Implementation reference · Checked 14 September 2026
Fin and your Salesforce data
A starting point for your administrator and security reviewer. The access granted in your org, installed package and selected channel determine the final scope.
| Area | What happens |
|---|---|
| Reads | The Cases integration syncs Case, Contact and Account fields and reads conversation content, including supported attachments. Field values refresh when Fin is assigned a Case; changes during that session are picked up at its next assignment. |
| Writes | Fin adds replies and Case activity, writes involvement and resolution fields, and sets a configured user or queue at handover. Workflows can populate additional Case fields. |
| Customer records | A separate setting controls updates to matched Contacts and Accounts. Turning it off keeps record matching but prevents those updates through this setting. |
Sources: Case data sync and write controls · Message and object permissions.
The controls your team owns
Review the connected Salesforce user’s effective access, including permissions outside the Fin package. The documented package grants Case create/read/edit and Contact/Account read/edit; it does not grant delete or view/modify-all-records permissions on those objects. That is a package boundary, not a guarantee about an already privileged user. Package reference.
Choose the content sources, permitted workflow actions and receiving teams. Salesforce assignment rules run on Fin’s writes when the corresponding setting is enabled. Guidance tells Fin how to respond; it does not itself authorise Salesforce access or connect a banking API.
Knowledge and live chat are separate paths
Salesforce Knowledge has its own article-sync setup and audience restrictions. Live handover has channel-specific permissions and mappings. Review the path you use, rather than treating every integration permission as a universal requirement. Knowledge sync · Connection and chat setup.
Hosting and stopping access
Check the hosting region of the actual Fin workspace and the applicable retention, subprocessors and contract terms. Do not infer its location from your Salesforce org. Fin regional hosting.
Salesforce lets you revoke an app’s OAuth access; revoke all of its access tokens when removing access. Also review whether it can be authorised again under your app policy. Revocation is not a data-deletion request or a substitute for a customer-support fallback. Salesforce access revocation.
Before approval
Record the connection and channel, requested OAuth scopes, effective user permissions, allowed fields and content, hosting/retention terms and the person who can pause the integration. Verify them against the deployed configuration. This guide is not a security certification.
Back to the walkthrough · Prepare your scoping brief
Talk through your trial
Request a 30-minute call Opens a Google Calendar booking page
What to have ready for the call: what the trial should prove, which requests Fin should try first, where customers should reach it, and your rough monthly support volume.