Config only org. Data will be manually loaded through data loader as needed

Middle Ware

MDM

3rd Party System

BW

Environment Considerations

Environment Considerations

QA/UAT Environment Considerations• Data – Transactional and Reference data need to be refreshed regularly for test cycles• Users - Will require 1 test login per role to test functionality• Interfaces - Environment will need to interface with legacy environments• Performance Testing - Full data loads and interface testing are required• Middleware integration - Multiple middleware environments to interface with for testing• Bug/fixes - Will need to be promoted from Development to Test

Training Environment Considerations• Training Data - Unique / controlled data set is required • Refresh Strategy - Data will need to be refreshed after every training session• Users - Approximately 30 training logins will be required• Interfaces - Environment will not need to interface with legacy environment• Phased Training - Training will continue after users are live on system

Foundation Environment Considerations• Data – Data will need to be manually loaded as appropriate for unit testing purposes• Interfaces - Environment will need to interface with legacy environments• Configuration Synchronization – changes made to the development environment for Pilot or Fast Track items must

be kept in sync with foundation instance

Development Environment Considerations• Data – Data will need to be manually loaded as appropriate for unit testing purposes• Unit Testing – Environment will need to interface with legacy environment is unit testing must include this

Traditional SDLC Process

1 Business Case Suite Completed

2 Project Plan and Roadmap defined

3 Inter-Program coordination points & dependencies identified

4 Business and IT resources, requirements and efforts coordinated

5 Value Case Updated

6 Global x-functional team in place

7 Quantitative & qualitative metrics defined

* Dates to be determined after completion of BRD

FRDSign-Off<xx/xx>

ITAnalysis <xx/xx>

ExecuteCommit<xx/xx>

TARGET In-Production

Date<xx/xx>

ConceptCommit<xx/xx>

Sign-OffUse Case<xx/xx>

FRDComplete<xx/xx>

Bus. Case Suite

Complete<xx/xx>

* Business Acceptance

Test Sign-Off

* UAT & Readiness Review

(Business & IT)

User EnablementEngagement

<xx/xx>

Traditional SDLC process is primarily driven by IT, with input and sign-off from the business

Analyze Design Develop Test Train & Deploy

Sample SDLC

Business Responsibilities

Daily Changes

Reports Dashboards List View Management Documentation Management User Administration Solution Management Communication Templates Email Templates

IT Responsibilities

Monthly Changes

Minor Release: Simple configuration changes that do not impact day to day business or require training. As Required (Target Monthly)

Major Release: New Initiatives and other changes that require training or testing. Dates determined by Steering Committee(Target Quarterly)

On-Demand supports existing SDLC processes, but allows for flexibility to deploy more quickly

Release Definitions

Release

Type

Activities Examples Level Of Effort

Immediate Release • Small changes that can be implemented in a short time span and

directly in the production environment as needed

• Changes can be configured, tested and deployed with minimal

impact within a single business unit

• DOES NOT HAVE TO GO THROUGH CHANGE CONTROL

PROCESS

• New dashboards and

reports

• Field positioning

• New related lists

• New roles

• Data Loads

• Territory Alignments

LOW

• No additional training

required

• None or minimal impact to

integration

• Potential candidate for

Business Administrators

Minor (Monthly)

Release

• Medium level changes that can be implemented with minor

impact to the production environment

• Changes can be configured, tested and deployed with minor

impact to one business unit

• New Fields

• New page layouts

• New custom Objects

• New org or sub-org in role

or territory hierarchy

MEDIUM

• < 1 day of additional

training required

• < 1 week of configuration

development

• IT involvement

Major Release • Large changes that have major impacts to the business or

environment

• Changes requiring a significant interface update, data migration

and/or integration impact

• Major releases should be tracked by a standard naming

convention for items such as: Role Hierarchy, Profiles, Page

Layouts, Record Types, Sales and Support Processes, sControls

• Items that do not need to follow naming convention: Fields,

Custom Objects, Reports, Dashboards

• New AppExchange app

• Process-impacting

configuration changes

• Data migration impact

• Integration changes

• Impacts to multiple

business units

HIGH

• 1 day of additional training

required

• > 1 week of configuration

development

• > 1 week of integration

development

• IT lead

For consistent implementation and support, investment requests should be categorized as immediate, minor or major based on level of effort

Release Definitions

Security Reviews ManyFew

Simple

Difficult

Level of Effort

Source: Faulkner 2006

Immediate Releases

Minor Releases

Major Releases

Implement immediate changes Owned by individual sub-group Minimal impact to the production floor

Minor changes impacting two or more groups Thrice as often as a Major Release Minor impact to training and production

Major impact on production and integration Significant changes such as AppExchange development Ali d with alpha / beta platform releases Impact across than one business unit

Release Management Scope

5. Application AdministrationReports DashboardsLetterhead TemplatesEmail TemplatesMail Merge TemplatesDocuments (e.g. images, links)Product Catalog

3. Standard Configuration

i. Data ModelCustom Objects

Properties

Custom Fields Picklist Values Field Dependencies Validation Formulas Audit Trail

Record Type / ProcessesTranslation Workbench

ii. User InterfaceHome Page ComponentsTab Names & LabelPage Layouts

Properties Fields Assignment Related List Assignment Custom Links / SControls Assignment

Custom Applications / Tabs Custom Buttons / LinksCustom Report TypesSearch Layout

4. CustomizationApex TriggersApex Classes / ScriptsApex Classes / Email ServicesS-ControlsVisual Force (Pre Release Only)Code reference to specific record id’s

2. Business Rules Automation

Workflow RulesApproval ProcessesAssignment Rules Validation RulesTerritory RulesCase Escalations Rules

1. Security & VisibilitySecurity Settings (including SSO)Organization Wide DefaultsSharing RulesUser recordsProfile settingsField Level SecurityRole HierarchyTerritory HierarchyFolder PermissionsPublic GroupsQueuesPage Layout to Profile AssignmentMobile Administration

Deployment Options - Comparison Tables

Items Pre Production

Data Integration

ApplicationPackage

Meta Data API Calls

Third Party Tools

(Snapshot)

Mercury Script

Manual

Security Settings Organization Wide Defaults Sharing Rules User records Profile settings new only partial Field Level Security Role Hierarchy Territory Hierarchy Folder Permission partial new only Public Groups Queues Page Layout to Profile Assignment Mobile Administration

1. Security & Visibility

= major release / high impact = within release cycle = frequent updates

Post Production

Sandbox Refresh

Deployment Options - Comparison Tables

Items Pre Production

Data Integration

ApplicationPackage

Meta Data API Calls

Third Party Tools

(Snapshot)

Mercury Script

Manual

Worflow Rules new only Workflow Alerts new only Workflow Outbound Messages new only Workflow Tasks new only Approval Processes Assignment Rules Validation Rules Territory Rules Case Escalations new only

2. Business Rules Automation

= major release / high impact = within release cycle = frequent updates

Post Production

Sandbox Refresh

Deployment Options - Comparison Tables

Items Pre Production

Data Integration

ApplicationPackage

Meta Data API Calls

Third Party Tools

(Snapshot)

Mercury Script

Manual

Custom Object Definitions new only Custom Object Properties Custom Field Definitions new only new only Picklist Values new only new only Field Dependencies w/ edits Validation Formulas Audit Trail w/ edits Record Types Object Processes Translation Workbench new only w/ edits ***

3. Standard Configuration / i. Data Model

= major release / high impact = within release cycle = frequent updates

Post Production

Sandbox Refresh

*** : Frequent updates for picklist values only.

Deployment Options - Comparison Tables

Items Pre Production

Data Integration

ApplicationPackage

Meta Data API Calls

Third Party Tools

(Snapshot)

Mercury Script

Manual

Home Page Components new only w/ edits Tab Names & Labels Page Layouts Properties Field Assignments Related List Assignments Custom Links Assignments S-Controls Assignments Custom Applications new only Custom Tabs new only Custom Buttons / Links new only Custom Report Types new only Search Layouts

3. Standard Configuration / ii. User Interface

= major release / high impact = within release cycle = frequent updates

Post Production

Sandbox Refresh

Deployment Options - Comparison Tables

Items Pre Production

Data Integration

ApplicationPackage

Meta Data API Calls

Third Party Tools

(Snapshot)

Mercury Script

Manual

Apex Triggers new only Apex Classes / Scripts new only S-Controls new only Code Ref to Record Id’s Email Services Visual Force (pre-release only) new only

4. Customization

= major release / high impact = within release cycle = frequent updates

Post Production

Sandbox Refresh

Deployment Options - Comparison Tables

Items Pre Production

Data Integration

ApplicationPackage

Meta Data API Calls

Third Party Tools

(Snapshot)

Mercury Script

Manual

Reports Dashboards Letterhead Templates Email Templates Mail Merge Templates w/ edits Documents (e.g. images, links) w/ edits Product Catalog

5. Application Administration

= major release / high impact = within release cycle = frequent updates

Post Production

Sandbox Refresh

***

***

*** : Only for Sandbox Full Copy.

Estimated Level of Effort – Comparison Table

Deployment Options

Dev QA/UAT Prod Training Activities

Data Integration

Data Load + 0-8hrs

Automated Automated Data Load + 0-8hrs

After initial setup: Users, Roles, Territories and Public Groups will be uploaded automatically via Role Mgmt Integration.

Application Package

1-5 minutes per item

1-5 minutes per item

1-5 minutes per item

1-5 minutes per item

Create Package by selecting each item Upload Package, Validate Log, Run Snapshot Diff

Meta Data API Calls

n/a 1-5 minutes per item

1-5 minutes per item

1-5 minutes per item

Using tools such as Eclipse, drag and drop objects and fields definition from one environment to another.

Third Party Tools /Snapshot

n/a Automated + 0-8hrs

Automated + 0-8hrs

Automated + 0-8hrs

Click of a button transfer of Configuration Validate Log, Run Snapshot Diff

Mercury Script n/a Automated + 0-8hrs

Automated + 0-8hrs

Automated + 0-8hrs

Recording in Dev, transfer to QA/UAT, Prod Certain items need Mercury script manual edits.

Manual Entry 5-20 minutes per item

5-20 minutes per item

5-20 minutes per item

5-20 minutes per item

Manual Entry from one environment to another

*** Estimated level of effort calculated using an average time of configuration by item in minutes. This estimate is only for a comparison basis and subject to change.

Sandbox Refresh (Post Production Only)

15min to 12hrs***

15min to 12hrs***

15min to 12hrs***

15min to 12hrs***

Enter Sandbox Refresh Request

***Depending on number of records and sandbox refresh requests received by SFDC at that time (e.g. TL CRM average time is 30 minutes).

Key Activities:- Project Team create prototype in cm, sfa or tlcrm sandbox.

- Project Team run Snapshot Diff to export implementation items.

- Project Team add design items to PM Org and generate initial design document.

- Project Team complete design document and submit for approval.

- Once approved, Release Manager upload implementation items per PM Org.

- Release Manager determine deployment strategy.

Key Activities: - Release manager applies package or run script to Prod.

- Release manager coordinates data migration and integration items.

- Release manager completes manual tasks.

- Release manager run Snapshot Diff to ensure that all configuration are included.

- Additional validation via Mercury Testing Tool can be added.

Key Activities:- Release manager prepares one or many packages or Mercury scripts from Dev and apply them in QA/UAT.

- Release manager coordinates data migration and integration items.

- Release manager completes manual tasks.

- Release manager run Snapshot Diff to ensure that all configuration are included.

- Additional validation via Mercury Testing Tool can be added.

Release Management Roadmap - Example

Step 1 Step 2 Step 3

Development Cycle Quality Assurance Cycle Deployment Cycle

What’s available in the Metadata API?

Spring ’08 (152) Planned for Summer ’08 (154) Custom fields Custom objects Apex classes Apex triggers Apex components Visualforce pages S-controls RecordTypes Profiles Field level security

Custom applications (tabsets)

Custom tabs Documents Folders Package Weblink Email template Letterhead Picklist / RecordType

map

Custom buttons

Static resources

Custom links

Workflows

Page layouts

Page layout

assignments

Home page

components

Home page layouts

Validation rules

Approval processes

Custom report types

Tab and field renaming

Button overrides

Field dependencies

Picklists

Dashboards

Reports

List views

Queues

Public groups

Email attachments

Translation

Other Enhancements to our MetaData API are planned for the future as well