Book a call

Salesforce security

Find out who and what can reach your data.

In August 2025, thieves copied Salesforce data from more than 700 organizations without breaking Salesforce itself. They came in through an outside app those companies had connected. Most midsize companies have never checked what is connected to theirs.

Book a call Check it yourself

Check it yourself

Six questions, and where to look.

Whoever looks after your Salesforce can check most of these in an hour or two in Setup, and Salesforce's free Health Check (Setup → Health Check) scores your security settings too. If an answer surprises you, the audit goes through all of it properly, and further than either.

  • 01

    Outside apps

    Which apps connected to Salesforce can read your data, who approved them, and whether they still need to.

    Where to look Setup → Connected Apps OAuth Usage lists every app holding access and how many people granted it. Installed Packages lists the rest, and Setup Audit Trail shows who installed or changed them.

  • 02

    Logins

    Whether multi-factor login is required for everyone, who is exempt from it, and whether any logins are shared.

    Where to look Setup → Identity Verification shows whether multi-factor login is required. Then check who holds the "Waive Multi-Factor Authentication for Exempt Users" permission, and that integration users are set to API Only User: multi-factor login doesn't apply to API logins.

  • 03

    People who left

    Former staff and contractors who can still log in, and admin rights nobody remembers giving.

    Where to look Setup → Users, portal users included. Anyone who has left should be inactive: switching someone off in your company directory doesn't always switch them off in Salesforce. The Last Login column shows who still logs in.

  • 04

    What outsiders can see

    Your customer, dealer or partner portal and any public pages: what a guest or portal user can actually open.

    Where to look For visitors who don't log in: each site's guest user profile (which objects) and the guest sharing rules in Sharing Settings (which records). For logged-in customers or dealers: the external sharing defaults and sharing sets. Check that one customer can't see another's records.

  • 05

    Who can export everything

    How many people can download all of your data, and whether anyone would notice if they did.

    Where to look A profiles list view with columns for Export Reports, View All Data, Modify All Data, Weekly Data Export and API Enabled, then the permission sets that grant the same. Seeing who actually exported needs Event Monitoring, a paid add-on.

  • 06

    Phone and email tricks

    Whether a fake "Salesforce support" call could talk someone into approving an app, and whether your settings would stop it if it did.

    Where to look Ask two people what they would do on that call. Then check who holds "Approve Uninstalled Connected Apps" and "Use Any API Client", and set your connected apps to "Admin approved users are pre-authorized".

Going further

When you want it done properly.

1 to 2 weeks From $5,000

Security & health audit

All six questions above, then further: your sharing model and permission sets, integration users, and the health of your data and automations. Read-only access, through your own login and multi-factor. You get:

  • a scored report on how your Salesforce is secured and set up
  • a fix list with a price for every item
  • a one-page summary for leadership or your board

The price depends on the size of your org: users, portals and integrations. You get it fixed, in writing, before we start.

Every monthRun & Protect plan

Ongoing protection

Because new apps, new admins and new portal users appear every month:

  • outside apps, admins and portal access reviewed every month
  • multi-factor login and its exemptions checked, and integration users kept to API-only access
  • a quarterly security report for leadership
  • an incident plan: who does what, and in what order, if something looks wrong
See the plans

Questionnaires

Insurance renewals and customer security reviews.

Cyber insurance renewals and large customers now ask about your Salesforce: multi-factor login, outside app access, who can export data. We answer the Salesforce sections with you and give you the evidence they ask for: screenshots and settings exports, not just a yes.

How we get in

How we access your Salesforce.

Before you give anyone admin access, you should know exactly how it works.

  • Named people only, each with their own login. No shared accounts.
  • Through your single sign-on and multi-factor login.
  • Only the permissions the work needs. Read-only for audits.
  • Every login recorded in your own Salesforce, where you can see it.
  • No apps of our own connected to your org.
  • Your data stays in your Salesforce. We don't copy it to our laptops, and we don't put it into any AI tool unless you ask us to in writing. If you do, it runs under your accounts.
  • Access removed the same day you ask, or the day the work ends.

Everyone with access is named to you before they get it, starting with our founder, who does the audit and the monthly work. We're a US company based in Omaha. We meet your team in person for kickoff, and again whenever it helps.

Paperwork

The paperwork comes with your quote.

We sign an NDA and a data processing agreement before anyone gets access. Contract terms and answers to your vendor security questionnaire come with your quote, or whenever your team asks.

What we won't promise. Nobody can make you "compliant" or "unhackable". We find the gaps, fix them, and give you the evidence your auditor, insurer or customer asks for.

Not sure where you stand?

Run the six checks above, or book a call and tell us what worries you. If the audit isn't the right next step, we'll say so on the call.

Book a call See managed services