SOLUTIONS FOR CRM / SECURITY
Where your archive lives, and how it is protected.
This page describes what is built today and what is not. Searchable Archive is in early access: it has not passed Salesforce’s AppExchange security review and holds no compliance certifications.
How data flows
You choose where the archive lives. Managed Cloud is the default. Native keeps everything inside your Salesforce org.
Managed Cloud Default
- In your Salesforce orgArchive app and Apex bridge
You choose the records. Staff search and read from here.
- Our AWS account · us-east-1Archive API
An HTTPS endpoint (API Gateway) and on-demand Lambda functions. It verifies the org and the user before it does anything.
- Our AWS account · us-east-1Archive storage
S3 holds compressed snapshots, attachments and search shards. DynamoDB holds index metadata. SQS queues the jobs.
- What leaves your org: copies of the records you select for archiving: email headers and bodies, attachments linked to those emails, and the custom-object fields you configure. The read-only assessment counts records and estimates size. It does not copy them.
- How the service reaches Salesforce: through an External Client App using OAuth with PKCE and rotating refresh tokens, as a dedicated integration user that you control. It reads the selected records, checks current access and performs restores.
- Order of operations: the first run only copies. Source records are removed only after the copy is verified and after two separate switches, one in the service and one in your Salesforce org, are turned on. Both are off by default.
- Reading archived records: every search, read and export is checked against the Salesforce user’s current access to the parent Case and to each field before results return. A large attachment is served through a download link that expires after 30 seconds.
Native Inside your org
- In your Salesforce orgArchive app (Apex)
Runs the copy, search, read and restore inside your org. No external service is called.
- In your Salesforce orgPrivate archive objects
Compressed snapshots are stored as Files with a private index, in objects that staff cannot open directly. They use File Storage.
- What leaves your org: nothing. No AWS component is involved and no archive data is sent to a sub-processor.
- Access: the viewer and admin permission sets grant use of the app’s service, not access to raw archive rows. Direct downloads of snapshots are blocked, and permitted file downloads use temporary copies that expire after 30 seconds.
- Not a backup: the archive lives in the same org as the source. It does not protect you if you lose that org.
Region
AWS US East (N. Virginia) is the only region at launch for Managed Cloud. All archive storage and processing for that mode run there. No other region is offered yet. Setup records an explicit region approval before anything is copied, and a different region would need a new approval. If you need data held elsewhere, tell us before you start. Native mode keeps the archive in the region where your Salesforce org is hosted.
Encryption
Managed Cloud, as deployed today.
| Data | In transit | At rest |
|---|---|---|
| Archive objects in S3: snapshots, attachments, search shards | HTTPS. The bucket policy denies any request that is not TLS. | SSE-S3 (AES-256, keys managed by AWS). Public access is blocked. Old object versions and temporary exports expire after 7 days. |
| Index metadata in DynamoDB | HTTPS | Server-side encryption with an AWS-managed key. |
| Job queues in SQS | HTTPS | SSE-SQS. |
| Salesforce connection credentials (OAuth) | HTTPS | AWS Systems Manager Parameter Store, SecureString, AWS-managed key. |
We do not use customer-managed encryption keys, and there are no per-customer keys today. Fields protected by Shield Platform Encryption are not certified: do not enable archiving for objects that depend on them.
Access and isolation
- Current access, every time. Search, read and export check the user’s current access to the parent Case and to each field. Revoked access takes effect on the next request.
- Three permission sets. ArchiveViewer searches and reads. ArchiveAdmin sets up, runs and restores. ArchiveIntegration is for the Managed Cloud integration user only. See the install guide.
- Restore writes as the integration user. Review that user’s object and field permissions before you enable restore. Restore also needs the admin-level restore permission.
- Tenant isolation lives in application code. Every stored key is qualified by tenant and the service checks the tenant on every request. The service runs under one shared AWS role for all registered customers. It is not a per-customer AWS sandbox.
- Diagnostics avoid content. Diagnostics and the buyer report do not include raw email bodies, and download links are short-lived and not logged. AWS runtime logging is switched off, so job status and errors are kept in the application’s own records.
- Safe rendering. HTML in archived emails is shown as safe text by default.
Sub-processors
| Provider | What it does | What it can see | Applies to |
|---|---|---|---|
| Amazon Web Services | Hosts the archive service and storage in us-east-1. | Archived content and index data, encrypted at rest. | Managed Cloud only |
| Paddle | Planned merchant of record for paid subscriptions: billing, tax and invoices. | Billing and payment details, your Salesforce org ID and the plan. Never archived content. | Not active yet. No payments are collected today. |
| Google Firebase Hosting | Serves this marketing website. | Technical connection data of website visitors, such as IP addresses. No Salesforce data. | Website only |
Salesforce is your platform, not our sub-processor.
When a plan ends
What stays available. When a trial or plan expires, authorized search, export and restore of records that are already archived keep working. Viewer export is JSON of the fields each user may read. It is not a backup of the full record graph.
What stops. New archive writes stop: new copies and archive runs are blocked until the plan is active again. Records you have not archived are not touched.
What is not defined yet. How long Managed Cloud data is retained after a subscription ends, and how deletion is carried out and confirmed. We agree those terms in writing before production use and before any Salesforce data is processed.
What is not in place yet
These are open items, not footnotes. Ask us about any of them before you decide.
- No completed Salesforce security review. The package has not passed AppExchange security review and is not an AppExchange-approved release.
- No compliance certifications. No SOC 2 report, ISO 27001 certificate or similar attestation.
- No durable account audit trail yet. An AWS CloudTrail trail is not configured. Application-level audit events exist.
- No per-customer encryption keys or AWS isolation. See Access and isolation above.
- Recovery of index metadata needs review. DynamoDB point-in-time recovery is an optional setting that has to be reviewed and switched on before real customer data is stored. The S3 manifests can rebuild group and search metadata, but not all operational, licensing or audit state.
- No support SLA or availability commitment. An evaluation does not establish one.
- Shield Platform Encryption fields are not certified for archiving.
Security questions
Where is my archive stored?
In Managed Cloud mode, in our AWS account in the us-east-1 (N. Virginia) region. In Native mode, inside your own Salesforce org. No other region is offered yet.
Is archived data encrypted?
Yes, at rest and in transit. Archive objects in S3 use SSE-S3 (AES-256), the DynamoDB index uses AWS-managed server-side encryption, queues use SSE-SQS, and Salesforce connection credentials sit in Parameter Store as SecureString values. Traffic uses HTTPS. We do not use customer-managed encryption keys and there are no per-customer keys today.
Has Searchable Archive passed Salesforce security review?
No. The package is not AppExchange-approved and has not passed Salesforce’s security review. We also hold no compliance certifications. Treat it as early-access software and evaluate it in a sandbox.
What happens to my archive if my plan ends?
Authorized search, export and restore of records that are already archived stay available. New archive writes stop. How long Managed Cloud data is retained after termination, and how deletion is confirmed, is agreed in writing before production use.
Does this website connect to my Salesforce org?
No. The marketing website never connects to your org and has no analytics or advertising pixels. Please do not send passwords, tokens or customer records through the inquiry form.
Have a security question?
Email manhnt.bkit@gmail.com before you start. Deployment, region, retention, deletion and any processing agreement are confirmed in writing before any Salesforce data is processed.