Access control
Access to customer environments is per named user, with multi-factor authentication and least-privilege principles. Access is granted per project and revoked when the work ends.
Trust Center
Security and trust at Bunker
Bunker builds revenue operations on the Salesforce platform. Our customers' data stays in the customers' own platforms, and our work follows the security practices described on this page.
Security practices
How we work
Our solutions run inside Salesforce and managed cloud services, inheriting the security controls of those platforms. On top of that, we apply the practices below.
Customer data
Data stays in the customer's platform (Salesforce and connected systems). We do not sell data, do not use it for other purposes, and do not keep copies beyond what the contracted delivery requires.
Secure development
All code is version-controlled, reviewed before reaching production, and deployed from controlled repositories. Changes to customer environments follow an auditable trail.
Credentials and secrets
Credentials, keys, and tokens are never committed to code or shared over open channels. Integrations use platform-native mechanisms such as Named Credentials and OAuth.
Privacy and compliance
Privacy by default
We process personal data in accordance with applicable law, including the LGPD (Brazil's General Data Protection Law).
LGPD
We act as data processors under our customers' instructions; customers remain the controllers. Data subject requests are directed to the controller and supported by us when needed.
Subprocessors and platforms
We work on established platforms such as Salesforce and Microsoft 365, which maintain their own compliance programs and public certifications.
Vulnerability reporting
Found a security issue?
If you have identified a vulnerability in any Bunker product or page, we want to know. We review every report received and respond with priority.
Write to [email protected]. Our privacy policy is available at Privacy Policy.