Salesforce Security and Governance
We review and tighten Salesforce access, plan Shield and Salesforce Guardian, prepare for connected app and OAuth changes, and set up audit trails.
Salesforce security is mostly configuration: who can see which records, which integrations hold which tokens, and whether you can show an auditor what changed. GeekMidst reviews and improves Salesforce security and governance remotely from India. For how GeekMidst handles your data during a project, see security and data handling. For a broader technical review, see the org health check.
Access model
We review profiles, permission sets and groups, roles, sharing rules, guest user access and login policies, then move you towards least privilege. Winter '27 items to factor in include enforced Profile Filtering, an option to keep manual shares on record transfer, and the Guest User Sharing Rule Access Report. MFA passkey and security-key management was added in late Summer '26.
Shield and Salesforce Guardian
Shield is still a product: Platform Encryption, Event Monitoring, Field Audit Trail and Data Detect. Salesforce Guardian is the umbrella name for Salesforce's security, privacy and resilience add-ons, not a rename of Shield. It includes Shield and Security Center (with Security Mesh), Customer Identity and Mobile App Security, Privacy Center and Data Mask & Seed, and Backup & Recover and Archive. Winter '27 adds MCP Risk Scores in Security Center, Global Consent Manager and Platform Encryption for Archive and Backup (GA per Salesforce), plus Observability Center (Beta). Security Center Essentials is released at no cost. See Shield and Guardian.
Connected apps and OAuth
Most integration risk sits here. We list connected apps and integration users, find which OAuth flow each uses, and plan moves to External Client Apps and supported flows. Our post on connected apps and OAuth changes explains the steps.
What's included
| Area | What we cover |
|---|---|
| Access review | Profiles, permission sets, roles, sharing and guest access |
| Integration security | Connected apps, OAuth flows, integration users and credentials |
| Shield and Guardian | A fit review, then setup of the components you license |
| Monitoring | Event Monitoring, Security Center and alerting |
| Audit | Setup Audit Trail, Field Audit Trail and change records |
| Governance | Change approval, admin access rules and periodic reviews |
How we work
- 01
Discovery
We review org settings, users, integrations and your audit requirements.
- 02
Design
We propose an access model, integration fixes and the tools you need.
- 03
Build
We make changes in a sandbox, including restructuring permission sets.
- 04
Test
Users run their daily work to confirm nothing they need is blocked.
- 05
Launch
We deploy in stages and switch on monitoring.
- 06
Support
We run periodic access reviews and track Salesforce security changes.
Prerequisites and licences
Shield components and Guardian add-ons are licensed separately, and Security Health Review in Setup is for Signature Success customers. For regulatory requirements, check with your legal adviser; we help you plan for them.
Who it suits
Organisations preparing for an audit, teams with many integrations, and orgs that grew without an access design.
Common mistakes
- Integrations running as a full system administrator.
- Many cloned profiles with small differences.
- Assuming Shield covers backup, when Backup & Recover is a separate Guardian item.
- Leaving OAuth changes until the retirement date.
Related services
See securing Salesforce API integrations, administration services and Agentforce testing and governance.
Questions we hear
Is Salesforce Guardian a new name for Shield?
When does connected apps support end?
Which integrations do the OAuth changes affect?
Do we need Shield?
Sources
Related reading
Review your Salesforce security
Tell us about your org, integrations and audit needs, and we will suggest where to start.
