AI · Data · Security
Intelligent help. Clear about your data.
Here is exactly what Alfred sends to an AI provider, what it keeps in your org, and how CauseStack works inside the Salesforce security model you already use.
How AI is used
What goes to the AI provider, and what doesn’t
Alfred is a paid add-on, and it only runs once an AI key is set up in your org. When someone uses it, CauseStack builds the request inside your Salesforce org and sends it straight to the AI provider. Here is what that request contains.
Sent to the model
- Your question and the conversation so far, plus the instructions CauseStack writes to tell the model how to answer.
- Your org’s structure: object, field, and picklist names, so the model can read your setup.
- The record data the task needs: record names, field values, and totals. That can include personal details such as names or email addresses. Alfred does not strip them out, except in Content Assist, which swaps first names for a placeholder.
Not sent
- Objects you hide from Alfred. An admin can hide any object with Alfred’s privacy screen, and Alfred’s tools refuse to read it.
- Your database as a whole. Alfred’s lookups return capped results, for example up to 50 records in a list, not an export of your data.
- Anything for training. CauseStack does not train a model on your data.
- On your own keyRequests run on your Anthropic, OpenAI, or Gemini account. Your agreement with that provider decides how it handles them, including how long it keeps them and whether it may train on them.
- Or on our keyWe supply the key. Requests still go straight from your org to the provider with the same content, but they run on CauseStack’s provider account, so the provider’s terms with us apply instead of yours. Your org gets a daily cap on requests and tokens.
- Logged in your orgEvery Alfred request is recorded in your own Salesforce org: the question, the full prompt, the answer, and the tokens used. Your admins can review it, and it is not copied to CauseStack.
- Learns your org’s languageEach night Alfred sends the past week’s questions to the AI provider to summarize how your team phrases things, then saves those patterns in your org to improve later answers. An admin can switch this off.
- Shared with us only when you askIf you send a support request from Alfred, your two most recent Alfred logs are attached so we can see what went wrong. Otherwise we do not receive your prompts or answers.
Salesforce security
How we handle security without the AppExchange
CauseStack installs straight into your org instead of listing on the AppExchange, so it has not gone through Salesforce’s marketplace Security Review. We are direct about that. Here is what we do instead, and where the limits are.
Scanned with Salesforce Code Analyzer
We scan CauseStack’s Apex, Visualforce, Flows, and bundled JavaScript libraries with Salesforce Code Analyzer, including its security rules for SOQL injection, sharing, and CRUD and FLS checks. Results are tracked against a recorded baseline, so a new finding stands out as a regression. Older findings sit in that baseline while we work them down.
Works under Salesforce’s model
Most CauseStack code runs with sharing, and many queries run in user mode, so your sharing rules and field permissions apply. Some code runs in system mode where it has to, such as background jobs, public forms, and parts of Alfred’s question answering. The scan flags code that skips these checks.
In your org, under your control
Access comes from permission sets you assign. Your records, and Alfred’s logs, stay in your Salesforce org. Features that connect outside, such as the AI providers, document generation, payments, and portal sign-in, each use an endpoint your admin can see in Setup (all of them are listed below), and you can restrict or uninstall CauseStack with the controls you already use.
Approving CauseStack at install
The web addresses Salesforce asks you to approve
When you install CauseStack, Salesforce shows a list of web addresses and asks you to approve them. This section explains that list in plain terms: who runs each address, what CauseStack uses it for, and whether you need it.
Why Salesforce asks
Salesforce keeps apps from contacting outside websites unless an admin approves it. The install screen is that approval step. It lists every address CauseStack might ever need, even for features you don’t use.
Why CauseStack needs them
Some features rely on a service outside Salesforce, such as taking card payments through Stripe or making PDFs. Each address below is one of those services.
Required or optional
Only one address is required, for checking your subscription. The rest are optional. Each one is used only by the feature named in its row.
| Who runs it | Web address | What CauseStack uses it for | Do you need it? |
|---|---|---|---|
| Cause3AscendLabs is now Cause3, the makers of CauseStack. | https://ascendnpo.my.salesforce-sites.comIn Setup: Remote Site Settings | Checks that your CauseStack subscription is active. It also connects your Stripe account for payments and shows our product roadmap inside the app. | RequiredCauseStack needs this to run. |
| Cause3AscendLabs is now Cause3, the makers of CauseStack. | https://pdf.magicmerge.ioIn Setup: Remote Site Settings | Turns your documents into PDFs, such as receipts and letters made with document generation. | OptionalUsed when you create PDFs. |
| Cause3AscendLabs is now Cause3, the makers of CauseStack. | https://ascend-labs-pdf-service.fly.devIn Setup: Remote Site Settings | A second address for the same PDF service, kept as a backup. Fly.io is the company that hosts it for us. | OptionalUsed when you create PDFs. |
| Cause3AscendLabs is now Cause3, the makers of CauseStack. | https://jsyzreanixtbxiredtlr.supabase.coIn Setup: Remote Site Settings, CSP Trusted Sites | Looks up a nonprofit by its tax ID (EIN), suggests addresses as people type them into a form, and checks that a form was filled in by a person rather than a bot. Supabase is the company that hosts it for us. | OptionalUsed by those form and lookup features. |
| Cause3AscendLabs is now Cause3, the makers of CauseStack. | https://mxvluqqobdovmytonual.supabase.coIn Setup: Remote Site Settings, CSP Trusted Sites | Lets people sign in to your CauseStack portal and register online. Supabase is the company that hosts it for us. | OptionalUsed if you run a portal or online registration. |
| Cause3AscendLabs is now Cause3, the makers of CauseStack. | https://qhbhvwqnfpftvrfndjgb.supabase.coIn Setup: Remote Site Settings | Our grants database. Lets you search for grants and look up funders. Supabase is the company that hosts it for us. | OptionalUsed when you search for grants. |
| Cause3AscendLabs is now Cause3, the makers of CauseStack. | https://ruiovfkgmksuixrhycoc.supabase.coIn Setup: Remote Site Settings | Shows what’s new when an update to CauseStack is available. Supabase is the company that hosts it for us. | OptionalUsed for update notices. |
| Google (Gemini) | https://generativelanguage.googleapis.comIn Setup: Remote Site Settings | The AI that powers Alfred, CauseStack’s AI assistant, unless you choose a different provider. See “How AI is used” above for what it receives. | OptionalUsed only with the Alfred add-on. |
| OpenAI | https://api.openai.comIn Setup: Remote Site Settings | Another AI choice for Alfred. CauseStack only contacts it if your admin picks OpenAI and adds your own OpenAI key. | OptionalUsed only if you choose OpenAI. |
| Anthropic | https://api.anthropic.comIn Setup: Remote Site Settings | Another AI choice for Alfred (Claude). CauseStack only contacts it if your admin picks Anthropic and adds your own Anthropic key. | OptionalUsed only if you choose Anthropic. |
| Stripe | https://api.stripe.comIn Setup: Remote Site Settings, CSP Trusted Sites | Processes card payments for donations, form payments, and recurring gifts. | OptionalUsed if you take payments. |
| Stripe | https://js.stripe.comIn Setup: CSP Trusted Sites | Shows Stripe’s secure card-entry box on your forms, so card numbers go straight to Stripe. | OptionalUsed if you take payments. |
| Google (reCAPTCHA) | https://www.google.comIn Setup: Remote Site Settings, CSP Trusted Sites | Google’s spam protection on your public forms. It checks that a person, not a bot, is filling the form in. | OptionalUsed only on forms where you turn on spam protection. |
| Google (reCAPTCHA) | https://www.gstatic.comIn Setup: CSP Trusted Sites | Loads the images and code for Google’s spam protection. | OptionalUsed only on forms where you turn on spam protection. |
| Cause3AscendLabs is now Cause3, the makers of CauseStack. | https://power-power-9881.scratch.my.salesforce.comIn Setup: Remote Site Settings | An old address from when we built CauseStack. It is switched off and CauseStack never contacts it. It still appears on the install screen because Salesforce doesn’t let us remove it. | Not used |
You can review or switch off any of these after installing. In Salesforce Setup, search for Remote Site Settings or CSP Trusted Sites. Switching off an optional address only stops the feature that uses it.