TwinStack Solutions builds AppExchange apps that run inside your own Salesforce org. This page explains how our apps handle your data, the security practices we follow, and how to reach us about security.
Our commitments
How each app handles data
| App | Where it runs | External connections | Data TwinStack receives |
|---|---|---|---|
| Google Form Auto Sync | Your Salesforce org, plus a script inside your own Google Form | Your Google Form sends responses directly to your org | None |
| Who Sees What | Your Salesforce org (read-only) | None | None |
Smart Lookup Data Loader also runs inside your Salesforce org, and TwinStack receives none of its data.
"Data TwinStack receives" refers to your Salesforce records and app data. Salesforce shares standard installation information with all AppExchange partners. See What we do receive below.
Security practices
- Salesforce security review: each app passes Salesforce's review before it is listed on AppExchange. You can see the status on each listing's Security tab.
- Salesforce permissions respected: our apps enforce field-level security and object permissions, so users only see and change what Salesforce allows them to.
- Least privilege: apps ship with permission sets that grant only what's needed. Your admins decide who gets them.
- Secure authentication: Google Form Auto Sync uses Salesforce's OAuth 2.0 Client Credentials flow through an External Client App, with a dedicated user you choose. No passwords are stored.
- Managed packages: apps are delivered as Salesforce managed packages, so updates and security fixes reach you through Salesforce's standard upgrade process.
Shared responsibility
Because our apps run in your org, some controls are yours:
- Decide which users get each app's permission sets.
- For Google Form Auto Sync, limit edit access to connected Google Forms. The connection's Consumer Key and Secret are stored in the form's script properties, so form editors can see them.
- Choose and manage the integration user that creates records.
- Keep your org's sharing rules and field-level security set the way you need them.
What we do receive
When you install one of our apps, Salesforce shares standard installation information with us: your org ID, Salesforce edition, package version, and the installing user's name, email and company. We use it to provide support and send important updates. Read our Privacy Policy for details.
Our website
Our website is served over HTTPS through Cloudflare. Enquiries from our contact forms and the Salesforce Cost Estimator are stored in our own Salesforce org. The website assistant chat sends your messages through our Cloudflare Worker to Anthropic's API to generate a reply, and we do not store chat conversations. Images are delivered by Cloudinary. Our apps do not send your data to any of these providers.
Reporting a security issue
If you think you've found a security vulnerability in one of our apps, email info@twinstack.net with the subject line "Security". Please include the app name, version and steps to reproduce. We acknowledge reports within 2 business days and keep you updated until the issue is resolved. Please don't share details publicly until we've fixed it.
Related documents
- Privacy Policy
- Terms & Conditions: on each AppExchange listing's Support tab
- Security review status: on each AppExchange listing's Security tab, for example Google Form Auto Sync
- トラストセンター（日本語）
Contact
Questions about security or privacy? Email info@twinstack.net. We respond within 2 business days.
Email info@twinstack.netRead the Privacy Policy