As a small company offering a low-cost, self-service solution, we strive to make our products affordable and user-friendly. While we don't have the margins to create custom technical documentation, complete bespoke questionnaires, or sign customer-specific security addenda, the information below covers the questions we are most often asked during a third-party security review.

Emma for Salesforce is a native Salesforce solution that talks to Emma through its secure APIs. There is no middleware and we do not process your customer data. The package is installed in your Salesforce org and uses Salesforce and Emma resources. Unlike middleware products such as Zapier, we don't hold your security token and therefore have no access to your Salesforce instance.

Because of this, compliance reports such as SOC 2 or ISO 27001 should be requested from Salesforce and Emma directly, as their infrastructure and controls underpin the integration. If the points below don't answer a specific question, our technical team can be reached at support@beaufort12.com.

Data Storage and Handling

• No independent data storage: Emma for Salesforce does not store customer data independently. All your customer data remains within your Salesforce and Emma accounts.

• Data flow: The integration acts as a conduit, passing data directly between Salesforce and Emma according to your configuration. We do not store, manage or manipulate personal data.

• Operational logging only: Limited, non-identifiable system metadata (error and maintenance logs) is sent to our AWS-hosted infrastructure for troubleshooting. It is retained for a maximum of 90 days and contains no customer records.

API Calls and Metadata Access

• Outbound connections only: The integration does not independently initiate inbound API calls to your Salesforce environment. Connections are made from Salesforce to Emma, using Salesforce encryption.

• API call usage: Because we don't make independent calls into Salesforce, the integration does not consume your inbound API call limits.

• Beaufort 12 API: During installation you are asked to allow access to api.beaufort12.com. This is used for licence checks and to host the in-app support chatbot. No customer data is sent via Beaufort 12, though anything you type into the chatbot passes through our server. Customer data is point to point, Salesforce to Emma, and does not pass through our servers.

Metadata Retrieval

• Purpose: The only calls made back into Salesforce are to retrieve metadata needed for features such as list view and report imports and page layout configuration.

• User-initiated: These requests are triggered in real time by your Salesforce users and are not stored or cached.

• Limited scope: The metadata retrieved is limited to what the feature needs and does not include user information.

• Opt-out: If you don't use these features you can choose not to grant metadata access.

Data Encryption and Security Measures

• Encryption in transit: All traffic between Salesforce and Emma is secured with TLS 1.2+, handled by Salesforce.

• Secure authentication: Emma is authenticated with an API key stored in a protected setting in your org. No login credentials are stored.

• Data isolation: All objects and fields the integration creates in your Salesforce org carry the namespace prefix em4sf, making integration data easy to identify, report on and manage.

Operational Transparency

• No hidden operations: The integration only runs the scheduled syncs and actions your administrator has configured. No background processes access your data without your knowledge.

• User control: You decide what data is shared between Salesforce and Emma. No personally identifiable information (PII) is sent to Emma without your explicit configuration or action.

• Data visibility: Any PII sent to Emma is visible within Emma under member custom fields. There are no hidden fields containing PII.

Ongoing Security

• Regular updates: The integration is continuously updated to patch vulnerabilities and meet current security standards, and every release passes Salesforce's AppExchange security review.

• Access controls: The integration respects the profiles, permission sets and sharing rules in your Salesforce org.

• Audit trails: The integration's actions can be tracked within Salesforce and Emma, giving you an audit trail for security reviews.

Technical Documentation and Policies

• Emma for Salesforce Technical Guide

• Emma API documentation, which outlines the APIs the integration uses

• Salesforce security and trust

• Beaufort 12 Privacy Policy and Terms and Conditions

• Beaufort 12 Data Processing Addendum (PDF), pre-signed and incorporated into our Terms

Summary

Emma for Salesforce is a secure bridge between your Salesforce and Emma accounts that never independently accesses or stores your customer data. By keeping all data flow inside Salesforce and Emma, and limiting operations to what your administrators configure, your information stays under your control.

Related Articles

• Emma for Salesforce Technical Guide [Full Guide]

• Does Beaufort 12 have a Data Processing Addendum (DPA)?

• Is there any personally identifiable information passed across?