A customer emails your privacy team on a Tuesday morning and asks you to delete everything you hold on them. Someone opens the account in Salesforce, and the record looks complete: contact details, three closed opportunities, and a support case from last spring.
Then a sales rep mentions the signed contract. It's in her inbox, attached to a thread from 2023, along with a scanned ID the customer sent during onboarding.
That gap is where most Salesforce orgs live. The CRM holds the customer's data, while the customer's documents are spread across Salesforce Files, mailboxes, and shared drives that nobody connected to the record. Can Salesforce be the home for customer documents, and if it can't, how do you still keep one view of every customer?
Answering that starts with an honest look at how documents ended up in the CRM in the first place.
Your CRM Became a Filing Cabinet by Accident
It starts with convenience. A rep uploads a quote to an opportunity because it's convenient, service attaches a damage photo to a case, and over five years the org quietly turns into a document repository.
US companies lean on the CRM for this more than most. In the Market Momentum Index: IDP Survey 2025 by AIIM and Deep Analysis, which polled 600 enterprises, 64% of US respondents said they store, process, or manage documents in their CRM. That put CRM ahead of dedicated ECM and document management systems in the US, at 60%.
Think about what that means for an insurer or a bank. Policies, loan agreements, signed consent forms, ID copies, and claims correspondence all count as customer documents, and contracts are only one slice of that pile.
Every one of those files carries personal data.
So the real question is whether Salesforce was built to manage them, and that's where the trouble starts.
Where Salesforce Falls Short on Documents
Salesforce is excellent at what it was built for: structured customer data, pipelines, and service processes. Documents are a different kind of object, with their own lifecycle, and the platform treats them mostly as attachments to records.
Storage Built For Records, Not Archives
Every org gets a set file storage allocation, and once you outgrow it, extra capacity becomes a recurring line on your Salesforce bill. Ten years of signed agreements, scanned forms, and email attachments fill that allocation faster than most admins expect.
Storage cost is the easiest problem to spot. The harder one is that Salesforce Files has no idea what each document is.
No Retention Logic Per Document Type
A signed loan agreement and a marketing brochure sit in Salesforce Files side by side, governed by the same sharing rules. Neither one knows how long it must be kept or when it must go.
Banks and insurers can't run retention like that. A credit file may need to survive for years after the relationship ends, while a copy of a driver's license collected for onboarding should disappear as soon as its purpose is fulfilled.
Versions, Audit Trails, and People Without a License
Here's a scene that plays out daily at large insurers. A claims handler needs the policy schedule a broker uploaded to Salesforce, but claims runs on a different system, and she has no Salesforce license, so she emails a sales colleague, who downloads the PDF and sends it over.
There are now three copies of that document. Which one is current, and who changed it last?
Multiply that by every department outside sales and service, and the "single customer view" turns into a set of loosely related copies. That fragmentation has a direct cost once privacy law enters the picture.
Why One Customer View Matters For Privacy and Data Leaks
Privacy rules now land on US companies from several directions at once. Roughly 20 states have comprehensive consumer privacy laws, according to the IAPP US State Privacy Legislation Tracker, and most of them give consumers a right to have their data deleted. Indiana, Kentucky, and Rhode Island added theirs on January 1, 2026. If you also serve customers in the EU, GDPR's right to erasure applies on top.
A deletion request is easy to answer when you know where everything is. It becomes a scavenger hunt when the customer's documents live in five places.
The Retain-or-Delete Squeeze
US companies can't simply delete everything on request, because tax rules, industry regulators, and litigation holds require certain records to be kept, sometimes for years.
So you're balancing two obligations: keep what the law requires and remove what no longer serves a purpose. That balance only works if every document is classified by type and tied to one customer, so a defined retention rule can decide its fate. An unclassified PDF in someone's inbox can't be governed by any rule at all.
Fewer Copies, Fewer Leaks
Every forwarded attachment is another copy of personal data sitting outside your access controls, in a mailbox that may be synced to a personal phone.
Centralizing Customer Documents Shrinks Your Attack Surface
When people open the document in one governed place, there are fewer stray copies to lose, and access rights are set in one system.
If one customer file is the goal, the next question is how to build it around Salesforce. There are three common routes.
Three Ways to Handle Documents Around Salesforce
Each route solves a different problem, so it's worth being clear about which problem you actually have.
• Keep it native. Salesforce Files works well when volumes are low, users all have licenses, and no regulator asks how long you keep things. Small sales teams live happily here.
• Offload the storage. Salesforce's own Files Connect lets users access, search, and share files held in Google Drive, SharePoint Online, OneDrive for Business, or Box from inside Salesforce. That relieves storage pressure, but access follows the external system's sharing settings, and retention stays whatever that repository offers.
• Connect a content platform behind Salesforce. Enterprise content management (ECM) platforms add the governance layer: retention schedules per document class, versioning, audit-proof archiving, and access for people outside the CRM. OpenText offers Extended ECM for Salesforce, and Doxis connects to Salesforce through its SmartBridge for Salesforce.
For a regulated enterprise, the third route is where most end up, because storage was never the real problem. The design question is how the two systems share the work.
The Pattern That Works: Salesforce Leads, the Content Platform Governs
The setups that hold up in audits share one principle. Salesforce stays the system where people work with customers, and the content platform is where documents are stored, versioned, and governed.
Here's how that looks in practice, using a Doxis implementation as the example. Other ECM platforms follow a similar logic, though the mechanics differ.
A Customer File That Builds Itself
When a new account, opportunity, or case appears in Salesforce, the integration automatically creates a matching electronic file (an eFile) in Doxis and carries the
Salesforce metadata across. Documents attached in Salesforce move into that file, and new versions are synced as they arrive.
Sales and service teams can stay in Salesforce. The Doxis client can be embedded as a component on the record page, so a rep sees folders, versions, and workflows right next to the opportunity. There's a closer look at how Salesforce becomes part of an ECM platform if you want the technical background.
Retention Lives in the Platform
The connector only moves documents and metadata. Retention and deletion rules are defined in the content platform itself, per document class and per eFile class, which is why the platform choice matters more than the connector.
That split also tells you what to check before you sign anything.
Questions to Ask Before You Choose an Integration
Vendor demos look alike at first glance. These questions separate a document bridge from a governed customer file:
1. Which Salesforce objects are mapped out of the box? Accounts, opportunities, and cases are standard, while custom objects and knowledge articles vary by vendor.
2. What syncs in real time, and what runs on a schedule? Generated quote PDFs, for example, sometimes sync on a timer, which matters if someone needs the latest version in the next five minutes.
3. How do access rights carry over? Ask whether Salesforce sharing rules are mirrored, mapped, or managed separately, and who maintains them.
4. How are retention and deletion handled per document type? Ask the vendor to show you the deletion of a single customer's documents, step by step.
5. What happens to the original file in Salesforce after archiving? Some teams delete it to save storage, others keep a link, and both choices have consequences for users.
6. Who outside the CRM needs access? If claims, finance, or legal work is done on customer documents, their access path deserves as much attention as the sales experience.
A vendor who answers all six with specifics, ideally in a live system, is offering governance. Vague answers to questions 3 and 4 usually mean you're buying storage.
One Customer, One File
So can Salesforce be the home for customer documents? For a small team with low volumes, often yes.
For an enterprise in a regulated industry, Salesforce should stay in the place where work happens, with a content platform behind it that knows what each document is, who may see it, and how long it must live. That's what turns a customer record into a customer view, and it's what lets your privacy team answer Tuesday's deletion request in an afternoon.
For that setup, Doxis is the way to go. It creates a customer file automatically for Salesforce accounts, opportunities, and cases; keeps those documents visible on the record page; and applies retention and deletion rules per document class in one platform. Colleagues in claims, finance, or legal work on the same file without needing a Salesforce license.
