Publisher security
- 100 %
- inside your org
- 0
- outbound data by default
- 71
- controls self-assessed out of 255 catalogued
- 10 min
- to install
The French text governs. This page is the English version of Sécurité de l'éditeur FR.
The site maps ISO 27001 and SOC 2 for your org. This page answers the symmetrical question, the one your vendor questionnaire asks: and you? Each section is dated. What is not done is written, in the last section, before you find out.
1. AppExchange Security Review —
Not submitted. The dossier is assembled (requirement-evidence matrix, Code Analyzer report, false-positive register, accessibility review), and we will not call the review passed or guaranteed before it is. The dossier exists so that the first submission counts.
2. Secure development cycle
WITH USER_MODEon 100% of SOQL and SOSL queries,AccessLevel.USER_MODEon writes: the package never reads more than the user running it. Two bounded, declared derogations, both of them writes and both on the package's own objects: the install marker, written in system mode by the package system user — without it an install would leave no trace at all — and the Big Object history snapshots, imposed by the platform (the Apex Big Object API exposes no access-mode overload). No read escapes user mode.with sharingorinherited sharingon every class touching data.- Queries on setup objects degrade gracefully: a missing permission produces a “not measured” finding, never an exception nor a false “healthy”.
- No hard-coded secret; HTTPS endpoints, TLS 1.2 minimum; self-callouts through a named credential, never through the session token.
- Salesforce Code Analyzer v5 static analysis on every version, 94% test coverage on the installable version (1.0.0.7), authoring and review in separate passes.
3. Outbound flows: none active at delivery
Four families of flows can be opened, one by one, by your administrator: health aggregates to the hosted viewer (no personal data, HMAC-signed), alert channels, ITSM integration, SIEM export. The last three go to a destination you choose, with your credentials. Consent to the first flow can only be granted inside the org, by a human: the setting is protected and cannot be reached from outside the package — we checked by trying.
4. Sub-processors and hosting —
| Sub-processor | Role | Location | Safeguards |
|---|---|---|---|
| Salesforce, Inc. (Heroku platform) | Hosting of the ingestion service and viewer — an option, involved only if you enable it | Heroku EU region | Salesforce standard contractual clauses, Heroku DPA |
| Amazon Web Services, Inc. (Heroku Postgres add-on) | Database of the multi-tenant viewer | AWS eu-west-1 (Ireland) | Via Heroku; TLS connections, encryption at rest |
| Infomaniak Network SA | Hosting of this website and the mailboxes | Switzerland (EU adequacy) | Infomaniak DPA, ISO 27001-certified host |
No other sub-processor accesses customer data. Any change to this list is notified to viewer subscribers thirty days ahead: this is a commitment the publisher makes here, not a clause the DPA already carries — the contractual corpus is under review, and we do not cite a contract for a period it does not yet contain. By default, no data leaves your org: this list concerns the hosted option only.
5. Reporting a vulnerability
security@orgguardian.com, or the
/.well-known/security.txt file. Acknowledgement
within two business days, triage within ten, fix in the next version for a confirmed defect. We do
not pursue good-faith research. There is no bounty programme.
6. Documents for your assessment — 1.0.0.7 edition
Documents in English, like the interface, written for version 1.0.0.7 of the package. They can be read without writing to us; the FAQ marks the compliance-dossier items provided on request. The complete set of guides is on the Documentation page.
- Security FAQ : what the package reads, what it stores, what can leave the org, and the query that checks it in yours. For the CISO, the DPO or the security architect. PDF, 509 KB
- Permissions and Personas : the shipped permission sets, who sees what, and the read rights you grant the scan account. PDF, 599 KB
- Installation Guide : from an empty org to the first scan, with the supported editions, sandbox first, access, and what an uninstall deletes. PDF, 472 KB
- Data Sheet : the product on one sheet, with its coverage, the figures counted in the package source and the outbound flows. PDF, 1.0 MB
7. What is not in place —
- No publisher certification (ISO 27001, SOC 2): DOPAMINE is a small SAS, and the product runs inside your org, under your certification.
- No published third-party penetration test on the hosted viewer.
- No source code escrow; a clause is possible on request.
- Security Review not submitted (section 1).