Security and Data Protection

Tomba for Salesforce is a managed package that runs inside your Salesforce org and calls the Tomba API only for the work you ask it to do.

Data flow

1. A user, a bulk job, an automation rule, a Flow or an agent asks Tomba to look up a record.
2. The package sends only the inputs of that lookup — for example an email address, or a first name, last name and company domain — to https://api.tomba.io over HTTPS.
3. Tomba answers with the result (email, verification status, company data…).
4. The package writes the result to the fields your field mapping allows.

Nothing is sent in the background unless an admin turns on automation, and automation is off in sandboxes unless explicitly allowed (Sandboxes).

What Tomba stores

Requests are recorded in your tomba.io account's request log (the Salesforce source on your usage page) like any API call, under the tomba.io privacy policy. The package does not export your Salesforce records in bulk to Tomba.

Credentials

• The connection is made with OAuth (PKCE) to your Tomba Enterprise account, or with an API key.
• The package creates a dedicated API key named after your org, so you can see and revoke it at app.tomba.io/api; it is renewed automatically before it expires.
• The key, secret and refresh token are stored in a Salesforce external credential, encrypted by Salesforce. Users and Apex code cannot read them; they are only added to requests to api.tomba.io.

Salesforce permissions

• Queries and updates run in user mode: object permissions, field-level security and sharing are enforced, so users only see and change records they have access to.
• Fields are written only when the user may edit them and only according to the field mapping.
• Access is granted with the Tomba User and Tomba Admin permission sets; only Tomba Admins can connect, change settings and edit field mappings.

Control and audit

• Usage log: every lookup is recorded per day, user and source (record action, search, bulk, automation, Flow, agent) — see Usage, limits and alerts.
• Limits: monthly automation budget and per-user credit limits.
• Bulk jobs record who started them, what they processed and the credits used.

Disconnecting

Disconnecting removes the stored credentials and revokes the OAuth grant. You can also revoke access at app.tomba.io › Connected apps or delete the Salesforce – … key.

Salesforce Security Review

Tomba for Salesforce is distributed through AppExchange, which requires passing the Salesforce Security Review; the review status is shown on the AppExchange listing. For security questionnaires, contact your Tomba account team or Tomba support.