Todd McKinnon SVP Development Salesforce.com October, 2007 Plug Your Code in Here An Internet Application Platform

Safe Harbor Statement “Safe harbor” statement under the Private Securities Litigation Reform Act of 1995: This press release contains forward- looking statements including but not limited to statements regarding our expected future revenue, GAAP diluted earnings per share, expected tax rate, anticipated shares outstanding,and concerning the potential market for our existing service offerings. All of our forward looking statements involve risks, uncertainties and assumptions. If any such risks or uncertainties materialize or if any of the assumptions proves incorrect, our results could differ materially from the results expressed or implied by the forward-looking statements we make. The risks and uncertainties referred to above include - but are not limited to - risks associated with possible fluctuations in our operating results and cash flows, rate of growth and anticipated revenue run rate, errors, interruptions or delays in our service or our Web hosting, our new business model, our history of operating losses, the possibility that we will not remain profitable, breach of our security measures, the emerging market in which we operate, our relatively limited operating history, our ability to hire, retain and motivate our employees and manage our growth, competition, our ability to continue to release and gain customer acceptance of new and improved versions of our service, customer and partner acceptance of the AppExchange, successful customer deployment and utilization of our services, unanticipated changes in our effective tax rate, fluctuations in the number of shares outstanding, the price of such shares, foreign currency exchange rates and interest rates. Further information on these and other factors that could affect our financial results is included in the reports on Forms 10-K, 10-Q and 8-K and in other filings we make with the Securities and Exchange Commission from time to time, including our Form 10-K for the fiscal year ended January 31, These documents are available on the SEC Filings section of the Investor Information section of our website at Salesforce.com, inc. assumes no obligation and does not intend to update these forward-looking statements, except as required by law.

Company Overview 35,300 Successful Customers 900,000 Subscribers >$700M revenue run rate* NYSE: CRM Founded 1999, HQ San Francisco, CA Employees; 40 Offices; 20 Countries 24 Generations of Product Innovation <1% Customer Attrition June 25, Fiscal Year 35,300 Customers Growth in Customers * Run rate based on FY08 Q2 reported results

The Two Pillars of Our Product Strategy 1 2 The world’s most popular family of killer applications The world’s first platform as a service

Proven Scalability and Performance Delivering 100 Million Transactions Daily Page Response Time (ms) Quarterly Transactions (billions) Fiscal Year

8 8 oracle instances 139, ,000 virtual databases (orgs) 1,046,000 1,046,000 users 35,000 35,000 customers standard objects, 1.4 billion rows 176, ,000 custom objects,.35 billion rows 8:00 peak hour, 8:00 am requests per second 35,000 35,000 SQL execs per second Internet Scale

Salesforce.com’s Mission: Innovation Driver Become the trusted standard for managing all business information on demand On-Demand 21 st Century Platforms Client/Server Late 20 th Century Platforms Mainframe Mid 20 th Century Platforms

Platform Stack J2SE, SOAP, JSF UI, Api, Batch, Analytics Distributed Metadata, UDD, Cache, Resources Hardware Load Balancer (stateless) Apex Virtual Machine VisualForce (JSF) Session Cookie, In-process edits Other Pods Shared File System Search Servers Oracle RAC Mirroring / Disaster Recovery 1 Pod AppServers (single code base)

Declarative Procedural API Full Professional Development Stack Database On-demand virtualization, Scalable, Self-Optimizing Formulas, Workflow, Analytics, Role-based Sharing Inbound and Outbound Web services Apex On Demand Language, MVC Framework, Governed AppServer Requests, Access Controls, Caching, Monitoring, Localization Teams Tools, SCCS, Required Testing and Code Coverage Deployment Install, Upgrade, Version, Deprecate, Feedback, Sell, Bill

Create any table Add any field Build any relationship Security & sharing Automatic audit history tracking Automatic tuning Automatic backups Automatic upgrades 139,000 logical databases Possible with physical db’s? Create Any Database

A simple multi-tenant table Organization_idAccount_idname (data fields…) modstamp(standard fields…) org1001…1 org1001…2 org1001…3 …001…4 org2001…5 org2001…6 org2001…7 001…8 001…9 Account Standard Entity Hash partitioned by organization_id All indexes lead with organization_id (compressed, partitioned, local) Smart primary keys (key prefix) Standard audit fields and triggers

A multi-tenant polymorphic table – custom fields Organization_idKey_prefixId Name, (Others) Val0Val1… ValN org1a01a01…1 org1a01a01…2 org1a02a02…1 org1a02a02…2 org2a01a01…3 org2a01a01…4 org2a02a02…3 … … Custom Objects Key_prefix subsetting Still partitioning by organization_id Smart primary keys (key prefix) Re-use across organizations GUID primary keys ValN flex fields

A multi-tenant Custom Index Organization_idKey_prefixId Column # StringNumDate org1a01a01…12“hello” org1a01a01…232“my org1a02a02…112“index” org1a02a02…234“me” org2a01a01…327“please” org2a01a01…4 org2a02a02…3 … … Custom Index Writing index Org_id, entity id, col # (unique) Reading index Org_id, key_prefix, col #,, id

Magic multi-tenant generic data modeling  core.name_denorm –Single table with the name of all entities  core.seach_name_lookup –Single table with all pivoted name components (for search)  core.custom_index_value (and custom_unique_value) –Pivoted, de-normalized physical indexes (native data types)  core.custom_foreign_value –Reverse lookups for any foreign key  core.clob_data –Pivoted clob values, maintained efficiently

Multi-tenant Optimization Your Company Your Division Your Customizations Query Optimization Engine 1 Your Sharing Model Oracle CBO Multi-tenant statistics Application semantics (E.g. sharing model) Knowledge of mult- tenant data structures Query hinting and re- write Pre-query selective filters Optimized Response

Optimizer example: Entity v Boss v “Peon”  For a given query, at least 3 possible plans –Entity driven filter: standard or custom index (join) driven –Peon driven sharing: use nested loop sharing-driven (2 joins) plan –Boss plan: use hashing sharing plan (hash semi-joins)  Statistics we must track –Size of the entity for the organization –Approximate visibility by user to this entity –Statistics of various field fields (custom indexes) For domain fields: which values are high-cardinality? If we don’t know, pre-query with ROWNUM SELECT name FROM Account WHERE Status = ‘Red’

Data validation Formula fields and summaries State Machine workflows Multi-Step approvals Automatic approvals Audit history tracking 100% automatic upgrades Declarative versus Procedural Business users can get a lot done without coding

Transactional Logic, over a Web Service Stored Procedures, Triggers Reliable DML Upgrade Scripts Executing on our Servers Must protect the site Strongly typed Persist schema references Much more natural than JDBC Preserved through Upgrades Code Coverage and Testing built-in Web Service Exposure (In and Out) Real Apps Require Procedural Code The case for Apex (384,000 lines and growing)

But why a new language?  We considered the alternatives –Java? (JDBC is a lousy interface for this) –JavaScript (Rhino)? Other scripting language? ( not db focused) –Existing stored procedure languages? (ugly)  Advantages of writing our own –We control the syntax: deep salesforce.com integration Our idioms, our schema binding, our ecosystem –We control the runtime: control resources and coding behavior –We can ease the transition: looks like Java, acts like Pl/Sql –It’s not that hard to do: Java VM makes a great VM container  But we have a high bar to match… –Modern language features, modern IDE’s

Metadata Multi-Tenant Application Code Base Apex Multi-version Virtual Machine Your Code Our Infrastructure Java-like syntax Strongly typed Transactional Object Oriented Collections Database-focused Schema Aware Governed Secured Testing

Apex Code example

Apex Run Time: Code Governors TypeRestriction Data Access Total SOQL Statements (force Bulk) Number of rows retrieved Data Modification Total DML (insert, update, etc) Statements Number of rows modified Transactions, Other Resources Transaction control Statements Outbound Calls, s sent Statements Total statements issued (loops, etc)

Apex Code “Big Brother” Best Practices  Governor limits enforce efficient coding styles –No SOQL inside of a for loop  Required functional testing –Built into the language –Coming soon: requirement to test in bulk  Required code coverage –Inability to deploy to production without it  Higher bar for 3 rd ISV’s than IT developers We can (almost) prove that our releases won’t break production applications

Areas of Active work and research  Next level of expressiveness across the platform –Richer semantics for virtual schema design, SOQL and Apex –Provide a custom scheduler, flesh out VisualForce components –Complete the on-demand development tools Debugger: what to do about transactions?  Managed code correctness –Deadlock detection best practices –Dynamic-SOQL and reflection in Apex  Operational next generation architecture –Oracle 10g, 11g, much cheaper Pods, cheaper storage, high-latency data center communication –Database replication, zero-down time releases (Call Centers)

Q&A 