Salesforce v1

Overview

The Salesforce integration adds a native SparkVault Files panel to every Account, Contact, Opportunity, and Case record page in your org. Files uploaded from a record are encrypted via Forge with AES-256-GCM, stored as ingots in the SparkVault vault you choose at install time, and organized automatically into a dedicated folder per CRM record. Salesforce never holds the file contents, only the panel.

Key Features

• SparkVault Files panel on CRM records: native Lightning panel on Account, Contact, Opportunity, and Case pages
• Triple Zero-Trust encryption via Forge: files encrypted with AES-256-GCM using keys derived from your vault's key hierarchy
• Folder-per-record organization: files auto-organized by CRM object type and record ID, no manual folder management
• Vault unseal via VMK or DVAK: each user unlocks the vault with their own key
• Upload, download, and delete from Salesforce: manage record files without leaving the CRM

How It Works

Folder Organization

Every record maps to one vault folder, named by object type and record ID. Folders are created lazily on first upload, so records without files add nothing to your vault.

Installation

Installation has two halves: the SparkVault managed package inside your Salesforce org, and the OAuth connection that binds the org to your SparkVault account and a vault you own.

In Salesforce

1. Install the SparkVault managed package in your org
2. Assign the SparkVault User permission set to users who need the Files panel
3. Add the SparkVault Files panel to Account, Contact, Opportunity, and Case record pages via Lightning App Builder

In SparkVault

1. Sign in and open Integrations in the SparkVault dashboard
2. Click "Connect Salesforce"; you are redirected to Salesforce to authorize the connection (only the openid scope is requested)
3. Choose which vault Salesforce CRM files will be stored in; the vault must belong to you, which SparkVault verifies server-side
4. You are redirected back to SparkVault with the installation confirmed, and the panel becomes active for your org

Refreshing the Connection

If the connection needs to be re-authorized (for example after the panel reports "Reconnect SparkVault"), use Refresh Connection on the Integrations page. Re-authorization keeps the bound vault and must target the same Salesforce org; connecting a different org is rejected with "Disconnect first to connect a new org" so the original org-to-account mapping is never silently orphaned.

Using the Files Panel

The panel is a native Lightning Web Component: no iframes for browsing, no third-party UI. It lists each file's name, size, and upload date with per-row Download and Delete actions.

Unsealing the Vault

A sealed vault shows an unlock prompt. The user enters their Vault Master Key (VMK) or a Delegated Vault Access Key (DVAK); the key unlocks the vault for the session and is then discarded. It is never saved in the browser or stored on SparkVault servers. Each Salesforce user unseals for themselves: one user's unlocked session is never shared with the rest of the org, and vault sessions expire after one hour, after which the panel prompts for the key again.

Uploading

Upload opens the embedded SparkVault upload widget in an in-panel modal. The vault and folder ride in the widget URL, while the short-lived vault access token is handed to the widget via postMessage, never in a URL. Files stream to Forge and are encrypted before storage; when the upload completes, the panel refreshes the file list automatically.

Panel States

Security Model

• Caller authentication (session bearer verified against the installed org): every panel request carries the current Salesforce user's session bearer token. SparkVault validates that token against the installed org's own /services/oauth2/userinfo endpoint and rejects the request unless the returned organization ID matches the installation. The org ID in the request body identifies the tenant but is never trusted as authentication.
• Record-level access checks: before listing, uploading, downloading, or deleting, SparkVault confirms the calling user can actually see the record by querying Salesforce with the user's own session. Object types are allow-listed (Account, Contact, Opportunity, Case) and record IDs must match the strict 15/18-character Salesforce ID format, re-validated at the query site. The packaged Apex controller additionally performs user-mode record checks before any callout.
• Per-user vault sessions: unsealing mints a Vault Access Token stored per verified Salesforce user. A user who has not unsealed the vault cannot reuse another user's unlocked session.
• Per-record isolation: download and delete verify that the requested file actually lives in that record's folder. A file ID alone is never sufficient to reach a file attached to a different record.
• Vault ownership verified at install: the OAuth callback re-checks the selected vault against the installing user's own SparkVault session, so an installation can never bind to someone else's vault.
• Keys are never stored: the VMK or DVAK is used to unseal and then discarded: not written to disk, not stored on SparkVault servers, not saved in the browser.
• No Salesforce tokens retained: after the openid-scoped OAuth exchange, SparkVault keeps the org ID, instance URL, bound vault, and its own SparkVault credential for the account: no Salesforce access or refresh tokens.
• Direct Forge streaming: file bytes stream between the browser and Forge. They are never proxied through the panel, the Apex controller, or Salesforce.
• Explicit CSP allow list: the managed package trusts exactly api.sparkvault.com, app.sparkvault.com, and files.sv, no wildcard domains.

API Endpoints

The integration is installed and managed from the SparkVault dashboard, and the Files panel talks to SparkVault on your behalf. The one endpoint you may want to call programmatically is uninstall.

# Authenticate with a session JWT...
curl -X DELETE 'https://api.sparkvault.com/v1/apps/salesforce/uninstall' \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

# ...or with an API key
curl -X DELETE 'https://api.sparkvault.com/v1/apps/salesforce/uninstall' \
  -H "X-API-Key: YOUR_API_KEY"

{
  "uninstalled": true,
  "account_id": "acc_1234567890",
  "org_id": "00Dxx0000001gPLEAY"
}

Internal Endpoints

The following endpoints are called by the SparkVault Files panel (through its Apex controller) and by the SparkVault dashboard during installation. They are documented here for transparency but are not intended to be called directly by your application.

Uninstall Behavior

There are two ways to disconnect, and both end at the same place:

• From SparkVault: click Disconnect on the Integrations page, or call DELETE /v1/apps/salesforce/uninstall.
• From Salesforce: uninstalling the managed package notifies SparkVault via a session-verified webhook, which removes the installation.

Pricing

Free to install. Standard vault storage and transfer pricing applies. The integration itself adds no per-file or per-seat charge.

Best Practices

• Use a dedicated vault for CRM files: binding the integration to its own vault keeps access, capacity, and audit review simple, and disconnecting never touches your other vaults.
• Issue DVAKs instead of sharing the VMK: give each team member a Delegated Vault Access Key so they unseal with their own revocable credential rather than the vault's master key.
• Expect re-unseal after an hour: vault sessions are deliberately short-lived; the panel will prompt for the key again once a session expires.
• Scope the permission set: assign the SparkVault User permission set only to users who need the Files panel. Record-level checks still apply, but least privilege starts in Salesforce.

Get Started

Connect your Salesforce org and put encrypted file storage on every CRM record.