Want to work smarter with AI? See how Agentforce fits your business.
A secure Salesforce integration protects data at every point it moves or rests, limits what each connection can access and keeps a record of everything that happens. In practice that means encrypted connections, token-based authentication instead of stored passwords, a dedicated integration user with least-privilege permissions, secrets kept out of code and audit logs that show who or what changed data. Compliance then becomes a matter of mapping those controls to the frameworks your business follows and proving they work.
Core Security Controls
- Encryption in transit: all traffic uses current TLS, with no unencrypted endpoints.
- Encryption at rest: sensitive fields are protected, for example with Salesforce Shield Platform Encryption where required.
- Token-based authentication: OAuth flows such as the JWT bearer flow for server-to-server connections, instead of usernames and passwords.
- Named Credentials: endpoints and authentication details stored securely in Salesforce rather than in code.
- Dedicated integration user: a non-personal account with only the objects, fields and permissions the integration needs.
- IP and session restrictions: connected apps limited to trusted networks where possible.
- Audit logging: API activity, field history and integration logs retained and reviewed.
- Secret rotation: keys, certificates and tokens rotated on a schedule and revoked when no longer needed.
Authentication and Named Credentials
Named Credentials let Salesforce store an external endpoint together with its authentication settings, so Apex code and flows call the service without exposing secrets. Paired with OAuth, this removes passwords from code and configuration, makes rotation easier and keeps credentials out of version control. For inbound connections, a connected app with scoped OAuth permissions controls what an external system can do in Salesforce.
Protecting Financial Data
- Send only the fields each system needs, and avoid copying full financial records where a status or total will do.
- Keep payment card data out of Salesforce entirely where possible, using tokens from your payment provider instead.
- Restrict visibility of financial fields with field-level security and permission sets.
- Validate and log every change to amounts, invoices and payment status.
- Monitor for unusual volumes or access patterns that could signal misuse.
Mapping Controls to Compliance Frameworks
| Control | SOC 2 | PCI DSS | HIPAA |
|---|---|---|---|
| Encryption in transit and at rest | Confidentiality and security criteria | Required for cardholder data | Safeguard for protected health information |
| Least-privilege integration user | Logical access controls | Restrict access by business need | Minimum necessary access |
| OAuth and Named Credentials | Access and credential management | Strong authentication | Access control safeguards |
| Audit logging and review | Monitoring and change tracking | Log and monitor all access | Audit controls |
| Data minimisation | Confidentiality | Do not store card data unless needed | Minimum necessary standard |
| Change management and testing | Change management criteria | Secure development and change control | Integrity and risk management |
Which frameworks apply depends on your industry and the data involved. Confirm requirements with your compliance or legal team, and check any agreements needed with your vendors, such as a business associate agreement for health data.
Keeping It Compliant Over Time
Security is not a one-time setup. Review integration permissions when roles change, test security settings after each release, rotate credentials and keep documentation that shows auditors how data flows and who can access it.
Folio3’s Approach
Folio3’s Salesforce integration services include API integration with secure authentication, endpoints and testing. For ongoing reviews, monitoring and patches, Folio3 provides Salesforce support and maintenance services, and regulated industries can explore Salesforce Financial Services Cloud and Health Cloud consulting.
People Also Ask
- What security controls should a Salesforce integration have?
- How do you secure API integrations that move financial data?
- What are Named Credentials in Salesforce?
- How do you make Salesforce integrations compliant with SOC 2, PCI DSS or HIPAA?
- How do you keep a Salesforce integration secure and compliant when it’s moving customer and financial data between systems?
Moving customer or financial data through Salesforce integrations? Talk to Folio3 about a secure integration design with controls mapped to your compliance needs.
