> For the complete documentation index, see [llms.txt](https://documentation.grax.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.grax.com/technology/security/security.md).
# Security
This page covers how GRAX protects your data and controls access to it: who is responsible for what in each deployment model, compliance, encryption and data storage, authentication, and security testing.
## Shared Responsibility
Who owns what depends on the deployment model. See [Deployment Options](/technology/overview/deployment-options.md) for how the models differ.
On self-managed deployments, see [Backup and Recovery](/technology/requirements/technical-requirements.md#backup-and-recovery) for protecting the GRAX database.
GRAX-managed infrastructure is protected by endpoint detection and response (EDR) agents that provide continuous intrusion monitoring and threat detection. GRAX-managed endpoints use publicly trusted certificates issued under the CA/Browser Forum Baseline Requirements, and they renew automatically.
## Compliance
* SOC 2 Type 2: GRAX has been audited across the platform. See the [GRAX Trust Center](https://trust.grax.com) for the report, policies, and supporting documentation.
* Salesforce AppExchange security review: the GRAX managed package has passed Salesforce's [security review](https://developer.salesforce.com/docs/atlas.en-us.packagingGuide.meta/packagingGuide/security_review_overview.htm).
* HIPAA: GRAX provides a BAA on request. Contact [GRAX Support](https://documentation.grax.com/support/get-support).
* PCI: store sensitive payment data in Salesforce Encrypted Custom Fields, and grant the GRAX user the "View Encrypted Data" permission as your needs require. GRAX respects the Salesforce sharing and permissions model.
* Data deletion for individuals: authorized users can permanently delete data related to one or more individuals in all product offerings. See [Purge](https://documentation.grax.com/protect-data/purge).
GRAX is deployed into public cloud ecosystems and builds on the security and compliance posture of those services. For the underlying documentation, refer to your cloud provider.
## Data Protection
### Encryption
| Data | Protection |
| ------------------- | -------------------------------------------------------------------------------------------------- |
| In transit | TLS 1.2+; HTTPS only. HTTP traffic is ignored, or redirected to HTTPS automatically where possible |
| At rest | Cloud provider storage encryption (AES-256 on AWS) |
| Application secrets | Encrypted by GRAX before storage in the database |
Application secrets are the configuration values that control connections to storage and Salesforce, plus licensing information. Even users with access to the database can't read them without the key used by the GRAX Application, and GRAX recommends encrypting the entire database storage volume as well.
### Where Your Data Lives
* **Blob storage bucket:** record data, metadata, and files, stored in your blob storage bucket. See [Blob Storage](/technology/overview/blob-storage.md).
* **PostgreSQL database:** application metadata. It doesn't store backed-up data.
* **Salesforce data never leaves the app environment.** Only operational telemetry is sent to GRAX, and it never contains Salesforce records. See [Telemetry](/technology/security/telemetry.md).
### Data Store Authentication
* **PostgreSQL:** the app database is protected with password authentication, and no other authentication methods are supported. GRAX doesn't use SSL with certificate verification on PostgreSQL databases, so no action is needed regarding root certificates or certificate authorities.
* **Blob storage:** GRAX supports several authentication methods per provider, including static keys, instance roles, assume role, managed identities, and app registrations. See [Technologies](/technology/overview/blob-storage.md#technologies) for the methods each provider supports.
## Authentication
GRAX authenticates users through Salesforce SSO. Telemetry to `hq.grax.com` is covered separately in [Telemetry](/technology/security/telemetry.md).
### GRAX SSO via Salesforce
Within the GRAX Application experience, authentication is driven by the user's Salesforce access. Your admins can prevent access to GRAX entirely, hide fields and features, and grant permission to modify general app settings.
GRAX involves two login types: the integration user, which backs up, archives, and restores data, and the user who logs into the GRAX interface to run archives, restores, or searches. The integration user must have extensive permissions and be connected to the GRAX backend via OAuth. To use GRAX, your Salesforce user must be assigned a custom permission set named along the lines of "GRAX - \[Name]" (for example "GRAX - Configuration Admin").
{% hint style="warning" %}
**'Log In As' (**[**User Impersonation**](https://help.salesforce.com/s/articleView?id=sf.logging_in_as_another_user.htm\&type=5)**) does not work with OAuth.**
{% endhint %}
### OAuth Flow
GRAX uses Salesforce's standard OAuth authorization code flow, with `hq.grax.com` as the OAuth client for every GRAX Application:
* You sign in on your own Salesforce domain, so GRAX never sees your Salesforce credentials.
* `hq.grax.com` is the registered callback. It holds the GRAX Connected App credentials and exchanges the authorization code for a token from `3.232.229.75`. Your browser never receives a Salesforce token; the GRAX Application retrieves the result from `hq.grax.com` over an authenticated server connection.
* The GRAX Application confirms you're an active user in the connected org with a GRAX permission set, checked through the integration user's connection, and then starts a GRAX session.
The GRAX Application doesn't store your Salesforce token, and `hq.grax.com` keeps the encrypted exchange result only briefly before deleting it. This multi-party flow is required by GRAX licensing processes and lets GRAX work under several of the more restrictive Salesforce security options.
### Permissions Management
GRAX respects [field-level security](https://help.salesforce.com/s/articleView?id=sf.admin_fls.htm\&type=5) and encrypted-field visibility in the GRAX application and its Lightning Web Components (LWCs). If a field is hidden from a user in your Salesforce org, that user can't view it in GRAX in any capacity. If fields are encrypted in Salesforce, the GRAX user needs the "View Encrypted Data" permission before GRAX can back up or modify them. The LWCs also support record-level security implicitly, based on the user's access to the parent record the LWC sits on.
You can also prevent the integration user from accessing specific data, so GRAX can never see, read, back up, archive, or restore it and the end-user access question never arises. This isn't recommended, because that data then can't be protected in backups. Manage this visibility as you normally would in Salesforce.
GRAX drives application access from custom permission sets that are installed with the managed package and can be customized by advanced users. To grant access, assign the user the relevant permission set.
## Penetration Testing
GRAX periodically conducts its own penetration tests, undergoes external penetration tests, and completes other security audits. Results are available in the [GRAX Trust Center](https://trust.grax.com/resources): click `Request Access` and you'll be notified when access is granted.
To run your own penetration tests against GRAX, get approval first by sending [GRAX Support](https://documentation.grax.com/support/get-support) your testing process and schedule.
Service providers also publish their own security reports and penetration testing guidance:
* [ngrok Security Portal](https://trust.ngrok.com/)
* [AWS Penetration Testing](https://aws.amazon.com/security/penetration-testing/)
* [Azure Penetration Testing](https://learn.microsoft.com/en-us/azure/security/fundamentals/pen-testing)
## Public Sector
You deploy GRAX into your own authorized cloud environment, and many agencies and customers manage their own GRAX Application there. Most government customers deploy the software in their own cloud (AWS, Google Cloud, Azure) or in a hybrid or multi-cloud environment.
* **GovCloud:** GRAX has received the [Government Cloud badge from Salesforce](https://appexchange.salesforce.com/listingDetail?listingId=a0N3A00000FMtthUAD\&tab=e) and is compatible with [AWS GovCloud (US)](https://aws.amazon.com/govcloud-us/), an isolated AWS region used by US government agencies, contractors, and other US customers.
* **FedRAMP:** deploy GRAX into a FedRAMP-authorized cloud environment, such as a FedRAMP-authorized data center with a FedRAMP-authorized cloud service provider. See the [FedRAMP program](https://www.fedramp.gov/) for how cloud services are assessed.
Running GRAX in a GovCloud-certified environment means:
* GRAX has no access to your data or infrastructure.
* Your data is owned by you and stored within your own environment.
* You can use private routing between Salesforce and AWS, and between your infrastructure and your GovCloud-certified environment.
For AWS's compliance with federal and other standards, see [AWS's compliance page](https://aws.amazon.com/compliance/).
## Legacy Heroku
Previous versions of the GRAX Platform were deployed using the Heroku PaaS, in a network-isolated Heroku Private Space. For compliance and security information specific to this legacy configuration, contact [GRAX Support](https://documentation.grax.com/support/get-support).
## Frequently Asked Questions
Does GRAX use certificate pinning or hardcoded certificates?
No. GRAX doesn't hardcode or pin certificates, and certificates renew automatically on standard expiration timelines.
Will Salesforce's DigiCert Global Root G2 change affect GRAX?
No. Because GRAX doesn't pin certificates, the update doesn't affect GRAX applications. Customers managing their own infrastructure remain responsible for TLS compliance and certificate updates, and both GRAX and Salesforce recommend staying current with trusted root stores such as Mozilla's.