How to Export and Document Profile Settings for Security Reviews
To export and document profile settings for a security review, you need a record of your org’s access controls: user permissions, object- and field-level security (OLS/FLS), login hours, IP restrictions, and record type assignments—the configuration that determines who can see and do what inside Salesforce. This lives entirely in Setup and is captured through Salesforce’s own security tooling, not through a file exporter. Getting this distinction right up front saves an audit team from chasing the wrong export.
Thank you for reading this post, don't forget to subscribe!Where Profile and Permission Data Actually Lives
Profile settings are metadata API objects, not records with attached files, so they’re pulled through the following:
- Security Health Check (Setup > Security) — gives an at-a-glance score and flags risky settings (password policies, session settings, sharing defaults) with no export needed for a quick review.
- Metadata API via Salesforce CLI (sf/sfdx)—retrieves full Profile and PermissionSet XML in bulk, ideal for version-controlled, diffable documentation over time.
- Setup Audit Trail — logs who changed which permission or profile setting and when, useful for showing change history to an auditor.
- Permission Set and Profile comparison reports—available natively or through tools like Gearset and Elements. cloud for side-by-side documentation of access differences across roles.
If the audit specifically asks for permission and access-control documentation, this is the correct path — and it’s worth saying plainly that a file/attachment export tool, including ours, doesn’t touch this layer.
Where File Export Tools Actually Help Security Reviews
Security and compliance reviews rarely stop at permissions, though. Auditors also typically ask for supporting evidence: signed policy documents, compliance certificates, prior audit reports, and access-request records—files that live as attachments on Cases, Accounts, or custom compliance objects. This is where native Salesforce exports create real friction and where a purpose-built exporter earns its place in the workflow.
The default weekly export service dumps these supporting files into unstructured zip archives, strips original file names, and replaces them with unreadable IDs. There’s no way to filter by object or date, so a File Storage Limit Exceeded warning forces an all-or-nothing export even when the audit only needs a narrow slice of documents.
Exporting Supporting Compliance Files with a Files downloader
Once profile and permission data is documented separately, here’s the workflow for the supporting-evidence side:
1. Target the right object. Use a standard or custom list view—Cases, compliance records, or a custom audit-tracking object—to filter to the exact files needed.
2. Run SOQL for precision. Pull specific document sets by date, owner, or custom field directly from ContentVersion or Attachment.
3. Export with context intact. Files retain original names, folder structure, owner, and parent-record association, so each document traces back to the case or record it supports.
4. Deliver audit-ready output. Files download in their native, readable formats (PDF, spreadsheet, image) — exactly what compliance officers expect to review, not raw XML.
Native Export vs. File downloader
| Challenge | Native Salesforce Export | files downloader |
|---|---|---|
| Selective Filtering | All-or-nothing | Object, list view, or SOQL-based |
| File Naming | Replaced with record IDs | Original names preserved |
| Metadata Context | Owner/record data stripped | Owner, object type, record link retained |
| Format | Generic archive | Native PDF, image, doc formats |
| Setup Time | Hours, CLI-dependent | One-click, instant |
The export runs natively within Salesforce and respects existing permission sets and sharing rules—meaning it doesn’t introduce a new access-control risk into the very review it’s supporting.
[Talk to Expert] [See Application in Appexchange] [See how it works.]