Veles

Security ​

The short version: Veles is a native managed package. Your configuration and secrets live in your own Salesforce orgs, move only between your own orgs, and nothing is hosted or stored anywhere else.

Where data lives ​

  • Configurations, values, credentials, environments, workflows and logs are protected custom objects in the package. In a subscriber org no user, report, data loader or API call can read them directly, whatever their profile. Only the package's own code reaches them, on behalf of a user who holds the Veles Admin permission set.
  • A secret field has one of three secret types: Masked (shown as dots, an admin can reveal it), Protected (never rendered to any UI, not even to the admin who stored it; the screen only says Populated or Empty) or Credential (like Protected, and also unreadable from Apex and Flow: it exists to be written into a Named or External Credential on the target org by a workflow action).
  • Sharing is private by default. The app is reached through one permission set.

How orgs talk to each other ​

  • Every call is between two of your own orgs. Veles has no server, no proxy and no vault in between.
  • The Hub signs in to a child with a short-lived JWT for a dedicated integration user and an External Client App you pre-authorise in your own Setup. No OAuth consent screen, no refresh token stored.
  • Each Hub-to-org connection has its own connection token, created when the org connects and rotated when it reconnects. There is no master secret shared by all orgs; a token that leaks is good for exactly one connection.
  • A child can only ever read its own configuration from the Hub and report back to it. A child cannot write to the Hub, run anything on the Hub or see another child. That rule is enforced on the Hub, not hidden in the child's UI.
  • Request and response bodies between orgs are encrypted with the connection token on top of TLS, and are only valid for 60 seconds.

Export and import ​

An export is an AES-256 encrypted file protected by a password you choose. You can exclude secrets from it. An import that fails part way rolls back completely.

What the integration user can do ​

The user Veles signs in as holds a least-privilege permission set cloned from Veles Hub Integration: access to the Veles API class and nothing else from the package. Veles never changes the user who started a run and never removes the Veles permission sets from anyone.

Logs ​

Log entries are encrypted at rest with a key Veles creates in your org. Veles never writes a token, key or password into a log or an error message.

Where to look ​

Everything above is visible in your org: the objects under Setup > Objects and Fields, the permission sets, the External Client App, the Remote Site Settings Veles creates for each connection, and the Activity Log for every call it made.