Salesforce standard SObject PII map

Vulkro knows which fields on the main standard objects hold personal data, so Apex that queries Contact.Email is recorded as processing personal data even if the code never says so.

List<Contact> cons = [SELECT Id, Email, Phone FROM Contact];
// reported: Contact.Email, Contact.Phone

On every Apex SOQL or DML statement that touches a mapped object, Vulkro reports one finding per (object, field) pair per file, under the rule sf-standard-sobject-pii. Test classes are skipped.

Covered objects

Object	Examples of mapped fields
Account	Billing and shipping address, phone, fax, website, Person Account Person* fields
Contact	Email, phone, mobile, mailing address, birthdate, name
Lead	The same personal fields as Contact
Opportunity	Amount, close date, forecast category (commercially sensitive)
Case	Supplied email and phone, description, subject
User	Email, username, federation id, phone, address

Tiers

Tier	Meaning	Severity	Confidence
1, regulated PII	Direct identifier, government id, payment data, credentials	Low	High
2, personal information	Personal detail or contact channel	Low	High
3, commercial-sensitive	Not personal, but confidential	Low	Medium

Severity is Low at every tier: the finding is an inventory fact ("this code reads Contact.Email"), not an exposure. Whether the read is allowed is answered by the CRUD/FLS, sharing and guest-user rules, which report on their own evidence. The PII findings feed the compliance rollups (GDPR records of processing, SOC 2 CC6.8, HIPAA).

Custom objects

Fields on custom objects (MyObj__c, Email__c) are not in this map, because their meaning is project specific. The general field-name catalog covers them instead.

Not covered yet

• A managed package that redefines a standard field: namespaced names (acme__Account) resolve to the bare object.
• Health Cloud and Financial Services Cloud objects are not in this map; separate Industries Cloud checks cover their sensitive objects and fields.

See also: Compliance mapping, GDPR