How to disconnect Salesforce from SourceLoop

This article covers the Salesforce disconnect flow end-to-end: what happens immediately, what data we delete, what we retain for 30 days, and how to request full data removal. It exists so you (and your data-protection officer, if you have one) can answer every reasonable question about SourceLoop’s handling of Salesforce-sourced data after disconnect.

Before you start

Set expectations correctly:

• Disconnecting on SourceLoop’s side revokes OAuth and stops sync.
• Revoking on Salesforce’s side removes SourceLoop from the org’s Connected Apps OAuth Usage list (recommended for clean audit trail).
• Neither action deletes data from Salesforce itself, SourceLoop has never had delete permissions on standard records, and disconnect doesn’t trigger any cleanup on Salesforce’s end.
• Existing SourceLoop data stays in your workspace unless you explicitly request deletion via GDPR.

If you have both sandbox and production connections, decide whether you’re disconnecting one or both. They’re stored as separate connection records and need to be disconnected independently.

Step 1: Disconnect on SourceLoop’s side

1. Sign in to SourceLoop.
2. Open Setup -> CRM -> Salesforce.
3. On the Salesforce card, click the three-dot menu (top-right) and select Disconnect.
4. Confirm the disconnect dialog.

The moment you confirm:

• SourceLoop revokes the OAuth access and refresh tokens stored on our side.
• SourceLoop stops scheduling sync jobs for this connection.
• The Salesforce card on the CRM tab flips to Disconnected.
• The cached field and pipeline schema is cleared.

No additional Salesforce API calls are made by SourceLoop after this point.

If you have both sandbox and production connections, repeat for each.

Step 2: Revoke SourceLoop on Salesforce’s side (recommended)

This step is optional but recommended. It removes SourceLoop from Salesforce’s Connected Apps OAuth Usage list, which:

• Creates a record in the Salesforce audit log
• Prevents any cached OAuth tokens from being reused
• Is the cleanest end-state for SOC2 / ISO27001 / GDPR records

1. Sign in to Salesforce with a System Administrator user.
2. Open Setup -> Apps -> Connected Apps -> Connected Apps OAuth Usage.
3. Find SourceLoop in the list.
4. Click Revoke in the action column.
5. Confirm.

Salesforce invalidates all tokens issued to SourceLoop from this user. Even if SourceLoop had any cached tokens, they’d be unusable from this moment.

For sandbox, repeat in the sandbox org separately.

Step 3: Decide what to do with the SourceLoop custom fields

During normal operation, SourceLoop created these custom fields on the Lead and Contact objects:

• sourceloop_first_source__c, sourceloop_first_medium__c, sourceloop_first_campaign__c, sourceloop_first_content__c, sourceloop_first_term__c
• sourceloop_first_landing_page__c, sourceloop_first_channel__c
• sourceloop_latest_source__c, sourceloop_latest_medium__c, sourceloop_latest_campaign__c, sourceloop_latest_content__c, sourceloop_latest_term__c
• sourceloop_latest_landing_page__c, sourceloop_latest_channel__c
• sourceloop_id__c

After disconnect, these fields stay in your Salesforce org with their last-synced values. SourceLoop does not, and cannot, delete custom fields automatically (Salesforce requires the Customize Application permission and a manual confirmation flow for field deletion).

Your options:

• Leave them (recommended). They don’t affect Salesforce behavior. If you reconnect later, SourceLoop picks them up automatically without recreating.
• Delete them manually. In Salesforce, go to Setup -> Object Manager -> Lead -> Fields & Relationships, find each sourceloop_* field, and delete it. Warning: this also deletes the data stored on every Lead. Repeat for Contact. Once deleted, the historical attribution values are gone, even if you later reconnect.

What SourceLoop retains after disconnect

For transparency, exact retention:

Deleted at the moment of disconnect

• Salesforce OAuth access token (encrypted at rest)
• Salesforce OAuth refresh token (encrypted at rest)
• Salesforce instance URL cache
• Scheduled sync jobs for the connection
• Cached field and Describe metadata

Retained for 30 days, then permanently deleted

• The connection record (instance URL, sandbox/production flag, last-sync cursor, sync-in-progress flag)
• Field mapping rules you configured
• Lead Status mapping rules you configured
• The most recent 30 days of sync logs

The 30-day window lets you undo an accidental disconnect by reconnecting without losing your mapping configuration. After 30 days, the connection record and all associated configuration are purged from our database.

Retained indefinitely (until you request deletion)

• Leads, Contacts, Accounts, Opportunities ingested from Salesforce inbound sync. Once synced, these records belong to your SourceLoop workspace’s data. They contain your business’s customer information and are governed by your SourceLoop workspace’s data policy, not the Salesforce connection.
• Conversion records, journeys, attribution. SourceLoop-owned records that reference the Salesforce contact via email/external ID.
• Aggregated and anonymized analytics.

These retained records can be deleted on request, see “GDPR / full data removal” below.

GDPR / full data removal

To request complete removal of all data we ever ingested from your Salesforce org, including Leads, Contacts, Accounts, Opportunities, pipelines, sync logs, and derived analytics:

1. Email [email protected] with the subject “GDPR data deletion request” and your Salesforce instance URL (e.g., acme.my.salesforce.com).
2. Confirm your identity (authenticated SourceLoop account email or verified workspace owner).
3. We acknowledge within 2 business days.
4. We complete deletion within 30 days and confirm in writing.

We delete:

• The Salesforce connection record (if not auto-purged)
• All Lead, Contact, Account, and Opportunity records ingested from the org
• All conversion records and journeys tied to those records
• All sync logs, error logs, configuration history
• All custom analytics derived from Salesforce data

This is irreversible. After completion, reconnecting Salesforce starts from a blank state.

Reconnecting later

If you change your mind within the 30-day grace window:

1. Sign in to SourceLoop.
2. Open Setup -> CRM -> Salesforce.
3. Click Connect on the Salesforce card.
4. Pick sandbox or production (matching your previous connection).
5. Run the OAuth flow.
6. SourceLoop resumes syncing from the last cursor, with your field and Lead Status mappings preserved.

If you reconnect after 30 days, the connection record is fresh and mappings need to be reconfigured. Existing SourceLoop contacts get re-stitched on the next sync by email match.

When to email support

For anything outside the standard flow:

• “I disconnected by mistake and want a full reset” → email [email protected]
• “Our compliance team needs a written data-processing agreement (DPA)” → we provide a signed DPA on request
• “An auditor needs evidence of what was retained vs deleted on our connection” → we provide a written audit trail keyed to your instance URL
• “Salesforce still shows SourceLoop as connected even though I disconnected” → complete Step 2 above; if it still shows, email us with screenshots

Email [email protected] for any of the above. We respond within one business day.