OrgRecon
Published privacy contract

Customer record contents do not become OrgRecon data.

OrgRecon may receive a bounded Salesforce response in memory long enough to classify anonymous access. It retains the minimum normalized evidence needed to support a finding, then discards customer record contents and transport secrets.

Four responsibilities

A clear boundary at every stage.

Authorization, detection, evidence, and explanation remain separate. No role receives more customer data than it needs.

01

Verified owner

Invite-only owners establish the organization relationship and authorize exact Salesforce hosts. Discovery of another hostname does not expand scan authority.

Controls the assessment boundary
02

Deterministic scanner

Runs bounded, read-only checks against approved hosts. Rules classify response structure and observable field presence without an LLM creating findings.

Observes only what the rule requires
03

Evidence layer

Retains normalized counts, field-presence states, fingerprints, provenance, and coverage outcomes—not Salesforce record contents or raw responses.

Keeps proof, discards customer content
04

Report assistant

Receives only the selected report’s curated, redacted context. It explains existing evidence and cannot access Salesforce, create findings, or change severity.

Explains; never detects
The report data contract

What is stored—and what is discarded.

OrgRecon retains evidence attributes that let an owner understand and reproduce a conclusion. Salesforce customer content is not needed for that purpose.

Stored for the report

Normalized security evidence

  • Finding identity, status, severity, and confidence
  • Authorized target and bounded scan metadata
  • Object API names and Salesforce-reported aggregate counts
  • Schema field names and field types
  • Value-present, null, empty, or schema-only classifications
  • Evidence provenance, fingerprints, and coverage outcomes
Contact__c · Email__c (Email) · value_observed · anonymous_field_probe
Discarded after classification

Customer content and transport secrets

  • Salesforce field and record values
  • Salesforce record IDs and returned row payloads
  • Raw HTTP and Salesforce response bodies
  • Salesforce access tokens, Salesforce refresh tokens, collected cookies, and session secrets
  • Customer files, attachments, and conversations
  • Values that are unnecessary to prove the finding

These values do not appear in the report or the report assistant’s context.

Bounded transient processing

A response can be processed without becoming retained data.

Some checks must briefly inspect an anonymous response to determine whether records, schema, or field values were returned. That processing is limited to the active check and is not a data-ingestion workflow.

  1. 1
    Request

    A deterministic rule sends a bounded, read-only request to an owner-authorized host.

  2. 2
    Classify in memory

    The scanner reads only enough response structure to determine counts, schema, and value-presence state.

  3. 3
    Normalize the proof

    Privacy-safe evidence is reduced to field names, types, classifications, provenance, and coverage state.

  4. 4
    Discard the response

    Raw bodies, record contents, record IDs, cookies, and transport secrets are not retained in the report.

Verify the methodology

See how evidence becomes a finding.

Review OrgRecon’s published scanner methodology or inspect the interactive evidence-backed report.

See how OrgRecon works Explore the report