How we secure your systems
Who has access to your systems, where they run and how we monitor them.
Access
Access from our network
Our admin accounts in your Salesforce environment only work from the Sparklink network. No one outside it can get in, even with the right credentials.
A personal account for every team member
Our team members sign in with their personal Sparklink account, with MFA. Our tool uses that account to give them access to your Salesforce environment and logs who signed in and when. We can send you that log on request.
Access only for those who work on your systems
A team member gets access to the Salesforce environments of the clients they work for, not to those of all clients.
MFA in every Salesforce environment
MFA is on in every Salesforce environment we manage for you. Anyone who signs in directly has to confirm with a second step.
Guests on a separate network
Visitors to our office use a separate guest network. Our admin accounts in your Salesforce environment don't work from that network.
Your systems
Changes to your Salesforce environment with our own tool
We deploy changes to your Salesforce environment with our own tool, without an external service in between. That way no extra party gets access to it.
Short-lived keys for every cloud change
Systems that deploy changes to cloud infrastructure are often a weak spot. Our pipelines get only the access they need for each release, and it expires right after. So there's no long-lived key in them that could leak.
A separate cloud project per client
Your applications run in their own cloud project (Google Cloud, Microsoft Azure, Amazon Web Services, …), separate from those of other clients.
Your cloud infrastructure in the European Union
The applications we manage for you in the cloud are hosted in the European Union, as are your files and backups.
Your code in private repositories
Everyone in our GitHub organisation signs in with MFA. Your code is in private repositories.
Who else works with your systems
Besides Sparklink: Salesforce, Google Cloud, Azure and Amazon S3 (where your systems run and your files are stored), GitHub (where your code lives) and Aikido (which checks our code and cloud).
Monitoring
Aikido checks our code and cloud
Aikido, a security company, checks our code and the open-source packages in it, every code change, the React and Angular pages we build and the cloud infrastructure we manage. It looks for known vulnerabilities, passwords and keys that don't belong in code, and settings that expose too much.
Reading security advisories every working day
We read the security advisories from the Centre for Cybersecurity Belgium (CCB), CISA in the US, the cloud providers and the makers of the software we use. If one concerns software we manage for you, we apply the update.
Software with security updates
We keep the software we manage for you on versions that still get security updates.
Reporting a problem
Found a security problem at Sparklink or in a system we manage for you? Email security@sparklink.be.
Questions about how we work? Email the same address.
If a security incident at Sparklink affects your systems or data, we let you know within 24 hours.
A security scan of your Salesforce environment and cloud infrastructure
44 checks. The scan is read-only: it doesn't change anything. It's included every year in a Sparklink support contract, with an extra automated scan every quarter.