Due diligence
Plan access and data handling before work starts.
Understand who needs access, what data crosses systems and how a change will be tested and released. These questions help your team assess the proposed work and responsibilities.
The proposal identifies which records and reviews Gosai will prepare, which approvals belong to your team, and who operates the result after handover.
Scope access to the work
Gosai can prepare an access matrix for the agreed environments, objects, fields, records and administrative capabilities. Your authorized owner approves grants and removal; the delivery plan distinguishes ordinary work from elevated production actions.
- Can the task be completed in a lower environment?
- Which permissions are necessary, and who approves them?
- Who owns service accounts, credentials and access removal?
- Which production actions need separate approval?
Keep data handling explicit
Gosai can map the information used by the change, its source and permitted recipients. The handling record identifies necessary exports, working copies and logs, with access and deletion responsibilities for your review. Use synthetic or redacted examples where practical; omit worker, client or health information from the initial website inquiry.
- Can synthetic or redacted data support the work?
- Would any data leave Salesforce?
- Which tools or providers would receive it?
- What retention, deletion and residency requirements apply?
Plan the change and its recovery
For scoped implementation, Gosai proposes a dependency review, acceptance examples and a release plan naming the approval owner and recovery actions. Migrations and destructive updates need their own recovery evidence: a code rollback may not restore changed data. The plan records when to stop, recover or escalate.
- What test evidence will the acceptance owner review?
- What happens if an integration or notification fails?
- What is recoverable, and what needs backup or reconciliation?
- Who owns production monitoring and support after release?
Ask for evidence that matches the scope
Select the artifacts that answer your due-diligence requirements in the proposal. Gosai’s proposed contribution and your approval or operating responsibilities should be explicit.
| Topic | Decision to establish | Proposed review artifact |
|---|---|---|
| Access | Approved permissions, grant owner and removal point | Access matrix or approval record |
| Data | Allowed locations, recipients and retention | Data-flow and handling record |
| Release | Acceptance owner, release authority and recovery | Test and release records |
| Operations | Incident, monitoring and follow-on responsibilities | Ownership or support guide |
- Topic
- Access
- Decision to establish
- Approved permissions, grant owner and removal point
- Proposed review artifact
- Access matrix or approval record
- Topic
- Data
- Decision to establish
- Allowed locations, recipients and retention
- Proposed review artifact
- Data-flow and handling record
- Topic
- Release
- Decision to establish
- Acceptance owner, release authority and recovery
- Proposed review artifact
- Test and release records
- Topic
- Operations
- Decision to establish
- Incident, monitoring and follow-on responsibilities
- Proposed review artifact
- Ownership or support guide
Your environment may change the approach
Restrictions on cloud services, external tools, production access or data movement can affect the solution. Evaluate native Salesforce work, client-owned supporting infrastructure and hybrid arrangements against the requirement and available capability. The scoped recommendation compares the permitted options and explains the selected approach.
Website inquiries have a separate privacy notice
The contact form and systems delivering this website are distinct from a client Salesforce engagement. See the website privacy notice; client-data processing terms belong in the relevant agreement.
Review the proposed delivery stages and engagement questions. Have a security questionnaire or access constraint? Mention it in your inquiry so it can be considered before scoping. Do not submit credentials or sensitive records through the form.
Scope of this overview
These are proposed engagement deliverables, with depth and inclusion agreed in writing. This page is not a compliance attestation or a claim that every listed control is already established. Client-data processing, security requirements and operating responsibilities belong in the relevant agreement.