Compliance BCC Email
Compliance BCC Email is the Salesforce Setup feature that automatically blind-carbon-copies every outbound email sent through Salesforce (case emails, sales emails, mass emails, Email Alerts from automation) to a specified compliance archival address.
Definition
Compliance BCC Email is the Salesforce Setup feature that automatically blind-carbon-copies every outbound email sent through Salesforce (case emails, sales emails, mass emails, Email Alerts from automation) to a specified compliance archival address. The address typically belongs to an email archival system (Microsoft Purview, Mimecast, Smarsh, Global Relay, Proofpoint) that retains all corporate email for regulatory or legal hold purposes. The user sending the email does not see the BCC; the archive captures the message silently.
Compliance BCC Email exists because regulated industries (financial services, healthcare, legal, government) commonly need to capture every outbound business communication for retention and supervisory review. Salesforce-sent emails are part of that business communication; without Compliance BCC, they would bypass the archival system. The feature is one of the cheapest compliance wins: a single Setup configuration plus a mailing list at the archival side captures every Salesforce-sent email forever.
Why Compliance BCC is the one-setting compliance shortcut for regulated orgs
Where Compliance BCC lives in setup
Setup, Email, Compliance BCC Email. The page has one primary field: the email address to BCC on every outbound email. The address must be a real, reachable mailbox or distribution list at the archival vendor. The page also has an active flag; toggling on starts BCCing every outbound email, toggling off stops. Changes apply within minutes to subsequent outbound mail; in-flight emails are not retroactively BCCed.
What outbound mail is captured
The setting captures every email sent through the standard Salesforce email infrastructure: emails sent from Case feed (Send Email action), Sales Cloud email actions, Marketing Cloud-to-Salesforce sends, mass email sent to lead or contact lists, Email Alerts fired from Flows, Workflow Rules, or Approval Processes, Apex-sent emails through Messaging.SingleEmailMessage. The capture is complete; the user has no per-email opt-out. The exception: emails sent through Email Relay (where Salesforce sends through the customer's own server) bypass Compliance BCC because the customer's server handles the routing.
How it interacts with Einstein Activity Capture
Einstein Activity Capture syncs sent emails from Outlook or Gmail to Salesforce; those emails were sent by the user's mail client, not by Salesforce, so Compliance BCC on the Salesforce side does not apply. The compliance archival of EAC-synced emails is handled by the email server itself (Exchange retention policies, Google Vault). Most regulated orgs configure compliance retention both at Salesforce (Compliance BCC) and at the email server (Exchange or Gmail retention) to cover both paths. Skipping either creates a gap.
The user-visibility question and the BCC silence
The Compliance BCC is invisible to the sender. The Send button looks the same, the sent email log shows the To and CC recipients only, the archival recipient does not appear. This silence is intentional; users do not need to think about compliance archival on every send. The trade-off is that users may not realize their emails are being archived for compliance review; most orgs include the BCC in the corporate acceptable-use disclosure so users are aware in general even if not per-email. Some orgs add a footer noting that emails may be retained for compliance purposes.
Archival vendor integration patterns
The receiving address at the archival vendor is usually a mailbox the vendor monitors and ingests into the archive. Common patterns: Microsoft Purview using a dedicated journaling mailbox, Mimecast using a Smart Tag-driven mailbox, Smarsh and Global Relay using vendor-provided endpoints. The integration is one-way (Salesforce sends, vendor archives); no two-way sync is needed. Most vendors provide setup guides specifically for Salesforce Compliance BCC. The compliance team typically owns the vendor side; the Salesforce admin owns the Setup configuration; coordination at setup is the practical part.
Volume implications and the archival cost question
Every outbound Salesforce email becomes an inbound archival email. For high-volume orgs (mass marketing, automated alerts), the volume can be significant: tens of thousands of archived emails per day. Most archival vendors price by volume; the compliance team should size the archival contract for the expected Salesforce-sent volume. Email Alerts from Flow can multiply quickly if not designed carefully; an Email Alert on every Opportunity stage change in a 1,000-rep org fires 100,000+ times a month, each captured by Compliance BCC.
Audit, testing, and the verification habit
After enabling Compliance BCC, verify with a test send. Send an email from a Case to a personal address; check the archival vendor inbox for the BCC copy. Repeat from Sales Cloud, from an Email Alert fired by a Flow, from a mass email. Each path should appear in the archive. The verification catches misconfiguration (typo in the BCC address, distribution list permission issue) before compliance discovers the gap during a retention audit. Annual re-verification is the discipline most regulated orgs adopt.
How to set up and verify Compliance BCC Email
The setup is a one-field Setup change; the discipline is in the coordination with the archival vendor and the verification testing. Most regulated orgs set this up at go-live; if it was skipped, the gap is silent until a regulator asks for records.
- Coordinate with the compliance team on the archival vendor
Identify the archival vendor and the BCC mailbox or distribution list they expose. Get the address from the compliance or IT team; do not guess.
- Enable Compliance BCC Email in Setup
Setup, Email, Compliance BCC Email. Enter the BCC address. Toggle the active flag. Save.
- Verify with a test send from each path
Send a test email from Case feed, from Sales Cloud (Email related list), trigger a test Flow that fires an Email Alert, and run a small mass email. Check the archival vendor inbox for each.
- Document the configuration in your compliance runbook
Date enabled, archival address, vendor, owner. The runbook is what compliance and audit teams will reference; building it after the fact is harder.
- Update the corporate acceptable-use disclosure if needed
Most orgs cover compliance archival in general policy language; verify the disclosure addresses Salesforce-sent emails specifically if the legal team requires.
- Schedule annual re-verification
Once per year, repeat the test-send-and-verify cycle. Configuration drift (address change, vendor migration, distribution list permission change) is invisible until verification.
- Size the archival vendor contract for expected volume
For high-volume orgs (Email Alerts, mass marketing), the archival volume can be tens of thousands per day. Confirm the vendor contract covers the expected volume before turning on.
The archival mailbox or distribution list. Coordinate with the compliance team.
Toggles BCC on or off. Active applies within minutes to subsequent outbound mail.
The compliance vendor receiving the BCC (Microsoft Purview, Mimecast, Smarsh, etc.).
Compliance BCC does not apply when Salesforce uses Email Relay; archival is handled by the customer mail server.
The archival vendor contract size; should cover expected Salesforce-sent volume.
- Compliance BCC is invisible to the sender. Users do not see the BCC; document in corporate policy if the legal team needs explicit per-email awareness.
- Email Relay bypasses Compliance BCC. Orgs using Email Relay rely on the customer mail server for archival; verify both paths cover.
- Einstein Activity Capture emails are not captured. EAC syncs emails sent by the user's mail client; those need server-side compliance archival.
- Volume can surprise procurement. High-volume Email Alerts multiply quickly; size the archival contract before turning on.
- Verification drift is silent. Address changes or distribution list permission issues break the archive without notification; annual re-verification catches drift.
Trust & references
Cross-checked against the following references.
- Compliance BCC referenceSalesforce
- Email Administration overviewSalesforce
Straight from the source - Salesforce's reference material on Compliance BCC Email.
- Compliance BCC EmailSalesforce Help
- Email DeliverabilitySalesforce Help
- Email RelaySalesforce Help
About the Author
Dipojjal Chakrabarti is a B2C Solution Architect with 29 Salesforce certifications and over 13 years in the Salesforce ecosystem. He runs salesforcedictionary.com to help admins, developers, architects, and cert/interview candidates sharpen their fundamentals. More about Dipojjal.
Test your knowledge
Q1. Can a Salesforce admin configure Compliance BCC Email without writing code?
Q2. What is the primary benefit of Compliance BCC Email for Salesforce administrators?
Q3. Why is understanding Compliance BCC Email important for Salesforce admins?
Discussion
Loading discussion…