Security

The short version: Release Notifier is a native managed package that makes no callouts and stores everything in custom objects inside your own Salesforce org.

No external services

• The package contains no HTTP callouts, Named Credentials, External Credentials or Remote Site Settings.
• Releases, translations, acknowledgments, ideas, issues and logs live in the package's custom objects in your org.
• Nothing is sent to Beyond The Cloud or any third party.
• Reminder emails are sent through Salesforce's own email service and contain the release name and a link back into your org.

Access model

Two layers control access:

Licenses (platform-enforced). Release Notifier is licensed per user. A user without a license under Setup > Installed Packages > Manage Licenses is blocked from every package component by Salesforce itself, whatever permission sets they hold.

Permission sets (packaged). Four sets, each granting one custom permission:

Permission set	Can
Release Notifier User	Read releases, acknowledge, submit ideas and issues, set preferences
Release Notifier Content Creator	Also create and edit releases, audiences and templates
Release Notifier Manager	Also track acknowledgments and manage banners
Release Notifier Admin	Also change org-wide settings

Checks run at three levels: navigation items are hidden, pages render an access denied view, and every server-side method verifies the custom permission again. Hiding a button is never the only guard.

What users can see

Audience targeting controls visibility of content, on top of (not instead of) your org's security model. A release targeted at an audience is only readable by its members, admins and managers.

Questions

Security review documentation for your InfoSec team is available on request: contact@beyondthecloud.dev.