A two-to-three-week audit of technical debt, security, performance and adoption, scored per pillar, with a prioritised backlog you can hand to your own team or ours.
A Salesforce org accumulates decisions. After a few years nobody remembers why the Flow fires twice or who the integration user is. A health check turns that fog into a list.
One number per pillar, each backed by a list of findings with a weight. The target line is where an org should sit before you build AI features on top of it.
Days one and two: read-only user, metadata retrieval, Salesforce Optimizer output, event log files and usage reports.
Static analysis of Apex, Flows and metadata; dependency mapping per object; limits and storage; the permission matrix.
Week two: the admin, two or three power users, one integration owner. We open the Flows nobody dares to.
Findings grouped per pillar, weighted and scored. Each becomes a backlog item with an effort band; quick wins are separated.
A ninety-minute session with your decision-makers, then the written report and the backlog in a format your tracker can import.
| What we check | How | Typical finding |
|---|---|---|
| Automation overlap | Flow, trigger and legacy rule inventory per object | Three automations updating the same field in an order nobody chose |
| Permission sprawl | Profile and permission-set matrix | Most users on a cloned System Administrator profile |
| Sensitive data exposure | Field audit against a data classification | Identity numbers or salary fields readable by every internal user (see AI data privacy) |
| Apex quality | Static analysis plus a read of the tests | Coverage above the platform minimum achieved by tests with no assertions |
| Data skew | Ownership and parent-child distribution | A single integration user owning most records, causing lock contention |
| Storage and limits | Limits API plus growth trend | Data storage at the cap because attachments were never archived |
| Adoption | Login history and report usage | Dashboards built for the launch, not opened since |
Four pillar scores, the weighting behind them, and the findings in plain language for people who do not log in to Setup.
Every finding as a ticket with risk, reach and an effort band, ordered so the first ten items remove the most risk.
Items that take under a day each: deactivating dead automation, tightening a sharing rule, archiving a storage hog.
A recommendation with the evidence, against the re-implementation criteria, and an estimate band for either route.
Most orgs are worth fixing. The backlog goes to your admin or into a managed-services retainer, and we re-score after the first quarter so the improvement is visible. A minority have debt so tangled that a clean org, with a disciplined data migration, is cheaper than the untangling. The report says which, and why.
Where Salesforce is one of several ageing systems, the same audit method extends to the rest of the estate under legacy modernisation. Where AI features are planned, the security pillar is the input to the model-side review described on our AI security pages.
Work the backlog down on a monthly retainer with a named engineer.
ReadThe re-implementation route, with the decision table and phase timeline.
ReadModel, prompt and retrieval security for AI features built on your CRM.
ReadThe same audit-then-fix discipline applied to the rest of your systems.
ReadClassifying and protecting personal data before a model reads it.
ReadImplementation, clouds, AI, development, integrations and support.
BrowseTwo to three weeks for a single org running Sales or Service Cloud. Multi-cloud orgs with many integrations take three to four. The first week is extraction and automated scanning; the rest is review, interviews, scoring and playback.
A dedicated read-only user with permission to view setup, metadata, event logs and data, but no permission to modify anything. If your policy prefers it, we work in a freshly refreshed full sandbox instead of production and only read login and usage history from production.
No. It tells you what to fix, in what order, and roughly how long each item takes. Quick wins (things that take under a day each) are listed separately and can be done in a follow-on week or under managed services.
It covers platform security: profiles and permission sets, field-level security, sharing, login policies and connected apps. If you run Agentforce or an external LLM against your CRM data, pair it with an AI security review that tests the model and the retrieval path.
Each pillar is scored 0–100 from weighted findings. Weights reflect risk and reach: a sharing rule exposing all accounts weighs more than an unused field. The weights are printed in the report so your team can challenge them and re-score after fixes.
Yes. The report ends with a recommendation against the fix-in-place versus re-implementation criteria described on our implementation page, with the evidence behind it.
Tell us about your systems, your data and your constraints. We reply within one business day with a straight answer and a suggested next step.