Skip to main content

Security

Jetstream is designed with security and privacy in mind. We take the protection of your data seriously and implement industry-standard practices to ensure its safety.

Independent Reviews​

Jetstream has been reviewed by Salesforce and by an independent audit firm. If your security team needs documentation to approve Jetstream, start here.

Salesforce Security Review​

Jetstream has passed the Salesforce Security Review and is published on the Salesforce AppExchange.

The Security Review is Salesforce's own assessment of a partner application, covering how the application authenticates, what data it accesses, and how it protects that data. Only applications that pass it may be listed on the AppExchange.

SOC 2 Type II​

Jetstream has completed a SOC 2 Type II audit performed by A-LIGN, an independent audit firm. A Type II report evaluates whether security controls are suitably designed and operated effectively over a period of time, rather than at a single point in time. The audit covers the Jetstream platform as a whole, so every plan runs on the same infrastructure and is protected by the same controls.

The full report is available under a non-disclosure agreement to paying customers and to organizations evaluating a paid plan. To request a copy, email sales@getjetstream.app.

Additional Resources​

Web Application Security​

When using the Jetstream web application, we employ the following security measures:

  • All data is encrypted in transit using TLS (Transport Layer Security) to protect against eavesdropping and tampering.
  • We use OAuth 2.0 for connecting to your Salesforce orgs, ensuring that your credentials are never stored or transmitted insecurely.
  • All access tokens and refresh tokens are encrypted and stored securely in our database.
  • We support multi-factor authentication and email verification to enhance account security.

Additional Security Features​

Upon request, we can provide additional security features for enterprise customers, including:

  • Restrict login to a specific provider (e.g. Google or Salesforce)
    • We currently don't offer Single-Sign-On via SAML or OIDC. However, if you require SSO to log in to your Google or Salesforce account and want to restrict logging in to that provider, this will ensure that users go through your existing SSO to gain access to Jetstream.
  • Require Multi-factor authentication (MFA) for all users in your domain, and specify which MFA options are available for your users (e.g. OTP using Authenticator App)
  • Prevent linking additional identities to your Jetstream Account
    • This will ensure that users can only login to Jetstream using the identity they were invited with, and cannot link additional identities (e.g. Google or Salesforce) to their account. This restriction applies to all users in your domain when enabled.

Browser Web Extension Security​

The Chrome and Firefox extension is available for users on paid plans.

When using the Jetstream browser extension, you will need to login with your existing Jetstream account. The extension is designed to enhance your Salesforce experience while maintaining security:

  • Your Salesforce browser session is used for communicating with your org, none of your Salesforce data passes through Jetstream's servers.
    • Optionally, you can enable history syncing, which will store and sync some data, such as your query history, to your Jetstream account. This feature is opt-in and is disabled by default.

Desktop Application Security​

The desktop application will be available for users on paid plans.

When using the Jetstream desktop application:

  • The application communicates directly with your Salesforce orgs using the Salesforce API, none of your Salesforce data passes through Jetstream's servers.
  • We use OAuth 2.0 for connecting to your Salesforce orgs, ensuring that your credentials are never stored or transmitted insecurely.
  • All access tokens and refresh tokens are encrypted and stored securely on your computer.