Security
This page provides a concise public summary for enterprise security review. Detailed responses and supporting documents are shared during due diligence and, where appropriate, under NDA.
Encryption
Transport encryption is used for public and service-to-service traffic. Managed infrastructure protections apply to stored data.
Access control
Access to production systems and customer data is restricted to authorized personnel with operational need.
Enterprise review
Security questionnaires and supporting materials are available on request during procurement and vendor review.
Platform and data protection
- Customer environments are logically isolated within the application and database.
- Data is encrypted in transit over TLS and protected at rest by managed platform controls.
- Customer-connected credentials and secrets are stored separately from general application data.
Access and operations
- Production access is limited to authorized personnel with role-based access controls.
- Administrative and operational actions are logged and reviewed as part of normal operations.
- Backups, change management, and incident handling are managed as part of internal operating procedures.
Application security
- Security controls include authenticated access, request validation, rate limiting, and auditability of key actions.
- Third-party providers are used for core infrastructure and are listed on the sub-processors page.
- Security issues can be reported through the coordinated disclosure contact published on this site.
Salesforce token handling
Customers connect their Salesforce orgs to ForceWeaver over OAuth 2.0. The section below summarises how the resulting credentials are protected, for reviewers who want more detail than the generic controls above.
- OAuth 2.0 with PKCE
- Authorisation happens on Salesforce. We never see or store your Salesforce password. The redirect returns a short-lived authorisation code, which we exchange server-side for the tokens described below.
- Refresh token at rest
- Refresh tokens are stored in Supabase Vault using pgsodium authenticated encryption. The application database only holds an opaque UUID pointer, never the token itself. Decryption is gated by a SECURITY DEFINER Postgres function that filters by the caller’s workspace, so cross-tenant reads are not possible even with a stolen application key.
- Access token lifecycle
- Salesforce access tokens are short-lived: typically around two hours. We refresh them automatically a few minutes before expiry, serialised via a database lease so parallel workers do not race. Plaintext access tokens live only in the request-scoped memory of a serverless function, for the duration of a single Salesforce API call, and are discarded when the function returns.
- Revocation
- Disconnecting an org from the product UI removes the associated Vault entries. Customers can also revoke the connected app from within Salesforce Setup at any time, which invalidates the tokens immediately.
Available on request
- Security questionnaire responses
- Security overview and architecture summary
- Incident response, access control, and business continuity materials
- Additional supporting documentation when appropriate under NDA
Contact security@forceweaver.com for security review requests or vulnerability reports.