Swantide is designed with security as a core principle. Understanding what Swantide does and does not access matters for your security review, compliance requirements, and peace of mind.
What Swantide accesses: metadata only, no exceptions
Swantide connects to your Salesforce org via a managed package and accesses metadata only, never record data, no exceptions. This is the absolute boundary, and it applies to every Swantide product (AI Documentation, AI Assistant, AI Admin, Workflows).
What "metadata" covers:
Object definitions: custom objects and standard object customizations.
Field definitions: field names, types, formulas, picklist values, validation rules.
Automation definitions: flows, triggers, workflow rules, process builders.
Apex code: classes, triggers, test classes (code structure, not runtime execution).
Configuration: page layouts, permission sets, profiles, record types.
Reports and dashboards: report and dashboard definitions, not the data they return.
What Swantide does NOT access
Record data: no Account records, Contact records, Opportunity records, or any business data. No exceptions.
Attachments and files: no documents, images, or file uploads from your org's records.
User credentials: no passwords or authentication tokens beyond the initial OAuth connection.
Email content: no email message bodies (Swantide reads email template and email alert metadata, not the messages users send).
Chatter posts: no social or collaboration content.
What "metadata only" means for what Swantide can answer
Because Swantide doesn't read record data, the AI Assistant can answer schema and configuration questions but not data questions:
Question type | Can Swantide answer? | Example |
Schema / configuration | Yes | "What does the Closed Won opportunity stage require?" |
Record-value / data | No | "Which customers are currently in the Negotiation stage?" |
This is a deliberate consequence of the security model, and it is the point: the boundary is what makes the answer to "what can Swantide see?" a short one.
Compliance and certifications
SOC 2 Type II: Swantide has completed a SOC 2 Type II audit, which verifies security controls over an extended period.
Need more detail? Contact your Swantide CSM for the security pack. Swantide maintains a productized security documentation package covering infrastructure, data flow, compliance posture, and the specifics your infosec team will ask about. Request it through your Customer Success contact.
How the connection works
You install the Swantide managed package in your Salesforce org.
A connection user authenticates via OAuth. There are three supported paths: Salesforce admin, standard user with required permissions, or Integration User (API-only license). See How to Connect a Salesforce Org to Swantide for the path picker.
Swantide pulls metadata through the Salesforce Metadata API and Tooling API.
Metadata is processed and stored securely to generate documentation and power the AI Assistant.
Nightly syncs keep the documentation current.
AI Admin: human in the loop
AI Admin, currently in beta, is the one Swantide product that writes to your Salesforce org, and even then every change requires explicit user approval. There is no batch mode, no auto-deploy mode, and no path that bypasses human review.
The AI Admin workflow:
Plan: AI Admin generates a Technical Design Document (TDD) setting out the components it plans to create or modify. Read it before you approve: it is your opportunity to catch anything that is out of scope.
Review: you read the TDD, chat with AI Admin to iterate, and approve when you're satisfied. Multiple TDD versions are supported.
Deploy: you click Deploy all. If a deploy error is recoverable, AI Admin retries and regenerates the metadata, always within the design you approved.
Revert: for a change to an existing component, one click restores the previous version. A task that creates something new has no Revert, so remove those the way you would remove any other component.
Even AI Admin doesn't access record data. It reads your metadata to generate a plan and writes metadata to deploy a plan, but it never reads or modifies the records in your org.
User access controls in Swantide
Swantide provides granular user management:
Owner vs. Admin roles: control who can manage users and org settings.
Per-org permissions: grant users access to specific orgs only.
Deployer access: control who can use AI Admin to deploy changes.
Read-only access: users can view documentation and use the AI Assistant without deployment permissions.
See How to Manage Users and Permissions in Swantide for the full model.
Common security questions
Question | Answer |
Can Swantide see my customer data? | No, metadata only, never record data. No exceptions. |
Can Swantide modify my org? | Only through AI Admin, and every change requires explicit user approval. |
Where is metadata stored? | In Swantide's SOC 2 Type II audited infrastructure. The security pack has the specifics. |
Can I revoke access? | Yes, disconnect the org at any time from Swantide settings. |
Does Swantide work with PHI/PII? | Swantide doesn't read record data from your org, so it doesn't touch PHI or PII held in your records. Anything you paste into a prompt or attach to a conversation is processed as context for that conversation, so treat an attachment the same way you would any other place you share data. |
Sample AI Assistant prompts
"Summarize the access scope of the Swantide connection on this org. What metadata can it see?"
"Open the Data Dictionary, filter to Apex Classes, then ask about specific high-risk classes by name (e.g., AccountTrigger, CaseEscalation): what does each one do?"
"What's the current OAuth grant for the Swantide connection? Tell me when it was authorized and by which user."
Looking for the broad answer to "what touches PII in our org?" That's an org-wide question best answered by browsing the Data Dictionary (filter to Apex Classes, custom objects, and fields) or running an audit through your Salesforce security tooling. The AI Assistant is agentic: it queries your org's metadata with tools on demand rather than pre-loading a fixed handful, and it's your tool for analysis and specific named components; for a complete org-wide inventory, the Data Dictionary is the source of truth, built to return every item.
Tips
Need more detail for your security review? Ask your CSM for the security pack. Send it to your infosec team before they start the review. It answers most of the questions in advance.
Use a dedicated connection account: whichever connection path you pick (admin, standard user, or Integration User), tie it to an account that won't disappear when someone leaves. See How to Connect a Salesforce Org to Swantide.
Revoking access is a one-click operation: disconnect from Org Settings at any time. There's no contractual lock-in around metadata access.