Skip to main content

Security & Compliance

Best practices for securing your RDN integration.

Authentication Security​

Auth Token Management​

Your RDN Auth Token is like a password - protect it!

✅ DO:

  • Store tokens in Custom Metadata Types (not visible in logs)
  • Rotate tokens every 90 days
  • Use strong, randomly-generated tokens
  • Limit who can view/edit metadata (Admins only)

❌ DON'T:

  • Share tokens via email
  • Commit tokens to version control
  • Use tokens in debug logs
  • Give access to non-admins

Token Rotation Process​

1. Generate new token in RDN dashboard
2. Test new token in Sandbox first
3. Update token in RDN API Provider metadata
4. Verify tests pass with new token
5. Deactivate old token in RDN
6. Document in change management system

Compromised Token Response​

If you suspect a token is compromised:

1. IMMEDIATELY deactivate token in RDN
2. Generate a new token
3. Update RDN API Provider in Salesforce
4. Run test to verify new token works
5. Contact RDN support to verify no unauthorized use
6. Document the incident

Data Access & Privacy​

Field-Level Security​

Only configure fields in RDN integration that are necessary:

✅ Recommended:

  • Job Title → Job Role mapping
  • Country → Region mapping
  • Industry → Category mapping

❌ Avoid:

  • Social Security Numbers
  • Credit card numbers
  • Passwords
  • Internal confidential data

Data Minimization​

Send only necessary fields to RDN API:

Configure RDN API Input Field records for:
✅ Job Title (needed for categorization)
✅ Country (needed for localization)
❌ Phone (not needed, creates privacy risk)
❌ Email (avoid unless necessary)

PII (Personally Identifiable Information) Handling​

Sensitive fields that need extra care:

FieldHandling
EmailOnly send via HTTPS (always encrypted)
PhoneOnly if necessary for integration
NameCan send if part of enrichment
AddressOnly with explicit consent
Government IDNEVER send

Policy:

  • Sensitive fields only sent via HTTPS (always enabled)
  • All data transmitted with TLS 1.2+ encryption
  • No sensitive data stored in logs
  • Data retention follows company policy

Network Security​

HTTPS Requirements​

All API calls MUST use HTTPS:

✅ Correct:

https://api.rdn.io/addScore

❌ Never:

http://api.rdn.io/addScore

Remote Site Settings​

Configure remote sites with security-first approach:

Remote Site Name: RDN_API_Prod
Remote Site URL: https://api.rdn.io
Active: ✓ Checked
Disable Protocol Security: ☐ Unchecked

API Endpoint Validation​

Only allow specific RDN endpoints:

✅ https://api.rdn.io (verified)
✅ https://prod-api.rdn.io (verified)
❌ https://unknown-api.com (suspicious)
❌ https://api.rdn.io:8080 (non-standard port)

Access Control​

Role-Based Access​

Limit who can modify integration:

RolePermissionsRationale
System AdminFull accessManage configuration
Integration AdminRead/Write metadataDay-to-day operations
DevelopersRead onlyTroubleshooting
Standard UsersNonePrivacy protection

Metadata Permissions​

Restrict access to sensitive metadata:

  1. RDN API Provider → Admins only (contains auth tokens)
  2. RDN API Configuration → Admins/Integration team
  3. RDN API Input Field → Admins/Integration team
  4. RDN Field Update → Admins/Integration team

Audit Trail​

Monitor who changes integration configuration:

Setup → Security Controls → Audit Trail

Review for:

  • Unauthorized changes to metadata
  • New remote sites added
  • Trigger modifications
  • API configuration updates

Compliance Considerations​

Data Residency​

Confirm with RDN:

  • Where is data stored?
  • Is data encrypted at rest?
  • What is data retention policy?
  • Are backups encrypted?

GDPR Compliance​

If processing EU resident data:

✅ Requirements:

  • Have data processing agreement with RDN
  • Document legal basis for data processing
  • Implement data subject rights (access, deletion)
  • Report any data breaches within 72 hours
  • Conduct data protection impact assessment

CCPA Compliance​

If processing California resident data:

✅ Requirements:

  • Disclose data sharing with RDN
  • Honor "Do Not Sell" requests
  • Document retention/deletion procedures
  • Maintain data access logs

SOC 2 Type II​

If your company has SOC 2 Type II certification:

✅ Verify RDN has:

  • SOC 2 Type II certification
  • Annual security audits
  • Incident response procedures
  • Access control policies

HIPAA (if applicable)​

If processing healthcare data:

⚠️ RDN HIPAA Readiness:

  • Confirm RDN is HIPAA compliant
  • Ensure Business Associate Agreement (BAA) is in place
  • Only send HIPAA-minimum data
  • Document all data flows

Monitoring & Alerting​

Key Metrics to Monitor​

1. Failed API calls (check daily)
2. Auth token usage (verify tokens are valid)
3. Unexpected fields being sent (check mapping changes)
4. API response times (identify slow integrations)
5. Error rates (monitor for spikes)

Set Up Alerts​

Email Notifications:

RDN API Provider → Get Notified field
integration-alerts@company.com

Dashboard Monitoring:

Create Salesforce dashboard with:
- API call volume (daily)
- Error rate (%)
- Processing time (avg)
- Failed records (count)

Review Logs​

Regularly review debug logs for:

  1. Unauthorized access attempts
  2. Unusual API call patterns
  3. Failed authentication
  4. Data mapping errors

Incident Response​

Data Breach Response​

If you suspect unauthorized access to data:

1. IMMEDIATELY notify RDN support
2. Disable integration metadata (set Is_Active = false)
3. Generate new auth token
4. Document incident details and timeline
5. Notify your security team
6. Assess scope of potential data exposure
7. Notify affected users if required
8. File incident report

Unauthorized API Call​

If you see unexpected API calls in logs:

1. Check RDN logs for source of call
2. Review debug logs for details
3. Verify no credentials were compromised
4. Check if trigger was modified
5. Review access logs for metadata changes
6. Document findings
7. Report to security team if suspicious

Quarterly Security Review​

Schedule quarterly reviews:

Checklist​

  • Review auth token rotation schedule
  • Check access logs for unauthorized changes
  • Verify field mappings are still necessary
  • Review error logs for suspicious patterns
  • Confirm RDN maintains compliance certifications
  • Update data processing agreements if needed
  • Test incident response procedures
  • Document security findings and improvements

Best Practices Summary​

PracticeBenefit
Rotate tokens quarterlyReduces exposure if compromised
Minimize data fieldsReduces privacy/compliance risk
Use HTTPS onlyProtects data in transit
Monitor logsDetects security issues
Limit accessPrevents unauthorized changes
Document everythingEnables audit trail
Annual auditsEnsures ongoing compliance

Support & Questions​

For security-related questions:

Next Steps​