Black Wolf Watch Bullhorn for Salesforce
Who can take your candidate data out of Salesforce, and would you know if they did?
An independent weekly record for recruitment businesses running on Salesforce. Twenty-three checks covering who can export data, what your people have connected to the org, and what has quietly stopped working. One page for you, the detail for your admin. If nothing needs attention, it says so in one line.
twenty-three checks, six groups, one glance
Orgs drift. Nobody sees it from the screens they use.
A scheduled job stops. Storage fills up. A permission set gets widened during a fix and never narrowed again. An integration user is deactivated by mistake. Most of these only surface when a recruiter cannot do something on a Monday morning.
On the first production org Watch monitored, a large staffing group, the first report found storage at 120.9% of entitlement, about 2 100 scheduled jobs aborted by the platform watchdog in a week, about 2 670 flow interviews in error, and 141 947 records owned by people who had left. Nothing was visibly broken. Watch catches these on the Sunday night.
What Watch checks
- 013 checks
Platform limits
Data and file storage, and daily API usage against your entitlement, so a full org or a starved integration never comes as a surprise.
- 024 checks
Automation reliability
Failed batch and scheduled Apex, scheduled jobs that have gone missing or stuck, and flows paused or in error.
- 036 checks
Security and configuration
Security Health Check score, new high-risk settings, sharing changes, new elevated permissions, new connected apps, and risky setup actions such as field deletions or user deactivations.
- 044 checks
Data quality
Population of the fields you care about, new duplicate contacts, records owned by people who have left, and week-on-week volumes of contacts, accounts, jobs, placements and applications.
- 052 checks
Bullhorn package health
TR1 package version changes, and recruitment records that have gone orphaned or stale: applications without a job, open jobs with no activity, placements past their end date.
- 064 checks
Data movement and access
Third-party applications your people have authorised against the org, who holds the rights to export data and who gained them this week, logins through data-loading tools, and the pattern of someone acquiring access shortly before they leave.
How it works
- 01
The audit
A one-off assessment. Your admin creates a read-only user from a one-page guide, every check runs once, and you get a one-page summary, the detailed findings and half an hour on a call to go through them. You can stop there.
- 02
Baseline
If you carry on, the audit run becomes the baseline, using the same read-only user. Nothing is installed. Watch records how the org looks today: settings, packages, scheduled jobs, sharing, data quality.
- 03
Weekly check
On your chosen night Watch compares the org with the baseline and with last week, using metadata and aggregate counts only, well inside your API limits.
- 04
Report
Louis reads every report before it goes out. Your director gets the one-page email; your admin gets the same email with the detailed findings attached as a PDF.
What it does not do
- It never changes anything in your org. The code only reads, and a test suite fails the build if anyone adds a write.
- No candidate or client record is read by, or sent to, any AI system. The narrative is written from the findings table, and every figure in it comes from code, not from a model.
- It needs no Event Monitoring or Shield add-on. Everything it reads is available on Enterprise Edition, which is the point: you should not have to buy an enterprise security product to know who can reach your data.
- It cannot tell you which records left the org, when, or how many. That needs Salesforce Shield and I will not pretend otherwise. Watch shows who is able to take data out, what has been connected to the org, who signed in through a data-loading tool, and what changed week by week, recorded by someone outside your business.
- It is not a helpdesk. When a report raises something you want fixed, reply to it and Louis will quote for the work separately. The monthly fee stays flat.
An audit to start. A monthly price per org after that.
The audit stands on its own and many clients stop there. If you carry on, there is no setup fee, because the audit was the setup. Three-month minimum on the subscription, then a month’s notice. A second org for the same client is half price.
- South Africa
R16 500per org, per month
Audit to start: R43 000, once per org.
Metadata-only tier: R14 000 a month, if you cannot grant access to records.
excluding VAT.
- United Kingdom and Europe
£950per org, per month
Audit to start: £2,500, once per org.
Metadata-only tier: £800 a month, if you cannot grant access to records.
excluding VAT.
- United States and rest of world
$1,200per org, per month
Audit to start: $3,000, once per org.
Metadata-only tier: $1,000 a month, if you cannot grant access to records.
excluding sales tax.
Questions security teams ask
Why does the integration user need System Administrator?
Storage, installed package and connected app figures are only readable with it. The user is API-only, logs in with a certificate rather than a password, is restricted to a fixed IP range, and the code cannot write to the org. A security document sets out every control. For orgs that prefer less, a metadata-only tier on a Platform licence covers the checks that need no record access.
What if we will not grant access to candidate and client records at all?
Then you take the metadata-only tier. Eighteen of the twenty-three checks need no record access, including all four data movement checks, the whole security group, platform limits and automation. The five you lose are the four data quality checks and the Bullhorn orphaned-records check, so you keep everything about who can reach your data and give up the housekeeping. It is a configuration rather than a different product, and you can move to the full tier later without a new audit.
Does any of our data leave Salesforce?
Only counts and settings. Watch reads aggregate figures and metadata, masks anything that looks like a record before it is stored, and never passes a record to the language model that writes the narrative.
What does it cost to set up?
Nothing beyond the audit. The audit covers the setup guide, the read-only user, the baseline and the first full run, so if you carry on to the weekly subscription there is no separate onboarding fee. Your admin spends about an hour creating the user.
Can you prove someone exported our candidate database?
No, and anyone who tells you otherwise without Salesforce Shield is mistaken. Record-level export logging needs Shield. What I can show you is who holds the rights to export, what applications your people have authorised against the org, who signed in through a data-loading tool, and what changed each week, dated and produced by someone outside your business. That is what turns a suspicion into something you can act on.
Can we cancel?
Yes. Three months minimum, then a month’s notice. The user and permission set are removed on request and nothing is left behind.
Is it only for Bullhorn for Salesforce?
The Bullhorn package checks are specific to the TR1 objects. The other twenty-one checks work on any Salesforce org, so a non-Bullhorn org can be monitored with that group switched off.
Who reads the reports before we do?
Louis Carr, personally. Nothing is sent automatically. Reports are held in a review queue and released one at a time.
Book an audit
Send the name of your org and who should get the report.
I will come back with a date and the one-page setup guide for your admin. The audit runs once the read-only user exists, and the report and the call follow within a week. Nothing is installed and nothing is written to your org.
Prefer email? info@blackwolf.work