Sub-Processors
Last updated: June 2026 (v1.17.0)
SFDevTools uses the following third-party sub-processors to deliver our service. A sub-processor is any entity that processes customer data on our behalf.
Infrastructure Sub-Processors
| Sub-Processor | Function | Location | Optional |
|---|---|---|---|
| Cloudflare | Hosts the web application frontend (app.sfdevtools.com) | USA | No |
| Railway | Hosts the backend API, PostgreSQL database, and Redis cache (api.sfdevtools.com) | USA | No |
| Vercel | Static site delivery for the landing page (sfdevtools.com) | USA | No |
| Resend | Transactional email delivery for authentication magic links | USA | No |
| PostHog | Privacy-first product analytics (fully anonymous usage events) | USA | No |
Data Processing Sub-Processors
| Sub-Processor | Function | Location | Optional |
|---|---|---|---|
| Salesforce | Customer-initiated OAuth connections to Salesforce orgs. API calls are proxied through our backend on behalf of the user. | USA | N/A - user-initiated |
| Anthropic | Powers Claude models for the optional AI Agent chat feature. Receives your prompts and read-only tool-call results when this model is selected. | USA | Yes - only used if you use the AI Agent |
| Google (Gemini) | Powers Gemini models for the optional AI Agent chat feature, including Salesforce documentation search. Receives your prompts and read-only tool-call results when this model is selected. | USA | Yes - only used if you use the AI Agent |
What Data Is Processed
- Cloudflare: Hosts the frontend as static assets and application bundles served via Cloudflare Pages. No customer data is stored.
- Railway: Hosts the backend API, database, and cache infrastructure. The backend API processes all requests including Salesforce API proxying. The PostgreSQL database stores user accounts, encrypted Salesforce OAuth tokens (AES-256-GCM), query history, session state, dashboard preferences, AI Agent conversations and Artifacts, and AI Dashboard layouts, field bindings, and version history. The Redis cache stores ephemeral performance data (tokens 90 min TTL, SOQL results user-controlled TTL, metadata describes 1–12 hr TTL).
- Vercel: Serves the landing page static assets. No customer data is stored.
- Resend: Receives your email address solely to deliver authentication magic link emails. No other data is shared.
- PostHog: Receives fully anonymous usage events (page views, feature interactions). No user identifiers, email addresses, or personal data are ever sent. Events use
person_profiles: "never"— PostHog cannot link events to individuals. - Salesforce: Your Salesforce org data is accessed only through authenticated API calls you initiate. We do not store query results beyond optional caching.
- Anthropic / Google (Gemini): If you use the AI Agent or AI Dashboards, your chat prompts and the results of read-only tool calls the agent makes on your behalf (e.g. query results, schema, permissions) are sent to your selected model provider to generate a response. These providers process this data under their own terms and do not receive your Salesforce credentials.
Changes to This List
We will update this page when sub-processors are added or removed. For questions, contact us at support@sfdevtools.com.