14-day trialVulkro Cloud
Enterprise security for code and Salesforce.
One workspace for your team, with Core, Salesforce, or both. Salesforce checks your whole org on a schedule. Code scans your repositories branch by branch and checks every pull request. Your team works one list of issues across both.
Only reads your Salesforce orgs, never changes one. Each scan in a container of its own. We set up your workspace within two business days, with a 14-day trial.
- Two apps, one workspaceSalesforce for your orgs and Core for your code repositories, switched from the app menu.
- Four numbers for your roleThe person reading sees their own four numbers, each with its change since last month.
- What to fix nextThe issues that matter most, with an owner and a fix deadline.
01Two apps, one workspace
Your Salesforce orgs and your code, side by side.
Each app reads its own kind of system the way an attacker would. Both put what they find in the same workspace, for the same team.
Salesforce
Org posture, access, attack paths and Apex code
- The whole org, on a scheduleWho holds which powers, what a guest can reach, connected apps, settings, sensitive fields and the code, production and sandboxes.
- Attack pathsHow someone would get from a public page to your data, step by step, so you fix the step that closes it.
- What changedNew issues, fixed ones and the Setup changes since the previous scan.
Core
Code repositories, branches and quality gates
- Repositories and branchesConnect GitHub, GitLab or Bitbucket with an access token, then choose the branches to track. Another git host works over https too, scanned on a schedule but without webhooks or pull-request checks; servers you host yourself need Business.
- Gates and pull-request checksEvery scan is held against a quality gate, and pull requests get a status, a summary comment and comments on the lines that changed.
- The whole applicationEndpoints and who can call them, data flow, the database, secrets, dependencies and attack paths, for each branch.
02One workspace
One list of issues. A home for every role.
Both apps share the people, their roles, the issues and where alerts go. Each person opens on the view their role needs, and every number links to the issues behind it.
- Closed by the next scanWhen a scan no longer finds an issue, it is marked fixed. If it comes back, it reopens.
- An owner for every issueFrom CODEOWNERS for code and from who last changed a Salesforce component, or assigned by team.
- Approved by a second personA false positive or an accepted risk stays a proposal until someone else approves it.
- A deadline for every fixSet by severity and by how critical the org or repository is. Late ones stand out.
- A home for each roleExecutive, Security, Engineering and Compliance views. Admins choose which one each role opens on.
- Fix deadlinesBy default 15 days for Critical, 30 for High, 90 for Medium and 180 for Low, scaled by how critical each org or repository is.
- Owners, Jira and reportsTeams, automatic assignment and Jira tickets created in bulk. PDF reports and evidence packs for your auditors.
- Alerts where your team worksSlackMicrosoft TeamsJiraPagerDutyGoogle ChatDiscordEmailWebhooks
03What it reads, what it writes
Only reads your orgs. Clear limits on your code.
A tool that holds your weak spots has to be careful with them. Here is exactly what Vulkro Cloud touches, and where your results are kept.
How Vulkro Cloud handles your dataSecurity at VulkroYour workspaceacme.vulkro.com
- Salesforce orgsReads onlySettings, metadata, code, and users and their permissions. Never your business records, and nothing is ever changed.
- Code repositoriesReads codeThe branches you track. Statuses, checks and pull-request comments are written only where you turn them on.
- Its own database
- Its own storage
- Its own encryption key
Every scan runs in a container of its own that can reach only the addresses that scan needs, and is removed when the scan ends.
Can Vulkro Cloud change our Salesforce org?
No. Vulkro Cloud only reads from your orgs and never changes one: its scans are limited to read queries. The connection uses the standard Salesforce API scope, which would allow writes; Vulkro does not use them, and no package is installed. You can disconnect an org at any time.
What does it read from our repositories, and what does it write?
It reads the code of the repositories and branches you add. Each scan copies that code into a container of its own, used for that scan only. It writes back only what you turn on for a repository: commit statuses, check results and pull-request comments. The data processing terms list every permission it asks for.
Does it read our customer records?
No. In Salesforce it reads settings, metadata, code, and user and login activity. Accounts, contacts, cases and other business records are not read.
Is our data kept apart from other customers?
Yes. Each customer gets a workspace of its own, with its own database, storage and encryption key. Every scan runs in a container of its own that can reach only the addresses that scan needs. Sensitive values are masked by default, you choose how long results are kept, and our support team gets in only when you grant it, for a limited time.
How often does it scan?
On a schedule (daily on Starter, every 6 hours on Business), whenever someone starts a scan, and for code on every push. Between scans, Vulkro Cloud checks your dependencies against newly published advisories once a day. See plans for what each one includes.
How do people sign in?
With their own account. Admins can require two-factor sign-in, limit sign-in to your email domains, set session timeouts and an IP allowlist. Single sign-on comes with the Business plan and is set up with our team.
04Where it runs
Scan on your machine, or in Vulkro Cloud.
The same checks either way. Vulkro Cloud adds the schedule, the shared workspace and the team around them.
Vulkro Cloud documentation- 14-day trialOn your machineThe scanners, the VS Code extension and the local console. Your code stays on your machine, and every check is in every Pro plan.Get started
- 14-day trialIn Vulkro CloudYour workspace at its own address, run and kept up to date by our team. Code, Salesforce, or both, for every member of your team.Set up my workspace
- Talk to usOn your own serversVulkro Cloud inside your own network, signed in through your own identity provider. Tell us what you need.Talk to us