Security & Trust

Pinion CPQ is a Salesforce managed package. It installs into your org and runs on the Salesforce platform — there is no separate Pinion server that stores or processes your data. This page is the short version for a security review; it states the guarantees, not the internals.

Where your data lives

  • Everything runs inside your org. Pinion’s logic executes as Apex on the Salesforce platform, against your org’s data. Pinion does not stand up external infrastructure that holds a copy of your records.
  • Your deal and customer data never leaves your org to Pinion or a third party. The package sends no telemetry, and licensing is verified locally (no license-server callout). During normal configure / price / quote / approve work, the package makes no outbound calls at all.
  • The one outbound path is an admin feature you opt into — Config Promotion (Pinion+). When an admin uses it, Pinion syncs your configuration (products, rules, templates — not customer or deal data) to another Salesforce org you connect, through a Salesforce Named Credential you set up. There are no hardcoded endpoints or secrets: the package only ever calls callout:<your-named-credential>, so you control exactly where it can reach.

Every action respects the running user’s permissions

Pinion never elevates a user beyond their Salesforce profile:

  • Object & field security is enforced by the platform. Reads run in user mode so Salesforce applies the user’s object and field-level permissions; writes run in user mode (or are filtered to the fields the user may write).
  • A user can’t see or change what their permissions don’t allow — Pinion’s configurator, admin surfaces, and AI tools all inherit the user’s CRUD/FLS.
  • New fields are granted through permission sets, not by loosening profiles, so you control exactly who sees what.

Least privilege

  • Pinion does not request Modify All Data, View All Data, or Author Apex. It asks only for the access its features need.
  • Access is organized into role-based permission sets (administrator, configurator user, approver, and the rest) so you grant each person the narrowest set that fits their job — see Personas & Permission Sets.

No secrets, verified licensing

  • The package ships with no hardcoded secrets, keys, or tokens.
  • License activation uses industry-standard signed-token (RS256 JWT) verification against a public key — there is no shared secret embedded in the package, and no license-server callout at runtime.

Built to the AppExchange Security Review bar

Security is a standing gate on every change, aligned to Salesforce’s own AppExchange Security Review:

  • Injection-safe data access — queries use bound variables only; no user input is concatenated into a query.
  • Output is escaped against cross-site scripting on every surface.
  • Sharing is explicit on every Apex class.
  • A single controller seam — the UI reaches data only through vetted entry points that re-check permissions and never leak another user’s data.