Security
Last updated 5 July 2026
Security is the whole point of Vault Maagic, so we designed it to hold as little of your data as possible. Here is how we protect what we do touch.
Your record data is never stored at rest
During a backup, your Salesforce records pass through our server's memory on their way to your Google Drive. They are never written to a database or file storage on our side. The CSV files live in your Drive, under your control. Record contents are never written to our logs; we log only object names, row counts, timestamps, and error messages.
Tokens are protected
- Refresh tokens are stored encrypted in a dedicated secrets vault and decrypted only server-side, only when a backup runs.
- Access tokens live only in server memory for a single run. They are never persisted, never logged, and never sent to your browser.
- When Salesforce rotates a refresh token, we immediately store the replacement so your connection keeps working.
Least-privilege access
We ask each provider for the narrowest access that works. On Google we use the drive.file scope, so Vault Maagic can only see and manage files it creates itself, never the rest of your Drive. On Salesforce we request query access plus an offline token for scheduled runs. You can revoke either connection at any time from your Salesforce or Google account settings, and backups will simply stop.
Our use of data from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements: we never use it for advertising, never sell it, and never use it to train AI or machine-learning models. Our Privacy Policy sets out the full statement.
Isolation and transport
- All traffic is encrypted in transit with TLS.
- Every customer's data is isolated with database row-level security, so one account can never read another's records.
- Administrative and background operations run with tightly scoped server credentials that are never exposed to the browser.
Where it runs
Our application and database are hosted in the United Kingdom (London region). See our Privacy Policy and Data Processing Addendum for how data is handled and where our providers operate.
Reporting a vulnerability
If you believe you have found a security issue, please tell us at vault@maagic.co.uk. We welcome responsible disclosure and will work with you to confirm and fix genuine issues. Please do not access or modify data that is not yours while testing.