---
isPublished: true
template: "marketing.peb"
title: "Trust Center"
displayName: "Trust Center"
description: "Plain-language answers about model training, dialogue continuity, Salesforce authority, data handling, and assurance evidence for iDialogue."
category: "trust"
contentType: "overview"
audience: "end-user"
tags: "trust,security,privacy,ai-governance,salesforce,compliance"
section: "trust"
seoTitle: "iDialogue Trust Center"
seoDescription: "Learn how iDialogue protects Salesforce workflows, keeps useful dialogue continuity, limits agent authority, and handles files and business data."
---

<div class="trust-portal">

<section class="trust-hero" aria-labelledby="trust-center-title">
  <p class="trust-status">Security, governance, and assurance for iDialogue</p>
  <h1 id="trust-center-title">Trust starts with clear answers</h1>
  <p>iDialogue connects Salesforce records, files, people, and AI-assisted workflows. This Trust Center explains how access is scoped, how agent actions are governed, how customer information is handled, and what evidence is available for security and procurement review.</p>
  <p><a href="#three-trust-pillars">Explore trust and security</a> or <a href="#functional-areas">browse a functional area</a>.</p>
</section>

<h2 id="direct-answers">Clear answers to common questions</h2>

<h3>Can another customer or a public ChatGPT user access our Salesforce data?</h3>

<p>No. Connecting iDialogue to Salesforce does not make CRM data available to public ChatGPT users or other iDialogue customers. Workflows operate within the customer's configured Salesforce connection and iDialogue tenant context. The connection identity, selected data, enabled tools, workflow rules, approvals, and sharing settings determine access.</p>

<h3>Is our information used to train OpenAI models?</h3>

<p>Customer data processed through the iDialogue-managed OpenAI API integration is not used to train OpenAI models. Model training is separate from the provider processing and application state used to deliver API functionality.</p>

<h3>What can an iDialogue agent access or change?</h3>

<p>An agent receives only the context and capabilities made available to its configured workflow. The Salesforce API connection user establishes the primary Salesforce permission boundary. Enabled skills, tools, object and field access, workflow instructions, and approval requirements narrow that authority further.</p>

<h3>Why does iDialogue retain some information?</h3>

<p>Retention supports defined business purposes. Approved dialogue context can support continuity. Task inputs support a requested operation. Repository artifacts and Experience content support review, delivery, eSignature, and later retrieval. Operational records support reliability, security, support, usage reconciliation, and billing. These data classes have different lifecycles.</p>

<h3>How do iDialogue Experiences and Document Rooms handle customer information?</h3>

<p>iDialogue Experiences and Document Rooms are secure customer-facing workspaces for documents, checklists, forms, uploads, review, and eSignature. Data collected through a configured Experience may update the corresponding Salesforce record. Documents and related activity can remain available in the Room for the configured business lifecycle.</p>

<h3>What evidence is available for enterprise review?</h3>

<p>Public materials include security and privacy policies, Salesforce AppExchange Security Review information, provider contractual documentation, and scoped testing evidence. Detailed architecture, data-flow reviews, vulnerability findings, questionnaires, and other sensitive materials may be provided under NDA.</p>

<h2 id="start-with-your-role">Start with your role</h2>

<div class="trust-role-grid">
  <article class="trust-role-card">
    <h3>Business or Salesforce user</h3>
    <p>Find guidance on agent authority, human review, and approval points.</p>
    <p><a href="/trust/ai-agent-governance.html#authority-and-approvals">Review authority and approvals</a></p>
  </article>
  <article class="trust-role-card">
    <h3>Salesforce Admin</h3>
    <p>Find configuration guidance for Salesforce identity, permissions, Connections, agent tools, and sharing controls.</p>
    <p><a href="/trust/security-data-handling.html#salesforce-api-integration">Review Salesforce API integration</a></p>
  </article>
  <article class="trust-role-card">
    <h3>IT, security, or CISO</h3>
    <p>Review data lifecycles, tenant isolation, external providers, and available assurance evidence.</p>
    <p><a href="/trust/security-data-handling.html#data-lifecycle">Review the data lifecycle</a></p>
  </article>
  <article class="trust-role-card">
    <h3>Procurement, Legal, or Compliance</h3>
    <p>Find public policies, contractual safeguards, and available assurance materials.</p>
    <p><a href="/trust/compliance/index.html#documents-and-evidence">Review policies and evidence</a></p>
  </article>
</div>

<h2 id="functional-areas">Explore trust and security</h2>

<div class="trust-card-grid trust-grid--four">
  <article class="trust-card">
    <h3><a href="/trust/compliance/index.html#salesforce-security-review">Salesforce Security Review</a></h3>
    <p>Review the scope and evidence for iDialogue's successful AppExchange Security Review.</p>
  </article>
  <article class="trust-card">
    <h3><a href="/trust/security-data-handling.html#salesforce-api-integration">Salesforce API Integration</a></h3>
    <p>Understand how the Salesforce API connection user configured by the Salesforce Admin sets the primary permission boundary.</p>
  </article>
  <article class="trust-card">
    <h3><a href="/trust/ai-agent-governance.html#openai-integration">OpenAI Integration</a></h3>
    <p>Review provider governance, dialogue continuity, task processing, application state, and customer configuration options.</p>
  </article>
  <article class="trust-card">
    <h3><a href="/trust/security-data-handling.html#connections">Connections</a></h3>
    <p>Control which external services are connected and which approved agent skills are authorized to use them.</p>
  </article>
  <article class="trust-card">
    <h3><a href="/trust/ai-agent-governance.html#authority-and-approvals">Agent Authority &amp; Approval</a></h3>
    <p>Control agent capabilities through the Salesforce connection user, enabled capabilities, workflow rules, approvals, and monitoring.</p>
  </article>
  <article class="trust-card">
    <h3><a href="/trust/security-data-handling.html#data-lifecycle">Data Lifecycle</a></h3>
    <p>Understand how dialogue history, task inputs, Experience and Room content, repository artifacts, Salesforce writeback, and operational records are handled.</p>
  </article>
  <article class="trust-card">
    <h3><a href="/trust/security-data-handling.html#sharing-and-access">Sharing, Rooms &amp; Publishing</a></h3>
    <p>Understand how invited members access private Experiences and Document Rooms, how content is shared for review or eSignature, and how deliberately public publishing differs.</p>
  </article>
  <article class="trust-card">
    <h3><a href="/trust/compliance/index.html#documents-and-evidence">Policies &amp; Evidence</a></h3>
    <p>Access security and privacy policies, Salesforce review evidence, scanning results, and other assurance materials.</p>
  </article>
</div>

<h2 id="security-model">Security model</h2>

<figure class="trust-diagram">
  <img src="/assets/img/trust/security-model.svg" width="1280" height="820" alt="Layered iDialogue security model connecting a Salesforce user and configured Salesforce org to iDialogue workflow controls, selected processing providers, stored artifacts, and audit records." />
  <figcaption>iDialogue uses layered controls across Salesforce, workflow configuration, AI providers, storage, sharing, and human review. Administrators control the connections, data context, agent capabilities, and approval requirements available to each workflow.</figcaption>
</figure>

<p>Connecting a Salesforce org does not create a public or cross-customer query path. Each workflow resolves within the applicable organization, connection, and configured access model.</p>

<div class="trust-callout trust-callout--qualified">
  <strong>Security follows the workflow.</strong> Different iDialogue features may process selected Salesforce data, files, conversation state, or generated artifacts. Our Trust Center documents those data flows so customers can evaluate each deployment based on how it is actually configured and used.
</div>

<h2 id="three-trust-pillars">Three trust pillars</h2>

<div class="trust-card-grid">
  <article class="trust-card">
    <h3><a href="/trust/security-data-handling.html">Security &amp; Data Handling</a></h3>
    <p>Understand Salesforce and file data flows, encryption, retention, storage, Connections, sharing controls, and subprocessors.</p>
  </article>
  <article class="trust-card">
    <h3><a href="/trust/ai-agent-governance.html">AI &amp; Agent Governance</a></h3>
    <p>Review how agent capabilities, tools, approvals, provider controls, transcripts, usage, and auditability are governed.</p>
  </article>
  <article class="trust-card">
    <h3><a href="/trust/compliance/index.html">Compliance &amp; Policies</a></h3>
    <p>Access public policies, contractual safeguards, Salesforce Security Review information, vulnerability evidence, and other assurance materials.</p>
  </article>
</div>

<h2 id="documents-and-evidence">Documents and evidence</h2>

<div class="trust-document-grid trust-document-grid--two">
  <article class="trust-document-card">
    <h3>Publicly available</h3>
    <ul>
      <li><a href="/trust/compliance/privacy-data-protection.html">Privacy &amp; Data Protection Policy</a></li>
      <li><a href="/trust/compliance/data-retention.html">Data Retention Policy</a></li>
      <li><a href="/trust/compliance/encryption.html">Encryption Policy</a></li>
      <li><a href="/trust/compliance/vulnerability-management.html">Vulnerability Management Policy</a></li>
      <li><a href="/trust/compliance/risk-assessment.html">Risk Assessment Policy</a></li>
      <li><a href="/trust/compliance/third-party-security.html">Third-Party Security Policy</a></li>
      <li><a href="/trust/compliance/openai-data-processing-addendum.html">OpenAI Data Processing Addendum summary</a></li>
    </ul>
  </article>
  <article class="trust-document-card">
    <h3>Available by request or under NDA</h3>
    <ul>
      <li>Detailed architecture and endpoint diagrams</li>
      <li>Detailed vulnerability scan findings and remediation context</li>
      <li>Security questionnaires and customer-specific data-flow reviews</li>
      <li>Additional assurance materials containing sensitive operational details</li>
    </ul>
    <p>Request security documentation at <a href="mailto:support@idialogue.app">support@idialogue.app</a>.</p>
  </article>
</div>

<h2 id="additional-technical-questions">Additional technical questions</h2>

<div class="trust-faq">
  <details>
    <summary>What did the April 9, 2025 Salesforce Security Review cover?</summary>
    <p>The iDialogue managed package successfully completed Salesforce's AppExchange Security Review on April 9, 2025. The review provides independent assurance for the package version and submission evaluated by Salesforce. Hosted services, later releases, customer configurations, and third-party providers have separate scopes. See <a href="/trust/compliance/index.html#salesforce-security-review">review details</a>.</p>
  </details>
  <details>
    <summary>Can a customer use its own OpenAI API key?</summary>
    <p>Yes. Customer-provided OpenAI API keys are supported for approved deployments and can be associated with the customer's organization in iDialogue. The customer controls provider-account administration, including usage, billing, rate limits, and available settings. The key does not expand Salesforce access or replace iDialogue workflow controls. See the <a href="/connections/openai.html">OpenAI Connection</a>.</p>
  </details>
  <details>
    <summary>Which Connections can an agent use?</summary>
    <p>An agent can use only the Connections made available through its enabled skills. A service appearing in the Connections catalog does not mean it is configured, authorized, or used within a particular customer organization. Administrators can review configured Connections and the skills enabled for each agent. See the <a href="/connections/index.html">Connections catalog</a>.</p>
  </details>
  <details>
    <summary>Is iDialogue a Salesforce native application?</summary> 
   <p>Yes. The iDialogue managed package provides 100% of the administrative experience within Salesforce. Some Connections, such as Twilio, Stripe, and Apollo.io, may require visiting a third-party service to configure or manage the integration.</p>
  </details>
  <details>
    <summary>How are credits, rate limits, overages, and background agents controlled?</summary>
    <p>iDialogue meters agent and processing activity using credits and records usage for billing and operations. Provider rate limits and model capacity are managed separately and may change over time. Administrators can define budgets and workflow permissions, monitor background work, and stop it when needed. See <a href="/trust/ai-agent-governance.html#usage-and-cost-controls">usage and execution controls</a>.</p>
  </details>
<details>
    <summary>Are any desktop or MCP connections required to use iDialogue?</summary> 
    <p>No. iDialogue is a cloud-hosted solution. Content management and agentic processes run in cloud services, including Salesforce and our AWS subprocessor. Desktop AI and MCP connections are not required or currently supported.</p>
  </details>
</div>

<section class="trust-callout" aria-labelledby="trust-review-title">
  <h2 id="trust-review-title">Planning an enterprise deployment?</h2>
  <p>Our team can provide a customer-specific security and data-flow review covering Salesforce access, selected fields and files, AI providers, agent capabilities, storage, sharing, and approval controls. Contact <a href="mailto:support@idialogue.app">support@idialogue.app</a>.</p>
</section>

</div>