A complete, honest explanation of how QueryStream handles your Salesforce credentials, executes SOQL queries, and processes your data. No black boxes. If you are evaluating QueryStream for an enterprise org or want to understand what touches your data, this page is for you.
QueryStream uses the standard Salesforce OAuth 2.0 web server flow. We never ask for your password directly. The entire credential exchange happens between your browser, Salesforce's own login servers, and our server acting as the authorized OAuth client.
Every SOQL query you run goes through a short, stateless chain. Your browser sends the query and token to our proxy, the proxy relays to Salesforce, Salesforce responds, and the proxy passes results back. Nothing is stored at any point in this chain.
Salesforce access tokens expire. When a query returns a 401 Unauthorized response, QueryStream automatically renews your session in the background using a refresh token, without interrupting your work.
When your session expires mid-query, QueryStream asks our server to renew it with Salesforce using your refresh token, which travels only in a request body over HTTPS. The new access token replaces the old one in your browser's memory and the query retries automatically. If Salesforce rotates the refresh token during renewal (a security feature some orgs enforce), QueryStream adopts the new one immediately, so renewal keeps working indefinitely.
The refresh token is held in your browser's memory alongside the access token. Like the access token, it is never written to persistent storage, a URL, or any server-side store. Our server sees it only for the duration of each renewal call and keeps nothing afterward. Closing the tab destroys the refresh token permanently, and if it ever expires or is revoked by your admin, QueryStream tells you plainly and asks you to log in again.
QueryStream automatically detects the best fetch strategy for each query. You never need to think about this - it just works.
For queries with no LIMIT or LIMIT above 2,000: fetches in batches of up to 2,000 rows. Results appear live as each batch arrives. Works on result sets of any size.
For GROUP BY and aggregate functions: Salesforce natively supports these. If native fails, QueryStream rewrites the query to stream raw rows and performs aggregation entirely in your browser using JavaScript. HAVING clauses are applied client-side after grouping.
For queries with LIMIT 2,000 or below: fetches in one request. Fastest path for targeted lookups. LIMIT above 2,000 automatically switches to streaming to return all requested rows.
| Data Type | Stored Where | Persists After Tab Close | Visible to Our Server |
|---|---|---|---|
| Access token | JS memory (tab only) | Never | Only during proxy relay (milliseconds) |
| Refresh token | JS memory (tab only) | Never | Only during token refresh call (milliseconds) |
| Your SOQL queries | JS memory while running; History in memory only | History cleared on close | Relayed through proxy, not stored or logged |
| Saved queries (name + SOQL text) | Your browser's localStorage | Yes - on your device only | Never transmitted to our server |
| Query results (rows returned) | JS memory (tab only) | Never | Relayed through proxy as raw JSON, not stored |
| Your Salesforce instance URL | JS memory (tab only) | Never | Used only to construct API URLs in proxy |
| Theme preference | Your browser's localStorage | Yes - on your device only | Never |
QueryStream supports connecting multiple Salesforce orgs in the same browser session using tabs. Each org has a fully isolated slot with its own token, query history, results, and cursor state.
Each org gets its own fully separate slot in memory holding: the access token, refresh token, instance URL, query history, saved state (scroll position, current page), and active column sort. Switching orgs restores the previous slot's state instantly, and nothing ever crosses between slots.
Every query batch checks two guards before processing: which org tab is active and whether a newer query or an abort has superseded it. If either has changed, the batch is silently discarded. This prevents stale batches from a cancelled query, or from another org, from mixing into new results.
Our server endpoints only accept requests from the satrangtech.com origin. Cross-site requests from other domains are rejected outright.
All endpoints accept POST method only. GET requests are rejected. Tokens are always in the POST body, never in URL parameters which could appear in server logs.
The relay validates that the target instance is a Salesforce-owned domain before making any outbound request. It cannot be misused to send requests, or your token, anywhere other than Salesforce.
Every value rendered into the results table is HTML-escaped first, and all Salesforce responses are treated as untrusted input. No field value can inject script or markup into the page.
When the OAuth popup hands the token back to the main window, the main window verifies the sender is our own site before accepting it. Forged messages from any other window or domain are discarded.
After login, the token is handed to your browser tab through tab-scoped browser storage, never a URL - so it cannot land in browser history, bookmarks, or web server logs. That storage is not shared with other tabs and is cleared the moment the tab closes.