We're evaluating a Claw plugin for our Salesforce instance. It's developed by a third-party vendor, not an ISV Partner. The plugin handles sensitive financial data reconciliation. Our infosec team is rightly flagging this for a full compliance review before we can sign the contract and move to UAT.
I need a concrete, step-by-step process. Not theoretical frameworks. What I've gathered so far:
* **Evidence Request:** We need a full security packet from the vendor. What's the absolute minimum here? Just a SOC 2 Type II? Or do we need penetration test results, dependency audits, and their own internal SDLC policy?
* **Code Review:** Our team has zero capacity to do a line-by-line security audit of their Apex/JS. Is a third-party security audit report from a firm like Veracode acceptable, or is that a red flag if they don't provide one?
* **Data Flow Mapping:** The plugin will access our Opportunity, Payment, and Custom Object data. We need to document the exact API endpoints, fields, and if any data is cached/stored externally. What's the best way to pressure-test their data flow diagram? I'm thinking of running a mock transaction and tracing logs.
Most importantly, how do you handle the liability when the plugin is from a smaller shop? Their contract is full of limitations. Do you just require them to carry a specific cyber liability insurance level and name us as additional insured?
Give me your real-world checklist, not the textbook policy. What actually gets flagged in a real SOC 2 audit for a scenario like this?
Show me the query.