Metadata in. Nothing out.
silobase is a static analyzer. You upload a Salesforce metadata export; it maps every email-sending path and who each one would reach. It never reads your CRM records or contacts, never writes back to your org, and never sends email. This page states the posture plainly — including what we do not claim.
Last reviewed July 3, 2026
The boundaries, stated plainly
The safest thing to know about a tool that touches Salesforce is what it will not do. Here is the full list of what silobase does not reach.
silobase parses a Salesforce metadata export — Flows, workflow rules, email alerts, Apex senders, approval emails, org-wide sender and deliverability settings. It never reads email content, CRM records, or contact data.
Everything happens against the export you upload. There is no connection into your Salesforce org, no field updates, no metadata deploy. Nothing silobase does changes your org.
The scan maps every path that would send — and who each one would reach — before you arm deliverability. It maps the paths; it never triggers one. No test email leaves as a result of a scan.
v1 is upload-only, with no live-org OAuth. Recipient resolution is a best-effort read of the metadata, not a live lookup. silobase is not a Salesforce product, is not endorsed by Salesforce, is not Mailtrap, and is not a live-org connection.
How it is hosted and stored
The infrastructure is standard, boring, and named. No claim below goes beyond what the underlying providers deliver.
The application runs on Vercel. Product analytics is Vercel Analytics, which is cookieless — no tracking cookie is set for it.
Uploaded metadata and account data live in Supabase (Postgres and file storage), with encryption at rest as provided by Supabase. Uploaded metadata is stored in the metadata-uploads bucket.
Data tables use Postgres row-level security so a signed-in account reads only its own scans, reports, and org identifiers.
Authentication runs through Supabase. Two-factor / authenticator (2FA) is available on your account if you choose to enable it.
Subprocessors
silobase relies on the following processors to run. Each is named, along with the data it handles.
Uploaded metadata (bucket metadata-uploads), account details, org/sandbox identifiers.
Billing details. Card data is handled by Stripe, not stored by silobase.
Request traffic and cookieless usage analytics.
Account email address, for messages such as receipts and account mail.
Detector findings only — not your raw org data. The deterministic detector owns risk classification; Claude explains it and drafts the safe-test plan from that output.
What we collect
A short list. The deterministic detector owns risk classification; the Claude API only explains it, and is given detector findings rather than your raw org data.
- Uploaded Salesforce metadata exports.
- Account details — your name and email — for authentication.
- Billing details, handled by Stripe.
- Org and sandbox identifiers you enter.
The metadata export you upload can be deleted. If you want it removed, delete it from your account or email privacy@silobase.io.
If GDPR or CCPA applies to you, you can exercise your rights to access, export, correct, or delete your data. This is a process we honor, not a certification we hold. Send data requests to privacy@silobase.io. The data controller is {{TODO: confirm legal operating entity — likely Peakure LLC}}.
What we do not claim
silobase holds no security or compliance certification. We will not imply one. Do not read anything on this page as a claim to any of the following:
- SOC 2
- ISO 27001
- HIPAA
- PCI
- GDPR-certified
- Penetration-tested
None of these exist for silobase today. If that changes, this page changes with it — and not before.
Report a vulnerability
Found a weakness? Tell us before you tell anyone else, and give us a reasonable window to fix it. We read every report.
Send vulnerability reports to security@silobase.io. Our machine-readable contact lives at /.well-known/security.txt.
Please do not run tests that could reach real inboxes, delete other accounts’ data, or degrade the service for other users.
Reach the right inbox
Three addresses, three jobs. No ticket portal in the way.