Security Overview
We take security very seriously & that is why we bring enterprise-grade security to companies of all sizes.
Below are some of security measures that we take to make your data secure & interaction seemless with Playground.
Application Security
Secure Communications
All communications use secure channels at all times, with TLS 1.2 or later and cannot be intercepted by untrusted parties.
Web Application Standards
Playground is adhered to OWASP standards giving protection from major security risks like Injection, CSRF, Clickjacking, Cross-Site Scripting (XSS) & much more.
Robust Identity Management
We use open industry standards such as OAuth 2.0, OpenID Connect and SAML 2.0 to manage identity and authorisations. Playground doesn't ask for separate credentials. Instead, it allows login via popular login methods, including your company identity provider through single sign-on, so that users don't need to remember another set of credentials.
Single Sign-On and Sign-in Policy
Private Exchange admins can connect their own identity provider with SAML 2.0 or OpenID Connect (2.1.10 and later) and, if they wish, require single sign-on as the only way in. Responses from the identity provider must be cryptographically verified before anyone is signed in. See Sign-in Methods & Policy.
Data Access & Security
Data Confidentiality
Playground only store some basic information, specifically Firstname, Lastname and Email Address. This information is being used to set up users at the time of signup and also matching users at the time of login.
note
Playground doesn't store any other information from your provider or any Salesforce org
Encryption at Rest
Sensitive values you store in Playground, such as connection credentials, API tokens and single sign-on client secrets, are protected with AES 256-bit encryption, using a separate key for every Playground domain. Once saved, these secrets are never sent back to your browser and never shown again.
Sign-in Audit
Every sign-in is recorded in the login history: when, from which IP address, with which method and whether it succeeded. Failed attempts also record a short reason (for example, an email outside your domain, or single sign-on being required), so admins can report on them.
Role Based Authorisations
A Role is a combination of permissions that is required to assign to each & every user. It helps decide what level of access that the user will have in the Playground. By default, there are the three pre-configured roles (Admin, Moderator & Collaborator). New roles can be created for more granular level control according to requirements.
Miscellaneous
No Production Deployments
The application doesn't support Salesforce production environments intentionally to stop direct deployments. It should always go through the proper development/testing cycle.