Live on AppExchange · Free · Never requires payment
Start with a user, not a permission set.
Pick anyone in your org, drill into any app, and see every object, field and record they can access, with the exact profile, permission set or sharing rule that granted it. 100% native. Read-only.
See a full access review in one demo.
A short tour: start with a person, see their apps, objects and fields, and the exact rule that granted each one. Pick a chapter to jump straight to it.
A 30-minute investigation, every single time.
Someone asks why a user can see a record they should not. Answering it means stitching together profiles, permission sets, permission set groups, role hierarchy, sharing rules and manual shares in your head, one Setup screen at a time.
Six places, no single view
Profiles, permission sets, permission set groups, role hierarchy, sharing rules and manual shares all grant access, and nothing shows them together.
You have to reverse-engineer
Setup starts from a permission set and lists who it affects. The question you were asked started from the person.
Reviews become guesswork
Security reviews, onboarding checks and offboarding checks all stall when confirming one user's effective access takes half an hour.
An access question left half-answered is how over-permissioned users stay over-permissioned, right up until a compliance check or an incident finds them first.
Salesforce’s most confusing question, turned into a two-click answer.
Instead of starting from a permission set or profile and working out who it touches, Who Sees What starts with the person, and resolves everything into one clear, user-centered view.
Pick any user
Anyone in your org. No configuration, no reverse-engineering, nothing to define before you ask.
See every app, object, field and record
Along with the exact profile, permission set or sharing rule responsible for granting it.
It works across Sales Cloud, Service Cloud, Data Cloud and Nonprofit Cloud, on nearly every Salesforce edition, and because it is read-only it is safe to install in production and safe to hand to anyone who needs an answer.
From a name to a complete answer.
There is no configuration stage. Install it, pick a person, and read the result.
Install the managed package
Installs from AppExchange in a few clicks. Lightning ready, nothing to configure before you can use it.
Pick any user
Start from the person the question is actually about, rather than from a profile or permission set.
Drill into any app
Narrow to the app you care about, or look across the org, whichever the question calls for.
See every object and field
Object access and field-level security together, resolved into one view instead of several Setup screens.
See the records they can touch
Record visibility included, which is where role hierarchy, sharing rules and manual shares usually complicate the answer.
Read the granting rule
Every result names the exact profile, permission set or sharing rule responsible, so you know precisely what to change.
What the app gives you.
One question, answered completely, without changing anything.
See access through a user's eyes
Pick any user and see every object, field and record they can touch. No reverse-engineering permission sets required.
Know the why, not just the what
Every access result shows the exact profile, permission set or sharing rule that granted it.
100% native and read-only
Runs entirely inside Salesforce with no write access and no external data storage. Nothing to break, nothing to expose.
Broad compatibility
Works across Sales Cloud, Service Cloud, Data Cloud and Nonprofit Cloud, on nearly every Salesforce edition.
Built for admins, consultants and developers
Speeds up troubleshooting, security reviews, onboarding and offboarding checks, and permission set cleanup.
Drill into any app
Scope the question to a single app or look across the whole org, whichever the situation calls for.
Person Accounts supported
Works in orgs using Person Accounts, so the answer is complete rather than partial.
Free, with no limits
Never requires payment, and there is no user cap or usage tier.
Built for the question you actually get asked.
Pick the person, not the permission set
Standard setup screens are organised around configuration objects. This one is organised around the user, which is how access questions arrive in the first place.
- Search and select any user
- No prior configuration needed
- Answer in one place
Object, field and record together
Access is rarely explained at one level alone. Seeing object, field and record access side by side is what makes an answer conclusive rather than partial.
- Object-level create, read, edit, delete
- Field-level security surfaced
- Record reachability included
Every grant, with its reason
Knowing a user can see something is only half the answer. Knowing which rule granted it is what lets you fix an over-permissioned user with confidence.
- Shows the specific granting rule
- Distinguishes profile from permission set
- Makes an audit defensible
Nothing to break, nothing to expose.
A permission inspector that could also change permissions would be a liability. This one cannot, which is what makes it safe to install in production and safe to hand to anyone who needs an answer.
No write operations
Nothing about a profile, permission set, role or sharing rule can be modified from inside the app.
Nothing leaves the org
It is a native package. Your permission model is never transmitted to an external service for analysis.
Safe to share
Because it cannot change anything, access to it can be granted more widely than access to Setup.
Evidence for audits
Showing the specific granting rule turns an assertion about a user's access into something you can put in front of a reviewer.
What it changes for an admin.
Same question, minutes instead of an afternoon, and an answer you can defend.
Answers in minutes
An access question stops being an afternoon of cross-referencing setup screens.
Complete answers
Object, field and record access together means fewer partial answers that later turn out wrong.
Nothing can break
Read-only means installing it and using it cannot change a single permission in the org.
Defensible sign-off
Being able to show the granting rule turns an assertion about access into evidence.
Catch over-permissioning
Access that nobody intended is far easier to find when it is visible in one place.
Free to run
No licence, no per-user fee, and nothing to renew.
Against how this gets answered today.
| Standard setup screens | Manual spreadsheet audit | Who Sees What | |
|---|---|---|---|
| Direction of enquiry | Permission set first | Whatever you assemble | User first |
| Object access | Several screens | Manual | One view |
| Field-level detail | Separate screen | Manual | Included |
| Record-level access | Hard to confirm | Estimated | Included |
| Shows the granting rule | Inferred | Inferred | Shown |
| Risk of changing something | Yes, you are in setup | None | None, read-only |
| Time to an answer | Hours | Longer | Minutes |
Comparison reflects publicly documented behaviour at time of writing. Verify before publishing.
The five moments that cost teams the most time.
Troubleshooting access
Resolve a user's access question in seconds instead of a 30-minute investigation across Setup.
Security and access reviews
Run them properly before a compliance check or an org health check, rather than sampling and hoping.
Onboarding checks
Confirm a new joiner's access is exactly what it should be on day one, not three weeks later.
Offboarding checks
Verify that access has actually been removed everywhere it was granted, with evidence.
Permission set cleanup
See which rules are actually doing the work before deleting anything from a sprawling permission model.
Consulting handovers
Document and explain an org's access model to stakeholders during an implementation.
The questions admins ask first.
What does Who Sees What do?
It shows the effective access of a single Salesforce user: every app, object, field and record they can reach, and the exact profile, permission set or sharing rule that granted each piece of access.
How is Who Sees What different from Salesforce Setup screens?
Setup is organised around permission sets and profiles, so you work backwards from configuration to people. This starts from the user, which is the direction access questions are actually asked in.
Can Who Sees What change Salesforce permissions?
No. It is read-only by design. Nothing about a profile, permission set or sharing rule can be modified from inside the app.
Is Who Sees What safe to install in production?
It is native and read-only, which is exactly the combination that makes it safe to install in a production org.
Does Who Sees What show record-level access or only object-level access?
Both, along with field-level security, since record access is where role hierarchy, sharing rules and manual shares usually complicate the answer.
Which Salesforce clouds and editions does Who Sees What work with?
It works across Sales Cloud, Service Cloud, Data Cloud and Nonprofit Cloud, on nearly every Salesforce edition, and supports orgs using Person Accounts.
Does Who Sees What send data outside Salesforce?
No. It runs entirely inside your org with no external service involved.
How much does Who Sees What cost?
It is free and never requires payment. There is no user cap and no usage tier.
Who is Who Sees What built for?
Administrators, consultants and developers. It speeds up troubleshooting, security reviews, onboarding and offboarding checks, and permission set cleanup.
Stop reverse-engineering permission sets.
Install Who Sees What from the Salesforce AppExchange and answer your next access question in two clicks.
Get it on AppExchangeFree managed package · No credit card · Published by TwinStack Solutions
Our other AppExchange products.
Native apps built around the same idea: less manual work between your data and your Salesforce org.
Smart Forms & Surveys
Native forms. Real records.
- Drag-and-drop form and survey builder
- Public forms on Salesforce Sites
- Creates or updates any object
- No external callouts
Google Form Auto Sync
Responses, straight into Salesforce.
- Real-time sync on form submission
- 100% native, no middleware
- No Google Sheets in the path
- No third-party server in the path
Smart Lookup Data Loader
Import smarter. Map faster.
- CSV import with upserts and dynamic lookups
- Auto-mapping of CSV headers to fields
- Multi-field matching prevents duplicates
- Row-level error reporting
Notes from the team.
New posts most weeks: setup guides, integration patterns, and what we learn from the Salesforce community.
Why answering a Salesforce access question takes an entire afternoon
The five places permission comes from, and why no screen shows them together.
Finding over-permissioned users before an audit does
A practical review process for effective access in a mature org.
Profile, permission set, role or sharing rule: which one granted it
How to trace an access grant back to its source.