How Secure Is Salesforce Tool Suite? Here’s Everything You Need to Know
When teams introduce a tool that interacts directly with their Salesforce org, security becomes the number one priority. Salesforce Tool Suite—our productivity-focused Chrome Extension and AppExchange application—was built with this priority at its core. Whether you’re a Salesforce admin, developer, architect, or security reviewer, understanding how the tool handles authentication, data access, and local storage is essential before adopting it across your team.
To help simplify this evaluation, our team has compiled a transparent and comprehensive FAQ that addresses the most common security questions we receive from users, security teams, and IT departments. This guide explains how Salesforce Tool Suite interacts with Salesforce APIs, how it protects user credentials, and what controls you have as a user.
General Security 🔐
Q: How does the Chrome Extension handle user data and privacy?
Our Chrome Extension is designed to prioritize user data privacy. It directly communicates with Salesforce APIs. No user data is stored on an intermediate server. All data transfer occurs securely between your browser tab and Salesforce.
Q: What data does the extension access from Salesforce?
The extension does not access any data unless user intract with it and try to access. User can fetch and retrieve data by using tools and features of extension. Which includes metadata and object data in tools and query builder. Access is governed by the permissions granted by the user and their Salesforce profile.
Q: Is there any data stored locally by the extension?
The extension may store minimal, non-sensitive configuration data locally within your browser's storage to enhance performance and user experience. This data typically includes user preferences and settings. Sensitive information, such as Salesforce credentials (Oauth 2.0), are stored locally by the extension using browser’s encrypted local-storage.
Q: What measures are in place to prevent unauthorized access to Salesforce data?
The extension leverages Salesforce's robust security model, including sessionId and OAuth 2.0 for authentication and authorization. This ensures that the extension can only access data that the authenticated user is authorized to view or modify within Salesforce.
Data Transmission 🌐
Q: How is data transmitted between the Chrome Extension and Salesforce?
Data is transmitted directly between your browser's tab and Salesforce using secure HTTPS connections. This ensures that all data in transit is encrypted and protected from eavesdropping and tampering.
Q: Does the extension use an intermediate server to process or store Salesforce data?
No, the extension operates without an intermediate server. All data interactions are directly between your browser and Salesforce. This minimizes potential points of vulnerability and ensures data remains within your control.
Q: Are there any firewalls or network configurations required for the extension to work securely?
Typically, no special firewall or network configurations are required beyond what is needed to access Salesforce directly. The extension utilizes standard web protocols that are generally allowed by operating system and corporate networks.
Q: What encryption protocol is used when Salesforce Tool Suite communicates with Salesforce?
Salesforce Tool Suite does not use its own encryption layer because it never handles or routes data through external servers.
All requests travel only between:
User's browser → Salesforce servers
Salesforce enforces industry-standard security during this communication:
All API requests use HTTPS (TLS 1.2 or higher) for encryption in transit.
Your Salesforce org manages the encryption, session security, and token protection.
This architecture was intentionally designed to behave just like any authenticated Salesforce browser session — secure, encrypted, and fully governed by Salesforce’s security model.
Authentication and Authorization 🛡️
Q: How does the Chrome Extension authenticate with Salesforce?
The extension primarily uses the session ID of the currently logged-in Salesforce user, which is retrieved from the Salesforce cookie when the user opens the extension from a Salesforce tab. A Salesforce user can revoke this access anytime by logging out of their Salesforce session.
The extension also provides an option to authenticate using Salesforce's standard OAuth 2.0 flow. Authorization granted via OAuth 2.0 can be revoked anytime from Salesforce's Connected Apps OAuth Usage page. This process ensures that your Salesforce credentials are never directly exposed to the extension.
Q: What permissions does the extension request, and why?
The extension requests specific permissions that are necessary for its functionality, such as:
Access the identity URL service
Access Lightning applications
Manage user data via Web browsers
Manage user data via APIs
These permissions are clearly outlined during the OAuth approval process, allowing users to understand and control the level of access.
Q: Can I revoke the extension's access to my Salesforce account?
Yes, you can revoke this access anytime by logging out of their Salesforce session if extension opened from a Salesforce logged in tab. OAuth2.0 access can be revoked through your Salesforce "Connected Apps OAuth Usage" settings. This will immediately prevent the extension from interacting with your Salesforce instance.
Q: Does the extension read Salesforce data before a user logs in or grants permissions?
No. Salesforce Tool Suite cannot access any Salesforce data until the user:
Is already logged into Salesforce in the same browser tab.
Explicitly authenticates through the OAuth 2.0 login screen.
The extension cannot bypass login, cannot pre-read data, and does not have background access to your org.
All access is governed by:
Salesforce session ID
OAuth 2.0 tokens
User permissions, profiles, and org-level settings
Q: Why doesn’t the extension use extra layers of encryption?
Because the extension is designed to work exactly like a regular Salesforce web app:
No server to store or intercept data
No proxy layer
No external processing
All communication is encrypted automatically through Salesforce's HTTPS/TLS framework, which already meets enterprise-grade standards.
Updates and Maintenance 🛠️
Q: How are security updates for the Chrome Extension handled?
The Chrome Extension is regularly updated to address any potential security vulnerabilities and enhance its features. Updates are pushed through the Chrome Web Store, and users are notified when an update is available. We recommend keeping your extension updated to the latest version.
Q: Who is responsible for the security of the Salesforce APIs used by the extension?
Salesforce is responsible for the security and integrity of its APIs. Our extension adheres to Salesforce's API usage policies and security best practices to ensure secure interactions.
API Usage & Encryption🧩
Q: Which Salesforce API endpoints does Salesforce Tool Suite use?
Salesforce Tool Suite interacts only with Salesforce’s official APIs, and all requests are made directly from the user’s browser to Salesforce. No intermediate server is involved.
Here are the primary API endpoints used:
SOAP API
/services/Soap/m/{version}
Used for Metadata API operations such as readMetadata, updateMetadata, and listMetadata.
Purpose: Retrieve and modify Salesforce configuration elements like Custom Objects, Profiles, Permission Sets, Flows, Workflow Rules, etc.
REST API
/services/data/v{version}/query/
Executes SOQL queries to retrieve Salesforce records.
/services/data/v{version}/tooling/query/
Queries Tooling API objects like Apex Classes, Debug Logs, Validation Rules.
/services/data/v{version}/sobjects
Lists all sObjects in the org.
/services/data/v{version}/sobjects/{objectName}/describe
Retrieves metadata details for specific objects.
/services/data/v{version}/composite
Batches multiple API calls into one request.
/services/data/v{version}/tooling/sobjects/{objectType}/
CRUD operations for Tooling API records (CustomField, WorkflowRule, etc.).
OAuth 2.0 Endpoints
/services/oauth2/authorize – Starts Salesforce login flow.
/services/oauth2/token – Retrieves or refreshes access tokens.
/services/oauth2/success – Callback after successful authentication.
These endpoints are all standard Salesforce endpoints, and permissions depend on the logged-in Salesforce user’s profile, role, and connected app permissions.
Additional Security Questions ❓
Q: Where can I report a security vulnerability?
If you discover a security vulnerability, please contact us immediately using Write Us option available at bottom-right of the extension. We take all security reports seriously and will investigate them promptly.
Q: Is the Chrome Extension open-source?
As of now the Chrome Extension is not open source.
Closing Thoughts: Built for Trust, Designed for Salesforce Teams
With Salesforce Tool Suite, our goal is simple: empower Salesforce professionals with powerful capabilities while maintaining the highest standards of security and transparency. By avoiding intermediaries, relying on Salesforce’s trusted authentication mechanisms, and giving users full control over access, the tool ensures a secure and compliant experience for teams of all sizes.
Whether you’re adopting Salesforce Tool Suite for productivity or evaluating it for enterprise use, we hope this FAQ provides clarity and confidence. If you have additional queries or would like our team to assist with a formal security review, feel free to reach out to us.
Have Questions? Drop them here 👇
