Security
RME inherits Salesforce platform security and adds messaging-specific controls.
Authentication and credentials
| Control | Implementation |
|---|---|
| Provider credentials | Named Credentials + External Credentials; never custom fields |
| OAuth | Client credentials or JWT bearer for REST callers |
| Connected App | Dedicated app per integration, scoped to api |
| Integration user | Least-privilege user with RME_Integration_User only |
| Webhook secrets | Protected Custom Settings inside the managed namespace |
| Key rotation | Rotate provider keys and webhook secrets on a scheduled cadence |
Email authentication
| Standard | Purpose | RME enforcement |
|---|---|---|
| SPF | Authorizes sending hosts for your domain | Domain verification checks the record before enabling sends |
| DKIM | Cryptographically signs each message | Required; unsigned domains cannot be activated |
| DMARC | Tells receivers what to do on failure | Policy monitored; aggregate reports summarized in RME |
| BIMI | Displays your logo in supporting clients | Optional, requires DMARC at enforcement |
Recommended progression: p=none → p=quarantine; pct=25 → p=quarantine → p=reject.
Encryption
- TLS 1.2+ enforced on every provider callout; opportunistic TLS is rejected where the provider supports enforcement.
- Data at rest is protected by Salesforce platform encryption; Shield can encrypt message body fields.
- Attachments stay in Salesforce Files; providers receive them only for the duration of the send.
Access control
| Layer | Control |
|---|---|
| Object and field | Permission sets, FLS on message body and recipient fields |
| Record | Standard sharing; communication history respects record access |
| Action | Only RME_Message_Sender can send; only RME_Administrator can configure |
| Template | Category restrictions per permission set |
| Rate | Per-user and per-org send ceilings |
Merge rendering runs with the requesting user's field-level security, so a message can never expose a field the sender cannot see.
Audit logging
Audit_Log__c records every configuration and policy change: provider added or disabled, domain verified, template activated, consent overridden, suppression removed, secret rotated. Entries capture actor, timestamp, before and after values, and source IP, and are read-only to all profiles.
Provider security
Evaluate providers on SOC 2 Type II, ISO 27001, data-residency options, sub-processor transparency, and breach notification terms. Provider selection is recorded per message, so an incident can be scoped precisely.
Threat considerations
| Risk | Mitigation |
|---|---|
| Credential exposure | Named Credentials, no keys in code or fields |
| Webhook spoofing | Mandatory signature verification, 401 on mismatch |
| Message injection via merge data | Output escaping in HTML templates |
| Mass-send abuse | Per-user ceilings, approval on Marketing category, anomaly alerts |
| Data exfiltration via templates | FLS-aware rendering, template review workflow |
Continue to Compliance.
Was this helpful?
Last updated 1 month ago