Two packages, one seam.
One codebase reads. A separate codebase writes. They meet at a metadata registry.
| JobType | HandlerClass | IsWrite | Available in |
|---|---|---|---|
| SCHEMA | core.SchemaHandler | read | prod + sandbox |
| DETECT | core.DetectHandler | read | prod + sandbox |
| ACCESS | core.AccessHandler | read | prod + sandbox |
| CONTENT | core.ContentHandler | read | prod + sandbox |
| REDACT | redact.RedactHandler | write | sandbox only |
Database.insert, .update, or .delete against customer objects, enforced by static scan in CI.JobType → HandlerClass. Core dispatches REDACT jobs by looking up a row it does not own. If the row's handler class is not loaded, the job parks in Blocked / AWAITING_HANDLER and never Failed. That state is load-bearing.Organization.IsSandbox == true, or the dispatcher throws before a chunk ever runs.The five steps from a sandbox refresh to a redaction. The dispatcher never guesses. It parks the job until the missing piece arrives.
Masking templates live in production as pure data, so no write code is needed to hold them. On refresh they arrive in the sandbox already copied. Then this sequence runs when an admin starts it. Nothing runs on refresh by itself: there is no scheduled job and no post-copy hook.
Every job is a queryable record.
A job is a Job_Request__c with Job_Target__c rows and Job_Result__c rows. Both packages work with zero control-plane connectivity. The web app orchestrates and mirrors. It never owns. If Org Warden's Console vanished tomorrow, you could keep dispatching jobs from the Salesforce UI.
A finding is a record, so a control can be scoped from it.
Because findings land as queryable records inside your own org, the list of fields that hold PII is available to your reporting, your change process, and your admins without an export from us. That list is what a control needs. Encryption at rest can be mandated on exactly those fields. Field-level security can be trimmed against the access map that produced them. Field audit history can be enabled where regulated data actually sits rather than everywhere or nowhere.
Org Warden applies none of it. Core is read-only in production by construction, so every change lands through your own change process, with your own approvals. What Org Warden provides is the scope, the evidence behind the scope, and a drift row the next time something lands outside it.
Scan one org free. See where your PII lives.
No install-to-buy. You get a Baseline Report (the same artefact paying customers get) for one Salesforce org. Metadata-only, always. Your data never leaves your org.