Trust & Security

Where your data is processed and stored

• Direct access from VS Code to Salesforce. The canvas runs in a VS Code webview. The local extension host retrieves records and applies uploads through Salesforce APIs as the connected user. Record data is not routed through Org Loom-operated servers, and the extension does not require the Org Loom managed package.
• Optional local encrypted recovery. Recovery is off until you enable it. A one-time prompt offers Enable recovery or Not now when you first open a connected canvas; you can change your choice later in VS Code settings. When enabled, unsaved canvas checkpoints and comparison snapshots are stored locally using AES-256-GCM encryption. The key is kept in VS Code SecretStorage. Recovery is scoped to the Salesforce org and user; these checkpoints are not saved in Salesforce Files. Turning recovery off deletes the stored checkpoints and keys while keeping your open canvas intact.
• Connection credentials. The extension connects only through Salesforce CLI. The CLI manages authorization; the extension keeps access tokens in memory and remembers only the selected org/user identity in VS Code SecretStorage. Credentials stay in the extension host and are not passed to the canvas webview.
• Exports need separate protection. CSV and JSON exports can contain readable record values. Local recovery encryption does not encrypt exported files.

Salesforce access and upload controls

• Your Salesforce permissions apply. The org must support API access. The connecting user needs API Enabled and View Setup and Configuration; a full System Administrator profile is not required. Object permissions, field-level security, sharing, validation rules, and automation still apply.
• Package feature settings do not govern the extension. The extension uses the connected Salesforce user’s access. It does not offer package canvas sharing, contributor requests, or saving canvases in Salesforce.
• Uploads can partially succeed. Related creates and updates are grouped into transactions. Successful groups remain committed if another group fails. Deletes run separately afterward. Review results before retrying.
• No Upload Recall. The extension does not provide the managed package’s review-and-reverse feature. Disconnecting or discarding a canvas does not undo Salesforce changes.

Read the extension’s full security and data-handling details, including recovery retention and disconnect behavior.

Regulated data and compliance

You are responsible for determining whether your use of Org Loom meets the legal, regulatory, and contractual requirements applicable to your organization and data. Installing Org Loom does not by itself establish compliance with those requirements. Do not send sensitive or regulated record data to Org Loom through support requests or other communications without an appropriate agreement.

Org Loom does not currently have a SOC 2 report or PCI DSS validation. See Section 5 of our Terms of Service for the regulated-data terms and contact security@orgloom.com to discuss your organization's assessment requirements.

Website and support information

Information you provide through our website, beta registration, or support channels is handled separately from the records you work with in the managed package or VS Code extension. Our Privacy Policy describes how we handle that information and the service providers involved. Avoid including sensitive record values in messages, screenshots, or attachments without an appropriate agreement.

Vulnerability disclosure

Security research is welcome. Report findings to security@orgloom.com. Please email before testing anything intrusive (for example authenticated fuzzing or denial-of-service simulation) so we can scope the engagement. We aim to acknowledge reports within 3 business days and provide an initial assessment within 7.

Source transparency

Check your installed Org Loom version in VS Code’s Extensions view when reviewing its behavior. Contact security@orgloom.com for extension-specific security assessment questions.

The shared canvas core is licensed under the PolyForm Internal Use License 1.0.0. That license does not by itself grant rights to operate the complete proprietary native application.

Contact

Security questionnaires and assessments: security@orgloom.com.
Privacy and data-subject requests: privacy@orgloom.com.
Procurement and legal: legal@orgloom.com.

See also: Terms of Service · Privacy Policy.