What's in the CRM Digest Salesforce package

This page is meant to be shared with your Salesforce admin before they install the package. It explains exactly what gets added to your org and what permissions it requests.

What gets installed

The package (namespace crmdigest) contains exactly one component: an External Client App named "CRM Digest" — Salesforce's standard framework for third-party OAuth integrations (the same mechanism used by tools like Slack or Zapier).

It does not include any of the following:

Apex classes, triggers, or Flows
Custom objects, fields, or page layouts
Any code that runs inside your org
Any automation or scheduled jobs in Salesforce itself

OAuth permissions requested

When your users connect via the "Connect your org" step, they'll be asked to approve these two permissions:

Permission	Why we need it
Manage user data via APIs (`api`)	Read Opportunity, Activity, and Task records to build your digest reports.
Perform requests at any time (`refresh_token`, `offline_access`)	Send scheduled digests on your chosen cadence without requiring you to log in again each time.

What CRM Digest does not do

We never see or store your Salesforce password — authentication happens entirely on Salesforce's own login page.
CRM Digest only reads your pipeline data. It never creates, updates, or deletes a Salesforce record.
We read opportunities and tasks, plus your org's name and whether your Salesforce user can view all data — nothing else in your org.
Access can be revoked at any time from Salesforce's own Connected Apps OAuth Usage page (in Setup).

Questions?

For full technical/security details (encryption, data retention, sub-processors), our security documentation is available on request — email [email protected] and we'll send it over.