Security at Eglerio

The Salesforce integration is designed to send a limited set of organization, user, team, performance-cohort, and approved achievement information. It is not designed to export raw opportunity records, customer or opportunity names, exact revenue, compensation, or arbitrary CRM fields.

Our Privacy Policy explains the information we collect, service providers, retention, and your privacy choices. This page describes application safeguards; it does not replace the privacy policy or your organization’s agreement.

Website sign-in uses limited-life, one-time links. Authentication tokens are checked for expiry and replay, and sessions use signed, HTTP-only cookies. Keep sign-in links private and use sign-out when you finish on a shared device.

Private application and API routes enforce authorization on the server. Salesforce integration requests use authenticated credentials, with organization scope checked by the service. Managed-package permissions and customer configuration also govern what Salesforce users can do. Company administration requires a separately configured authorization policy; an unconfigured policy denies access.

• Production web and API endpoints use HTTPS.
• Server-side credentials stay outside browser responses. LinkedIn access tokens use application-layer encryption at rest when posting is enabled.
• Authentication endpoints apply rate limits. The website’s authentication proxy checks request origin before forwarding a sign-in request.
• Browser safeguards include a Content Security Policy and restrictions on framing, embedded objects, and form destinations. Development preview routes are disabled by default in production.
• Optional third-party content, such as the official LinkedIn profile badge, loads after the visitor chooses to load it. The verification page remains usable without that content.

Organization public sharing is opt-in. Publishing an individual profile requires a separate authenticated choice and applicable employer authorization. Private, withdrawn, or unavailable profiles do not expose their contents through the public profile endpoint.

A verification record may display a limited revoked or superseded status so viewers can understand that a previously shared achievement is no longer current. Withdrawal cannot recall copies already saved or posted to third-party services. See the privacy policy for the distinction between publication, verification status, and retention.

Your organization controls its Salesforce users, permissions, package assignments, integration configuration, and sharing choices. Restrict administrator access, review publication settings, protect credentials, and keep your Salesforce and Eglerio contact details current.

Report suspected unauthorized access promptly. Do not put passwords, one-time links, access tokens, or unnecessary customer information in support messages.

We use automated tests, dependency checks, static analysis, and Salesforce security analyzers during development and release preparation. These checks help identify issues but do not guarantee that every vulnerability has been eliminated.

Eglerio is preparing for Salesforce AppExchange Security Review. We do not currently claim a passed Salesforce security review or SOC 2, ISO 27001, or other independent security certification. For questions about a specific deployment or contractual requirement, contact us before sending sensitive data.

Send suspected vulnerabilities or unauthorized access reports to support@eglerio.com with the subject “Eglerio security report.” Include the affected page or feature, steps to reproduce, and the potential impact. Redact secrets and personal information from screenshots or examples.

Please avoid accessing another person’s data, disrupting the service, or publicly disclosing sensitive details. Contact us to coordinate testing that could affect other users. This reporting channel does not authorize intrusive testing or promise a bug bounty.

Eglerio is operated by Laudes LLC. For general service obligations, see our Terms and Conditions.