Security — iSOLV

Last updated: 23 October 2026

We take the security of your data and your Salesforce organisation seriously. This page summarises how iSOLV Inbox is built and operated with security as a foundational principle, not an afterthought.

Our approach

iSOLV Inbox was designed from the ground up for multi-tenant security. Every customer's data is isolated at every layer — no query, API call, or cache entry can cross organisational boundaries. We treat any potential for cross-organisation data access as a critical defect requiring immediate resolution.

Encryption

All sensitive data at rest — including OAuth tokens, Salesforce credentials and shared secrets — is encrypted with AES-256-GCM using envelope encryption with AWS Key Management Service (KMS) in the eu-west-2 (London) region. Each value is encrypted with its own data key, and our master key never leaves AWS KMS, which records every use of it in an audit log. Newer values are also cryptographically bound to the mailbox or organisation they belong to. Data in transit is protected by TLS 1.2 or higher on all connections.

Email and calendar data

iSOLV's servers never store email bodies, attachments or calendar event notes. Email content is fetched on demand directly from Gmail or Outlook when a user opens a message, and is never written to iSOLV servers; we store only thread and message identifiers, the matched email address and the Salesforce record it links to. Emails that are linked to a Salesforce record are stored in your own Salesforce organisation (with their attachments, as Salesforce Files), owned by the person who linked or sent them; emails that aren't linked are never stored, and an email unlinked from every record has its stored copy removed.

AI matching

On the Professional plan, when iSOLV Inbox can't find the right Salesforce record by its own rules, it can ask Anthropic's Claude API. It sends the email's subject, the first 500 characters of the body and a list of candidate Salesforce records (names, record IDs and contacts' email addresses). Anthropic doesn't use this data to train its models and deletes it within 30 days. iSOLV stores none of it. The Starter plan never uses AI.

Authentication

Connections between your Salesforce organisation and iSOLV Inbox use JWT Bearer Flow — a secure, token-based authentication mechanism that does not require storing your Salesforce password anywhere. Gmail and Outlook connections use OAuth 2.0 with only the permissions iSOLV Inbox needs. User sessions are short-lived (four hours) and only work inside your own Salesforce domain. Every call from your Salesforce organisation to iSOLV is signed with a secret unique to your organisation, is checked for freshness, and can't be replayed.

Infrastructure

Our backend, its database and the database backups are hosted by Railway in the EU (Amsterdam, the Netherlands). Railway, Inc. is a US company, and its staff may access the service from the United States; this is covered by Railway's Data Processing Agreement. Our encryption keys are managed in AWS London (eu-west-2), and our error monitoring (Sentry) is hosted in the EU (Frankfurt, Germany). Our website and the iSOLV Inbox email client are static files served by Vercel's global network. Details of where our providers process data are in our Privacy Policy. We do not operate our own data centres.

Access controls

Access to production infrastructure is restricted to the iSOLV staff who need it and is protected by multi-factor authentication. We operate a principle of least privilege — no person or system has access to more than is necessary for their role. Customer data is never accessed for support purposes without the customer's explicit request.

Vulnerability management

We conduct regular dependency audits and apply security patches promptly. Our Salesforce code is audited against Salesforce's AppExchange security review checklist, including CRUD and FLS enforcement, sharing model compliance, and SOQL injection prevention. We maintain comprehensive automated test coverage to catch regressions.

Incident response

In the event of a security incident affecting customer data, we will notify affected customers within 72 hours in accordance with our obligations under the UK GDPR. Notifications will be sent to the administrator email address on the account. We will provide clear information about what happened, what data was affected, and what steps we are taking.

Responsible disclosure

If you discover a security vulnerability in iSOLV Inbox, please report it to hello@isolv.net. We will acknowledge your report within 48 hours and work to resolve confirmed vulnerabilities promptly. We ask that you do not publicly disclose vulnerabilities before we have had a reasonable opportunity to address them.

Certifications and compliance

iSOLV Inbox is built for compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are preparing iSOLV Inbox for the Salesforce AppExchange security review. We will update this page as reviews and certifications are completed.

Questions

Contact hello@isolv.net for any security-related questions or concerns.

Security at iSOLV.