For agencies and consultancies
A security review for every client org. Evidence included.
Review each client’s code and org together, see the attack paths behind the findings, and leave the client a report they can keep.
One Vulkro Cloud workspace per client, each on its own plan.
UserGuest user
Anyone on the internet is this user.
The Customer Portal site is active and serves unauthenticated visitors as its guest user. There is no login between a stranger and everything this user can reach.
<CustomSite><active>true</active><guestProfile>Customer Portal Profile</guestProfile><siteType>ChatterNetwork</siteType></CustomSite>
Break the path at the hop that carries it. Declare with sharing on InvoiceController and query WITH USER_MODE: one change in one class closes all five hops.
01Review every client
The same review on every client org.
The same checks and the same answer for every client, so two engagements are comparable.
- CodeThe client’s projectApex, LWC, Aura, Visualforce, Flows and metadata, scanned on your machine. Nothing is uploaded.
- OrgThe live org, read-onlyUsers, permissions, sessions, sharing, connected apps and guest access. Settings, never records.
- ResultAttack paths, rankedFindings joined into the paths that reach data, with the one step that closes each path.
- HonestyNothing unchecked passesA check your login could not run reads "not evaluated", with what to grant. Never a pass in front of a client.
753 checks: 147 on the live org and 606 on code and metadata (vulkro-sf 0.28.0).
02Hand over evidence
Every finding comes with its evidence.
The file and line, the path behind it, and whether it is proven, unproven or not checked. Each deliverable is built from the same results.
AgentExchange Security Review- Org posture report
- The live org’s posture in one self-contained HTML or Markdown report.
- ISV review readiness
- The review categories scored before submission, so an ISV client avoids a second round. Salesforce charges a $999 fee per attempt on a paid solution, and a round typically takes four to five weeks (Salesforce).
- Compliance evidence
- Findings mapped to SOC 2, HIPAA and PCI controls, and a GDPR record of processing.
- Machine-readable
- SARIF and JSON for the client’s own pipeline.
- Plan
- Live-org scanning, the readiness checklist, the reports and compliance evidence are all part of Salesforce Pro.
03Vulkro Cloud
Each client in its own workspace. On its own plan.
For clients you look after month to month: their orgs scanned on a schedule, and what changed between scans.
- Isolation
- Each workspace has its own address, database, storage and keys. Nothing is shared between clients.
- Scheduled
- Orgs scanned on a schedule, each scan in its own container, every result kept.
- What changed
- New admins, permission sets, connected apps, relaxed settings and guest access since the last scan.
- Client access
- Roles from Owner to Viewer, scoped per org. Every member is a seat; people who only read results get scheduled report emails.
- Alerts
- SlackMicrosoft TeamsJiraPagerDutyGoogle ChatDiscordEmailWebhooks
04How agencies pay
One workspace per client.
Agencies and consultancies run one workspace per client, each on the plan that fits it. Your staff are members in each client’s workspace.
Set up a client workspace- Each client
- Its own workspace and subscription, on the Vulkro Cloud plan and product that fit it: Core, Salesforce, or both.
- Your staff
- Members in each client workspace they work in. Every member is a seat, and gets Pro on their own machine.
- The client’s people
- Members if they work the issues; scheduled report emails if they only read.
- Bigger clients
- Above the Business size, or with procurement needs, a client moves to Enterprise.
- Does client code or data leave our machines?
- Not with Vulkro for Salesforce: it scans locally and works offline. Org checks read settings and definitions through your own Salesforce login, never records. Vulkro Cloud, if you use it, keeps each client in its own workspace.
- Can the client see the results themselves?
- In Vulkro Cloud, yes. People on the client side who work the issues join their workspace as members; people who only read results get scheduled report emails. From the command line, hand over the HTML report, or the SARIF and JSON output.
- Do our consultants each need a licence?
- Each Pro subscription belongs to one person. A consultant who is a member of a client’s Vulkro Cloud workspace also gets Pro on their own machine for that workspace’s products.
- How do we start a client workspace?
- Tell us the plan that fits the client on the set-up page, and we set up the workspace within two business days, with a 14-day trial. Then invite your staff and the client’s team.
Prices for Pro and for every Vulkro Cloud plan are on the pricing page.