How Secure Is Salesforce Tool Suite? Here’s Everything You Need to Know
When teams introduce a tool that interacts directly with their Salesforce org, security becomes the number one priority. Salesforce Tool Suite—our productivity-focused Chrome Extension and AppExchange application—was built with this priority at its core. Whether you’re a Salesforce admin, developer, architect, or security reviewer, understanding how the tool handles authentication, data access, and local storage is essential before adopting it across your team.
To help simplify this evaluation, our team has compiled a transparent and comprehensive FAQ that addresses the most common security questions we receive from users, security teams, and IT departments. This guide explains how Salesforce Tool Suite interacts with Salesforce APIs, how it protects user credentials, and what controls you have as a user.
General Security 🔐
Q: How does the Chrome Extension handle user data and privacy?
Our Chrome Extension is designed to prioritize user data privacy. It directly communicates with Salesforce APIs. No user data is stored on an intermediate server. All data transfer occurs securely between your browser tab and Salesforce.
Q: What data does the extension access from Salesforce?
The extension does not access any data unless user intract with it and try to access. User can fetch and retrieve data by using tools and features of extension. Which includes metadata and object data in tools and query builder. Access is governed by the permissions granted by the user and their Salesforce profile.
Q: Is there any data stored locally by the extension?
The extension may store minimal, non-sensitive configuration data locally within your browser's storage to enhance performance and user experience. This data typically includes user preferences and settings. Sensitive information, such as Salesforce credentials (Oauth 2.0), are stored locally by the extension using browser’s encrypted local-storage.
Q: What measures are in place to prevent unauthorized access to Salesforce data?
The extension leverages Salesforce's robust security model, including sessionId and OAuth 2.0 for authentication and authorization. This ensures that the extension can only access data that the authenticated user is authorized to view or modify within Salesforce.
Data Transmission 🌐
Q: How is data transmitted between the Chrome Extension and Salesforce?
Data is transmitted directly between your browser's tab and Salesforce using secure HTTPS connections. This ensures that all data in transit is encrypted and protected from eavesdropping and tampering.
Q: Does the extension use an intermediate server to process or store Salesforce data?
No, the extension operates without an intermediate server. All data interactions are directly between your browser and Salesforce. This minimizes potential points of vulnerability and ensures data remains within your control.
Q: Are there any firewalls or network configurations required for the extension to work securely?
Typically, no special firewall or network configurations are required beyond what is needed to access Salesforce directly. The extension utilizes standard web protocols that are generally allowed by operating system and corporate networks.
Authentication and Authorization 🛡️
Q: How does the Chrome Extension authenticate with Salesforce?
The extension primarily uses the session ID of the currently logged-in Salesforce user, which is retrieved from the Salesforce cookie when the user opens the extension from a Salesforce tab. A Salesforce user can revoke this access anytime by logging out of their Salesforce session.
The extension also provides an option to authenticate using Salesforce's standard OAuth 2.0 flow. Authorization granted via OAuth 2.0 can be revoked anytime from Salesforce's Connected Apps OAuth Usage page. This process ensures that your Salesforce credentials are never directly exposed to the extension.
Q: What permissions does the extension request, and why?
The extension requests specific permissions that are necessary for its functionality, such as:
Access the identity URL service
Access Lightning applications
Manage user data via Web browsers
Manage user data via APIs
These permissions are clearly outlined during the OAuth approval process, allowing users to understand and control the level of access.
Q: Can I revoke the extension's access to my Salesforce account?
Yes, you can revoke this access anytime by logging out of their Salesforce session if extension opened from a Salesforce logged in tab. OAuth2.0 access can be revoked through your Salesforce "Connected Apps OAuth Usage" settings. This will immediately prevent the extension from interacting with your Salesforce instance.
Updates and Maintenance 🛠️
Q: How are security updates for the Chrome Extension handled?
The Chrome Extension is regularly updated to address any potential security vulnerabilities and enhance its features. Updates are pushed through the Chrome Web Store, and users are notified when an update is available. We recommend keeping your extension updated to the latest version.
Q: Who is responsible for the security of the Salesforce APIs used by the extension?
Salesforce is responsible for the security and integrity of its APIs. Our extension adheres to Salesforce's API usage policies and security best practices to ensure secure interactions.
Additional Security Questions ❓
Q: Where can I report a security vulnerability?
If you discover a security vulnerability, please contact us immediately using Write Us option available at bottom-right of the extension. We take all security reports seriously and will investigate them promptly.
Q: Is the Chrome Extension open-source?
As of now the Chrome Extension is not open source.
Closing Thoughts: Built for Trust, Designed for Salesforce Teams
With Salesforce Tool Suite, our goal is simple: empower Salesforce professionals with powerful capabilities while maintaining the highest standards of security and transparency. By avoiding intermediaries, relying on Salesforce’s trusted authentication mechanisms, and giving users full control over access, the tool ensures a secure and compliant experience for teams of all sizes.
Whether you’re adopting Salesforce Tool Suite for productivity or evaluating it for enterprise use, we hope this FAQ provides clarity and confidence. If you have additional queries or would like our team to assist with a formal security review, feel free to reach out through the Write Us option inside the extension.
Have Questions? Drop them here 👇
