Security

Salesforce Saver only reads from your org. It never creates, edits or deletes anything in Salesforce. This page lists exactly what it reads, what it keeps and how to cut it off.

What you approve in Salesforce

You connect through Salesforce's standard sign-in and approve access on Salesforce's own screen. Salesforce has no read-only option for connected apps, so that screen says the app can “access and manage your data”. That's the same wording every Salesforce API app gets. What Salesforce Saver does with the access is limited by its code to the read queries below.

If your security team wants that guaranteed by Salesforce itself, connect as a dedicated user whose profile and permission sets have no create, edit or delete rights. The scan then can't change anything, whatever the approval screen says. A System Administrator sees the most; a narrower user works too, and the report lists anything it couldn't read. To see your contract and invoices, the user needs the Manage Billing permission.

What we read

• Users: name, username, email, profile, license type, last login and creation dates, and whether they're frozen.
• License counts, permission set and package licenses, and which profiles and permission sets can see Opportunities, Leads and Cases.
• Connected app names and how often they're used, installed AppExchange packages, sandbox names and refresh dates, and org limits.
• Record counts, not records: how many Account, Contact, Lead, Opportunity, Case, Task, Event records each user created or edited in the last 90 days, and when each installed package's objects last changed. We never read what's in those records.
• Your Salesforce contract and invoice totals, when the connected user has Manage Billing. Never payment card details.

Every query a scan runs

Through the Salesforce REST API (v62.0). Placeholders in angle brackets are filled in per object or package. A scan also reads /limits and the object list at /sobjects.

• SELECT Id, Name, OrganizationType, IsSandbox FROM Organization LIMIT 1
• SELECT Id, Name, Username, Email, UserType, ProfileId, Profile.Name, Profile.UserLicense.Name, LastLoginDate, CreatedDate FROM User WHERE IsActive = true
• SELECT ParentId, Parent.ProfileId, Parent.IsOwnedByProfile, SobjectType, PermissionsRead, PermissionsCreate, PermissionsEdit, PermissionsDelete FROM ObjectPermissions WHERE SobjectType IN ('Opportunity', 'Lead', 'Case')
• SELECT AssigneeId, PermissionSetId FROM PermissionSetAssignment WHERE Assignee.IsActive = true
• SELECT Id, AppName, UserId, UseCount, LastUsedDate FROM OauthToken WHERE UseCount > 0
• SELECT Id, Name, TotalLicenses, UsedLicenses FROM UserLicense
• SELECT Id, NamespacePrefix, Status, AllowedLicenses, UsedLicenses FROM PackageLicense
• SELECT Id, MasterLabel, TotalLicenses, UsedLicenses FROM PermissionSetLicense
• SELECT SandboxName, LicenseType, Description FROM SandboxInfo
• SELECT SandboxName, EndDate FROM SandboxProcess WHERE Status = 'Completed' ORDER BY EndDate DESC
• SELECT UserId FROM UserLogin WHERE IsFrozen = true
• SELECT Id FROM User WHERE IsActive = true AND UserPermissionsSupportUser = true
• SELECT SubscriberPackage.NamespacePrefix, SubscriberPackage.Name FROM InstalledSubscriberPackage
• SELECT Id, ContractNumber, StartDate, EndDate, SalesforceContractStatus, AutoRenewCode, BillingFrequency, ContractCurrency FROM SalesforceContract
• SELECT SalesforceContractId, InvoiceDate, TotalAmount, InvoiceCurrency FROM SalesforceInvoice WHERE InvoiceDate = LAST_N_DAYS:730 ORDER BY InvoiceDate DESC
• SELECT CreatedById u, COUNT(Id) c FROM <object> WHERE CreatedDate = LAST_N_DAYS:90 GROUP BY CreatedById
• SELECT LastModifiedById u, COUNT(Id) c FROM <object> WHERE LastModifiedDate = LAST_N_DAYS:90 GROUP BY LastModifiedById
• SELECT QualifiedApiName, Label FROM EntityDefinition WHERE NamespacePrefix = 'namespace'
• SELECT MAX(CreatedDate) c, MAX(LastModifiedDate) m FROM <namespace>__<object>__c

What we store and where

• Salesforce access and refresh tokens, encrypted with AES-256-GCM before they reach the database.
• A snapshot of the data above for each scan, so results and history load without calling Salesforce again.
• The database is hosted by Supabase in London, UK. The app runs on Netlify servers in the United States.
• Payments go through Stripe. We never see or store card numbers.

Cutting off access

Disconnecting an org in Salesforce Saver revokes our tokens in Salesforce and deletes its scans straight away. You can also revoke access from Salesforce at any time under Setup, Connected Apps OAuth Usage. See the privacy policy for the rest.