Platform Architecture and Data Residency

Precursive is deployed as a managed package within each customer’s Salesforce Org. There are no external services, databases, or infrastructure operated by Precursive to store or process customer data. This design ensures:

• All data remains in the customer’s Salesforce instance.

• Data location and residency are determined by the customer’s Salesforce region.

• No processing occurs outside the Salesforce platform.

For Salesforce hosting practices, replication, and resilience, refer to:

• Salesforce Trust Site

• Salesforce Security Center

Shared Responsibility Model

Precursive operates on the Salesforce Platform, where responsibility for security is shared between the customer, Precursive, and Salesforce. Each party plays a distinct role in maintaining the confidentiality, integrity, and availability of services.

• Customer: You control the configuration and access within your Salesforce Org. This includes user permissions, customizations, data entry, and integration with other systems. You are responsible for managing user access, applying security best practices, and ensuring backups of your Salesforce and Precursive data. We recommend reviewing Salesforce Security Best Practices.

• Precursive: Precursive are responsible for the design, development, and support of our applications. Our products are built securely to meet Salesforce’s AppExchange Security Review standards, and undergo annual third-party web application security assessments. We also maintain ISO/IEC 27001 certification.

• Salesforce: As the underlying infrastructure provider, Salesforce is responsible for operating the platform. This includes managing the network, physical data centers, operating systems, and the core security architecture (such as encryption, identity services, and disaster recovery).

This shared responsibility model enables flexibility, security, and performance, while ensuring that all data and operations stay within your trusted Salesforce environment.

Identity and Access Management

Precursive is built to align with Salesforce's powerful identity and access management model. Since Precursive runs entirely within your Salesforce Org, you retain complete control over who can access the application and what they can do.

Customers manage users, roles, and permissions directly using Salesforce's native tools, which include:

• Single Sign-On (SSO) integration with corporate identity providers

• Multi-Factor Authentication (MFA) enforcement

• Role- and profile-based access controls through permission sets

• Session security, IP restrictions, and audit logging via Login History and Setup Audit Trail

All user provisioning, authentication, and access monitoring take place within your existing Salesforce environment, allowing you to enforce consistent policies across all applications, including Precursive.

Access to Customer Data

Precursive does not have access to any customer data by default. Access is only possible when the customer explicitly grants it. There are two methods:

1. Grant Login Access: Customers can authorize a Precursive support representative to log in temporarily using the Salesforce "Grant Account Login Access" feature. This access is time-bound, auditable, and reflects the permissions of the user granting access.

2. Provisioned User Account: In some cases, such as implementations, customers may create a Salesforce user for a Precursive consultant. This account is fully under customer control and can be disabled at any time.

All access activity is logged and reviewed by the customer. Precursive does not retain administrative access beyond the access window.

Encryption

Precursive inherits Salesforce's encryption protocols, including:

• Encryption in Transit: All communications are secured using TLS 1.2 or higher.

• Encryption at Rest: All data is stored encrypted on Salesforce infrastructure.

• Field-Level Encryption: Customers using Salesforce Shield can apply additional encryption at the field level. Deterministic or probabilistic encryption methods can be chosen based on compatibility with filtering and search.

The availability of specific encryption features, such as Platform Encryption and Shield capabilities, depends on the customer’s Salesforce edition and licensing agreement. Customers should review their Salesforce edition and licensing agreement to understand which encryption options, such as Shield and Platform Encryption, are included or can be enabled in their environment. Salesforce Platform Encryption Overview.

Backup, Archive, and Data Retention

Because Precursive operates fully within the Salesforce platform, backup responsibilities follow Salesforce's standard data management approach. Salesforce performs regular backups as part of its platform-level disaster recovery and resilience commitments. However, these backups are designed for Salesforce's operational recovery in the event of a major incident—they are not intended for customer-level restoration of accidentally deleted records, field-level changes, or user errors.

To safeguard day-to-day operational data, customers should implement a proactive backup and recovery strategy as part of their broader Salesforce data governance plan. This includes any managed packages, like Precursive, installed within their environment.

Salesforce offers a range of built-in and extensible options to support data backup, including:

• Data Export Wizard

• Third-party backup providers integrated via Salesforce APIs

These tools help ensure critical business data is protected, retrievable, and compliant with organizational and regulatory requirements.

Data Export on Uninstall

When a Precursive package is uninstalled, Salesforce automatically generates a data export file that includes records related to the managed package. This export is created for the user performing the uninstall and is available for download for a limited time.

To protect critical operational data and meet long-term retention needs, Precursive recommends:

• Backing up Salesforce and Precursive data regularly using the available tools.

• Verifying and testing backup and restore processes to ensure data integrity and recoverability.

Disaster Recovery and Business Continuity

Salesforce provides built-in disaster recovery through geographically distributed data centers, automatic replication, and failover.

Precursive maintains its own business continuity and disaster recovery plans, designed to ensure the availability of our services and support functions in the event of an issue. If a disruption originates within the Precursive application, we take responsibility for resolving the incident and will activate appropriate response measures while keeping customers informed through established communication channels.

As part of this commitment, Precursive has a formal incident response process in place. This ensures that if a security incident occurs, it is handled swiftly and appropriately. The process includes incident classification, internal escalation, customer notification, root cause analysis, and the implementation of corrective actions. Customers are notified promptly in the event of an incident that could impact their data or their use of the platform.

Secure Development and Product Security

Precursive follows a secure development lifecycle (SDLC) modeled on recognized industry standards. Security is considered at every stage of the development process—from design through to deployment and maintenance. Key practices include:

• Static code analysis on every build: Automated tools scan code for vulnerabilities and weaknesses during each build to detect issues early.

• Code reviews and version control: All code changes are reviewed by experienced developers to identify potential security flaws, supported by robust version control workflows.

• Open source vulnerability scanning: Third-party libraries and dependencies are continuously monitored for known vulnerabilities using industry-standard scanning tools.

• Secure deployment pipelines: Builds are validated and deployed through hardened pipelines that include security checks, audit logging, and access controls.

These controls ensure that security is integrated into development practices and that risks are minimized before code reaches customer environments.

Every version of Precursive submitted to the Salesforce AppExchange must pass Salesforce’s mandatory AppExchange Security Review.

In addition, Precursive performs annual web application security assessments using OWASP methodologies. These tests validate the product’s behavior within the Salesforce platform—they do not include infrastructure or network testing, which remains the responsibility of Salesforce.

Logging and Monitoring

Precursive applications rely on Salesforce for core logging, auditing, and event monitoring capabilities. Customers can configure login history tracking, field audit trails, and automated alerts using Salesforce’s native features. For advanced monitoring, Salesforce Shield enables event monitoring at scale. Precursive does not store or process log data outside of the customer’s environment.

Personnel Security

All Precursive staff with access to information systems undergo background checks appropriate to their role and jurisdiction. Employment contracts contain confidentiality clauses and security responsibilities. Employees receive onboarding security training, with periodic updates aligned to policy changes and security awareness needs.

Handling of Personal Data (PII)

The Precursive application may process personal data as entered by users, such as names, email addresses, and job titles. This data remains entirely within the customer’s Salesforce Org. Precursive:

• Does not extract PII for analytics, monitoring, or support.

• Does not transmit personal data to external systems.

• Does not access data unless granted access by the customer.

Precursive supports customer compliance with GDPR, UK Data Protection Act, and CCPA. Personal data processing is governed by our Privacy Policy and Data Processing Agreement.

International Data Transfers

Precursive operates globally, and customers may use its services from any location worldwide. The Precursive application is deployed inside your Salesforce Org, and therefore customer data—including any personal data—is not transferred or accessed by Precursive unless the customer explicitly grants access for support or implementation purposes.

When such access is provided, it may be fulfilled by Precursive personnel located in the United Kingdom, United States, or European Union. In these cases, access is time-bound, auditable, and always under the customer's control.

Precursive adheres to applicable data transfer requirements and safeguards, including the use of Standard Contractual Clauses where necessary. Customers are encouraged to evaluate their own global data access policies as part of their Salesforce governance.

Learn more from the Salesforce Privacy Overview

Data Portability and Customer Ownership

All data created by or through Precursive is owned by the customer. Customers can:

• Export data via reports, dashboards, Data Loader, or API.

• Migrate data using ETL tools or integrations.

• Connect to data warehouses and analytics platforms using APIs or integration middleware.

• Configure retention policies using native Salesforce features.

Precursive does not limit or restrict access to customer data at any time.

Use of Subprocessors

Precursive does not use any subprocessors to store or process customer data outside the Salesforce platform. As the application operates fully within the customer's Salesforce Org, Salesforce acts as the primary data processor under the customer's agreement and is considered a subprocessor for the purposes of data hosting and platform services. The application runs entirely within the customer's Salesforce Org. Operational subprocessors used for support or internal services are listed in the Privacy Policy. These subprocessors do not have access to customer Salesforce data.

Compliance and Certifications

Precursive operates a certified ISMS under ISO/IEC 27001:2022. This includes:

• Annual audits

• Statement of Applicability documenting implemented controls

• Ongoing risk assessment and control improvement

Precursive also benefits from Salesforce’s compliance credentials, including:

• ISO 27001, 27017, 27018

• SOC 1/2/3

• PCI-DSS

• HIPAA (with restrictions)

• and more

Salesforce Security and Compliance Site

Reporting a Security Concern

If you identify or suspect a security issue related to Precursive, please contact us immediately: support@precursive.com