Security & Data Compliance

• No business record values leave Salesforce. Field values like account names, contact emails, and opportunity amounts are never sent outside your Salesforce org.
• What is sent is intentionally minimal: schema names, aggregate counts, signed authentication headers, and (for Deep Scan only) a metadata ZIP that you manually upload.
• All communication between Salesforce and our Cloud Engine is authenticated using HMAC-SHA256 with a shared secret packaged as protected custom metadata. Each request includes a timestamp and a single-use nonce to prevent replay attacks.
• Deep Scan uploads are deleted immediately when the scan finishes (orphaned uploads are purged within 1 hour).
• Operated from India, with backend infrastructure hosted in the United States by reputable providers.

Quick Scan (Tooling-API native)

• Runs entirely inside your Salesforce org.
• Uses Salesforce's MetadataComponentDependency Tooling API to find dependencies on fields you select.
• Does not send any data to the FieldRat Cloud Engine for the dependency analysis itself.
• After completion, sends limited usage telemetry to the Cloud Engine: your Salesforce Org ID, scan type ("quick"), number of fields scanned, number of dependencies found, and duration in milliseconds.
• Covers 11 of the most commonly relied-on metadata types.

Deep Scan (Cloud Engine)

• An administrator manually exports a Salesforce metadata ZIP using standard Salesforce tooling (Workbench, Salesforce CLI, or the Salesforce Setup UI), and uploads that ZIP through the FieldRat wizard.
• The ZIP contains metadata definitions — fields, layouts, automations, validation rules, etc. — and does not contain business record values.
• Our Cloud Engine performs symbolic dependency analysis across all 23 metadata types, generates an Excel report, and returns the findings to your Salesforce org as a ContentVersion linked to the run record.
• The uploaded ZIP is deleted from our Cloud Engine immediately when the scan finishes (success or failure). Any upload that never reaches the scan step is purged by an automatic sweeper within 1 hour.

Field Analysis (population counts)

• Runs entirely inside Salesforce. Counts non-null vs null records per field.
• Stores results in FR_Field_Usage__c records inside your org.
• No record values, no data, no aggregates are sent off-platform.

Field Dictionary

• Reads your org's schema using Salesforce's standard describe APIs.
• Stores the resulting catalogue in FR_Field_Dictionary__c records inside your org.
• No data is sent off-platform.

Scheduled Field Usage Analysis

• Same data shape as Field Analysis (counts, no record values), run on a recurring schedule.
• Optionally generates a CSV file as a ContentVersion linked to the run record, stored inside your org.

Every request from the FieldRat App to the Cloud Engine carries:

• A header naming the Salesforce Org ID making the request.
• A current Unix timestamp.
• A single-use nonce (randomly generated, never reused).
• An HMAC-SHA256 signature computed over org_id|timestamp|nonce using a shared secret.

The shared secret is stored:

• In Salesforce, as a value on a protected=true Custom Metadata Type that subscriber-namespace Apex cannot read. Subscribers cannot read it through Setup, through SOQL, or through Apex.
• On the Cloud Engine, as an environment variable accessible only to the running service process.

If a request arrives with an invalid signature, a stale timestamp, or a previously-seen nonce, the Cloud Engine rejects it with HTTP 401.

The Cloud Engine also records limited aggregate usage telemetry for operational monitoring and service protection. The submitted free AppExchange package includes all packaged scan functionality.

• FieldRat does not automatically delete fields. It is a decision-support tool, not an automated cleanup tool.
• FieldRat does not retrieve metadata from your Salesforce org by sending a Salesforce session ID off-platform. The v1 Deep Scan path uses a metadata ZIP that you manually upload, not an automated session-based retrieval.
• FieldRat does not require API access to read or modify your Salesforce records. The App needs standard CRUD/FLS on its own FR_* custom objects, which are granted by the included FR_Field_Rationalization_Admin permission set.
• FieldRat does not sell, share, rent, or monetise the limited data it collects.
• FieldRat does not use the data it collects to train AI or machine-learning models.

As a subscriber admin, you can:

• Choose between Quick Scan (native, no upload required) and Deep Scan (manual metadata upload).
• Choose which metadata types to scan.
• Review the generated package.xml before running a Deep Scan to confirm what will be analysed.
• Review every dependency finding before retiring any field.
• Export evidence (Excel, CSV, ContentVersion files) for approval and audit purposes.
• Uninstall the App at any time. Uninstall removes the App from your org. To also delete server-side tenant registry entries, email contact@fieldrat.app with your Salesforce Org ID; we will purge the registry entry within 7 days.

• Your Salesforce org: Quick Scan, Field Analysis, Field Dictionary, and Scheduled Field Usage Analysis all run inside your org. The App stores results in standard custom objects (FR_Analysis_Run__c, FR_Field_Usage__c, FR_Dependency_Result__c, FR_Field_Dictionary__c, FR_App_Log__c).
• FieldRat Cloud Engine (operated by us on Railway, hosted in the United States): Deep Scan dependency analysis, service authentication, usage telemetry aggregation.
• FieldRat marketing website (operated by us on Cloudflare Workers, with Cloudflare's global edge network): the public website at https://fieldrat.app.
• Source code and build artefacts: stored on GitHub (United States).

Full sub-processor list, retention periods, and lawful bases for processing are in our Privacy Policy.

• Run an initial Field Analysis and Quick Scan in a Salesforce sandbox before running them in production.
• For Deep Scan, retrieve a metadata ZIP only from the org you intend to scan. Do not include unrelated project files.
• Review the App's FR_Field_Rationalization_Admin permission set before assigning it; the permissions granted are scoped to the App's own custom objects.

FieldRat is built as a Salesforce 2GP managed package with the goal of passing AppExchange Security Review. Specifically:

• All Apex DML and SOQL operate under AccessLevel.USER_MODE / WITH USER_MODE to enforce object and field permissions.
• The App declares with sharing on all classes by default.
• External callouts go through Named Credentials / External Credentials, not hard-coded URLs or tokens.
• The App uses Salesforce's standard install/uninstall handlers and does not require manual setup beyond permission-set assignment.
• Static analysis (PMD AppExchange ruleset, Salesforce Code Analyzer) reports zero severity 1 or 2 violations.

If we become aware of a security incident affecting FieldRat users, we will:

• Investigate promptly and contain the issue.
• Notify the relevant supervisory authority within 72 hours where required by GDPR/UK GDPR.
• Notify affected users without undue delay, via the email address on file or via a notice on this website.

If you discover a vulnerability in FieldRat, please report it responsibly to contact@fieldrat.app with the subject line "Security Report". We commit to:

• Acknowledging your report within 5 business days.
• Investigating the issue and providing a status update within 30 days.
• Crediting the reporter (where requested) once the issue is resolved.

Please do not perform security testing against FieldRat infrastructure without prior written consent (see Section 5 of the Terms of Service).

For security or compliance questions: contact@fieldrat.app