OmniStudioBeginnersecurityomnistudio
What security considerations apply to OmniStudio?
Real World Scenario
OmniScript calls external credit API with customer SSN. Security team asks about protection.
Expected Answer
• Store API secrets in Named Credentials or OmniStudio secured settings—not in scripts
• Run sensitive Integration Procedures server-side; never expose keys in browser
• Respect Salesforce sharing and FLS in DataRaptor extracts
• Log PII minimally; mask in FlexCard display where possible
• Profile and permission set control access to OmniScript actions
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Only if explicitly exposed with strict guest profile limits. Review every DR field exposed to guest.
Architect Perspective
OmniStudio security = Salesforce security + no secrets in client—dual message.