---
description: >-
  This page describes the Omnata Connect architecture from a security point of
  view.
---

# Security

## Remote Callouts

In order to retrieve data from the customer's data platform, our Apex code invokes [HTTP Callouts](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_http.htm) directly to those endpoints.

During connection configuration, [Named Credentials](https://help.salesforce.com/s/articleView?id=sf.named_credentials_about.htm\&type=5) are created which grant our Apex code the privilege to call those endpoints. No other endpoints are called by Omnata code, and this is also enforced by the Apex runtime.

## Connection Settings

Non-sensitive connection parameters (e.g. database names), are stored in Custom Metadata Types.

## Credential Storage

All sensitive credentials are stored in Named Credentials, and are not retrievable. Per Salesforce best practises, credentials are applied to outbound connections by using [Callout Endpoints](https://developer.salesforce.com/docs/atlas.en-us.apexcode.meta/apexcode/apex_callouts_named_credentials.htm).

In addition to this, when Snowflake JWT Authentication is used, a Self-Signed certificate is generated in Salesforce and used by the Named Credentials. During setup, the certificate's public key is assigned to the Snowflake user.

## Data Storage

Data accessed by External Objects is not cached or stored on the Salesforce platform, and instead is always read on demand.

## Architecture diagram

<figure><img src="https://2119005510-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FedNbhp7XNeTdK7we4Ka5%2Fuploads%2FHOs8KVE7hxrMfpjQj7fD%2FOmnata%20Connect%20Security%20Architecture%20Diagram.png?alt=media&#x26;token=af85c882-0891-4b2a-ad75-001b370b9b32" alt=""><figcaption></figcaption></figure>
