Security
Connecting Salesforce. You connect an environment by signing in to Salesforce and approving access. Metacaliper never receives the password. It acts as the user who connected the environment, with that user’s permissions, and you do not create a connected app in the org. No managed package is installed.
What is stored. Metacaliper stores the metadata it retrieves for comparisons, deployments and snapshots, and the records of what ran. It does not copy business records such as accounts, contacts or opportunities. Change monitoring reads who made setup changes, user permission assignments and login history, to raise its flags. On Enterprise, files can be kept in the customer’s own storage bucket, with the customer’s encryption key.
Encryption. Data is encrypted in transit and at rest. Stored credentials (Salesforce tokens, git tokens) are encrypted before they are stored, and are never shown again once saved.
Encryption keys. Each workspace has its own data key, and the workspace’s secrets (Salesforce tokens, git tokens, invitation links) are sealed with it. A data key is stored only wrapped by a key held in a key management service, so a copy of the database alone does not open the secrets. The wrapping key can be replaced without exposing any secret. Erasing a workspace deletes its data key.
Tenancy isolation. Each workspace’s data is separated at the database level: every read and write is limited to one workspace by row-level security, and a request for another workspace’s data is refused by the database itself.
Access control. Members have roles (Owner, Admin, Member, Approver, Viewer), and each change is checked against the member’s role. Workspaces can require an authenticator app, and single sign-on with SAML or OIDC on Business and Enterprise.
Operator access. Metacaliper staff reach a workspace only through one audited path: every access writes an audit row with the operator, the time and the reason.
Logging. Members’ and the system’s actions are recorded in each workspace’s audit log, which Owners and Admins read on Business and Enterprise. Sign-ins are recorded.
Backups and restore drills. The database is backed up automatically, together with its transaction log, and the backups are encrypted, so it can be restored to a chosen moment. Restore drills restore a copy of the database to a chosen moment, check that the copy holds what it should, and record the outcome.
Controls. Metacaliper follows SOC 2-aligned controls. It is not SOC 2 certified.
Reporting an incident or a vulnerability. Email support@metacaliper.com. If an incident affects a workspace’s data, Metacaliper emails the workspace’s Owners. The Data Processing Addendum sets out how a personal data breach is notified. Testing the Service’s vulnerability needs our written permission first, as the Terms say.