The Salesforce AppExchange has been an enterprise gamechanger for over 15 years. Chock-full of business apps for Salesforce (4,000+!), it can enhance your org’s functionality by several orders of magnitude.
When you consider installing a third-party application into your CRM, however, there should be one major question on your mind: how will this app affect my org’s security?
While there are a number of security considerations you can (and should) take into account when seeking a best-fit Salesforce app for your business, we have one that we don’t think should ever be overlooked: is the app 100% native to Salesforce? If it is, you may be able to save your team weeks of security vetting.
What Are 100% Native Salesforce Apps?
Salesforce apps are considered 100% native if they are built entirely on the Lightning Platform (formerly the force.com platform). That’s the same platform that products like Sales, Service, and Experience Cloud are built on - they all share Salesforce’s core technology stack.
When we discuss native app security, we’re actually discussing the data security practices of Salesforce itself (which we’re assuming your organization has vetted and approved, since you’ve already invested in the platform). See what we’re getting at here?
100% native Salesforce apps leverage the data security of the Salesforce platform, meaning your team can approve and use them faster - without worrying about your data being processed anywhere other than your Salesforce org.
You Might Also Like: Reduce Your Compliance Burden With Native Salesforce Apps
Native Salesforce App Data Security Benefits
There’s a reason Salesforce is preferred by leading organizations in security-conscious industries like healthcare, government, and financial services - it invests in unmatched data security. That investment carries through to cover native applications.
Salesforce Security Architecture
Salesforce prides itself on its network security. In most cases, your data is stored in Salesforce-owned data centers in the region you’re located in. If your company is based in the United States, so is your Salesforce data, and so on.
When you access data in Salesforce, it’s encrypted in transit using Transport Layer Security (TLS) with at least 2048-bit RSA server certificates and 128-bit symmetric encryption keys. Traffic passes through stateful packet filtering firewalls and edge routers that protect your org’s perimeter.
Their servers are constantly monitored by intrusion detection systems and any incidents that occur are reported in real time at trust.salesforce.com. Salesforce also conducts regular penetration testing and vulnerability scans.
Native apps are covered by these same security measures. When you use a native application, your data never leaves the protections of the Salesforce platform.
Data Processing Control
Salesforce processes customer data only as customers instruct. Where data must be processed by one of Salesforce’s sub-processors, Salesforce has entered into written privacy and data security agreements with those sub-processors - and these agreements are enforced by regular audits.
Native Salesforce apps automatically comply with Salesforce’s data processing policies. They never process data in any way that you haven’t already agreed upon with Salesforce.
Certifications
Salesforce boasts dozens of data security certifications globally. These include (but are not limited to):
- Department of Defense IL-2 & IL-4
- GDPR
- HIPAA & HITRUST
- ISO 27001/27017/27018
- Payment Card Industry (PCI)
- Cloud Computing Compliance Controls Catalogue (C5)
Native apps are covered by most application security controls that these certifications require.
Reliability and Disaster Recovery
Salesforce works hard to ensure data stored within the platform is never lost or corrupted. Their networking components, network accelerators, load balancers, web servers, and application servers are configured redundantly - which means that if any one piece fails, there are multiple backups available to keep things running.
Your Salesforce data is stored on redundant, carrier-class disc storage with multiple data paths, and is automatically replicated in real time and backed up to localized data stores.
You Might Also Like: 6 Easy Ways To Make Your Salesforce Org More Secure
In the event of a disaster, Salesforce has procedures in place designed to restore services within 12 hours. These procedures are tested annually.
Native Salesforce applications don’t process your data outside of Salesforce, meaning your data is always protected by Salesforce’s reliability and disaster recovery policies.
Customer-Driven Security
While the Salesforce platform architecture is incredibly secure, Salesforce data security also depends upon how you use the platform. The best network security in the world can’t protect against insider threats or negligent access policies.
Luckily, Salesforce provides its customers with configurable security controls that allow them to ensure their org is protected from the inside out. From simple controls like secure password policies to more complex permission sets and data sharing models, your internal compliance policies can always be enforced within Salesforce.
Native applications respect all customer-configured security controls, ensuring no data is leaked or accessed by the wrong individuals.
Physical Security
Salesforce’s rigorous network security policies are backed up by equally strong physical security. Its data centers are only accessible by authorized personnel - buildings are unmarked and surveilled by around-the-clock guards that enforce 2-factor access screening. They’re also built to withstand adverse weather conditions and use systems that monitor temperature, humidity, and other environmental factors. Alternate power systems are also in place to prevent electrical failures.
These data centers also host native Salesforce apps, meaning you can always be sure that your data is protected - from the digital to the brick-and-mortar level.
You Might Also Like: 5 Security and Compliance Benefits of Salesforce Document Automation
Data Return or Deletion
At the end of the day, Salesforce isn’t for everyone. If your company decides to move away from the platform, you can request a return of all data within 30 days - and it will be permanently deleted after at least 120 days of contract termination.
If you leverage native apps, you’ll never have to worry about your data floating around external servers if you decide to stop using Salesforce. It never leaves the platform.
Native Salesforce Apps: Partners In Secure Business Innovation
Native Salesforce apps extend Salesforce’s functionality while leveraging its world-class application architecture for superior security and speed. They’re built to help your business achieve its goals digitally, without the complexity of external security evaluations.
While native apps are not a universal solution, you should look to them first as you work to streamline and enhance your Salesforce workflows. Your team will thank you!
S-Docs: 100% Native Document Generation & E-Signature For Salesforce
Speaking of native apps: S-Docs is the only 100% native document generation & e-signature solution for Salesforce. We help businesses automate and e-sign their digital paperwork faster, more easily, and more securely.
S-Docs is leveraged by leading government, healthcare, and financial institutions due to its secure native architecture that never sends data off-platform. From invoices to sensitive medical documentation, S-Docs is the trusted partner for secure document generation and e-signature collection for Salesforce.
Interested in digging a little deeper? Contact our sales team at sales@sdocs.com, or request a demo today.
