Data handling
This page describes what data Edge processes on your behalf, where it resides, and how guest analytics are handled with privacy in mind.
Salesforce is the system of record
Your Salesforce org remains the authoritative source for booking, itinerary, contact, and pricing data. Edge reads what your data transformation configuration requests at the moment a document, payment session, or booking step is generated — it does not maintain an independent copy of your org's data model. What is temporarily held by the platform falls into three categories:
| Category | What it is | Where it comes from |
|---|---|---|
| Document data | The validated dataset behind a generated document — traveler names, itinerary details, pricing — shaped by your schemas | Queried from your org at generation time |
| Payment session data | Payer name and contact details, booking reference, amount, and schedule allocation for a payment in progress | Queried from your org and entered by the payer |
| Webform submissions | The fields your enquiry configuration defines, plus mapping and scoring results | Submitted by the website visitor |
Rendered documents and payment session records persist only for as long as needed to serve the recipient (viewer link validity, payment session lifetime) and for the operational history shown in Salesforce (delivery and payment history). Ask your Kaptio account team for the specific retention configuration on your tenant.
Data residency
Platform infrastructure runs in the EU (Google Cloud, europe-west1). Your Salesforce org's data residency is governed by your own Salesforce contract and is unaffected by Edge.
Guest viewer analytics
Where guest viewer analytics are enabled for your tenant, the tracker is designed with guest privacy in mind:
- No persistent tracking cookies. Return-visit detection uses local browser storage rather than a tracking cookie.
- IP addresses are not stored in raw form. An IP address is hashed with a salted one-way hash before storage.
- Location is coarse. Geolocation is designed to resolve to city/country level only, not precise coordinates.
- No form or contact data is captured by the tracker itself. The tracker records interaction with the document (scroll depth, time on page, clicks), not personal information beyond what the document itself already contains.
Confirm the specific analytics configuration enabled for your tenant with your Kaptio account team.
Payment analytics access
Where payment analytics are enabled for your tenant (confirm availability with your Kaptio account team), access to payer contact details is role-scoped: general viewers see masked contact information, while roles that need full detail (for reconciliation or customer service) see it unmasked. This mirrors the principle that data is shown on a need-to-know basis even within your own team's access to the platform.
Where to go next
- Security model — authentication, encryption, and tenant isolation
- Payment security — card data handling specifically
- Security FAQ — retention, subprocessors, and compliance questions