Security

Metadata in. Nothing out.

silobase is a static analyzer. You upload a Salesforce metadata export; it maps every email-sending path and who each one would reach. It never reads your CRM records or contacts, never writes back to your org, and never sends email. This page states the posture plainly — including what we do not claim.

Last reviewed July 3, 2026

The boundaries, stated plainly

The safest thing to know about a tool that touches Salesforce is what it will not do. Here is the full list of what silobase does not reach.

metadata_only
It reads metadata, not your data

silobase parses a Salesforce metadata export — Flows, workflow rules, email alerts, Apex senders, approval emails, org-wide sender and deliverability settings. It never reads email content, CRM records, or contact data.

read_only
It never writes back to your org

Everything happens against the export you upload. There is no connection into your Salesforce org, no field updates, no metadata deploy. Nothing silobase does changes your org.

no_send
It never sends email

The scan maps every path that would send — and who each one would reach — before you arm deliverability. It maps the paths; it never triggers one. No test email leaves as a result of a scan.

upload_only_v1
Recipient resolution is heuristic

v1 is upload-only, with no live-org OAuth. Recipient resolution is a best-effort read of the metadata, not a live lookup. silobase is not a Salesforce product, is not endorsed by Salesforce, is not Mailtrap, and is not a live-org connection.

How it is hosted and stored

The infrastructure is standard, boring, and named. No claim below goes beyond what the underlying providers deliver.

Hosted on Vercel

The application runs on Vercel. Product analytics is Vercel Analytics, which is cookieless — no tracking cookie is set for it.

Storage on Supabase

Uploaded metadata and account data live in Supabase (Postgres and file storage), with encryption at rest as provided by Supabase. Uploaded metadata is stored in the metadata-uploads bucket.

Row-level security

Data tables use Postgres row-level security so a signed-in account reads only its own scans, reports, and org identifiers.

Auth with optional 2FA

Authentication runs through Supabase. Two-factor / authenticator (2FA) is available on your account if you choose to enable it.

Subprocessors

silobase relies on the following processors to run. Each is named, along with the data it handles.

Supabase
Postgres database, authentication, and file storage

Uploaded metadata (bucket metadata-uploads), account details, org/sandbox identifiers.

Stripe
Payment and subscription processing

Billing details. Card data is handled by Stripe, not stored by silobase.

Vercel
Application hosting and Vercel Analytics

Request traffic and cookieless usage analytics.

Resend
Transactional email delivery

Account email address, for messages such as receipts and account mail.

Anthropic Claude API
Plain-language explanations and safe-test plan drafting

Detector findings only — not your raw org data. The deterministic detector owns risk classification; Claude explains it and drafts the safe-test plan from that output.

What we collect

A short list. The deterministic detector owns risk classification; the Claude API only explains it, and is given detector findings rather than your raw org data.

  • Uploaded Salesforce metadata exports.
  • Account details — your name and email — for authentication.
  • Billing details, handled by Stripe.
  • Org and sandbox identifiers you enter.
Uploaded metadata is deletable

The metadata export you upload can be deleted. If you want it removed, delete it from your account or email privacy@silobase.io.

Your data rights

If GDPR or CCPA applies to you, you can exercise your rights to access, export, correct, or delete your data. This is a process we honor, not a certification we hold. Send data requests to privacy@silobase.io. The data controller is {{TODO: confirm legal operating entity — likely Peakure LLC}}.

What we do not claim

silobase holds no security or compliance certification. We will not imply one. Do not read anything on this page as a claim to any of the following:

  • SOC 2
  • ISO 27001
  • HIPAA
  • PCI
  • GDPR-certified
  • Penetration-tested

None of these exist for silobase today. If that changes, this page changes with it — and not before.

Report a vulnerability

Found a weakness? Tell us before you tell anyone else, and give us a reasonable window to fix it. We read every report.

disclosure

Send vulnerability reports to security@silobase.io. Our machine-readable contact lives at /.well-known/security.txt.

Please do not run tests that could reach real inboxes, delete other accounts’ data, or degrade the service for other users.

    Security — silobase