Security & compliance
Breadwinner Security & Compliance
Breadwinner processes sensitive financial data, so security is foundational to how our Salesforce integrations are built and operated. This page answers the questions finance and IT teams ask most often about our architecture, certifications, and data handling.
Certifications & reviews
Independently audited. Publicly listed. Regularly re-reviewed.
SOC 2 Type II
Breadwinner Integrations, Inc. maintains SOC 2 Type II compliance for its Salesforce integration products, independently audited by Dansa D'Arata Soucia LLP, with a clean opinion and no exceptions noted across all controls. The full report is available under NDA on request.
Salesforce AppExchange security review
Like all AppExchange apps, Breadwinner has passed Salesforce's rigorous security review — first on our initial listing in 2014, and again through the required re-reviews every year since.
Accounting platform reviews
Breadwinner has also passed security reviews from the accounting platforms we connect to, including Intuit's security review for QuickBooks.
SOC 2 Type II
Salesforce Partner since 2014
Listed on AppExchange
Architecture
Secure by design
Read-only by default
Every Breadwinner app installs in read-only mode. The finance system is the system of record; Breadwinner replicates its data into Salesforce as read-only records so your team gets visibility without direct access to the finance system.
Writes are opt-in and controlled
Writing back to your finance system is off until an admin explicitly enables "Active Mode." Even then, writes are constrained — created through a guided wizard from Salesforce orders or opportunities, with broader automation available only through a governed API. You start safe and expand deliberately.
Data integrity
A regular sync keeps Salesforce current, and a weekly integrity pass hard-refreshes the local Salesforce copies against the finance system — so your records stay an accurate representation of the source of truth, correcting anything that drifted.
Infrastructure
The sync between your finance system and Salesforce is brokered by Breadwinner's own infrastructure on Amazon Web Services (AWS) — a purpose-built managed app, not a third-party iPaaS you configure and maintain. Data is encrypted in transit (TLS) and at rest, and AWS is covered as a sub-processor under Breadwinner's SOC 2 Type II audit.
Access control
Inherits Salesforce's own security model.
Breadwinner inherits Salesforce's own security model. Access is governed through Salesforce permission sets and profiles: installing the app and establishing the connection to your finance system require a System Administrator, while day-to-day user access is granted through Breadwinner's permission sets layered on top of your existing profiles, roles, and sharing rules.
Admins control read-versus-write access — including the read-only / Active Mode toggle — using the same Salesforce permission model they apply to every other object, rather than a separate system to manage.
Security posture
How Breadwinner affects your security posture.
Breadwinner typically improves security posture. It lets companies tightly restrict direct access to the finance system while still exposing the specific Accounts Receivable (and optionally Accounts Payable) data that sales and operations teams need. What Breadwinner permits has been refined across hundreds of customers and thousands of users. For example, Breadwinner allows read-only visibility of credit memos, but they cannot be created through Breadwinner's guided wizards — those require someone with accounting access or a governed API call.
Payments
Card data stays tokenized in the processor.
Breadwinner Payments uses tokenization: card numbers, CVVs, and bank details are held by the payment processor (Stripe, Square, or Braintree) and are never stored by Breadwinner or in your Salesforce org.
Frequently asked questions
Common questions from security and compliance teams.
Your finance system stays the system of record, and your finance data lives in your finance system and your own Salesforce org — not on Breadwinner's servers. Breadwinner replicates finance data into Salesforce as read-only records; the sync moves that data in transit only and does not persistently store your finance transaction records. That sync infrastructure runs on AWS, is covered by Breadwinner's SOC 2 Type II audit, and encrypts data in transit and at rest. The only data Breadwinner itself retains is its own operational data — such as contact, subscription/billing, and system-log data — which is likewise encrypted at rest.
Yes. Most customers do not require an NDA to evaluate or use Breadwinner, but we're happy to sign one on request — and we can share our SOC 2 Type II report under NDA. Breadwinner has processed financial data as a business since 2013.
Breadwinner's sales and operations teams are in the US and the UK, and our engineering team is in India. All staff and contractors sign NDAs.
Our first app, Breadwinner for Xero, has been on the Salesforce AppExchange since 2014. We serve hundreds of customers and hold a 5-star average across our AppExchange reviews.
Questions our security review didn't cover?
Contact us — we're happy to walk security and compliance teams through our architecture and share documentation under NDA.