Read-Only · Your Data Stays in Your Tenant · <5 min Setup

See what breaks before it breaks in your Salesforce org.

Every certificate, Connected App, Named Credential, Auth Provider, and scheduled job in your org, mapped to what depends on them. When an asset is about to fail, you see the blast radius before the integration goes down. Read-only architecture. Salesforce‑native managed package. Your business data stays in your tenant.

Install Free from AppExchange Coming soon See pricing

Prefer direct support? Apply for beta

Read-Only

Access Model

100%

Salesforce-Native

Asset Types Discovered

<5 min

Setup Time

OrgGuard Home Dashboard showing KPI cards for assets monitored, critical findings, ownership coverage, and scheduled job health, plus a certificate expiry timeline, active findings list, category breakdown, findings trend chart, and discovery coverage gauge.

Most teams cannot answer what breaks when a certificate expires without hours of manual investigation. OrgGuard gives you that answer in one click.

An expired certificate does not warn you. The integration stops, and it stays stopped until someone works out which certificate did it. OrgGuard maps that dependency before the expiry date instead of after the outage, and keeps the ownership record an auditor asks for.

Surprise integration outages

Certificates expire without warning. Connected Apps break silently. You find out when customers call, not before.

Spreadsheet tracking

Manually tracking cert expirations, credential owners, and renewal dates across disconnected spreadsheets that go stale within weeks.

Auth asset blind spots

No single view of all certificates, Connected Apps, Auth Providers, Named Credentials, and External Credentials. You don't know what you don't know.

Costly audit scrambles

Compliance teams spend weeks manually assembling evidence for SOC 2 and GDPR audits. Failed audits block enterprise sales and invite regulatory exposure.

See the blast radius

Every certificate shows its dependent configurations: Named Credentials, the Identity Provider, Connected Apps. Know what breaks before you act, not after.

A complete integration register

Every Connected App, Auth Provider, Named Credential, and External Credential, discovered automatically with owners and findings. No spreadsheets. No guessing.

Audit-ready, no add-on licensing required

Compliance evidence generated on demand. Policy violations tracked with full lifecycle audit trails. No more last-minute scrambles before SOC 2 reviews.

Automated daily discovery replaces spreadsheets

Every auth asset is inventoried, categorized, and monitored with ownership tracked and enforced. No manual updates, no stale data.

One Click

See what an expired cert breaks

Automated

Eliminate spreadsheet tracking

< 5 min

Compliance report generation

In-Tenant

Data residency

Your Salesforce business data stays in your org.

See the blast radius — monitor Salesforce certificate expiration before it breaks an integration

OrgGuard runs entirely inside your Salesforce org. It maps certificate dependencies, discovers auth assets, monitors scheduled jobs, and enforces governance policies against your org's own metadata. Your business data stays in your tenant.

Certificate Dependency Mapping

Every certificate shows its blast radius: which Named Credentials, the Identity Provider, Connected Apps, SAML configs, and Outbound Messages depend on it. Tracks three cert classes (Outbound, Inbound mTLS, Connected App JWT) with optional owner tagging and a complete findings lifecycle.

Auto-Discovery

Automatically finds certificates, Connected Apps, Auth Providers, Named Credentials, and External Credentials using standard Salesforce Platform APIs. No add-on licenses required.

Policy Engine

Configurable policies detect expiring certificates, missing owners, and unknown expiry dates. Findings span five severity levels: Critical, High, Medium, Low, and Informational.

Smart Notifications

Email alerts to asset owners and admin groups with built-in deduplication to prevent alert fatigue. Full delivery tracking.

Dashboards & Reporting

Inventory dashboard with expiry metrics, findings dashboard by severity and status, coverage summary with confidence levels, and CSV export.

Scheduled Job Health

Detects scheduled Apex jobs running under inactive users and consecutive failures before they cause silent data or integration outages. Routes findings to the current responsible owner.

Setup in 5 Minutes

Guided 7-step wizard handles permissions, policies, scheduling, email, and your first scan. Mid-flow save if you need to step away.

Security First

Read-only access to assets. No secrets stored. No third-party callouts. CRUD/FLS enforced everywhere. Every Apex class declares explicit sharing keywords.

Audit Trail

Immutable event log for every certificate change, job failure, and policy action. Queryable history for compliance reporting without custom report types.

See what depends on every certificate, Connected App, and Auth Provider

From certificate inventory to dependency mapping, every screen runs inside your Salesforce org.

Home Dashboard with KPI cards, certificate expiry timeline, and active findings

Home Dashboard: KPI cards, expiry timeline, findings, and coverage at a glance

Certificate Inventory showing dependency counts per certificate

Certificate Inventory with dependency counts

Certificate detail showing 7 dependent configurations

Blast radius: 7 configurations depend on this certificate

Certificate detail view with Dependencies and Findings tabs

Certificate detail with dynamic tab labels and findings

Certificate Inventory filtered to show only certificates with 3 or more dependencies

Filter by dependency count to prioritize high-impact certificates

Certificate with zero dependencies, potentially unused

Zero dependencies: this certificate may be unused

How it works

Three steps. Five minutes. Your org is governed for life.

Install

Install the managed package from AppExchange. No external dependencies, no infrastructure to provision. Works with any Salesforce edition that supports managed packages.

Scan

Run the guided 7-step setup wizard. OrgGuard scans every Connected App, Auth Provider, Named Credential, External Credential, and certificate in your org and builds your inventory.

Monitor

Daily scheduled scans keep your inventory fresh. Policies trigger findings, owners get notified, and your team stays ahead of every expiration and ownership gap.

The gap OrgGuard fills

Salesforce orgs grow integration complexity faster than governance tooling catches up. Native cert expiry emails tell you a certificate is expiring; they don't tell you the six Named Credentials and two Connected Apps that stop working when it does. OrgGuard fills that gap. Built on standard Salesforce Platform APIs, running entirely inside your org, with no add-on licensing required.

Runs entirely inside your Salesforce org
Your business data stays in your Salesforce tenant
No add-on licensing required

Where OrgGuard is headed

Beta participants shape what ships next.

Pre-Deactivation Readiness

Before you deactivate a user, see exactly what breaks.

See Pro+ features

Log Analyzer

Turn login, setup, and integration event logs into dashboards and alerts, tied to the assets they affect.

See Pro+ features

Credential blast radius

Trace every Apex class, Flow, and job that depends on a credential before it expires.

See the roadmap

Join the Private Beta

We're working with a small group of Salesforce teams to shape OrgGuard's roadmap. Beta participants get priority onboarding and lock in founding-cohort pricing, locked for 24 months, when we go GA.

Install Free from AppExchange Coming soon Or apply for beta

Frequently asked questions

What auth assets does OrgGuard track?

Connected Apps, Auth Providers, Named Credentials, External Credentials, and certificates (both org-issued and uploaded). Discovery runs entirely inside your Salesforce org using standard Salesforce Platform APIs. No external systems required.

Which Salesforce editions are supported?

Any edition that supports managed packages: Professional, Enterprise, Unlimited, and Developer. Essentials is supported with limited functionality.

How long does installation take?

Less than 5 minutes for the package install, plus our 7-step guided setup wizard for permissions, policies, scheduling, and your first scan. Most teams are fully governed within 30 minutes.

Does OrgGuard require any Salesforce add-on licensing?

No. OrgGuard runs on standard Salesforce Platform APIs available on Enterprise, Unlimited, Developer, and Professional editions. No additional licensing required.

Is my Salesforce data sent outside my org?

No. Your business data stays in your Salesforce tenant. OrgGuard runs entirely inside your org, stores no secrets, and only the standard LMA license metadata (org ID, package version, tier, etc.) is synchronized via Salesforce's own infrastructure. Every Apex class declares explicit sharing keywords and CRUD/FLS is enforced everywhere. See the Trust & Privacy page for the field-level disclosure.

Govern every certificate, Connected App, and integration in your org.

OrgGuard installs in minutes, maps every certificate to its dependent integrations, and shows you the blast radius on day one. No external dependencies. No add-on licensing required.

Install Free from AppExchange Coming soon Or apply for beta Contact Us →