Elvance Architecture and Security Overview
Elvance provides intelligent opportunity management tools and deep insights to drive more accurate forecasting, ROI and collaboration.
Elevate Your Teams.
Advance Your Business.
Overview
The Elvance Application is built on the Salesforce Platform. Being 100% native to the Salesforce Platform, no Customer Data is shared beyond your Salesforce instance. All processing, calculations and functionality is run directly from your Salesforce instance.
All logic and code is executed either by Salesforce or within your browser. Salesforce has security built into every layer of the Platform. The infrastructure layer comes with replication, backup, and disaster recovery planning. Network services have encryption in transit and advanced threat detection. Salesforce application services implement identity, authentication, and user permissions.
More details on Salesforce security can be found here: https://security.salesforce.com/
Components
The application is built through a number of Lightning Web Components to provide various functionality. Apex classes are used to drive queries and DML operations for these components. Through the LWCs a user can administer the platform, create a custom scorecard and track this for Opportunities. When installing the Elvance managed package a list of components can be obtained for reference.
Security
Elvance is a Salesforce native application. By listing on the Salesforce AppExchange, Elvances complies with the Salesforce Security Review process and all reasonable best practices.
Elvance cannot access or view any data customers have created or generated through the Elvance application, unless access has specifically been granted to your Salesforce instance.
Salesforce upholds high security standards for solutions distributed on AppExchange. The AppExchange security review tests how well it protects Customer Data. The security review is designed to identify security vulnerabilities that a hacker, malware, or other threat can exploit. Salesforce security review teams use threat-modelling profiles that are based on the most common web vulnerabilities.
Disaster Recovery
Being 100% Force.com-native, all product data processed by the Elvance application resides on the Salesforce platform, in your own Salesforce instance. This means that in case of disaster or when something goes wrong with the core platform (identity and access management; hardware; servers and data centre; operating system and services; data storage; networking) then we trust Salesforce to have the resources and scale to resolve the matter swiftly. As part of disaster recovery planning, Salesforce ensures that the systems where customer data is stored have a disaster recovery facility that is geographically remote from its primary data centre, along with required hardware, software, and Internet connectivity, in the event production facilities at the primary data centre were to be rendered unavailable.
More information on Salesforce’s DR and BCP planning can be found here: https://compliance.salesforce.com/en/disaster-recovery-bcp
Should an issue be found with the Elvance Application, the SLAs outlined in Exhibit A of the Master Services Agreement will apply.
Data Encryption
Being 100% Force.com-native, Elvance relies on the Salesforce platform for encryption of data in transit. Salesforce uses industry-accepted encryption standards during transmissions between a user’s client browser and Elvance applications, including 128-bit TLS Certificates and 2048-bit RSA public keys at a minimum. Additionally, customer data is encrypted during transmission between data centres for replication purposes.
Data Categories
Elvance respects your privacy and takes significant efforts to protect “Customer Data” and the security of the services that our products interact with. Throughout our relationship with customers and partners Elvance will collect and process “Company confidential and Employee Personal Data” related to customers’ business, employees and processes.
“Customer Data” — Data within the customer’s Salesforce instance created or processed by Elvance products installed within the Salesforce instance. Elvance does share or access this data without explicit access being granted by the customer for a time-bound period.
“Individual product usage data” — Through the use of Elvance products we may collect Individual Product Usage Data relating to the Users (employees, contractors, etc.) interacting with the Product for the provision of support and product analytics. Specific details of this can be found in the Master Services Agreement.
“Anonymous product usage data” — Through your agreement with Salesforce anonymous usage data relating to your interaction with Authorised Security Reviews Applications is shared with the provider for the purpose of product analytics.
Sub Processors
The Elvance Application is 100% native to the Salesforce platform. All Customer Data processed and stored by these services is hosted by Salesforce.com – therefore the residency of this data is dependent upon your own agreement with Salesforce and your Salesforce Instance.
Elvance uses certain sub processors to assist it in providing its services.
A list of sub processors can be found at: https://elvance.io/resources/sub-processes
Personal Data Processing
The privacy-first architecture of the Elvance Application as 100% native to the Salesforce platform ensures that Customer Data is not shared beyond your Salesforce instance. Through the use of the Elvance Application we will collect “Individual Product Usage Data” relating to the Users interacting with the Product for the provision of support, product communications (release updates, training, etc.) and product analytics.
Salesforce Environment Access
Elvance does not have access to your Salesforce Org including Customer Data and org configuration, unless you have explicitly granted it.
There are two methods to grant access, Elvance may request this to help with; issue resolution, Professional Services or troubleshooting.
- Grant Login Access
By Granting Login Access Elvance will be provided with a secure, auditable time restricted access to your Salesforce instance. Only approved members of the Elvance team are permitted access to login to your environment.
- Provide a Salesforce User Account
Providing a dedicated User Account may be required for certain troubleshooting steps, including, but not limited to, installation and upgrading of the Elvance managed package. Any costs incurred by providing a dedicated licence will not be reimbursed by Elvance. The account can be suspended or disabled at any time by you.
More Information
Please get in touch if you have any questions about the Elvance Application, Architecture or Security.