Where does my Salesforce access token live?

In your browser's sessionStorage only. It is never written to persistent storage, never sent to any server other than your own Salesforce instance, and it is destroyed when you close the tab.

Where does my Salesforce metadata go?

Nowhere. OrgKit has no backend. All API calls go directly from your browser to your Salesforce instance. Metadata is processed in browser memory and discarded.

What does OrgKit log?

Nothing on any server. An audit log of changes you make is kept in your own browser's localStorage so you can export it for change management — it never leaves your machine.

Is my Salesforce password stored anywhere?

No. You log in on Salesforce's own login page via OAuth. Your credentials never pass through OrgKit.

Does OrgKit touch my records or data?

No. OrgKit tools work on the metadata layer (automations, fields, profiles, OmniStudio components). They never read or write your business records.

Trust & Security

You're about to point a free tool at an org you're responsible for. Here is exactly what OrgKit can see, store, and do — and what it can't.

Where does my token live?

Browser memory

Where does my metadata go?

Nowhere

What do you log?

Nothing

Architecture: there is no server

OrgKit is a set of static pages. There is no backend, no database, no API of ours in the middle. When you use a tool, your browser talks directly to your Salesforce instance over HTTPS using Salesforce's own APIs. That's why each org needs a one-time CORS allowlist entry — Salesforce is verifying that your org's admin approved this site to make browser calls, which is a security feature, not a workaround.

OrgKit works on the metadata layer only — automations, object schemas, profiles, OmniStudio components. It never queries or writes your business records.

Your access token

You authenticate on Salesforce's own login page (OAuth 2.0). Your username and password never pass through OrgKit.
The access token is kept in sessionStorage only — it is destroyed when the tab closes and is never written to persistent storage.
The token is only ever sent to one place: your own Salesforce instance URL.
Disconnect any time — or revoke the session in Salesforce under Setup → Session Management.
Prefer full control? Create your own Connected App in your org and use its Consumer Key instead of OrgKit's shared one. Your admin then controls scopes, IP ranges, and session policies.

What stays in your browser

So that snapshots and audit trails survive a browser restart, OrgKit keeps non-sensitive working data in your browser's localStorage: org nickname and instance URL, automation snapshots, your local audit log, and preferences. None of it contains credentials, and none of it ever leaves your machine. Clearing site data removes everything.

Safety rails for destructive actions

Snapshot before change — Migration Mode auto-snapshots the exact active/inactive state of every automation before touching anything.
Verified toggles — after every change, the tool re-reads Salesforce to confirm the change actually applied. Silent failures are surfaced, not swallowed.
Crash-safe bulk operations — bulk changes are journaled locally item-by-item. If your tab crashes or your session expires mid-run, you can resume exactly where you stopped after reconnecting.
Production friction — entering Migration Mode on a production org requires typing the org name to confirm.
Audit log — every change is recorded locally with timestamps and before/after state, exportable to CSV for your change ticket.

Common security-review questions

Is my password stored anywhere?

No. Login happens on salesforce.com via OAuth. OrgKit only ever receives a short-lived access token.

Do you use analytics or tracking?

If enabled, only privacy-friendly, cookie-free page analytics (counts, not identities). Never any org data, metadata, tokens, or Salesforce responses.

What scopes does the shared Connected App request?

API access sufficient for the Tooling and REST API calls the tools make. If your policy requires narrower control, use your own Connected App — every tool supports it.

Can OrgKit modify my org without me?

No. There is no server to act on your behalf and no stored credentials. Every change happens live, from your browser, in your session, and is written to the local audit log.

Is the code auditable?

Each tool is a single, unminified HTML file — View Source shows you everything that runs. No bundlers, no third-party JavaScript dependencies.

Terms of use

OrgKit is provided free of charge, "AS IS" and without warranty of any kind, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, and non-infringement. In no event shall the author be liable for any claim, damages, or other liability arising from the use of these tools.

You are solely responsible for: changes made to any Salesforce org through these tools; compliance with your organization's and your clients' change-management, security, and access policies; and verifying results after any operation. Test in a sandbox before using in production.

OrgKit is an independent project by Himadeep Guduru. It is not affiliated with, endorsed by, or supported by Salesforce, Inc. Salesforce and related marks are trademarks of Salesforce, Inc.

Found a security issue?

Please report it privately via GitHub — responsible disclosure is appreciated and acknowledged.