---
url: https://veles.beyondthecloud.dev/docs/security.md
description: >-
  Where Veles keeps your configuration and secrets, how orgs talk to each other,
  and what nobody can read.
---

# Security

The short version: Veles is a native managed package. Your configuration and secrets live in your own Salesforce orgs, move only between your own orgs, and nothing is hosted or stored anywhere else.

## Where data lives

* Configurations, values, credentials, environments, workflows and logs are **protected custom objects** in the package. In a subscriber org no user, report, data loader or API call can read them directly, whatever their profile. Only the package's own code reaches them, on behalf of a user who holds the **Veles Admin** permission set.
* A secret field has one of three secret types: **Masked** (shown as dots, an admin can reveal it), **Protected** (never rendered to any UI, not even to the admin who stored it; the screen only says *Populated* or *Empty*) or **Credential** (like Protected, and also unreadable from Apex and Flow: it exists to be written into a Named or External Credential on the target org by a workflow action).
* Sharing is private by default. The app is reached through one permission set.

## How orgs talk to each other

* Every call is between two of your own orgs. Veles has no server, no proxy and no vault in between.
* The Hub signs in to a child with a short-lived JWT for a dedicated integration user and an External Client App you pre-authorise in your own Setup. No OAuth consent screen, no refresh token stored.
* Each Hub-to-org connection has its own **connection token**, created when the org connects and rotated when it reconnects. There is no master secret shared by all orgs; a token that leaks is good for exactly one connection.
* A child can only ever read its own configuration from the Hub and report back to it. A child cannot write to the Hub, run anything on the Hub or see another child. That rule is enforced on the Hub, not hidden in the child's UI.
* Request and response bodies between orgs are encrypted with the connection token on top of TLS, and are only valid for 60 seconds.

## Export and import

An export is an AES-256 encrypted file protected by a password you choose. You can exclude secrets from it. An import that fails part way rolls back completely.

## What the integration user can do

The user Veles signs in as holds a least-privilege permission set cloned from **Veles Hub Integration**: access to the Veles API class and nothing else from the package. Veles never changes the user who started a run and never removes the Veles permission sets from anyone.

## Logs

Log entries are encrypted at rest with a key Veles creates in your org. Veles never writes a token, key or password into a log or an error message.

## Where to look

Everything above is visible in your org: the objects under **Setup > Objects and Fields**, the permission sets, the External Client App, the Remote Site Settings Veles creates for each connection, and the Activity Log for every call it made.