⚠️ Action required. To avoid any interruption to syncing between Salesforce and the Trust Center, please complete this upgrade before July 31, 2026.
Overview
Drata is upgrading the SafeBase Trust Center Salesforce managed package from first‑generation (1GP) to second‑generation (2GP) packaging. This upgrade modernizes how the app connects to and authenticates with the Trust Center, and is required to keep the Salesforce ↔ Trust Center integration running as the legacy connection method is retired.
This new version consolidates both the standard integration and currently optional managed package into a single, modern managed package with a supported upgrade path.
Important Terminology
OAuth External Client App
This is the standard Trust Center Salesforce integration. Its OAuth external client app powers auto-approve, NDA bypass, the advanced rules engine, and the Trust Center's Advanced Analytics.
Lightning components
This optional component (formerly the "SafeBase SFDC Managed App") adds an "Add to SafeBase" button inside Salesforce. From there, users can create accounts, invite contacts, upload questionnaires, and more to the Trust Center without leaving Salesforce.
Why this upgrade is necessary
Salesforce now requires External Client Apps (ECAs) for inbound integrations. In its Spring '26 release, Salesforce restricted the creation of new Connected Apps (the legacy OAuth app model) by default across both the UI and the Metadata API (re-enabling requires a request to Salesforce Support), and made External Client Apps the primary way to define inbound external integrations.
Older versions of the integration authenticated through a shared Connected App
The new version ships a dedicated ECA in the managed package. ECAs separate the app from its OAuth policies and give admins stronger, more granular control over scopes, IP relaxation, and session and consent policies.
Upgrading keeps the integration aligned with Salesforce's current security requirements and support going forward.
Upgrading also keeps the account, contact, and questionnaire syncing working without interruption. Along with any access request auto approve/deny rules or NDA-bypass rules organizations have configured for the Trust Center, this includes Enterprise Analytics.
What's in the SafeBase package?
Earlier versions (v1.21 on 1GP and before) included only the SafeBase Lightning components, the optional UI elements organizations can add to Salesforce record pages. The new version includes those and the SafeBase OAuth External Client App (ECA).
OAuth External Client App (required). The ECA authorizes the SafeBase Trust Center ↔ Salesforce integration so it can connect to and sync data. It is required to use the integration at all.
Lightning components (optional). As they always have been, the Lightning UI components are optional. If organizations would rather not use them, they can ignore them entirely; they have no effect unless an organizations adds and configure them.
Security improvements in this release
Dedicated OAuth connection (External Client App)
The integration now authenticates through a dedicated, scoped OAuth application instead of a shared Tray.ai one.
Organizations can apply their own IP restrictions to the connection.
Only a minimal set of OAuth scopes are requested (
api,id,openid, andrefresh_token) instead of the broadfull(full-access) scope the previous app required.
Secure credential storage (Named Credentials).
If organizations use the SafeBase Lightning components inside Salesforce, the SafeBase API key is stored using Salesforce's encrypted Named Credential / External Credential framework, so it is never kept in plain configuration or exposed in code.
If only using the OAuth connection (so SafeBase can sync data from Salesforce), no Named Credential or API key configuration is required.
Field‑level security.
Access to SafeBase fields is governed by a dedicated SafeBase User permission set, so only authorized users can read or write SafeBase data.
Modern, supported packaging (2GP).
A cleaner, reliable upgrade and lifecycle path for future releases.
How to find the installed SafeBase version
In Salesforce, click the gear icon → Setup.
In the Quick Find box, type Installed Packages, then select it.
Locate SafeBase in the list (namespace prefix
safebase).Note the Version Number shown next to it (for example,
1.21) and the packaging mode (for example,1GP).
If SafeBase isn't listed, it is not installed, so use the New install path below.
All SafeBase installations from before this migration are first‑generation (1GP).
Use the version number found above to choose the upgrade path listed below.
How to upgrade
New install (SafeBase not currently installed)
Install the latest version directly. No migration needed.
Open the SafeBase 2GP 1.24 install link
Choose Install for All Users, then complete the installation.
Complete Required setup after upgrading below.
Note: For a sandbox, change login to test in the URL.
If currently on version 1.21 (1GP)
Important: Upgrade in two steps, in this order. Installing 1.24 directly will fail with a namespace conflict, so step 1 is required first.
Note: For sandboxes, change login to test in both URLs.
If currently on a version older than 1.21 (1GP)
The migration step must match version 1.21, so first bring the installation up to 1.21, then migrate.
Upgrade to 1GP 1.21 using this link
Follow the If currently on on version 1.21 steps above
(migrating to 2GP 1.21, then upgrade to 2GP 1.24).Complete Required setup after upgrading below.
Required setup after upgrading
Reconnect the SafeBase integration (required for everyone).
In the SafeBase app, go to Settings (in the lower left) → Integrations and reconnect Salesforce so the integration authenticates through the new External Client App.
Assign the SafeBase User permission set (for Lightning-component users).
If using the SafeBase Lightning components, assign each of those users the SafeBase User permission set via Setup → Permission Sets → SafeBase User → Manage Assignments → Add Assignment.
This grants both field-level access to the SafeBase fields and the External Credential Principal Access the components need to authenticate their API calls.
Note: This installs for All Users and grants field access but does not assign permission sets, so this step is still required for component users.
If only using the OAuth connection, this can be skipped
Set a SafeBase API key (Lightning components only).
Store the SafeBase API key on the packaged SafeBase API external credential: Setup → Named Credentials → External Credentials tab → SafeBase API → under Principals, edit SafeBasePrincipal → set the x-sb-api-key parameter → Save.
While there, confirm callouts are enabled on the SafeBase API named credential (the package ships them on; turn them back on if a Salesforce security checkpoint disabled them during install).
If only using the OAuth connection, skip this step.
Note: For full configuration and connection steps of the Lightning app, see the SafeBase Salesforce Managed App Setup Guide.
Frequently asked questions
Will I lose any data or configuration when I upgrade?
No. The 1GP → 2GP step is an in-place reference switch that preserves all of your existing data and configuration, including any access-request auto-approve/deny rules, NDA-bypass rules, and Enterprise Analytics. Ordinary version upgrades also keep your data intact.
Do I have to use the Lightning components?
No. Only the OAuth External Client App is required for the integration to work. The Lightning UI components are optional. If you don't use them, you can ignore them.
Do I need to assign the permission set or configure an API key?
Only if you use the SafeBase Lightning components. Those components need the SafeBase User permission set (which grants both field access and the External Credential Principal Access used to authenticate API calls) and your SafeBase API key, set on the SafeBase API external credential. If you only use the OAuth connection so SafeBase can sync data, you can skip both.
Why can't I install 1.24 directly if I'm on 1GP 1.21?
The 1GP → 2GP migration must be version-matched: install 2GP 1.21 first (the in-place reference switch), then upgrade to 2GP 1.24. Installing 1.24 directly over a 1GP install fails with a namespace conflict.
Will my currently authenticated Salesforce OAuth connection continue to work?
Yes, for now. Your existing connection will keep working until July 31, 2026. After that date it will stop working, and you will need to complete this upgrade to restore the SafeBase ↔ Salesforce integration. We strongly recommend upgrading well before then to avoid any interruption.
What happens if I don't upgrade?
Salesforce is retiring the legacy Connected App model the previous integration relied on (see Why this upgrade is necessary above). Without upgrading, your SafeBase ↔ Salesforce integration will eventually stop working. Please complete the upgrade before July 31, 2026.
Do I need to reconnect SafeBase to Salesforce after upgrading?
Yes. After upgrading, reconnect Salesforce in the SafeBase app under Org Settings → Integrations so the integration authenticates through the new External Client App.
Should I test in a sandbox first?
We recommend it. Use the test.salesforce.com versions of the install links in a sandbox, then repeat the steps in production.
Who performs the upgrade, and how long does it take?
A Salesforce administrator installs the package; each install typically completes within a few minutes.