Every risky permission in your org. Traced to its source.

A Salesforce permissions audit is a diagnostic that surfaces over-permissioned users, stale permission sets, integration users with excessive access, and the gap between what users have access to versus what they actually need. The audit reads your org directly (read-only OAuth), scores each user on a 0–100 risk scale, and traces every permission back to the profile or permission set that granted it. Clientell offers a free version that returns results in 10 minutes with a 24-hour remediation plan.

Consulting partners charge $5,000 to $25,000 for a manual permissions review. Big-4 SOC 2 audit firms add another $20,000 to $50,000 to map permissions against the SOC 2 control framework. Clientell runs the equivalent audit for free, returns results in 10 minutes, ships the compliance mapping included, and produces evidence-ready exports for ISO 27001, GDPR, HIPAA, and NIST CSF in addition to SOC 2.

The scan runs in roughly 10 minutes against a read-only OAuth user. The full report, including per-user risk roster, effective-access drill-downs, profile consolidation proposal, and stale-permset cleanup queue, is delivered in 24 hours. Manual consulting audits typically take 2 to 6 weeks.

Yes. The scan, the risk roster, the effective-access reports, the consolidation plan, the stale-permset queue, and the compliance framework mapping are all free with no paid engagement required. The free version is the same product paid customers use, just without the ongoing monitoring layer.

Effective access is the union of every permission a user actually has, regardless of whether it came from a profile, a permission set, a permission set group, or a role hierarchy. Most audits stop at "this user has X profile and Y permission sets". Effective access goes further: for each individual permission the user holds, it traces back the exact assignment source. This is what auditors actually want to see during a SOC 2 or ISO 27001 review.

Salesforce Optimizer is a free Salesforce-native tool that produces a static PDF of generic recommendations. It does not score per-user risk, does not benchmark against industry, does not produce effective-access reports, and does not propose sandbox-tested fixes. Our audit scores 0–100 per user, benchmarks against 1,000+ scanned orgs, traces every permission to its source, and ships a one-click fix per finding.

In a clean org, fewer than 25. Above 25 and you almost certainly have profile sprawl: each profile is a near-copy of one above it with a small modification, and nobody knows the full picture. Our audit maps the overlap between your profiles, proposes a consolidation set (typically reducing 30+ profiles to 8–12), and shows the per-user access impact before you apply.

Healthy benchmark is under 5%. The orgs we scan typically run at 20–30%, often because the original 'temporary' admin grant from a 2021 project was never revoked. Each SysAdmin user is a permanent backdoor with broad Modify All Data and Manage Users rights. Our audit flags every SysAdmin user, proposes a scoped substitute permission set, and lets you downgrade them with one click in sandbox.

Yes, and integration users are usually the worst-performing user class in the audit. Service accounts created in 2020 with full Administrator profile because it was easier than scoping. Our audit lists every integration user, the API call patterns they actually use, and proposes the least-privilege permission set that would let them keep working without the SysAdmin breadcrumbs.

A read-only OAuth user with API access plus Setup Audit Trail read permission. We do not write to your org during the scan. We do not export PII. The OAuth connection can be revoked at any time. The audit is SOC 2 Type II compliant and the entire scan happens in our customer-isolated infrastructure.