This article covers the Precursive PSA platform: the Precursive managed package running inside your Salesforce org.

Precursive AI is a separate managed package and works differently. When it's enabled, the configured context is sent outside Salesforce to AI sub-processors (an AI gateway and Microsoft Azure OpenAI) to generate insights. Precursive AI is off by default and must be enabled and configured by an admin. For how Precursive AI processes data, where it's processed, its sub-processors, retention and controls, see Precursive AI Data Privacy and Security.

The PSA platform includes Precursive MCP, which lets users connect their own AI assistant to Precursive. Precursive MCP is off until an admin sets it up. When it is on, data that a user requests leaves Salesforce for the assistant of that user. See Precursive MCP security and data privacy.

Unless stated otherwise, everything below applies to the PSA platform.

Architecture and shared responsibility

The Precursive PSA platform runs inside your Salesforce org. The following sections describe where your data is stored and who is responsible for each part of its security.

Platform architecture and data residency

Precursive is deployed as a managed package within each customer’s Salesforce Org. The Precursive PSA platform uses no external services, databases, or infrastructure operated by Precursive to store or process customer data. This design ensures:

• All data remains in the customer’s Salesforce instance.

• Data location and residency are determined by the customer’s Salesforce region.

• For the PSA platform, no processing occurs outside the Salesforce platform, unless your users connect their own AI assistant through Precursive MCP.

For Salesforce hosting practices, replication, and resilience, refer to:

• Salesforce Trust Site

• Salesforce Security Center

Shared responsibility model

Precursive operates on the Salesforce Platform, where responsibility for security is shared between the customer, Precursive, and Salesforce. Each party plays a distinct role in maintaining the confidentiality, integrity, and availability of services.

• Customer: You control the configuration and access within your Salesforce Org. This includes user permissions, customizations, data entry, and integration with other systems. You are responsible for managing user access, applying security best practices, and ensuring backups of your Salesforce and Precursive data. We recommend reviewing Salesforce Security Best Practices.

• Precursive: Precursive are responsible for the design, development, and support of our applications. Our products are built securely to meet Salesforce’s AppExchange Security Review standards, and undergo annual third-party web application security assessments. We also maintain ISO/IEC 27001 certification.

• Salesforce: As the underlying infrastructure provider, Salesforce is responsible for operating the platform. This includes managing the network, physical data centers, operating systems, and the core security architecture (such as encryption, identity services, and disaster recovery).

This shared responsibility model enables flexibility, security, and performance, while ensuring that all PSA platform data and operations stay within your trusted Salesforce environment.

Precursive MCP

Precursive MCP lets your users connect an AI assistant that your organization has already approved, such as Claude or Microsoft 365 Copilot, to Precursive. It is a Salesforce Hosted MCP server created in your own org. Precursive operates no infrastructure for it and supplies no AI model. Each user signs in with their own Salesforce login, and every request runs with their permissions. Any data that the user can read can be returned to their AI assistant, under your agreement with that AI vendor. For how it works, what it costs, and the controls available, see Precursive MCP security and data privacy.

Identity and access management

You control who can access Precursive in your org, and when Precursive personnel can access your data.

User access

Precursive is built to align with Salesforce's powerful identity and access management model. Since Precursive runs entirely within your Salesforce Org, you retain complete control over who can access the application and what they can do.

Customers manage users, roles, and permissions directly using Salesforce's native tools, which include:

• Single Sign-On (SSO) integration with corporate identity providers

• Multi-Factor Authentication (MFA) enforcement

• Role- and profile-based access controls through permission sets

• Session security, IP restrictions, and audit logging via Login History and Setup Audit Trail

All user provisioning, authentication, and access monitoring take place within your existing Salesforce environment, allowing you to enforce consistent policies across all applications, including Precursive.

Precursive access to customer data

Precursive does not have access to any customer data by default. Access is only possible when the customer explicitly grants it. There are two methods:

1. Grant Login Access: Customers can authorize a Precursive support representative to log in temporarily using the Salesforce "Grant Account Login Access" feature. This access is time-bound, auditable, and reflects the permissions of the user granting access.

2. Provisioned User Account: In some cases, such as implementations, customers may create a Salesforce user for a Precursive consultant. This account is fully under customer control and can be disabled at any time.

All access activity is logged and reviewed by the customer. Precursive does not retain administrative access beyond the access window.

Data security and privacy

The following sections describe how Precursive handles personal data, where it can be accessed from, how it is encrypted, and how you can export it.

Handling of personal data (PII)

The Precursive application may process personal data as entered by users, such as names, email addresses, and job titles. This data remains entirely within the customer’s Salesforce Org. Precursive:

• Does not extract PII for analytics, monitoring, or support.

• Does not transmit personal data to external systems from the PSA platform. If Precursive AI is enabled, configured context is sent to AI sub-processors, and fields tagged with Salesforce compliance categories (including PII) are excluded by default. See Precursive AI Data Privacy and Security. If your users connect an AI assistant through Precursive MCP, the assistant receives the data that each user requests and can read. See Precursive MCP security and data privacy.

• Does not access data unless granted access by the customer.

Precursive supports customer compliance with GDPR, UK Data Protection Act, and CCPA. Personal data processing is governed by our Privacy Policy and Data Processing Agreement.

International data transfers

Precursive operates globally, and customers may use its services from any location worldwide. The Precursive application is deployed inside your Salesforce Org, and therefore customer data—including any personal data—is not transferred or accessed by Precursive unless the customer explicitly grants access for support or implementation purposes.

When such access is provided, it may be fulfilled by Precursive personnel located in the United Kingdom, United States, or European Union. In these cases, access is time-bound, auditable, and always under the customer's control.

Precursive adheres to applicable data transfer requirements and safeguards, including the use of Standard Contractual Clauses where necessary. Customers are encouraged to evaluate their own global data access policies as part of their Salesforce governance.

Learn more from the Salesforce Privacy Overview

Encryption

Precursive inherits Salesforce's encryption protocols, including:

• Encryption in Transit: All communications are secured using TLS 1.2 or higher.

• Encryption at Rest: All data is stored encrypted on Salesforce infrastructure.

• Field-Level Encryption: Customers using Salesforce Shield can apply additional encryption at the field level. Deterministic or probabilistic encryption methods can be chosen based on compatibility with filtering and search.

The availability of specific encryption features, such as Platform Encryption and Shield capabilities, depends on the customer’s Salesforce edition and licensing agreement. Customers should review their Salesforce edition and licensing agreement to understand which encryption options, such as Shield and Platform Encryption, are included or can be enabled in their environment. Salesforce Platform Encryption Overview.

Data portability and customer ownership

All data created by or through Precursive is owned by the customer. Customers can:

• Export data via reports, dashboards, Data Loader, or API.

• Migrate data using ETL tools or integrations.

• Connect to data warehouses and analytics platforms using APIs or integration middleware.

• Configure retention policies using native Salesforce features.

Precursive does not limit or restrict access to customer data at any time.

Application security

The following sections describe how Precursive develops the PSA platform and how its security is reviewed and tested.

Secure development lifecycle

Precursive follows a secure development lifecycle (SDLC) modeled on recognized industry standards. Security is considered at every stage of the development process—from design through to deployment and maintenance. Key practices include:

• Static code analysis on every build: Automated tools scan code for vulnerabilities and weaknesses during each build to detect issues early.

• Code reviews and version control: All code changes are reviewed by experienced developers to identify potential security flaws, supported by robust version control workflows.

• Open source vulnerability scanning: Third-party libraries and dependencies are continuously monitored for known vulnerabilities using industry-standard scanning tools.

• Secure deployment pipelines: Builds are validated and deployed through hardened pipelines that include security checks, audit logging, and access controls.

These controls ensure that security is integrated into development practices and that risks are minimized before code reaches customer environments.

Security review and penetration testing

Every version of the Precursive PSA package submitted to the Salesforce AppExchange must pass Salesforce’s mandatory AppExchange Security Review.

In addition, Precursive performs annual web application security assessments of the PSA platform using OWASP methodologies. These tests validate the product’s behavior within the Salesforce platform—they do not include infrastructure or network testing, which remains the responsibility of Salesforce.

Logging, monitoring, and incident response

Logging and monitoring use the native features of Salesforce, and Precursive has a formal process for responding to security incidents.

Logging and monitoring

Precursive applications rely on Salesforce for core logging, auditing, and event monitoring capabilities. Customers can configure login history tracking, field audit trails, and automated alerts using Salesforce’s native features. For advanced monitoring, Salesforce Shield enables event monitoring at scale. The PSA platform does not store or process log data outside of the customer’s environment. Precursive AI’s gateway records usage metrics (no request or response content) for entitlement and routing; see Precursive AI Data Privacy and Security.

Incident response

Precursive has a formal incident response process in place. This ensures that if a security incident occurs, it is handled swiftly and appropriately. The process includes incident classification, internal escalation, customer notification, root cause analysis, and the implementation of corrective actions. Customers are notified promptly in the event of an incident that could impact their data or their use of the platform.

Business continuity and resilience

Salesforce provides platform-level backup and disaster recovery, and you are responsible for backing up your own data.

Backup, archive, and data retention

Because Precursive operates fully within the Salesforce platform, backup responsibilities follow Salesforce's standard data management approach. Salesforce performs regular backups as part of its platform-level disaster recovery and resilience commitments. However, these backups are designed for Salesforce's operational recovery in the event of a major incident—they are not intended for customer-level restoration of accidentally deleted records, field-level changes, or user errors.

To safeguard day-to-day operational data, customers should implement a proactive backup and recovery strategy as part of their broader Salesforce data governance plan. This includes any managed packages, like Precursive, installed within their environment.

Salesforce offers a range of built-in and extensible options to support data backup, including:

• Data Export Wizard

• Third-party backup providers integrated via Salesforce APIs

These tools help ensure critical business data is protected, retrievable, and compliant with organizational and regulatory requirements.

Data export on uninstall

When a Precursive package is uninstalled, Salesforce automatically generates a data export file that includes records related to the managed package. This export is created for the user performing the uninstall and is available for download for a limited time.

To protect critical operational data and meet long-term retention needs, Precursive recommends:

• Backing up Salesforce and Precursive data regularly using the available tools.

• Verifying and testing backup and restore processes to ensure data integrity and recoverability.

Disaster recovery

Salesforce provides built-in disaster recovery through geographically distributed data centers, automatic replication, and failover.

Precursive maintains its own business continuity and disaster recovery plans, designed to ensure the availability of our services and support functions in the event of an issue. If a disruption originates within the Precursive application, we take responsibility for resolving the incident and will activate appropriate response measures while keeping customers informed through established communication channels.

Governance and compliance

The following sections describe how Precursive screens and trains its personnel, which sub-processors are involved, and the certifications that Precursive and Salesforce hold.

Personnel security

All Precursive staff with access to information systems undergo background checks appropriate to their role and jurisdiction. Employment contracts contain confidentiality clauses and security responsibilities. Employees receive onboarding security training, with periodic updates aligned to policy changes and security awareness needs.

Use of sub-processors

The Precursive PSA platform does not use any subprocessors to store or process customer data outside the Salesforce platform. As the application operates fully within the customer's Salesforce Org, Salesforce acts as the primary data processor under the customer's agreement and is considered a subprocessor for the purposes of data hosting and platform services. The application runs entirely within the customer's Salesforce Org. Operational subprocessors used for support or internal services are listed in the Privacy Policy. These subprocessors do not have access to customer Salesforce data.

Precursive AI, if enabled, uses Microsoft (Azure OpenAI) and Portkey as sub-processors. See Precursive AI Data Privacy and Security.

Precursive MCP uses no Precursive sub-processors. The vendor of the AI assistant that your users connect is contracted by your organization and is not a Precursive sub-processor.

Compliance and certifications

Precursive operates a certified ISMS under ISO/IEC 27001:2022. This includes:

• Annual audits

• Statement of Applicability documenting implemented controls

• Ongoing risk assessment and control improvement

Precursive also benefits from Salesforce’s compliance credentials, including:

• ISO 27001, 27017, 27018

• SOC 1/2/3

• PCI-DSS

• HIPAA (with restrictions)

• and more

Salesforce Security and Compliance Site

Report a security concern

If you identify or suspect a security issue related to Precursive, please contact us immediately: support@precursive.com