Overexposed profiles
Find profiles and permission sets granting broad object, field, or system access beyond the role that needs it.
Salesforce permission audit
Who sees what in your Salesforce org?
Expose risky access before auditors, customers, or incident response force the question. Who Sees What scans your Salesforce security model and turns permission sprawl into a prioritized remediation plan.
Safe by design. You authorize access through Salesforce OAuth and revoke it anytime, and we read only your access metadata, never your business-record contents. Read-only today, and it never modifies your org.
8
Tier-one Salesforce access audits in the v0.1 scanner
0
Business-record contents read or stored by the audit
<5 min
Typical setup for an initial risk snapshot
Not sure where to start? Ask me anything about Who Sees What.
Powered by Digadop
Ask Horton anything about Who Sees What, or browse at your own pace.
What gets flagged
Permission risk, translated into decisions.
Salesforce access is spread across profiles, permission sets, groups, roles, sharing rules, queues, teams, and managed-package defaults. The audit connects those layers so teams can answer who can see what, why, and what to fix first.
Sensitive data paths
Map who can reach regulated fields, revenue data, customer records, and internal-only objects across every access layer, including field-level security read on its own and relationship-derived record sharing.
Dormant access
Surface users, groups, and assignments that still carry meaningful access after the business process moved on.
Audit-ready evidence
Produce a concise report with findings, severity, affected users, and the exact grant behind each one, so your admin team knows what to fix.
What nothing else answers
The questions your other tools leave open.
Salesforce Setup, Health Check, and the posture platforms tell you how the org is configured. None of them answer who can actually reach this data, or get it out. These five views do, and they are the reason teams keep Who Sees What after the first audit.
Who can walk the data out
The bulk-egress report: every user who holds Export Reports, View All Data, API Enabled, or the other permissions that let data leave the org, and the exact profile or permission set granting it.
Dependency-aware risk findings
Risks are traced through what actually touches the object: Apex, Flows, Visualforce, and cross-object formulas that republish a value past its own field-level security. You see the dependency, not just the symptom.
Sensitivity-ranked exposure
Fields are ranked by how sensitive they are, so a widely-readable national ID rises above a widely-readable industry code. You triage the exposure that matters instead of a flat alphabetical list.
Connected app and OAuth inventory
Every connected app and live OAuth authorization in the org, with the scopes it holds and whether it is still in use. Integrations bypass the sharing model, and most orgs have never inventoried them.
Over-permissioned and dormant access
Org-wide findings for the dangerous permissions concentrated in too many hands, and for privileged access that outlived the person or process it was granted for.
What you get
A report you can act on.
Every scan produces a prioritized exposure report: findings ranked by severity, the users and metadata affected, and the specific grant to fix. Take it with you as CSV, as a multi-sheet Excel workbook, or as a print-ready PDF. Here is the shape of it.
3 High7 Medium12 Low
- "View All Data" granted to 4 non-admin profiles
- Field SSN__c readable by the Standard User profile
- Dormant permission set still grants Export Reports
- Guest user can read Account.Industry via a sharing rule
Illustrative example. Your report reflects your org.
See it in action
Every answer shows its work.
Two ways to get an answer, both read-only against your org and both showing the reason behind every result: ask Horton in plain English, or build a precise audit by hand. Horton reads your org's own schema to work out which object you meant, finds records by name instead of making you paste an Id, and when you ask for a person it carries the whole conversation across so you never have to retype your problem.
How it works
From OAuth to a remediation plan in minutes.
Connect Salesforce with read-only OAuth.
Scan metadata, permission sets, groups, profiles, roles, and sharing rules.
Receive a prioritized exposure report with the reason behind every finding.
Security
Security first. You're in control.
Protecting your data is the whole job, and it is engineered into how Who Sees What is designed, authorized, and operated. Here are the controls that keep it safe. The full specifics are on our trust pages.
Least privilege by design
Who Sees What requests only what its audit needs, through standard Salesforce OAuth. No password is shared. It is read-only today and never writes to your org.
You authorize and stay in control
You connect the org and choose what to enable, and you can revoke access from Salesforce Connected Apps at any time. Disconnect in one step and we delete the audit data we hold for your org.
What we read
Only access configuration: profiles, permission sets, roles, groups, sharing rules, and field-level security. The metadata that decides who can see what.
What we never read
Your business-record contents. We never read or store the data inside your Accounts, Opportunities, or custom objects, only how access to them is configured.
Isolated, encrypted, deterministic
Tenants are isolated with org-scoped access and row-level security, stored credentials are encrypted with AWS KMS, and the audit is computed by deterministic analysis you can re-run. Your data is never used to train models that benefit other customers.
Details: Data scope · Privacy · Revoke access · Terms.
See who can reach your most sensitive data.
Nothing to install, and you stay in control. You authorize access, and we read only your access metadata, never your business-record contents. Connect your org and get an initial risk snapshot in under five minutes.