Salesforce Simplified Was Built Without a Backend

Browser extensions have a trust problem.

They can potentially see a lot.

So when an extension is designed for something as sensitive as a Salesforce org, the architecture matters as much as the features.

Salesforce Simplified takes a deliberately different approach:

There is no server belonging to the extension.

Your Salesforce data stays between your browser and your Salesforce org.

No account required

Salesforce Simplified doesn't require you to create an account.

There is no Salesforce Simplified cloud account storing your organizations.

There is no dashboard hosted somewhere else.

There is no profile database.

You install the extension and use it with Salesforce.

Salesforce queries go to Salesforce

The extension's primary job is to interact with the Salesforce org you are already working in.

Metadata queries, debug-log information, setup information and other Salesforce data are retrieved from your org.

They are not sent to an external Salesforce Simplified backend for processing.

This keeps the architecture simple:

Browser → Salesforce

rather than:

Browser → Extension Server → Salesforce

Local usage analytics

Salesforce Simplified includes Usage Analytics, but the analytics aren't transmitted to a remote analytics platform.

The extension stores its usage counters in the browser.

They're maintained separately for each Salesforce org.

That allows the extension to calculate things such as:

• Features used

• Number of uses

• Active days

• Usage streaks

• Longest streak

• Estimated time saved

without requiring a telemetry service.

The time-saving calculation also exposes its per-feature weighting, so users can understand how the estimate was produced.

No telemetry

There is no hidden event stream recording:

• Which Salesforce org you use

• Which components you open

• Which users you investigate

• Which metadata you download

• How frequently you use the extension

• What you search for

The extension doesn't need that information to perform its job.

So it doesn't collect it.

The one external service

There is one exception.

The Trust Status feature needs current Salesforce service-health information.

For that feature, the extension contacts Salesforce's public status API.

It does not send your Salesforce metadata to a third-party analytics service to obtain that information.

Minimal browser permissions

Salesforce Simplified requests three extension permissions:

Storage

Used for settings and locally stored usage information.

Clipboard Write

Used for copy functionality.

Identity

Used when the Connected App authentication flow is required.

The extension's host access is restricted to Salesforce org domains.

It isn't designed as a general browser surveillance extension that can inspect arbitrary websites you visit.

Authentication when Salesforce hides the session

Most Salesforce environments can use the existing Salesforce session.

Some organizations deliberately prevent scripts from accessing the Salesforce session cookie.

This can happen through Salesforce session-security settings such as restricting session cookies to their original domain or using HttpOnly.

In those environments, Salesforce Simplified can use a Connected App.

The authentication flow uses:

OAuth 2.0 Authorization Code with PKCE

PKCE is particularly important for browser-based applications because there is no client secret embedded in the extension.

A browser extension is not a secure place to hide a traditional client secret.

So Salesforce Simplified doesn't pretend otherwise.

Your organization controls the Connected App

Organizations that restrict Connected Apps can create their own.

The extension allows you to select where authentication should begin:

• Current Salesforce org

• Production

• Sandbox

• Custom login URL

When a Connected App needs to be created, the extension provides the callback URL needed for configuration and asks for the organization's Consumer Key.

This keeps authentication under the Salesforce administrator's control.

Why open source?

Security claims are stronger when users can inspect the implementation.

Salesforce Simplified is MIT licensed and open source.

That means developers can inspect the code, report problems, propose improvements, and contribute changes.

The project isn't asking users to blindly trust a proprietary server.

There isn't one.

The design principle

The architecture follows a simple principle:

If the extension doesn't need your data, don't collect it.

There is no reason a Salesforce productivity tool needs to build a database of everything its users search for.

There is no reason it needs to know which Salesforce orgs its users access.

There is no reason it needs to send usage events to an analytics company.

The browser already has everything necessary to provide the core functionality.

So Salesforce Simplified keeps the data there.

A different model for Salesforce tooling

Salesforce developers already trust their Salesforce org with some of their most important business information.

Adding another external service between the developer and Salesforce creates another system that must be trusted, secured, monitored and maintained.

Salesforce Simplified avoids that additional layer.

It is intentionally local where it can be.

It talks directly to Salesforce where it needs Salesforce data.

And it keeps its own usage information in the browser.

No account. No telemetry. No extension backend.

Just a productivity layer for the Salesforce org you already use.