How do you connect to my data in Salesforce.com?

Madison Logic connects to Salesforce.com using publicly documented REST APIs provided by Salesforce.com.

We authenticate to Salesforce.com using one username and one password provided by you when you configure our Salesforce.com integration module.

What data do you retrieve and store from Salesforce.com?

1. Authentication: Madison Logic use OAuth2 flow to enable login and get the API access token from clients. This token is stored in AWS DynamoDB with encryption at Rest using AWS KMS.
2. Meta Data: Madison Logic has clients choose which SFDC fields they would like to map during the integration process in ML Platform. Fields are only selected from SFDC Accounts, Contacts and Opportunities objects. Madison Logic stores additional meta data consisting of client’s predefined set of Opportunity stage names and probability.
3. Record Data: Madison Logic stores SFDC AccountId, Name and Domain (this is extracted from Client Email or Account Website field). This data is encrypted at rest using AWS KMS and stored in AWS S3.

For each of the following objects, Madison Logic stores the following:

Where do you physically store my data?

Madison Logic stores your CRM data in the United States, in the state of Virginia, within the Amazon Web Services region us-east-1.

How is my data secured in transit?

When Madison Logic retrieves your data from Salesforce APIs, it is secured in transit by encryption using Transport Layer Security (TLS) version 1.2.

When your CRM data is transferred within Madison Logic systems, it is also secured in transit by encryption using TLS 1.2.

How is my data secured at rest?

Your data is secured at rest by encrypting it using AWS Key Management Service APIs.

AWS KMS uses the Advanced Encryption Standard (AES) algorithm in Galois/Counter Mode (GCM), known as AES-GCM. AWS KMS uses this algorithm with 256-bit secret keys.

Is my data isolated from other customers? If so, how?

Access to your data is programmatically restricted by customer via a third party authentication & entitlements service (Okta).  

Is there a process in place for removing our content and data at the end of the use agreement?

Yes. We can ensure that your content is securely removed from Madison Logic systems. Contact us for more information.

What type of compliance and controls are in place?

Security and quality controls in Amazon Web Services have been validated and certified by the following compliance schemes:

• AWS Service Organization Controls (SOC 1, SOC 2, and SOC 3) Reports. You can request a copy of these reports from AWS Compliance.
• PCI DSS Level 1. For more details on PCI DSS compliant services in AWS, you can read the PCI DSS FAQs.
• ISO 27017. For more details on ISO 27017 compliant services in AWS, you can read the ISO-27017 FAQs.
• ISO 27018. For more details on ISO 27018 compliant services in AWS, you can read the ISO-27018 FAQs.
• ISO 9001. For more details on ISO 9001 compliant services in AWS, you can read the ISO-9001 FAQs.
• In evaluation for FIPS 140-2. For more details, you can view the FIPS 140-2 Implementation Under Test List. 

What are the minimum requirements needed for the SFDC admin user that is used to authenticate?

1. Organization should have API feature enabled.
2. User permissions: API Access (Read-only)

References

Salesforce Developer Documentation

• Force.com REST API

Amazon Web Services Documentation

• AWS Key Management Services
• KMS - Cryptography Basics describes the cipher used: Advanced Encryption Standard (AES) algorithm in Galois/Counter Mode (GCM), known as AES-GCM. AWS KMS uses this algorithm with 256-bit secret keys.

AWS KMS uses the Advanced Encryption Standard (AES) algorithm in Galois/Counter Mode (GCM), known as AES-GCM. AWS KMS uses this algorithm with 256-bit secret keys.

Related docs