Security
Here is how Salt handles it, in plain terms. If your security review needs more than this page covers, ask us directly — a person will answer.
Your data is encrypted in transit and at rest. Each organization's data is isolated from every other organization's, enforced at the data layer rather than by application logic alone. You can export it, and you can delete it.
Permissions are evaluated per organization and per team on every request. What a seller can see is a strict subset of what their manager can see. Credentials for connected systems are encrypted and never exposed to the browser.
Salt never writes to your CRM on its own. When a review finds a field the evidence contradicts, it proposes a correction with the source attached, and someone on your team accepts or rejects it.
Field changes, reviews, forecast submissions, and write-back approvals are all recorded with who did what and when — so you can reconstruct any decision after the fact.
SOC 2 is the standard we build against, and it is a working constraint rather than a box we intend to tick later. How access is granted and revoked, how data is encrypted and isolated between organizations, what gets logged, how changes are recorded and reviewed — those controls are how the system is built today, on every feature we ship.
What we do not yet hold is the certificate. A formal third-party audit is a significant expense for a company our size, so we have not started that process — we would rather keep building against the standard and pursue certification when customers need the report in hand. If that report is a hard requirement for your procurement process today, tell us early and we will be straight with you about where it leaves us.
