Using aprity in Audits and Reviews
Auditors and reviewers often ask how your Salesforce org behaves: which rules protect the data, what automation runs when, who can access what, and what changed over time. aprity documentation helps you answer these questions quickly, from the org's own metadata.
What aprity can bring
| Question | Where to find it in the portal |
|---|---|
| What business rules apply to this object, and when? | The object page, Rules & validations tab, and the execution graph. |
| Who can read or change this object? | The object page, Access tab. |
| Which external systems does the org exchange data with? | The Integrations & API part of the documentation, and the integration map. |
| What changed since the last review? | Coverage and fidelity > Versions: rules added, modified and removed between two analyses. |
| How complete is this documentation? | Coverage and fidelity > Coverage: what was documented and what is excluded by design. |
| How accurate is it? | Coverage and fidelity > Verification: the fidelity certificate, with its sample, verdicts and scope. |
Each analysis produces a dated version. A version shows the org as it was when the analysis ran.
What aprity does not do
Be clear about these limits with your auditors:
- aprity is not a compliance certification. It does not assess your org against a framework (SOC 2, GDPR, ISO 27001 or others) and does not tell you whether a control is sufficient.
- The documentation describes configuration, not operations. It does not show who changed what and when in Salesforce, nor what happened to individual records.
- AI-written text can contain errors. The fidelity certificate measures accuracy on a sample and says what it does not cover. For evidence, rely on the computed facts (rules, dependencies, access) and check narrative text against the source.
- A version marked Partial documentation has gaps. Do not present it as complete.
Prepare for an audit
- Run an analysis a few days before the review, so that the version is recent and your team has time to check it.
- Check coverage and fidelity of that version. Explain any gap or divergence on the objects in scope.
- Handle reader feedback on the objects in scope, so that corrections are applied.
- Share links to the pages in scope with the reviewers who have portal access. Each link points to that version.
Your data
aprity reads metadata (configuration), not your business records. For where aprity stores data and how long, see Data Residency and Privacy.