Overview

• Files stay in Dropbox. They are never copied into or stored in Salesforce.
• Authentication uses Dropbox OAuth 2.0. Beaufort 12 never receives your Dropbox password.
• Credentials are stored in Salesforce as protected custom settings, visible only to the integration.
• The integration is a native Salesforce managed package. There is no Beaufort 12 middleware in the file path.
• Dropbox remains the authority on file permissions. The integration cannot grant access that Dropbox has not granted.

Where your data lives

Stored in Salesforce

A folder mapping record per record with a folder, holding the folder path and ID. Per-user OAuth credentials, as protected custom settings. Org configuration, including workspace definitions and licence status.

Stored in Dropbox

Every file and folder.

Files are streamed between the browser or Salesforce and the Dropbox API. They are not staged on Beaufort 12 infrastructure and they do not consume Salesforce file storage.

Because files never enter Salesforce, your Dropbox data residency and retention arrangements continue to apply unchanged. The integration does not create a second copy of your documents in another jurisdiction.

Authentication

Connections use Dropbox OAuth 2.0. The user authenticates directly with Dropbox, and Salesforce receives an access token and refresh token. Beaufort 12 never sees the password.

Access tokens are short lived and refreshed automatically. If a refresh fails because the authorisation has been revoked, the stored credentials are cleared and the user is asked to reconnect.

Connections are per user, not per org. Each user authorises their own Dropbox account, and every API call is made with that user's own credentials against their own permissions.

Credential storage

Tokens are stored in a protected hierarchy custom setting, scoped to the individual user. Protected means the setting is not accessible to other code in the subscriber org, and not exposed through the standard object model to users or admins browsing data.

Access tokens can exceed the length of a single Salesforce text field, so they are stored across several fields and reassembled when used. This is a storage detail, not an encryption scheme, and should not be described as one.

The Dropbox application key and secret are held in protected custom metadata inside the managed package. They are not visible in the subscriber org.

Revoking access is available at both ends. A user can disconnect from Salesforce, which revokes the token with Dropbox and deletes the stored credentials. A user or Dropbox administrator can also revoke the application from Dropbox account settings, which invalidates the connection immediately.

Permissions model

Two independent layers govern access, and both must permit an action.

Salesforce controls whether a user can use the integration at all, through the Dropbox Standard or Dropbox Admin permission set, and controls record visibility as normal.

Dropbox controls whether a user can see a given folder, through folder ownership and sharing.

The integration cannot widen Dropbox permissions. A Salesforce administrator has no ability to reach into a folder held in another user's Dropbox account. When a user lacks Dropbox access to a folder, they see a request access prompt rather than the contents.

For centrally governed access, use a Dropbox Business Team Folder as the workspace. Access is then managed in Dropbox for the whole team rather than person by person.

Multi-factor authentication

The integration meets Salesforce's MFA requirements. It introduces no separate login of its own. Users authenticate to Salesforce under whatever MFA policy you enforce, and authenticate to Dropbox under Dropbox's own MFA settings. There is no path that bypasses either.

Salesforce platform security

The package is a native managed package, distributed through AppExchange and subject to Salesforce security review. All logic runs on the Salesforce platform. Callouts go directly to the Dropbox API.

One call goes to Beaufort 12 rather than Dropbox: a scheduled job reports the number of connected users to our licensing service twice a day, for billing. It sends a count. It does not send file names, file contents, record data or user names. See the billing article for how seat counting works.

Common questions

Do you store our files?
No. Files remain in Dropbox at all times.

Do you have access to our files?
No. Beaufort 12 has no access to your Salesforce org or your Dropbox account. Tokens are held in your org, not by us.

Is any data sent to Beaufort 12?
Only a periodic count of connected users, for licensing.

Do you store our Dropbox password?
No. Authentication is OAuth. We never receive it.

Where is our data processed?
File transfers are between your users' browsers or your Salesforce org and the Dropbox API. We are not in that path.

How do we revoke access?
Disconnect from within Salesforce, or revoke the application in Dropbox account settings. Either takes effect immediately.

Can we restrict which users have access?
Yes, through permission set assignment in Salesforce and folder sharing in Dropbox.

‍