For Your IT Team

Technical details for Salesforce administrators and IT security teams reviewing this tool.

Authentication Approach

This tool uses Salesforce Session ID authentication — not OAuth and not a Connected App. The user generates a temporary Session ID from within their own Salesforce org (via Developer Console) and provides it to the tool. The Session ID is used as a Bearer token for REST API calls, exactly as Salesforce uses OAuth access tokens.

No setup is required in your Salesforce org. There is no Connected App to configure, no OAuth redirect URI to register, and no client credentials to manage.

Required User Permissions

Permission	Why It's Needed
API Enabled	Required for all REST API access
View Setup and Configuration	Read field and object definitions via Metadata API
Read on audited objects	To check aggregate record counts for usage analysis

System Administrators meet all requirements by default. Other profiles may produce partial results.

What the Tool Reads

• Custom field definitions (name, type, label, help text)
• Custom object definitions
• Page layout assignments
• Aggregate record counts per object (to identify unused objects)
• Field-level usage indicators

The tool does not read, copy, or transmit business records (Accounts, Contacts, Leads, Opportunities, etc.).

KeelCadence reviews Salesforce metadata and aggregate configuration signals. It does not export customer records, files, attachments, emails, Chatter content, or transactional data. Field usage is calculated from aggregate counts — individual field values and record-level data are not exported.

API Usage

Each audit run consumes approximately 50–200 API calls against your org's daily API limit. Salesforce orgs typically allow 15,000 API calls per day. This tool's usage is minimal.

Session ID Security

The Session ID is equivalent to a Salesforce session token. It expires automatically after your org's configured session timeout (default 2 hours). Its containment path is as follows:

• Held in the user's encrypted, signed browser session cookie for the duration of the visit.
• When an audit starts, held in process memory for the duration of the audit only — never written to the database, logs, or report files.
• Discarded immediately when the audit completes or fails.
• Additional server-side controls ensure session credentials cannot be written to persistent storage.

When the user disconnects, the session cookie is cleared and the Session ID is no longer accessible to the tool.

No Persistent Access

Because this tool uses Session IDs rather than OAuth refresh tokens, it has no persistent access to your Salesforce org. Once a session expires or the user disconnects, the tool cannot make further API calls without the user providing a new Session ID. You do not need to revoke any app access in Salesforce when a user stops using the tool.

Network Calls

Outbound HTTPS calls are made from our server to your Salesforce org's REST API:

• https://[your-instance].salesforce.com/services/oauth2/userinfo — session validation on connect
• https://[your-instance].salesforce.com/services/data/vXX.0/ — metadata and audit API calls

All calls are outbound HTTPS from our server. No webhooks, no inbound connections from our servers to your org.

Data Stored on Our Servers

• Org ID and Instance URL — to identify which org was audited
• Audit results: field API names, labels, data types, aggregate fill-rate counts and percentages, page layout names, profile/permission set grant counts — no individual record values, no business data
• Stripe Checkout session ID and a paid/unpaid flag — to enable workbook download after payment. No card data.
• Not stored: Salesforce Session IDs, OAuth tokens, passwords, individual record values, or Salesforce audit report contents in any analytics service
• Audit results are automatically purged 90 days after the audit was queued
• Users can request immediate deletion via the Privacy page or the “Delete My Data” action in the app

Hosting

Hosted on Replit (US region) behind a custom domain (audit.keelcadence.com). DNS managed via GoDaddy. All traffic is TLS-encrypted.

Third-Party Services

Service	Purpose	Data received
Stripe	Payment processing	Card data handled by Stripe. KeelCadence stores only a Stripe checkout session ID and paid/unpaid flag. No card details on KeelCadence servers.
Google Analytics 4	Website and product usage analytics	Consent-gated. Receives sanitized page paths (run IDs replaced with [id]), page titles, and safe funnel events. Does not receive Salesforce credentials, Org IDs, usernames, field/object names, report contents, or Stripe session IDs.
Google Fonts	Font delivery	Visitor IP address and user-agent sent to Google servers on page load.
unpkg.com (Cloudflare CDN)	HTMX JavaScript library delivery	Visitor IP address and user-agent sent to Cloudflare on page load.
Replit	US-based hosting infrastructure	All app data and request logs within Replit’s US infrastructure.

KeelCadence does not use advertising pixels, retargeting pixels, fingerprinting tools, email marketing automation, session replay tools, Sentry, Datadog, PostHog, Mixpanel, Segment, Hotjar, or any similar service.

Frequently Asked Security Questions

Does KeelCadence export Salesforce records or files?
No. KeelCadence does not export customer records, files, attachments, emails, Chatter content, or transactional data. The reports are based on Salesforce metadata, configuration, permission structures, automation metadata, and aggregate counts where needed for diagnostic scoring.

Can KeelCadence write to or modify my Salesforce org?
No. The tool makes read-only API calls. It does not create, update, or delete any Salesforce records, fields, objects, or configuration.

Does KeelCadence retain access after the session ends?
No. Session IDs expire with your Salesforce session (default 2 hours). There are no OAuth refresh tokens. The tool cannot access your org after the session expires without you providing a new Session ID.