Legal
How we protect your data and your Salesforce organisation.
Last updated: July 2026
We take the security of your data and your Salesforce organisation seriously. This page summarises how iSOLV Inbox is built and operated with security as a foundational principle, not an afterthought.
iSOLV Inbox was designed from the ground up for multi-tenant security. Every customer's data is isolated at every layer — no query, API call, or cache entry can cross organisational boundaries. We treat any potential for cross-organisation data access as a critical defect requiring immediate resolution.
All sensitive data at rest — including OAuth tokens, Salesforce credentials, and shared secrets — is encrypted using AES-256-GCM via AWS Key Management Service (KMS) in the eu-west-2 (London) region. Raw encryption keys never touch our application servers; all encrypt and decrypt operations are performed through AWS KMS, which maintains a full audit trail of every key usage. Data in transit is protected by TLS 1.2 or higher on all connections.
Connections between your Salesforce organisation and iSOLV Inbox use JWT Bearer Flow — a secure, token-based authentication mechanism that does not require storing your Salesforce password anywhere. Gmail and Outlook connections use OAuth 2.0 with the minimum required scopes. All session tokens are short-lived and use HMAC-SHA256 signing to prevent replay attacks.
Our backend infrastructure runs on Railway, hosted within the United Kingdom and European Economic Area. Encryption key management uses AWS KMS in the eu-west-2 (London) region. Our website is hosted on Vercel. We do not operate our own data centres.
Access to production infrastructure is restricted to iSOLV engineers and is protected by multi-factor authentication. We operate a principle of least privilege — no engineer or system has access to more than is necessary for their role. Customer data is never accessed for support purposes without the customer's explicit request.
We conduct regular dependency audits and apply security patches promptly. Our Salesforce code is audited against Salesforce's AppExchange security review checklist, including CRUD and FLS enforcement, sharing model compliance, and SOQL injection prevention. We maintain comprehensive automated test coverage to catch regressions.
In the event of a security incident affecting customer data, we will notify affected customers within 72 hours in accordance with our obligations under the UK GDPR. Notifications will be sent to the administrator email address on the account. We will provide clear information about what happened, what data was affected, and what steps we are taking.
If you discover a security vulnerability in iSOLV Inbox, please report it to hello@isolv.net. We will acknowledge your report within 48 hours and work to resolve confirmed vulnerabilities promptly. We ask that you do not publicly disclose vulnerabilities before we have had a reasonable opportunity to address them.
iSOLV Inbox is built for compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Salesforce AppExchange security review is in progress. We will update this page as certifications are obtained.
Contact hello@isolv.net for any security-related questions or concerns.