Security & data handling

Overview

SmixAI is designed to give you insight while limiting what it reads to what a task needs, and it isolates every organization's data.

What SmixAI reads

• Discovery reads: object/field definitions, record counts, automation & code metadata, org limits (storage), license totals, and user activity (e.g. last login). Duplicate detection uses aggregate counts, not row exports.
• Agents read only what a task needs: SmixAI reads only the records it needs to do the task you ask for.

See What gets inventoried for the full list.

How your data is protected

Control	Detail
Credential encryption	OAuth tokens, secrets, and private keys are encrypted at rest.
Tenant isolation	Each customer's data is kept separate from every other customer's, and we test that separation.
Least privilege	Connect with a scoped/integration user; server-to-server runs as a defined identity.
Audit trail	Significant actions are logged (see Activity & audit log).
Permissioned actions	Agents act only within the permissions you give them. New agents propose changes for your approval, and every production deployment needs a person's approval.

How to: keep your connection secure

• Use a dedicated, least-privilege Salesforce user for scanning.
• Prefer JWT Bearer for automated scans so no interactive password is involved.
• Rotate credentials periodically (add a new credential, set primary, remove the old).

Use cases

• Security review: confirm what SmixAI reads for discovery, how agent actions are permissioned, and that credentials are encrypted.
• Procurement: point your security team here plus to your contract/DPA for specifics.

Notes

• For formal security documentation (certifications, DPA), contact the SmixAI team.