Salesforce Consultants near you

Salesforce publishes role-based credentials and runs a verification service where a certification can be confirmed and its maintenance requirements viewed. Maintenance is a real feature of the scheme rather than a formality: holders are expected to keep up with product updates and demonstrate that knowledge to keep credentials current, which is a reasonable proxy for whether someone has worked on the platform recently.

What a credential does not tell you is whether the person has done work like yours. Certification proves platform knowledge, not judgement about your data model or your sector. Ask for references from organisations of a similar size and shape, ask who specifically will do the work rather than who is in the sales meeting, and ask to see a configuration they built and why they chose it.

Change should be built in a sandbox, reviewed, and deployed to production through a repeatable process rather than rebuilt by hand in the live environment. Hand-built production change is how two environments drift apart until nobody can test anything safely, and it is the single clearest signal about how a consultancy works.

Salesforce updates the platform on a published schedule several times a year, and those updates apply to your org whether or not you are mid-project. Ask how the consultancy tracks release changes, whether it tests in a sandbox ahead of the update reaching production, and what happens if a release affects something it built. Include that in the support arrangement rather than treating each release as a new piece of chargeable work.

Hold the subscription in your organisation's name and keep at least one system administrator account that only your own people control. Consultancies legitimately need privileged access to work, and named accounts for each consultant give you that without giving away the keys. Review those accounts when people leave the project, because partner staff turn over and a dormant administrator account is a standing risk.

Keep your own record of what has been installed and why. Managed packages from the AppExchange come with their own licences, their own renewals and their own effect on your data model, and removing one later is not always clean. A simple register of packages, owners and renewal dates prevents the common situation where nobody knows what a component does or whether it is still needed.

You are the controller for the personal data in your org. Salesforce, as the platform provider, processes it on your behalf, and it publishes a compliance documentation library covering certifications, audit reports and assurance material that your own due diligence can draw on. A consultancy that accesses production data is a further processor and needs its own written contract with you.

In practice the sharpest risk is not the platform, it is the copies. Data extracted for migration, refreshed into sandboxes or exported for a reporting project ends up in places that are not covered by anyone's assessment. Agree in writing where production data may be copied to, whether sandbox refreshes carry real personal data or masked data, and how extracts are destroyed when the work is finished.