How Vault Maagic works
Automated Salesforce backups that land in your own Google Drive. Here is exactly what happens, which services it talks to, and how your access is kept safe.
1. Connect Salesforce
Sign in to Salesforce through its standard OAuth screen and approve access. We never see or store your Salesforce password.
2. Connect Google Drive
Do the same for Google Drive. Vault Maagic creates its own backup folder and can only touch files it creates there.
3. Choose objects and a time
Pick which Salesforce objects to back up, how much history the first run should fetch, and a daily time in your timezone. Standard and custom objects are both supported.
4. Get your backups
Each run exports the records that changed, writes them as CSV files in your Drive folder, and emails you a short summary.
Your first backup
The very first run decides how much history lands in your Drive. When you create a backup, you choose:
- Everything. The complete table for every selected object, with no date cutoff. This is the right choice for a true backup, and size is not a concern: exports stream from Salesforce to your Drive in chunks, so even multi-gigabyte objects complete reliably.
- Start from today. Only records that change after you create the backup. The fastest start, with no history.
- From a date. Records modified on or after a date you pick. Bear in mind that older records which never change again will not be included.
To help you decide, the form shows an approximate record count for your selected objects before you commit to anything.
Two details make the backups genuinely complete. Archived activities (Tasks and Events older than about a year, which Salesforce hides from normal queries) are included. And formula and roll-up fields are skipped by default, because Salesforce recalculates them from other fields and they cannot be restored; a per-backup setting includes them when your CSVs are meant for reporting or migration rather than recovery.
The services it connects to
Vault Maagic is the bridge between two accounts you already own. It talks to each one through the provider's official API using OAuth, so you approve access on Salesforce's and Google's own sign-in screens.
Salesforce. We use the Salesforce REST API to list your objects and their fields, and the Bulk API 2.0 to export the records that changed. Bulk API is built for large, asynchronous exports and counts against a separate, generous quota, so a backup will not eat into your normal API limits. The access we request is scoped to querying data (the api scope) plus an offline refresh token so scheduled runs can work while you are away.
Google Drive. We use the Google Drive API with the drive.file scope. This is the narrowest Drive scope there is: Vault Maagic can only see and manage the files it creates itself. It cannot read, list, or touch anything else in your Drive. Large CSV files are sent using resumable uploads so a slow connection will not corrupt a backup.
How your tokens are handled
After you approve access, each provider gives us two things: a short-lived access token and a longer-lived refresh token. We treat both carefully:
- Refresh tokens are stored encrypted in a dedicated secrets vault (Supabase Vault). They are decrypted only on our server, only for the moment a backup runs.
- Access tokens live only in server memory for the length of a single run. They are never written to a database, never logged, and never sent to your browser.
- Salesforce rotates its refresh token every time it is used. When that happens we immediately save the replacement, so your connection keeps working without you noticing.
- You can revoke Vault Maagic's access at any time from your Salesforce or Google account settings. Backups simply stop; your existing CSV files stay in your Drive.
What happens during a run
A scheduler wakes up on your chosen daily time. For each object you selected, Vault Maagic works out which records changed since the last run (using each record's last-modified date, plus a small overlap window so nothing slips through), exports just those records, and merges them into the matching <Object>.csv in your Drive folder. Existing rows are updated by their Id and new rows are added, so each file always holds the complete, current table.
When the run finishes you get an email summary: how many rows each object exported, what was created or updated, and anything that needs your attention.
Where your data lives
This is the part that matters most: your Salesforce record data is never stored on our servers. During a run it passes through our server's memory on its way from Salesforce to your Drive, and that is the only place it goes. We keep the CSV files in your Google Drive, under your control. We hold only the small amount of operational data needed to run the service: your account email, connection metadata (such as your Salesforce org id and Google account email), your backup settings, and run logs made up of object names, row counts, timestamps, and any error messages. Record contents never appear in those logs.
Our infrastructure is hosted in the UK (London region). For the full detail, see our Security and Privacy Policy pages.
Ready to keep your own copy of your Salesforce data?