Trust Center

How we protect your org and your data.

Your Salesforce org holds donor, client and financial records your community trusts you with. These are the security standards Alpenglow follows on every engagement.

Our commitments

Four standards behind every project.

One person, one login

We never share credentials. Every consultant works under their own named user in your org.

Least access needed

We ask only for the permissions the work requires, and you can remove our access at any time.

Data stays in Salesforce

We work inside your org and avoid copying constituent data to other places.

Sandbox first

Changes are built and tested in a sandbox before they reach production.

Security standards

The details.

Access and authentication

  • Every consultant uses their own named Salesforce user. We don't share logins with your staff or with each other.
  • Multi-factor authentication is on for every Salesforce org we access, and for our own email, file storage and password manager.
  • Passwords are unique, generated and stored in an encrypted password manager.
  • We request a permission set scoped to the project. System Administrator access is used only when the work truly needs it.
  • At the end of an engagement we ask you to deactivate our users, and we confirm when it's done.

Handling your data

  • We work with your data inside Salesforce wherever possible.
  • When a migration requires exports, files are kept in encrypted storage, shared only with people on the project, and deleted once the migration is verified.
  • We use test or masked records in sandboxes when working with sensitive data such as health or case records.
  • We never use your data for anything other than your project, and we never sell or share it.
  • Our laptops use full-disk encryption, screen locks and automatic security updates.

Building and changing your org

  • New work is built and tested in a sandbox, then deployed to production after your review.
  • Before large data loads or deletions, we take a backup or export so changes can be rolled back.
  • We document every change we make: fields, automation, integrations and permissions.
  • Integrations use dedicated integration users with only the access they need, not a staff member's login.
  • Every project includes a review of sharing settings, profiles and permission sets, so people see only what they should.

Built on Salesforce's security

Your data is hosted by Salesforce, which maintains its own independent security certifications and audits. Details are at trust.salesforce.com. Our job is to configure your org so those protections are used well.

Confidentiality

We're glad to sign your non-disclosure agreement or data protection terms before a project begins. Ask us for our standard confidentiality terms if you don't have your own.

Vendors we use

The services behind our work.

None of these store your Salesforce data unless noted.

Google Workspace
Email, calendar and project files. Encrypted storage for temporary migration files.
Password manager
Encrypted storage for credentials and MFA recovery codes.
Calendly
Scheduling. Stores names and emails of people who book calls.
Fathom
Meeting notes and recordings, only with participants' consent. You can ask us not to record.
Netlify
Hosts this website and receives contact form messages.
Incidents and questions

If something goes wrong, you'll hear from us first.

If we suspect a security issue affecting your org or data, such as a lost device or exposed credential, we'll contact you within 24 hours. We'll tell you what happened, what we've done about it and what you should do.

To report a concern or request our security questionnaire answers, email roger@alpenglowconsulting.com or call 510-410-0720.

Last reviewed November 2026.