Technology & Tool Disclosures
Last updated: February 2026
SFDevTools is built on modern, battle-tested infrastructure. Below is a transparent disclosure of the third-party services and technologies that power the platform.
Hosting & Infrastructure
| Component | Provider | Purpose |
|---|---|---|
| Frontend App | Netlify | Hosts the SFDevTools web application at app.sfdevtools.com |
| Landing Page | Netlify | Hosts this site (sfdevtools.com) |
| Backend API | Deno Deploy | Serverless runtime for the API at api.sfdevtools.com |
| Database | Supabase | Managed PostgreSQL database with Row Level Security |
| Cache | Upstash Redis | Optional serverless Redis for performance caching |
Frontend Stack
- React with Vite for the main application
- TanStack Router for file-based routing
- TanStack Query for server state management
- Tailwind CSS and Shadcn UI (Radix Primitives) for the interface
- Lucide React for iconography
Backend Stack
- Deno runtime with Hono framework
- Supabase JS client for database operations
- Upstash Redis client for cache operations
- Zod for request/response validation
Security Infrastructure
- pgcrypto PostgreSQL extension for cryptographic functions
- AES-256-GCM encryption for stored Salesforce OAuth tokens
- Row Level Security (RLS) enforced on all database tables
- Gzip compression for cached data (reduces Redis footprint ~10x)
Data Processing & Authentication
- Supabase Auth handles user authentication.
- Salesforce OAuth 2.0 (PKCE) handles org connections via standard Connected App flow.
- All Salesforce API calls are proxied through our backend - your credentials never touch the browser.
- Dynamic Scopes: We strictly follow the principle of least privilege. "Session Only" connections request only
apiandwebscopes. "Persistent" connections additionally requestrefresh_tokenandoffline_access. - OAuth tokens are encrypted at rest and decrypted only when making API calls on your behalf. "Session Only" connections are explicitly purged upon user logout.
- Query results and metadata can be optionally cached with a user-controlled TTL.
- User execution history (SOQL/Apex) defaults to browser Local Storage. Cloud synchronization to our database is strictly opt-in.
For questions about our technology choices or security practices, contact us at support@sfdevtools.com.