Skip to main content

Security architecture

TrueSign is designed fail-closed: in doubt, the system refuses rather than accepts. This page summarizes the architectural guarantees — implementation details are part of the AppExchange Security Review submission.

Authenticated, closed-by-default webhook​

The entry point for Yousign notifications is public by necessity — so it is treated as hostile by default:

  • every notification must carry an HMAC-SHA256 signature, verified in constant time;
  • no secret configured = notification rejected — the degraded mode only exists in sandbox, never in production;
  • a forged notification can neither change a status nor trigger a writeback;
  • error responses never reveal internal information.

Protected secrets​

The Yousign API key and the webhook secret are stored in the package's protected metadata: once installed, they cannot be read from Setup, the API, or any code outside the package — including by org administrators.

The configuration screen never returns secrets in clear text: masked display (•••••••• + 4 characters), and the stored value is only reused server-side. Access to the configuration is restricted to the administrator permission set.

Access rights (CRUD/FLS)​

  • On read and on write alike, operations triggered from the interface run in user mode: the Salesforce platform itself enforces the user's actual rights — object by object, field by field — not a home-grown check. A field a user has no right to is neither shown to them nor writable by them.
  • State fields (status, counters, signed document) remain driven exclusively by the package through the authenticated webhook: nobody can hand-set a request to "Signed".
  • The Salesforce sharing model applies everywhere: each user only sees the requests sharing grants them.

Validated inputs​

Configuration parameters that could influence internal queries are validated by allow-list — covering the contexts where mere escaping is not enough.

Exported documents​

A generated file (CSV, HTML) is made to be distributed and opened elsewhere: it is an attack surface in its own right, distinct from the site's pages. Two protections apply to every generation:

  • CSV formula injection (CWE-1236) — a cell starting with =, +, - or @ is executed by Excel, LibreOffice and Google Sheets. Since values come from records, potentially from a third party, they are neutralized (leading apostrophe, OWASP recommendation) — without breaking legitimate negative amounts.
  • HTML markup injection — every merged value is escaped. The model body may contain markup (the admin writes it); values, never.

A generated file is never rendered by a public-site page: it is stored then downloaded.

Least privilege​

Ten permission sets graduate access — four exclusive roles plus stackable options, detailed in User management. The public surface (webhook, weSign signing pages) has its own dedicated permission set, TES_Guest: only the necessary entry points, no delete, append-only logs. The kill switch shuts the integration down in one move.

Traceability​

Every exchange with Yousign is journaled (level, timestamp, return code) with configurable retention, and every request carries its timestamped audit trail — see Logs & audit.

AppExchange Security Review

These mechanisms are documented in detail in the submission to Salesforce's Security Review, along with the static and dynamic analysis reports.

An external signer's journey​

The token is the only credential: an external signer has no Salesforce licence, so no permission can be granted to them in the usual sense. Access rests on a random, time-limited token, a one-time code whose attempts are counted, and — if the template requires it — an access code shared out of band.

The document is only revealed after authentication: while the code is pending, no link to the file is produced. That link is itself time-boxed, so a forwarded invitation does not grant perpetual access.