Any official recommendation from salesforce to use this.

[Nagendra Singh]

First of all thanks for this awesome plugin. I have been using this for past 5 years.

Just wanted to check, if you have any official recommendation from salesforce saying this plugin is safe to use and does not have access to codebase.
The new client (banking) I am dealing with, uses VSCode. When I proposed Illuminated cloud to them, they say its not official from salesforce and may have access to the code which gets sent via illuminated cloud.
I know that illuminated cloud does only uses SFDX commands / tooling api/ metadata api for its processes and harnesses the power of Intellij to show smart context aware autocompletions and code navigations etc.

But to convince client with official documents is where I am having trouble.
Is there any way you can help here?

[Scott Wells]

Hi. No, there’s no official recommendation from Salesforce. The concern about where information is sent comes up regularly in security/InfoSec-style questionnaires from purchasers, and here’s the general response:

When installed, the plugin communicates with two external systems:

1. The Salesforce organizations which have been explicitly authenticated by the end user. For native connections (those managed by the product itself), all credentials are stored securely in JetBrains PasswordSafe. OAuth connections are managed by the Salesforce CLI, and only access tokens and refresh tokens are stored locally (again, by the Salesforce CLI), not credentials. All communications occur over HTTPS/SSL using the standard Salesforce SOAP and REST APIs.
2. The licensing servers at https://wyday.com, and if direct access is not allowed, offline activations can be used.

Salesforce source and metadata files are stored on the local machine in the project directory structure and are transferred to/from the connected Salesforce organizations.

No usage or telemetry data is ever transmitted by Illuminated Cloud 2, though depending on how it's configured, the host JetBrains IDE may do so. That can be disabled as well, though.

I’m happy to provide a response to a security questionnaire for this client as well if that helps to address any concerns.