Publisher security
- 100 %
- inside your org
- 0
- outbound data by default
- 71/255
- controls self-assessed
- 10 min
- to install
The French text governs. This page is the English version of Sécurité de l'éditeur FR.
The site maps ISO 27001 and SOC 2 for your org. This page answers the symmetrical question, the one your vendor questionnaire asks: and you? Each section is dated. What is not done is written, in the last section, before you find out.
1. AppExchange Security Review —
Not submitted. The dossier is assembled (requirement-evidence matrix, Code Analyzer report, false-positive register, accessibility review), and we will not call the review passed or guaranteed before it is. About half of first submissions fail; the dossier exists so that the first one counts.
2. Secure development cycle
WITH USER_MODEon 100% of SOQL and SOSL queries,AccessLevel.USER_MODEon writes: the package never reads more than the user running it. Two bounded, declared derogations, both of them writes and both on the package's own objects: the install marker, written in system mode by the package system user — without it an install would leave no trace at all — and the Big Object history snapshots, imposed by the platform (the Apex Big Object API exposes no access-mode overload). No read escapes user mode.with sharingorinherited sharingon every class touching data.- Queries on setup objects degrade gracefully: a missing permission produces a “not measured” finding, never an exception nor a false “healthy”.
- No hard-coded secret; HTTPS endpoints, TLS 1.2 minimum; self-callouts through a named credential, never through the session token.
- Salesforce Code Analyzer v5 static analysis on every version, 91% test coverage on the latest built version, authoring and review in separate passes.
3. Outbound flows: none active at delivery
Four families of flows can be opened, one by one, by your administrator: health aggregates to the hosted viewer (no personal data, HMAC-signed), alert channels, ITSM integration, SIEM export. The last three go to a destination you choose, with your credentials. Consent to the first flow can only be granted inside the org, by a human: the setting is protected and cannot be reached from outside the package — we checked by trying.
4. Sub-processors and hosting —
| Sub-processor | Role | Location | Safeguards |
|---|---|---|---|
| Salesforce, Inc. (Heroku platform) | Hosting of the ingestion service and viewer — an option, involved only if you enable it | Heroku EU region | Salesforce standard contractual clauses, Heroku DPA |
| Amazon Web Services, Inc. (Heroku Postgres add-on) | Database of the multi-tenant viewer | AWS eu-west-1 (Ireland) | Via Heroku; TLS connections, encryption at rest |
| Infomaniak Network SA | Hosting of this website and the mailboxes | Switzerland (EU adequacy) | Infomaniak DPA, ISO 27001-certified host |
No other sub-processor accesses customer data. Any change to this list is notified to viewer subscribers thirty days ahead: this is a commitment the publisher makes here, not a clause the DPA already carries — the contractual corpus is under review, and we do not cite a contract for a period it does not yet contain. By default, no data leaves your org: this list concerns the hosted option only.
5. Reporting a vulnerability
security@orgguardian.com, or the
/.well-known/security.txt file. Acknowledgement
within two business days, triage within ten, fix in the next version for a confirmed defect. We do
not pursue good-faith research. There is no bounty programme.
6. What is not in place —
- No publisher certification (ISO 27001, SOC 2): DOPAMINE is a small SAS, and the product runs inside your org, under your certification.
- No published third-party penetration test on the hosted viewer.
- No source code escrow; a clause is possible on request.
- Security Review not submitted (section 1).