Introduction

Protecting your organization's data is a shared responsibility. Maintaining a secure Soapbox Engage account involves following good security practices for your Soapbox Engage users, connected CRM systems, payment gateways, and other third-party integrations.

We recommend regularly reviewing your account settings, user access, authentication credentials, and integrations to help reduce security risks and prevent unauthorized access.

The recommendations below are intended as general security best practices and are not an exhaustive list of security measures. Every organization's systems, integrations, and security requirements are different. We strongly encourage you to work with your IT and security professionals to evaluate your specific environment, implement appropriate safeguards, and ensure your use of Soapbox Engage aligns with your organization's security policies.

Soapbox Engage security best practices

We recommend that all organizations regularly review their Soapbox Engage account security and follow these best practices:

1. Regularly review and update user passwords. Review your Soapbox Engage user passwords according to your organization's security policies. Ensure passwords are strong and unique, and reset them immediately if there is any concern that an account or password may have been compromised.
2. Use individual user accounts. Each person accessing the Soapbox Engage administrator interface should have their own user account. Avoid sharing usernames and passwords among staff members, contractors, or other users.
3. Limit administrative access. Review which individuals have access to your Soapbox Engage administrator interface and ensure access is granted only to those who need it to perform their responsibilities.
4. Promptly remove access for former staff and contractors. Disable or remove accounts when individuals leave your organization or no longer require access. Regularly review your list of authorized users to identify accounts that are no longer needed.
5. Use strong, unique passwords. Avoid reusing passwords across Soapbox Engage and other systems. We recommend using a reputable password manager to generate and securely store unique passwords.
6. Protect your devices and login credentials. Ensure computers and devices used to access Soapbox Engage are kept updated with current security patches. Be cautious of phishing attempts and never share passwords or sensitive credentials through unsecured communication channels.
7. Report suspicious activity promptly. If you suspect unauthorized access to your Soapbox Engage account, immediately review affected credentials, restrict access as appropriate, and contact Soapbox Engage support for assistance.

Integration security best practices

If your Soapbox Engage account connects to external services, such as Salesforce, Microsoft Dynamics, payment gateways, or other third-party services, we recommend regularly reviewing the security configurations of those integrations.

Integration security best practices include using dedicated integration accounts, restricting access to authorized systems and IP addresses where supported, limiting permissions to only what is required, securely managing authentication credentials, and revoking unnecessary or outdated access.

Salesforce integration

If your Soapbox Engage account connects to a Salesforce organization, we recommend reviewing your existing integration configuration and following these security best practices.

1. Always use a dedicated Salesforce Integration User license. We recommend using Salesforce's purpose-built Integration User license for your Soapbox Engage integration rather than a standard Salesforce user account.
2. Regularly reset an existing Salesforce integration user's credentials.  Then, update the corresponding credentials as appropriate in Soapbox Engage to ensure your integration continues operating after you have updated the credentials.
3. After updating a Salesforce integration user's security credentials, revoke existing Salesforce sessions and authentication tokens associated with the Salesforce integration user.  This is a good best practice when updating Salesforce user credentials.  Included in this should be applicable API and connected-app sessions.
4. Always restrict access to authorized Soapbox Engage IP addresses. Configure IP restrictions on the Salesforce Profile used by the Salesforce integration user using our list of authorized Soapbox Engage IP addresses:
   1. 3.128.138.191
   2. 18.224.131.69
   3. 18.222.57.245
5. Review and minimize the integration user's permissions. Ensure the Salesforce user has access only to the Salesforce objects, fields, records, and operations required.

Further documentation regarding Salesforce integration user configuration for Soapbox Engage can be found in our support article:  Using Salesforce Integration User Licenses with Soapbox Engage

Other integrations

For any additional systems connected to Soapbox Engage, including Microsoft Dynamics, payment gateways, and third-party services, we recommend working with your IT and security professionals to:

1. Use dedicated integration accounts or credentials wherever supported.
2. Grant only the permissions required for the integration to operate.
3. Securely store API keys, passwords, access tokens, and other authentication credentials.
4. Review and rotate credentials according to your organization's security policies.
5. Restrict access to authorized IP addresses or systems wherever supported.
6. Remove unused integrations and revoke credentials that are no longer needed.
7. Regularly review the security recommendations provided by each connected service.

Maintaining strong security requires ongoing attention. We encourage organizations to periodically revisit these recommendations with their IT and security teams as their technology, staffing, and operational needs evolve.