Security & Authentication
How Relationship Intelligence authenticates and isolates each customer.
Tenant isolation
Every request is bound to the originating Salesforce Organization ID and resolved to a specific EIE tenant. Credentials and providers are selected only from that tenant.
Asymmetric authentication
Salesforce signs requests using RS256.
| Key | Location |
|---|---|
| Private key | Remains in Salesforce, in Certificate and Key Management |
| Public certificate | Registered with EIE |
Certificate KID
EIE generates and stores a certificate fingerprint (the KID) used to identify the correct verification certificate for the tenant. Salesforce sends the KID with each assertion.
Short-lived assertions
Assertions expire after 300 seconds.
Replay protection
Each assertion contains a unique jti identifier.
No shared API secret
The integration does not depend on a shared static Salesforce-to-EIE API password. There is nothing to rotate manually beyond the certificate itself.
Google credential isolation
Each tenant's Google Workspace provider is independently configured with its own service account. Credentials never fall back to another tenant.
Data scope
Relationship Intelligence uses read-only directory and message metadata scopes. It derives relationship signals rather than copying message content.
Credential lifecycle
Google service-account credentials must be rotated and revoked using the documented order in Google Cloud Service Account Setup. Never delete an active key before the replacement credential has been uploaded and verified unless the key is suspected to be compromised.
Never share a Salesforce private key or a Google service-account key. If a key is exposed, rotate it immediately — see Signing Certificate for Salesforce certificates and Google Cloud Service Account Setup for Google credentials.
Was this helpful?
Last updated 1 month ago