Security
Your documents stay in your org. Unless you send them.
Docable makes every document inside Salesforce, as the person who asks. Anything that leaves goes only where your admin has connected it.
Everything runs inside Salesforce.
Designed, proved and made in your org, with the person's own permissions and sharing.
Docable- DesignTemplates, data and Brand Kits
- ProofPDF and Word from a real record
- ApproveA person makes it live
- Made herePDF and Word, in your org
As the person who asks, with their permissions and sharing.
Nothing else leaves.
- No Docable servers
- User mode by default
- Your sharing and field access
Three doors out. All shut until you open them.
An admin can connect storage, a data provider or AI. Nothing else leaves.
DocableEvery document made hereAs the person who asks- Off until connected
- Your own app and account
- A data provider, approved by an admin
- AI never sees record values
Who can do what.
Four roles, each a permission set group. No role both writes and approves.
- Docable AdminSets Docable up: settings, background jobs and who has which role. Doesn't write, approve or make documents.
- Template AuthorWrites templates, makes proofs and uses AI. Can't approve.
- ApproverApproves and activates templates. Can't write them.
- Document UserMakes documents from active templates on records they can see.
Extra access, only for the people who need it: Brand Manager, Approve Brand, system mode, schedules and portal access.
- Your sharing model applies
- Only people who can read a template use it
- The permission sets, one by one
A person makes it live.
Proofs of that exact version first, then a person approves it. Every version is kept, ready to roll back.
- Approval on by default
- No approving your own draft
- AI never approves
- Compare and roll back
Kept as long as you choose.
Documents and logs live in your org, or your own storage, never with Docable. Docable's clean-up runs in your org, on periods you set in Docable Setup.
- Retry data: 7 days
- Proofs: 30 days after a newer one
- Audit records: 90 days
- Files on records: until you delete them
- Or a temporary File that expires
Found something? Tell us.
Email us with Security in the subject. Please leave customer data out.
- What you found, and where
- How to reproduce it
- What someone could do with it
- No customer data, please
Questions, answered.
Does any data leave our org?
Not to make documents. Docable's own code makes every PDF and Word file in your org; there are no Docable servers. Only three things reach out, each turned on by your admin: a storage destination, a data provider, AI.
What does the AI see?
Your template's words and structure, field names and types, and Brand Kit styles, sent through Salesforce's Models API to the model your admin chose. Never record values, generated files, or a kit's bank details, signatories, number series or remit-to address.
What does AI need to be switched on?
Einstein generative AI, Docable's AI extension, the Salesforce licence your admin names and Docable's Use AI permission. Prompts are handled under your Salesforce terms and settings.
Can AI or Claude approve a template?
No. AI can prepare a template and ask reviewers. It can't approve or activate one, approve a Brand Kit, share a template or change its owner. A machine-authenticated client such as Claude can't give a human approval.
How do Claude and Agentforce get in?
Claude connects through Docable's MCP server, hosted in Salesforce and set up by your admin; each call runs as the person who connected, with their permission sets, licence, sharing and field access. Agentforce has the same actions, where licensed.
What does Claude receive?
The template, field names and types, Brand Kit styles and proof facts with a link: no record values or file contents. Anything you share with Claude yourself falls under your agreement with Claude's provider. Agentforce agents and instructions stay yours.
Which permission sets and controls apply?
Salesforce's own. Documents are made in the requester's access by default, so your sharing, field access and permission sets decide. Each Docable role is a permission set group given in Docable Setup, and Docable checks each person's package licence.
Can a document show more than the requester can see?
Only in system mode: asked for per request, capped by a ceiling the template sets, approved by someone with Docable Activate Template, audited and shown on the approval screen. Otherwise every document runs in the requester's own access.
Who can open a document made in system mode?
If it's kept on the record, anyone in Salesforce who can see the record; portal and site users can't. Allow system mode only where the content suits all of them, or don't keep the file on the record.
Can Experience Cloud and guest users get documents?
Yes, for templates your admin allows. Docable makes the document in the background as one Salesforce user you name, never with the visitor's own session.
Can anyone at Docable see our org, or our logs?
No. Nothing is copied anywhere else. If you ask for help, only a support file you choose to send leaves: versions, settings, permission flags, limits and reason-code counts, with no record values, Ids or names.
Do sandboxes work the same way?
Yes. Every sandbox of your production org is included, and Docable runs inside each one as it does in production. Build and prove templates there, then move them across as drafts.
Learn how.
Step-by-step guides, with the screens.
Bring your security questions.
Join the waitlist and tell us what your security team needs to know. We'll answer from what's documented here.