Help Vantage learn what makes a valuable customer

Two fixed lists. A core set across five objects: Lead, Opportunity, Contact, OpportunityContactRole and OpportunityHistory, covering record identity, funnel stage and its history, deal value and currency, campaign linkage, record type, lead rating, timestamps and the ad click id. And a short per-customer set of qualification fields, such as budget or model of interest, agreed at onboarding and listed in that customer’s disclosure.

The only PII touched is email and phone, which are hashed at ingest so a deal can be matched to the click that produced it; the raw values are never stored. Names, addresses, job titles, free text and activity history are never requested, and no other object is queried.

The integration issues no writes of any kind: no create, update, delete, Apex or composite write against any object, and it never creates fields, layouts, automation or users. The only POST requests it makes are the OAuth token exchange and the Bulk API query job.

Salesforce does not offer a read-only OAuth scope, so read-only is enforced by the permission set the customer’s admin assigns to the integration user, in addition to the integration itself never issuing a write.

Tapper reads one financial figure: Opportunity.Amount, the value of the deal, alongside its currency (CurrencyIsoCode), StageName, IsWon, IsClosed and CloseDate so the value is attached to a real outcome on a real date in the right currency.

No billing or payment object is queried: no line items, orders, products, price books, invoices, payments, payment methods, gateway logs, refunds, credit memos, contracts or assets. Tapper reads no payment instrument data of any kind: no card details, no payment methods, no bank references.

Only to Google Ads, and only for conversion upload: the Google click id, a conversion value and currency, a timestamp, an order id for de-duplication, and consent flags where legally required. Uploads are de-duplicated per person, so duplicate lead records cannot fire duplicate conversions.

No email, phone, hash, name or CRM record content is sent to Google on this path, and nothing is sent to any other third party. Additional ad platforms would be covered by an updated disclosure before any data is sent to them.

Tapper corrects it. When a deal regresses after a value-bearing stage, a cancelled reservation, declined financing, a withdrawn purchase, or a lead resolves to a status the customer has mapped as disqualified, Tapper sends Google Ads a conversion adjustment that reduces or retracts the previously uploaded value.

Reported results reflect real revenue, not just initial outcomes, and disqualified leads never contribute value at all.

One historical backfill of the last 12 months when the connection is first enabled, including historical stage changes from OpportunityHistory, then an incremental poll (default every 15 minutes) reading only records changed since the last successful sync.

The customer can pause syncing or disconnect at any time. Disconnecting revokes the token with Salesforce and deletes the stored credentials; outcomes already collected are retained unless deletion is requested. Credentials are encrypted with AES-256-GCM before they are written to any store.

No. Reporting and model training run against the per-customer analytics dataset, and Salesforce data is never pooled across customers, so one customer’s CRM outcomes never inform another customer’s models.