Salesforce credential isolation
Authentication uses Salesforce OAuth. Salesforce passwords are never requested. OAuth tokens remain in extension-controlled browser storage and are excluded from cloud snapshots.
Security and trust
Security claims should be verifiable.
This page separates controls implemented in Org Sentinel from independent certifications. We do not display certification logos or imply an audit that has not occurred.
Current formal status: Org Sentinel has not yet completed an ISO 27001 certification, SOC 2 Type II examination or Salesforce AppExchange Security Review. Payment-card data is collected and processed by Paddle, not by Org Sentinel.
Implemented controls
Controls active in the product and production service
These statements describe the current architecture and are covered by automated tests, production checks or operational procedures.
Data minimization
Cloud synchronization accepts an explicit allowlist of normalized metrics and summarized evidence. Raw Salesforce business tables, session cookies and payment-card data are rejected.
Encryption and signed access
Sensitive cloud payloads use AES-256-GCM encryption with a versioned keyring. Paid entitlements are signed by the server with Ed25519 and verified by the extension.
Workspace-signed evidence
Eligible workspaces can explicitly sign a JSON audit digest with a rotatable Ed25519 key. Private key material remains encrypted on the backend; this is not an independent certification or trusted timestamp.
Tenant isolation
Workspace data is scoped by tenant in every authenticated operation. PostgreSQL Row-Level Security protects multi-tenant records, with least-privilege application credentials.
Web and extension hardening
Manifest V3, restrictive Content Security Policy, no remotely executed extension code, exact-origin CORS, HTTPS, HSTS, rate limiting and security headers reduce browser and API attack surface.
Billing integrity
Paddle webhooks require HMAC verification over the original request body. Events are deduplicated, ordered and mapped to tenants using server-owned price and transaction records.
Recovery and monitoring
Daily Hostinger backups complement encrypted PostgreSQL backups copied offsite. Restore drills, readiness checks and an external GitHub monitor cover availability, TLS and operational failures.
Account and privacy controls
Email verification, short-lived access tokens, rotating refresh tokens, audit events, notification opt-in, data export and permanent account deletion are available in the authenticated service.
Assurance readiness
A documented program, with independent assurance still ahead
Org Sentinel maintains a defined security scope, asset and data inventory, risk register, control register, operating policies and sanitized CI evidence manifests. This internal program improves auditability; it does not constitute certification or an independent opinion.
Governance foundation
Scope, roles, data classification, supplier dependencies, risks, control ownership and review frequencies are versioned and validated with the product.
Sanitized traceability
Successful quality workflows generate a hash-based evidence index tied to the commit without copying environment variables, logs, credentials or customer payloads.
External assurance
An independent penetration test, completed operating-evidence period, internal audit, management review and qualified external auditor are still required before a formal claim.
Certification register
Formal certifications and external assurance
“Not certified” is intentional disclosure, not a security badge. Vendor certifications do not automatically certify Org Sentinel.
| Framework or review | Current status | Scope and interpretation |
|---|---|---|
| ISO/IEC 27001 | Not certified | No accredited certification audit has been completed for the Org Sentinel information-security management system. |
| SOC 2 Type II | Not examined | No independent Type II report is currently available. A future report must be completed by an authorized audit firm before any claim is made. |
| PCI DSS | Paddle boundary | Org Sentinel does not collect or store full card data. Checkout and card processing occur on Paddle's payment surface. This does not make Org Sentinel itself PCI DSS certified. |
| Salesforce AppExchange Security Review | Not submitted | Org Sentinel is distributed as a browser extension and has not completed the AppExchange review. Chrome Web Store review is a distribution review, not a security certification. |
| GDPR and LGPD | Privacy controls | These are legal frameworks, not certifications. Export, deletion, minimization, retention and preference controls support compliance obligations; applicability depends on the customer's role and jurisdiction. |
Report a security issue
Private, responsible disclosure
Send a private security request. Do not include passwords, OAuth tokens, session cookies or card data.