Privacy Policy

Deplo is a Salesforce admin copilot. We connect to your Salesforce org via OAuth to read metadata (fields, Flows, Apex classes, validation rules, and related components) so we can produce dependency analyses, plain-English explanations, and AI-assisted change proposals.

Records Doctor write-back. Deplo can also propose, and in some configurations execute, narrow data fixes against your org (e.g. reopening a record locked by a validation rule). Write-back is opt-in at three independent layers: (1) a per-deployment server flag, (2) a workspace setting your admin must enable, and (3) a per-org "data write enabled" toggle on the connection. Every executed change is captured in our audit log with the actor, timestamp, before/after state, and a deterministic rollback plan. At launch, production write-back is gated to sandbox orgs only; production execution unlocks after our extended rollback-test program completes.

The Deplo browser extension. The Chrome extension runs on your Salesforce pages and works in two ways. Most tools run in direct mode: they use your existing Salesforce session in your browser to call your own org's API directly, so no org data passes through Deplo's servers, and these tools work even without a Deplo account. AI features (plain-English explanations, Investigate, formula help, and turning a description into a SOQL query) send your question plus the specific metadata or text you are acting on to Deplo's API, which calls Anthropic (see §3). You can also make configuration and data changes from the extension (for example pausing a validation rule for a data load, or a bulk field update). These always run through your own Salesforce session at your explicit request, never through Deplo's servers, and are reversible.

Account & access. Email address, bcrypt-hashed password, workspace + role memberships, refresh tokens (server-side, hashed).

Salesforce connection. Org ID, instance URL, your Connected App credentials (Client ID, plus Client Secret encrypted at rest with AES-256-GCM), and OAuth access/refresh tokens (encrypted at rest).

Metadata catalog. API names, labels, and descriptions of objects, fields, Flows, Apex, validation rules, profiles, and permission sets in your org. Dependency relationships between them. We do not bulk-export records.

Ticket bodies and repair proposals. When you connect a PM tool (Jira, Linear, JSM, ServiceNow) or use Investigate, we store the inbound ticket body or pasted problem description, the structured change proposal Deplo produces, and, for Records Doctor, a snapshot of the targeted records' current and proposed field values. These snapshots include only the fields involved in the proposed repair, not the whole record. Investigate conversations (your questions, the answers, result snapshots, and thread titles) are encrypted at rest (AES-256-GCM), auto-delete after 90 days of inactivity, and can be deleted instantly from the app: deleting a conversation removes its messages immediately, with no soft-delete grace period. Publicly shared runs (anonymized at share time) persist until you revoke the share.

AI response cache. Claude's output for impact summaries, explanations, and proposals is cached for 1–7 days (depending on call type) to keep latency and cost down. Cache entries are keyed by a one-way hash, and each cached response is encrypted with a key derived from the prompt itself plus a server-side secret. The prompt is never stored, so the cache cannot be browsed or bulk-decrypted; a cached response can only be opened by a request carrying the identical prompt that created it.

Audit logs. Every Records Doctor execution, every share-link view, every billing change, every org connect/disconnect is logged with actor, timestamp, and outcome.

Monitoring & drift snapshots. If you enable monitoring (Watch), Deplo periodically snapshots org-health metrics and metadata diffs against a baseline. These snapshots are stored for trend analysis and alerting.

AI usage telemetry. Per-workspace, per-feature, per-day rollups of Claude calls and costs so we can detect runaway usage. No prompt or response content is stored in the telemetry table, only counts and token sums.

Salesforce session (browser extension). To run its direct-mode tools, the extension reads your Salesforce session cookie in your own browser and uses it only to call your own org's API. This session identifier never leaves your browser: it is not sent to Deplo's servers, not stored by us, and not shared with anyone. The extension's direct-mode tools read org metadata and (only at your explicit request) make changes to your org entirely within your browser session; Deplo's servers do not receive or store that org data.

Browser-extension error reports (opt-in). If you enable "Share anonymous error reports" in the Deplo Chrome extension (it is off by default), we receive a report when the extension itself breaks: the error message, a stack trace limited to the extension's own files, the extension version, and which extension screen failed. Reports are scrubbed inside the extension before they are sent, and scrubbed again on our servers, of record IDs, org hostnames, URLs, email addresses, and query text, so they never contain Salesforce data or anything that identifies your org. They are forwarded to Sentry (see §8) for diagnosis.

Several Deplo features call Anthropic's Claude API. The data sent depends on the feature:

• Explain / Investigate / Suggest: the relevant metadata snippet (formula, Apex body, ticket body, etc.) wrapped in safety tags so the model treats it as data, not instructions.
• Records Doctor planner: the targeted record's current state (selected fields only), org-level metadata that affects the record (active validation rules, approval processes), and your goal description.
• Generate XML: the change description and ticket context, never your records.
• Explain a save error (extension): when you ask the extension to explain a Salesforce save error, the verbatim on-screen error message is sent. Salesforce sometimes puts a record's field values (e.g. a name or email in a duplicate or validation-rule message) into that text, so this can include record-derived data, sent only on that explicit action.

We use the Anthropic API under their commercial terms. Anthropic does not use Deplo's API inputs or outputs to train their models. Per Anthropic's published policy, API content is retained only for the period needed to operate the service (typically 30 days for abuse monitoring) and then deleted. We have not enabled any "training," "extended context," or other opt-in features that would expand retention. See our Trust & Security page for our full subprocessor list and incident-response posture.

Bring your own key (optional). If you turn on BYOK in the extension, the AI features run on your own Anthropic or OpenAI account instead of ours. Your API key is stored only in your browser and is sent only to the provider you chose. On this path, the content you ask about goes directly from your browser to that provider under your agreement with them. It does not pass through and is not stored on Deplo servers. Deplo records only that your plan includes BYOK, never your key or your prompts.

• To provide dependency analysis, Explain, Investigate, Generate, and (where enabled) Records Doctor
• To cache analysis results so repeated queries are faster and cheaper
• To enforce billing, tier limits, and per-workspace AI budgets
• To send transactional emails (password reset, billing, alerts you've configured)
• To improve the service through aggregate, non-identifying analytics

We do not sell your data. We do not use your data for advertising. We do not use your prompts, your metadata, or your record snapshots to train any AI model, ours or anyone else's.

When you create a shareable link, anyone with that link can view the underlying analysis. Share links now expire by default 30 days after creation. Org name and instance URL are never exposed; public viewers see a generic "Customer Org" label. Raw dependency lists are hidden by default; you can explicitly opt in to expose them at share-creation time. Every view is logged (with a one-way hash of the viewer's IP, never the raw IP) so you can audit access. You can revoke a share link at any time; revocation takes effect immediately.

Retention is per data type:

• Account & workspace: retained while the account is active.
• Salesforce connection & encrypted tokens: retained while the connection is active; deleted within 7 days of disconnecting an org.
• Analyses, Investigate runs, change proposals: retained while the account is active; deleted on account closure.
• Records Doctor record snapshots: retained for 90 days after the repair completes, then deleted. The audit-log row remains (without the snapshot payload) for the legal/compliance window.
• AI response cache: 1–7 days depending on call type; auto-expires.
• Audit logs (executions, share-view, billing): 90 days, then archived.
• Monitoring & drift snapshots: 90 days for daily snapshots; aggregated trends retained while the account is active.
• Share-link views: 90 days, then deleted.

You can request deletion of any of the above (or your whole account and all data) by emailing hello@getdeplo.com. We will confirm receipt within 2 business days and complete the deletion within 30 days.

All data is encrypted in transit (TLS 1.2+). Salesforce tokens and Connected App secrets are encrypted at rest using AES-256-GCM with a server-managed key. Passwords are hashed with bcrypt (cost factor 12). Records Doctor execution paths are gated by three independent opt-ins and every executed action is replayable from the audit log. Public share endpoints anonymize org identifiers and never expose instance URLs.

We use the following processors. Each is bound by their own privacy policy and we minimise the data sent to each.

• Supabase: PostgreSQL database hosting (encrypted at rest, in transit).
• Render: backend application hosting.
• Vercel: frontend hosting.
• Anthropic: Claude API for impact summaries, Explain, Investigate, Generate, Suggest, and Records Doctor planning (see §3).
• Resend: transactional email delivery (password reset, alerts, billing).
• Stripe: payment processing. We never see, store, or transmit raw card numbers.
• Sentry: error tracking (stack traces with PII scrubbed before send; also receives the opt-in browser-extension error reports described in §2, scrubbed of all org-identifying data).
• PostHog: product analytics (event names + workspace IDs, no record data).

You may request access to, correction of, export of, or deletion of your personal data at any time. You can download a full export of your workspace's data (analyses, orgs, and configurations, with secrets redacted) yourself from Settings → Data & retention. For correction or deletion, email hello@getdeplo.com or submit a deletion request from the same Settings page. We will confirm receipt within 2 business days and complete the request within 30 days. EU/UK users have the additional rights of GDPR Articles 15–22; California residents have the rights described in the CCPA. We honour both.

We may update this policy from time to time. Material changes (anything that changes what we collect, what we send to processors, or how long we retain it) will be communicated by email at least 14 days before they take effect. Continued use of Deplo after changes take effect constitutes acceptance.

Questions about this policy, requests under it, or security disclosures? Email us at hello@getdeplo.com.