Salesforce v1

Overview

The Salesforce integration adds a native SparkVault Files panel to every Account, Contact, Opportunity, and Case record page in your org. Files uploaded from a record are encrypted via Forge with AES-256-GCM, stored as ingots in the SparkVault vault you choose at install time, and organized automatically into a dedicated folder per CRM record. Salesforce never holds the file contents, only the panel.

Key Features

• SparkVault Files panel on CRM records: native Lightning panel on Account, Contact, Opportunity, and Case pages
• Triple Zero-Trust encryption via Forge: files encrypted with AES-256-GCM using keys derived from your vault's key hierarchy
• Folder-per-record organization: files auto-organized by CRM object type and record ID, no manual folder management
• Vault unseal via VMK or DVAK: each user unlocks the vault with their own key
• Download and delete from Salesforce, upload in SparkVault: manage record files from the record; an upload opens the record's folder in SparkVault in a new tab

How It Works

Folder Organization

Every record maps to one vault folder, named by object type and record ID. Folders are created lazily on first upload, so records without files add nothing to your vault.

Installation

Installation has two halves: the SparkVault managed package inside your Salesforce org, and the OAuth connection that binds the org to your SparkVault account and a vault you own.

In Salesforce

1. Install version 1.8 of the SparkVault managed package in your org, or update an earlier installation to it
2. Assign the SparkVault User permission set to users who need the Files panel
3. Add the SparkVault Files panel to Account, Contact, Opportunity, and Case record pages via Lightning App Builder

In SparkVault

1. Sign in and open Integrations in the SparkVault dashboard
2. Click "Connect Salesforce"; you are redirected to Salesforce to authorize the connection (only the openid scope is requested)
3. Choose which vault Salesforce CRM files will be stored in; the vault must belong to you, which SparkVault verifies server-side
4. You are redirected back to SparkVault with the installation confirmed, and the panel becomes active for your org

Refreshing the Connection

If the connection needs to be re-authorized (for example after the panel reports "Reconnect SparkVault"), use Refresh Connection on the Integrations page. Re-authorization keeps the bound vault and must target the same Salesforce org; connecting a different org is rejected with "Disconnect first to connect a new org" so the original org-to-account mapping is never silently orphaned.

Using the Files Panel

The panel is a native Lightning Web Component: no iframes, no third-party UI. It lists each file's name, size, and upload date with per-row Download and Delete actions.

Unsealing the Vault

A sealed vault shows an unlock prompt. The user enters their Vault Master Key (VMK) or a Delegated Vault Access Key (DVAK); the key unlocks the vault for the session and is then discarded. The panel never saves it in the browser, and SparkVault never stores it on its servers. Each Salesforce user unseals for themselves: one user's unlocked session is never shared with the rest of the org, and vault sessions expire after one hour, after which the panel prompts for the key again.

Uploading

Upload in SparkVault opens the SparkVault upload page for the record's folder in a new tab. The user signs in to SparkVault there if they are not already signed in, unseals the vault, and uploads; the record's folder is created with the first file. Files stream to Forge and are encrypted before storage. Back in Salesforce, Refresh lists the new files.

Panel States

Security Model

• Caller authentication (session bearer verified against the installed org): every panel request carries the current Salesforce user's session bearer token. SparkVault validates that token against the installed org's own /services/oauth2/userinfo endpoint and rejects the request unless the returned organization ID matches the installation. The org ID in the request body identifies the tenant but is never trusted as authentication. A request without a session token is refused before SparkVault looks the org up, and an org with no active installation is refused exactly as an invalid session is, so a caller cannot learn which orgs have installed the app.
• Record-level access checks: before listing, downloading, or deleting, SparkVault confirms the calling user can actually see the record by querying Salesforce with the user's own session. Object types are allow-listed (Account, Contact, Opportunity, Case) and record IDs must match the strict 15/18-character Salesforce ID format, re-validated at the query site. The package's Apex controller additionally performs user-mode record checks before any callout.
• Per-user vault sessions: unsealing mints a Vault Access Token stored per verified Salesforce user. A user who has not unsealed the vault cannot reuse another user's unlocked session.
• Per-record isolation: download and delete verify that the requested file actually lives in that record's folder. A file ID alone is never sufficient to reach a file attached to a different record.
• Vault ownership verified at install: the OAuth callback re-checks the selected vault against the installing user's own SparkVault session, so an installation can never bind to someone else's vault.
• Keys are never stored: the VMK or DVAK is used to unseal and then discarded: not written to disk, not stored on SparkVault servers, not saved in the browser. Whenever it loads, the panel removes any key a version before 1.8 saved in the browser (see Unsealing the Vault).
• No Salesforce tokens retained: after the openid-scoped OAuth exchange, SparkVault keeps the org ID, instance URL, bound vault, and its own SparkVault credential for the account: no Salesforce access or refresh tokens.
• Direct Forge streaming: file bytes stream between the browser and Forge. They are never proxied through the panel, the Apex controller, or Salesforce.
• Explicit CSP allow list: the package declares exactly two trusted sites, api.sparkvault.com for its calls and app.sparkvault.com for images, no wildcard domains, and the panel frames nothing. Versions before 1.8 declared more: every one also trusted app.sparkvault.com for calls and frames, versions 1.1 to 1.7 the wildcard https://*.sparkvault.com for calls, frames, and images, and versions 1.6 and 1.7 https://files.sv as a frame source. After updating from an earlier version, check your org's trusted URLs in Salesforce Setup and remove any SparkVault entry beyond those two.

API Endpoints

The integration is installed and managed from the SparkVault dashboard, and the Files panel talks to SparkVault on your behalf. The one endpoint you may want to call programmatically is uninstall.

curl -X DELETE 'https://api.sparkvault.com/v1/apps/salesforce/uninstall' \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

{
  "uninstalled": true,
  "account_id": "acc_1234567890",
  "org_id": "00Dxx0000001gPLEAY"
}

Internal Endpoints

The following endpoints are called by the SparkVault Files panel (through its Apex controller) and by the SparkVault dashboard during installation. They are documented here for transparency but are not intended to be called directly by your application.

Uninstall Behavior

Disconnect from SparkVault: a SparkVault admin or owner clicks Disconnect on the Integrations page, or calls DELETE /v1/apps/salesforce/uninstall. Uninstalling the managed package in Salesforce does not disconnect SparkVault: a Salesforce session proves only that its user belongs to the org, not the authority to disconnect the org for every user.

Pricing

Free to install. Standard vault storage and transfer pricing applies. The integration itself adds no per-file or per-seat charge.

Best Practices

• Use a dedicated vault for CRM files: binding the integration to its own vault keeps access, capacity, and audit review simple, and disconnecting never touches your other vaults.
• Issue DVAKs instead of sharing the VMK: give each team member a Delegated Vault Access Key so they unseal with their own revocable credential rather than the vault's master key.
• Expect re-unseal after an hour: vault sessions are deliberately short-lived; the panel will prompt for the key again once a session expires.
• Scope the permission set: assign the SparkVault User permission set only to users who need the Files panel. Record-level checks still apply, but least privilege starts in Salesforce.

Get Started

Connect your Salesforce org and put encrypted file storage on every CRM record.