Applies to orgs using Salesforce Sites or Experience Cloud for public Payments2Us forms
This article is for Salesforce administrators preparing for Salesforce's Winter '27 change that conceals personal information on User records when visitors use your site without logging in (the site guest user).
Overview
Salesforce is introducing stricter personal information masking for guest users as part of Enhanced Personal Information Management (EPIM).
When this is enabled or enforced in your org, Salesforce hides (masks) certain User fields for the site guest user, the identity your public payment pages run under. Which fields are hidden is controlled by the Guest_PersonalInfo_EPIM field set in Setup, under User Management Settings.
HOW PAYMENTS2US USES USER INFORMATION ON PUBLIC SITES
Payments2Us public checkout, completion pages, and some PDF outputs can run as the site guest user. In those situations, the product may read a small set of User fields on that guest identity:
Language/locale: used to set the default language on checkout and related pages when you have not set a language in the page URL.
Email and Active: used only if an unexpected error occurs on the public site, to help route an internal alert email. This is not used for normal successful payments or donor receipts.
If your Receipt Text, Letter Text, or similar HTML includes User merge fields (for example, a signature line with a staff first name), Payments2Us loads those User fields when a guest opens the PDF.
ACTION REQUIRED BEFORE GUEST PII MASKING IS ENFORCED
Salesforce's default Guest_PersonalInfo_EPIM field set often includes fields that Payments2Us must be able to read on the site guest user. You should remove the following User fields from Guest_PersonalInfo_EPIM so they are not masked for guest users:
Email: unexpected error alerts on public checkout
Locale (shown in Setup as Locale Sid Key): default language on public checkout and related pages
Active: same error-alert path as Email
If you use User merge fields in receipt or letter text shown on guest-accessible PDFs, also remove those specific User fields from Guest_PersonalInfo_EPIM.
Steps in Salesforce
- Go to Setup and open User Management Settings.
- Confirm whether Enhanced Personal Information Management and guest field masking are enabled.
- Open the Guest_PersonalInfo_EPIM field set in the User Object
- Remove Email, Locale (Locale Sid Key), and Active from the field set, then Save.
- Remove any other User fields you reference in guest-facing receipt or letter merge text.