Security
Security at Calenta
Calenta connects your Salesforce to Claude so your team can work with donor data in plain English. We’re built on Cloudflare, Anthropic, and Salesforce, and we take the sensitivity of donor information seriously. Here’s how we handle your data.
How Calenta accesses your data
- Scoped, per-user access. Calenta connects through Salesforce’s standard OAuth and can only see the records your own Salesforce permissions already allow — never more. Nightly brief preparation runs through the most recent connected person’s permissions.
- Your Salesforce stays the source of truth. Calenta reads it live and stores the briefs, queues, and reports it prepares, which include donor names and giving details. Never used to train AI, and deleted if you leave.
- You stay in control. Disconnect on the Salesforce page in your Calenta portal, or revoke Calenta in Salesforce. Removing the connector in Claude alone doesn’t notify us. Disconnecting revokes tokens and stops nightly preparation. Stored data stays until you ask us to delete it, and then we delete it within 30 days.
Encryption
- In transit: TLS on every connection — between Claude, Calenta, Salesforce, and storage.
- At rest: all stored data is encrypted at rest by default (Cloudflare R2 and KV, AES-256) — org context, uploaded documents, and connection tokens.
AI & your data
- Never used to train AI models. Donor data is processed through Anthropic’s commercial API, whose terms do not use your inputs for training.
- Data minimization. Only the data needed to answer a given request is sent to the model.
Storage & retention
| Data | Where | Retention |
|---|---|---|
| Live query results | Not stored | Returned to you, not persisted |
| Derived outputs (briefs, reports) | Your isolated storage | Deletable on request |
| Documents you upload | Your isolated storage | Deletable on request / offboarding |
| Usage telemetry | Encrypted store | Usage by signed-in person, with no donor data — auto-deleted after 30 days |
| Connection tokens | Encrypted store | Kept while connected; removed when you disconnect or on offboarding |
Tenant isolation. Each organization’s data is isolated. We never share data across organizations, and we never sell it. Usage logs hold no donor data — donor names, emails, query contents, and giving data are never written to it.
Sub-processors
| Provider | Role | Donor data? |
|---|---|---|
| Anthropic | AI model (Claude) | Yes — processes; no training |
| Cloudflare | Hosting, storage, edge | Yes — encrypted storage |
| Salesforce | Your source CRM | Your own system |
| Vercel | Site / portal | No |
| Clerk | Account sign-in | No |
| Stripe | Billing | No |
| Resend | Email, including weekly briefs | Yes, in weekly briefs |
Compliance
Calenta is an early-stage product. We’ve built our foundation to formal-audit standards — scoped access, encryption, tenant isolation, data minimization, and retention limits — and will pursue SOC 2 when our customers’ requirements call for it. We’re glad to complete security questionnaires and sign a DPA.
Security questions or a review request? Email joe@calenta.ai — we’ll respond quickly and candidly.