Security & Trust at Saltbox
Your Salesforce delivery data deserves the same level of protection you give your production org. Security isn't an afterthought at Saltbox — it's built into every layer of the platform.
Data Protection
Defense in depth, by design
Encryption everywhere
All data is encrypted in transit using TLS and at rest using industry-standard AES-256 encryption. Integration credentials — Salesforce tokens, API keys, OAuth secrets — are encrypted with rotating keys and are only decrypted at the moment they're needed.
They're never logged, never cached, and never exposed to client-side code.
Tenant isolation
Saltbox is multi-tenant by design. Every query, every API call, every background job is scoped to your organization. Your data is architecturally separated from every other customer's data — not just by application logic, but at the data layer.
Within your organization, access is further scoped by project membership. Users only see the projects they've been added to. Identity is always derived server-side from your authenticated session, never from request parameters.
Infrastructure
Enterprise-grade cloud hosting
Saltbox runs on trusted cloud infrastructure including Vercel, Heroku, PostgreSQL, and Google Cloud — providers that maintain their own SOC 2, ISO 27001, and GDPR certifications.
- HTTPS only. All traffic is encrypted via HTTPS — no unencrypted connections accepted.
- Hardened headers. Industry-standard security headers protect against clickjacking, MIME sniffing, and other common web vulnerabilities.
- Global CDN. Distribution with automatic failover for high availability.
- Automated backups. Database backups with point-in-time recovery.
Authentication & Access
Secure by default
SSO & API keys
Saltbox supports Single Sign-On via Google OAuth for secure, passwordless authentication. API keys are available for service-to-service integrations — each scoped to specific permissions with built-in expiration and revocation.
Role-based access
A three-tier role model — Member, Admin, and Owner — ensures users have exactly the access they need and nothing more. Project-level membership adds a second layer, so sensitive work stays visible only to the people involved.
Rate limiting
All API endpoints are protected by adaptive rate limiting to guard against abuse while keeping legitimate usage uninterrupted.
AI Security
Your data, your control
Saltbox uses AI to accelerate Salesforce project delivery. Here's how we keep your data safe throughout.
No model training on your data.
Your conversations, project data, and Salesforce metadata are never used to train AI models. Our commercial agreements with AI providers explicitly prohibit this.
Isolated context per session.
Each AI conversation operates in a sandboxed environment scoped to your project. The AI cannot access data from other projects or organizations.
Human-in-the-loop.
Sensitive operations like Salesforce deployments and record creation require explicit user approval. The AI proposes — you decide.
Full transparency.
Every AI action is visible in the chat interface. There are no hidden operations or background calls you can't see.
Comprehensive logging.
All AI interactions are monitored for quality, performance, and security through our observability stack.
Compliance
Standards we hold ourselves to
SOC 2 Type II
Saltbox is currently undergoing a SOC 2 Type II examination, evaluating our controls for security, availability, confidentiality, and processing integrity.
Contact security@saltboxmgmt.com for the latest status or to request our readiness documentation.
GDPR
Saltbox is fully compliant with the EU General Data Protection Regulation:
- Data export — Administrators can export all organizational data on demand
- Data deletion — Organization deletion permanently removes all associated data
- Configurable retention — Set retention windows for chat history, audit logs, and meeting transcripts
- Data minimization — We collect only the data necessary for platform functionality
Audit logging
Every security-relevant action is recorded in a comprehensive audit log scoped to your organization — authentication events, member changes, integration updates, data exports, Salesforce operations, and administrative actions.
Logs include contextual metadata and are retained for up to two years by default.
Security Testing
Tested on every change
Automated security test suites run on every code change before it reaches production. Our testing covers:
- Data isolation — Verified separation between organizations and between projects within the same organization.
- Identity security — Protection against email spoofing, session hijacking, and parameter tampering.
- Authorization enforcement — Every protected endpoint is tested for unauthenticated access, role violations, and cross-tenant access attempts.
- Input validation — Malformed inputs, injection attempts, and fabricated identifiers are handled safely without information leakage.
- AI safety — Hallucination detection, tool authorization, and output validation.
Integration Security
Connecting your tools safely
Saltbox integrates with Salesforce, Jira, GitHub, Confluence, Google Drive, and more. Every integration follows the same principles.
Encrypted credentials
All integration secrets are encrypted at rest and decrypted only at the moment of use.
Least-privilege auth
We use OAuth 2.0 and app-level authentication wherever possible, avoiding personal access tokens.
Immediate revocation
Disconnecting an integration immediately removes stored credentials.
Audit trail
Every integration event (connect, disconnect, credential update) is recorded in your audit log.
Responsible AI
Built to assist, not to act alone
01
Human approval required
For any operation that modifies your Salesforce org, creates records, or takes external action.
02
Scoped access
The AI can only work within your authorized project and organization boundaries.
03
No autonomous outreach
The AI cannot send emails, post messages, or call external APIs without your explicit initiation.
04
Auditable
Every AI tool execution is logged with full context.
Incident Response
When something goes wrong
In the event of a security incident, we are committed to prompt investigation, timely customer notification (within 72 hours as required under GDPR), transparent communication about impact and remediation, and thorough root cause analysis.
Report a vulnerability
If you discover a security vulnerability, please report it to security@saltboxmgmt.com.
FAQ
Frequently asked questions
Where is my data stored?
Does Saltbox train AI models on my data?
Can Saltbox employees access my data?
What happens when I delete my organization?
How long is my data retained?
Can I export my data?
Is Saltbox SOC 2 certified?
Have security questions?
Contact us for our compliance documentation, data processing agreement, or to schedule a security review.