4

I wanted to check how secure is data transfer between salesforce and heroku. Is there any encryption mechanism built in when we integrate salesforce and Heroku (when data transfer occurs).

Update - we are planning to build heroku rest api which will be consumed by Salesforce.

  • 1
    how are you transferring data between SF & Heroku ? using standard api / custom api / heroku connect ?? – Vamsi Krishna Apr 2 '15 at 3:44
  • 1
    Not using heroku connect, but planning to use std api or develop rest api. – user18421 Apr 2 '15 at 3:45
3

All of the API mechanisms use transport layer security (TLS). This means that your connection is encrypted end to end at the socket level. Neither side specifically has to deal with encryption or decryption at the level in which you normally program at. It's all handled for you at the lower levels transparently. This includes Heroku and any other commonly used platform, such as Ruby, Perl, PHP, etc.

| improve this answer | |
3

Security of such a transfer is primarily determined by key management and session management, not transport layer concerns.

  • Are you storing the keys in Heroku Properties as per their best practice, and not in your repository? Are they hard coded in the source?
  • If this is a client callout are you validating certificates?
  • If you are calling out from Salesforce to a Heroku service, then are you storing the API Token in a protected custom setting within a managed packaged? (Using named credentials is also recommended). Never store authentication data in custom objects or public custom settings or even protected custom settings that are not namespaced.
  • Do you have a mechanism in place to rotate credentials and expire them?
| improve this answer | |
  • we are planning to implement service now, it will be rest api hosted on heroku and salesforce will call that service. As per your recommendation I am planning to use named credentials. Thanks! – user18421 Apr 3 '15 at 4:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.