Dropbox for Salesforce is a native Salesforce solution that talks to Dropbox through its secure APIs. Your files stay in Dropbox. They are never copied into Salesforce or onto Beaufort 12 servers, and there is no middleware in the file path. Unlike middleware products such as Zapier, we don't hold your security token and therefore have no access to your Salesforce instance or your Dropbox account.

Our Trust Centre covers live service status, security practices, release management, compliance and sub-processors. If you are reviewing us as a vendor, our security pack is free on request and includes our DPA and a completed standard security questionnaire. If you need your own questionnaire completed, we offer a custom security review.

Compliance reports such as SOC 2 or ISO 27001 should be requested from Salesforce and Dropbox directly, as their infrastructure and controls underpin the integration. The points below cover the questions we are most often asked during a third-party security review. If they don't answer a specific question, our technical team can be reached at support@beaufort12.com.

Data Storage and Handling

• Files stay in Dropbox: Files are streamed between the user's browser or your Salesforce org and the Dropbox API. They are not saved as Salesforce Files or attachments and do not use your Salesforce file storage.

• What Salesforce stores: A folder mapping record for each record that has a folder, holding the Dropbox folder path and ID, plus each user's connection and your org configuration.

• Residency and retention: Because files never leave Dropbox, your existing Dropbox data residency and retention arrangements continue to apply.

• Licensing data: Twice a day the package reports your org ID and the number of connected users to our licensing service so that we bill accurately. No file names, file contents, record data or user names are included.

API Calls and Access

• Outbound connections only: Nothing outside Salesforce logs in to your org. Connections are made from Salesforce to Dropbox, using Salesforce encryption.

• No calls back into Salesforce: The integration makes no Metadata API or other API calls into your org.

• Beaufort 12 API: During installation you are asked to allow access to api.beaufort12.com. This is used for licence and billing checks and the in-app support chat. The support chat receives the name and email address of the Salesforce user who opens it, along with anything they type. File transfers are point to point with Dropbox and do not pass through our servers.

Authentication and Credentials

• Per-user OAuth 2.0: Each user connects their own Dropbox account and authenticates directly with Dropbox. We never receive a Dropbox password, and every request runs with that user's own Dropbox permissions.

• Credential storage: Tokens are stored in a protected setting in your org, scoped to the individual user, that only the package can read.

• Revoking access: A user can disconnect from Salesforce, or a user or Dropbox administrator can revoke the application in Dropbox account settings. Either takes effect immediately.

• Encryption in transit: All traffic between Salesforce and Dropbox is secured with TLS 1.2+, handled by Salesforce.

Permissions

• Two independent layers: Salesforce controls who can use the integration, through the Dropbox Standard and Dropbox Admin permission sets, and which records they can see. Dropbox controls which folders each user can open.

• No widened access: The integration cannot grant access that Dropbox has not granted. A Salesforce administrator cannot reach into a folder held in another user's Dropbox account.

• Multi-factor authentication: The integration adds no login of its own. Users sign in to Salesforce and Dropbox under the MFA policies you already enforce.

Operational Transparency

• No hidden operations: The only scheduled job is the twice-daily licence check. Everything else runs when a user, Flow or agent action you have configured asks for it.

• Data isolation: All objects and fields the integration creates in your Salesforce org carry the namespace prefix dbx, making integration data easy to identify, report on and manage.

Ongoing Security

• Reviewed by Salesforce: The package has passed Salesforce's AppExchange security review and is re-reviewed as Salesforce requires.

• Regular updates: Every change is peer reviewed, tested and security scanned before release. See release management in our Trust Centre.

Technical Documentation and Policies

• Beaufort 12 Trust Centre

• Dropbox for Salesforce Security and Compliance guide and Technical Guide

• Dropbox API documentation, which outlines the APIs the integration uses

• Salesforce security and trust

• Beaufort 12 Privacy Policy and Terms and Conditions

• Beaufort 12 Data Processing Addendum (PDF), pre-signed and incorporated into our Terms

Summary

Dropbox for Salesforce connects Salesforce records to Dropbox folders without copying your files anywhere else. Files stay in Dropbox, credentials stay in your org, and Dropbox remains the authority on who can see what.

Related Articles

• Security and Compliance [Full Guide]

• Does Beaufort 12 have a Data Processing Addendum (DPA)?

• How do upgrades work, and when will my org get a new version?