Privacy & Security Policy

About GoCloudz Technologies Inc.

GoCloudz Technologies is a 100% native Salesforce Independent Software Vendor (ISV), delivering scalable, secure, and Salesforce-certified SaaS products. We design, deploy, and run our applications entirely within the Salesforce platform. As a result, they inherit its comprehensive security, compliance, and data governance framework.

Definitions

• Salesforce Shield: An optional Salesforce add-on offering advanced security features such as field-level encryption, platform event monitoring, and field audit trails.
• PII: Personally Identifiable Information.
• ISV: Independent Software Vendor.
• Zero-data processor: An application that does not store or access customer data outside the customer's platform.
• Security Review: A mandatory Salesforce certification process for ISV applications listed on AppExchange. It includes vulnerability scans, code analysis, and penetration testing.

1. Information Security Policy

1.1 Native Salesforce Architecture

As a 100% Salesforce-native application provider, GoCloudz does not manage or control any external infrastructure. All customer data resides within the customer’s own Salesforce instance, leveraging Salesforce’s secure multi-tenant architecture. In other words, we do not host, replicate, or export customer data outside of the Salesforce platform.

Relevant Salesforce documentation:

• Salesforce Security Best Practices
• Salesforce Security Infrastructure

1.2 Authentication and Identity Management

Salesforce handles all user authentication, session management, and access controls. As a result, customers benefit from Salesforce-native capabilities such as:

• Multi-Factor Authentication (MFA)
• Single Sign-On (SSO) integrations
• Role- and profile-based access controls
• Organization-level IP whitelisting and login hours

Consequently, GoCloudz does not have any direct control or visibility into your user authentication processes unless login access is explicitly provided for support purposes.

1.3 Security Review and Code Assurance

Every GoCloudz application listed on the Salesforce AppExchange, including Product Bundle and PDF Generator, is subject to Salesforce’s Security Review process, which includes:

• Static code analysis
• Manual penetration testing
• Vulnerability scanning for OWASP Top 10 risks
• Enforcement of platform security best practices

Reference: Security Requirements for AppExchange Solutions

2. Privacy Policy

2.1 Zero-Data Access by Design

GoCloudz applications do not access, transmit, or store any customer data by default. Instead, all business and customer records created or modified using GoCloudz apps remain fully contained within your Salesforce Org.

In addition, support interactions that require data access happen strictly on an on-demand and permissioned basis, and only for the duration of issue resolution.

2.2 Customer-Controlled Data Governance

Since GoCloudz operates within client’s Salesforce Org, you retain full control over all data, including:

• Data retention
• Record-level sharing rules
• Field-level security
• User access auditing

This also aligns with both U.S. and international privacy standards such as:

• General Data Protection Regulation (GDPR) (EU)
• California Consumer Privacy Act (CCPA) (U.S.)

As a 100% native Salesforce ISV solution:

• GoCloudz neither stores nor processes personally identifiable information (PII) outside Salesforce and thus operates as a zero-data processor.
• GoCloudz aligns indirectly with industry compliance standards such as SOC 2, ISO 27001, and HIPAA when used with Salesforce Shield.

2.3 Website visitors (gocpq.com)

This section of our privacy policy covers our website, gocpq.com. However, it is separate from our apps, which keep all customer data inside your Salesforce org as described above.

• Contact form: when you send us a message, we receive the details you enter (such as your name, email address, company and message) by email, so we can reply.
• Analytics: we use Google Analytics to understand how visitors use the site, for example which pages people view and which buttons they click. Google Analytics also uses cookies.
• Spam protection: the contact form uses Google reCAPTCHA, which checks information about your browser to block spam.
• Website agent: when you type a question into the GoCloudz Agent chat, we send it to our AI provider (Anthropic) to generate an answer. For this reason, please don’t enter personal or confidential information in the chat.
• Booking a call: the Book a demo and Get help links open Koalendar, a third-party scheduling service with its own privacy policy.
• Theme setting: only your own browser stores your light or dark theme choice.

We do not sell personal information. To ask about, correct or delete information you have sent us, email support@gocpq.com. Our Terms of Service cover subscriptions and use of the website.

3. Encryption Policy

3.1 Salesforce Native Encryption

Salesforce encrypts all data it stores in transit using TLS 1.2+ and at rest using AES-256, according to its platform standards.

Reference: Salesforce Encryption Overview

3.2 Advanced Field-Level Encryption with Salesforce Shield

Customers who need granular encryption for sensitive data (for example, PII, financial records, healthcare data) may purchase Salesforce Shield, which supports:

• Field-level encryption
• Database encryption
• Event monitoring
• Transactional field audit history

Moreover, GoCloudz is compatible with Salesforce Shield and places no limitations on customers using encrypted fields within our apps.

Reference: Salesforce Shield

4. Acceptable Use Policy (AUP)

4.1 Permitted Use

Customers may use GoCloudz applications strictly within the scope of Salesforce’s acceptable use and licensing terms. Permissible activities include:

• Business process automation using GoCloudz features
• Integration with standard/custom Salesforce objects
• Customization through declarative tools such as Flows

4.2 Prohibited Use

Customers must not:

• Reverse-engineer or attempt to extract source code
• Circumvent license or user restrictions
• Use the applications for illegal, unethical, or unauthorized purposes
• Provide GoCloudz with persistent login credentials outside authorized support windows

Accordingly, violation of this policy may result in license suspension or revocation without refund.

5. Incident Response Policy

At GoCloudz, we recognize that proactive incident management is essential to maintaining trust and minimizing risk. While our applications are 100% native to Salesforce and we do not manage external infrastructure or customer data directly, we maintain a structured incident response process for all application-related issues.

5.1 Incident Classification

GoCloudz classifies incidents into the following categories:

• Service Disruption: Functional issues impacting availability or performance of the application.
• Security Events: Any suspected or confirmed vulnerabilities identified within GoCloudz applications.

5.2 Reporting an Incident

Support is available via email at support@gocpq.com or through our contact page. In addition, we can arrange premium phone support on request, subject to additional service agreements.

We encourage customers to provide detailed context (for example, org ID, steps to reproduce, impact) to expedite triage and resolution.

5.3 Response and Remediation

Once you report an incident:

• First, we acknowledge it within one business day
• Then we prioritize it based on severity, scope, and impact
• Next, we triage the issue and decide on a resolution path (for example, patch, update, or workaround)
• Finally, we keep you informed throughout the remediation lifecycle

5.4 Root Cause Analysis (RCA)

For critical incidents, GoCloudz will conduct a formal RCA within 5–10 business days after resolution. For example, this may include:

• Summary of impact
• Timeline of events
• Technical root cause
• Remediation actions
• Preventive measures

5.5 Customer-Granted Access

GoCloudz will only access customer environments when:

• You grant explicit, time-limited login access
• We use that access solely to diagnose or resolve the reported issue
• All access ends immediately after resolution

We also recommend that clients assign GoCloudz to a limited permission set with only the minimum necessary privileges for support.

5.6 Post-Incident Review and Continuous Improvement

Following each major incident, our internal teams review the process to identify improvements in:

• Code quality assurance
• Regression testing
• Incident documentation and escalation workflows

6. Vulnerability Management Program

GoCloudz commits to maintaining the highest levels of application security through a proactive and structured Vulnerability Management Program. Furthermore, as a Salesforce-native ISV with apps listed on the Salesforce AppExchange since 2011, we continuously align with evolving SaaS industry standards and best practices.

6.1 Continuous Security Assurance

All GoCloudz applications are subject to Salesforce’s AppExchange Security Review, a rigorous evaluation process that includes:

• Static code analysis
• Dynamic application testing
• Manual penetration testing
• Secure session and authentication checks
• Data access pattern evaluations
• OWASP Top 10 vulnerability scans

For full details of this process, see Salesforce’s documentation: Salesforce ISVforce Guide

6.2 Review Frequency

Security reviews take place:

• Initially, before any app appears on the AppExchange
• Periodically for each major version update or release
• Ad hoc, if anyone discovers a platform-level risk or vulnerability

GoCloudz makes sure Salesforce reviews and recertifies all applications on its mandated schedule. In addition, we never release an app update that has not passed the latest security standards.

6.3 Vulnerability Detection and Scanning

In addition to Salesforce’s internal scans:

• GoCloudz conducts internal pre-submission reviews for all releases
• We also use automated tools to detect issues such as insecure APIs, unsafe query execution, and improper input handling

6.4 Remediation Timeline

Upon identification of any security vulnerability:

• We address critical issues within 48–72 hours
• We typically resolve high-severity issues within 5 business days
• We fix medium/low-severity issues in the following release cycle (or sooner if risk warrants)
• We promptly notify every customer whose instance any known vulnerability could affect

6.5 Ongoing Commitment

Since launching our first Salesforce app in 2011, GoCloudz has maintained a zero-tolerance policy for unresolved security flaws. We are proud to have consistently met Salesforce’s security standards across multiple product lines and continue to evolve our internal review frameworks alongside platform developments.

7. Hosting, SLA, and Platform Availability

The Salesforce platform hosts all GoCloudz solutions. Therefore:

• Hosting, uptime, and disaster recovery fall under Salesforce's purview.
• Salesforce’s own service commitments cover platform availability, as set out in each customer’s Salesforce agreement.

You can monitor outage updates and planned maintenance at:

• https://trust.salesforce.com

GoCloudz does not host or replicate infrastructure and, therefore, is not responsible for platform-level outages or latency.