Security

Architecture

InfoIQ is a managed package: Apex, Lightning Web Components, custom objects, flows and permission set groups, installed from AppExchange into your org. There is no Jalon Works server, website account or external service behind it. Every request a user makes is handled by Salesforce, under your org's authentication, session settings and policies.

Outbound calls: None. The package makes no callout and has no Remote Site Setting, Named Credential or CSP Trusted Site.
Inbound access: None. It exposes no REST or SOAP service, no Visualforce page, no site or community page, and no connected app.
Authentication: Salesforce's own. The package never handles a password, a token or a session id.
Access to your data: Jalon Works has none. We cannot read, copy or receive anything stored by the package.

How data moves

An author builds an announcement in the builder. Pages, images, videos and imported decks are saved as Salesforce records and Salesforce Files, on the announcement.
An administrator curates audiences from profiles, roles, users, public groups and queues already defined in the org. Authors pick an audience by name and never see its criteria.
A reader opens a Salesforce page. The Announcement Host component asks the package's Apex, as that reader, whether an announcement is meant for them on that page. Only the one chosen is shared with them, read only.
Reading is recorded as states on the announcement: displayed, opened, the pages reached, finished or dismissed, and confirmed when the author asked for it.
Authors and administrators read the figures on the Home, Metrics and Analytics pages, computed in the org, under Salesforce sharing. The Readers tab of an announcement names who it targets and where each of them stands, for whoever can edit it and for administrators only — or gives totals alone, if your administrator says so.

Every step happens inside your org. Nothing is copied to another system along the way.

What the package stores

All of it lives in your org's data and file storage, in the region Salesforce hosts your org in.

Records	Personal data
Announcements, pages, placement rules and their files	Only what an author chooses to write in an announcement
Audiences and their criteria	Salesforce user ids, when an administrator names a person
Reading states, per announcement and per page	User id, dates, how far the reader went, whether they confirmed, and the audiences they were reached through
Questions readers ask, and the author's answers	The question text and who asked it
Figures kept when an announcement is deleted	None: counts and distributions only, never a reader
Diagnostic log, errors only	The id of the user who hit the error. No content, no question text, no stack trace. Kept 30 days, or until the announcement it names is deleted.

The package processes no payment, health or other special category data, and has nowhere to put any. Deleting an announcement deletes its pages, readings and questions, and the files only it used unless the person deleting it chooses to keep them.

Access control

Three personas, as permission set groups: Reader, Author and Administrator. Each is the sum of a few narrow permission sets, so you can see exactly what a person is granted.
Readers see their own data only. They hold no access to the reading or question records, so a reader cannot list who read what or read a colleague's question. The package serves each reader their own rows, filtered in the query.
Salesforce sharing applies. Every Apex class declares its sharing mode, and writes made for an author run in user mode, with object and field permissions checked. The few places that must step past sharing — delivering an announcement to its reader and recording their reading, reading the criteria of the audiences it targets, serving a reader the answers published to them, counting the files still in use before one is deleted, and purging the log of a deleted announcement — are small, private and documented in our security review submission.
Sensitive tools stay with administrators: audience criteria, the Critical priority, every announcement's analytics and the diagnostic log are granted only through the Administrator group.
Rich text is sanitised by Salesforce's own components before it is displayed, and media can only reference files of your org.

Third-party components

None. The package contains no third-party library, no static resource, and loads no script, stylesheet or font from outside Salesforce. Every line of code it runs is in the package version you install, and changes only with a new version.

How we build it

Every release is scanned with Salesforce Code Analyzer using the AppExchange security rules, and each finding is either fixed or documented.
Access rules are tested as each persona, against the real platform: a reader, an author and an administrator, each in their own test user, rather than as an administrator who can see everything.
Salesforce security review: Not yet submitted.

Keeping your org secure

What we recommend to the administrator who installs InfoIQ:

Give each person the narrowest group they need: most people are Readers.
Keep the Administrator group for the few people who curate audiences and read the diagnostic log.
Schedule the log purge, as a holder of the Administrator group, so entries older than the retention window are removed. The guide shows how.
Choose Install for Admins Only. Installing for all users grants every profile every permission in the package, and every custom profile access to every InfoIQ object, which walks around the separation between readers, authors and administrators.
Install in a sandbox first and review the permission set groups before assigning them.
Decide how far the Readers tab names readers before authors rely on it, and tell your people. The guide shows the settings.

Reporting a vulnerability

If you believe you have found a security issue in InfoIQ, write to support@jalonworks.com with "Security" in the subject. Please include the package version and the steps to reproduce, and do not test against an org you do not own.

We acknowledge a report within 3 business days, keep you informed while we investigate, and ship the fix as a package upgrade. If a personal data breach affects a customer, we notify them without undue delay and within 72 hours, as our data processing addendum commits.