Salesforce MCP security
ApexGenius MCP is a gateway: Salesforce record data is processed transiently and never stored, credentials are encrypted with AES-256-GCM, and every tool call is audit logged.
No Record Storage
MCP stores no Salesforce record content
No LLM Routing
Your data goes to the AI client you connect
Delete on Request
We purge what we hold whenever you ask
Row-Level Security
Database-enforced isolation
How We Protect Your Data
Every layer of our stack is built with security as a first-class concern, not an afterthought.
Your AI, Your Data Path
ApexGenius MCP is a conduit. Tool results return to the AI client you connect — Claude, ChatGPT, and others — under your own agreement with that provider. Your Salesforce data is never routed through ApexGenius’s own AI models.
No Copy of Your Org
MCP does not index or vectorize your org. It stages only the components you explicitly pull into your workbench, which you can delete at any time. There is no background copy of your metadata or records.
AES-256-GCM Encryption
Salesforce OAuth tokens and other credentials are encrypted at rest with AES-256-GCM. MCP tool calls and results are not retained as content. TLS is enforced on every connection with HSTS.
Per-User Salesforce Auth
Each team member authenticates with their own Salesforce credentials via OAuth 2.0. Data access respects your existing Salesforce permission model. Tokens are stored as encrypted vault references.
Row-Level Security
Every database table has Row-Level Security enabled. Your data is isolated at the user, organization, and project level, enforced at the database layer for every table.
Comprehensive Audit Logging
Every RPC call, permission change, deploy action, and error is logged with full context. RBAC audit logs are retained 90 days. Credentials and secrets are stripped from server logs before writing.
Network Intrusion Detection
Our production backend is monitored by an intrusion detection system that alerts on known attack patterns, port scans, and anomalous behavior in real time.
Delete on Request
MCP stores no Salesforce record content in the first place. Anything we do hold — encrypted credentials, the staging you have pulled, saved content, and audit logs — is deleted whenever you ask.
When you use ApexGenius Chat
Everything above describes the MCP product. ApexGenius Chat is our separate, managed assistant (available by request) that runs models on your behalf — so it has its own AI provider and retention story, laid out here.
AI providers for ApexGenius Chat
| Provider | Model | Trains on API Data? | Privacy Policy |
|---|---|---|---|
| Anthropic | Claude | No | View |
| OpenAI | GPT | No | View |
| Gemini | No | View | |
| xAI | Grok | No | View |
| Groq | Inference | No | View |
Every provider above is used through its enterprise API endpoint under terms that prohibit training on customer data. Prompts are retained only within each provider’s short abuse-monitoring window before deletion. These providers apply to ApexGenius Chat, not to the MCP product.
Need our full security documentation?
We provide detailed security architecture documentation, penetration test summaries, and infrastructure reports to enterprise customers and security teams on request.
Infrastructure and Sub-Processors
The infrastructure that runs the platform. For the MCP product, these are the only sub-processors — AI providers apply solely to ApexGenius Chat (above).
| Provider | Purpose | Data Accessed |
|---|---|---|
| Supabase (AWS) | Database, auth, vault encryption | All application data (encrypted at rest) |
| DigitalOcean | Backend hosting | Application runtime (encrypted in transit) |
| Vercel | Frontend hosting + CDN | Static assets, IP addresses |
| Upstash | Redis caching + rate limiting | Rate limit counters, metadata cache (no secrets) |
| Stripe | Payment processing | Billing info, subscription status (no full card numbers) |
Security FAQ
Answers to the questions security teams ask before approving new tools.
Ready to see it in action?
Start with a free account. No credit card required. Connect your Salesforce sandbox and experience enterprise-grade security from day one.