Salesforce B2C Commerce 24.7 > B2C Commerce Security Guide > Security Best Practices for Administrators

Secure Communications

Secure communications are crucial to prevent attackers from reading or changing sensitive information, for example, credit cards, personally identifiable information (PII), credentials, and so on. Within Salesforce B2C Commerce, you can secure these interactions using the following secure protocols.

Interaction Between... Via...
Storefront Shoppers and your storefront. TLS
Business Manager Users and Business Manager.
Note: This interaction is always secured by the site and doesn’t require a separate configuration.
 TLS
Web Services Your instance and an external web service. SOAP over TLS, HTTPS, SFTP
File Upload Your instance and an external system. WebDAV over TLS (recommended), HTTPS, SFTP
  • HTTPS / TLS
    In HTTPS, the communication protocol is encrypted using transport layer security (TLS) or its predecessor, secure sockets layer (SSL). The protocol is also often referred to as HTTP over TLS, or HTTP over SSL.
  • Web Services
    Salesforce B2C Commerce provides a web services framework that helps you manage calls to web services and analyze service performance. You need custom code to interact with a web service. We recommend that you use secure protocols as web service types, such as HTTPS, SFTP, and SOAP over TLS. A web service can also use a service credential, such as username and password, to perform HTTP basic authentication.
  • Data Upload
    Data upload refers to transferring data files from an external system to your instance’s file system. You can upload data such as import files, images, and snapshots manually or programmatically. Use Business Manager to transfer data manually. As always, any interaction with Business Manager is performed over HTTPS. Data transfer is performed programmatically using custom code. In this case, while several file transfer protocols are supported, use only the secure protocols: WebDAV over TLS (recommended), HTTPS, or SFTP.
  • Code Upload
    You can upload custom code, also known as cartridges, to an instance using UX Studio, or with a file transfer mechanism such as WebDAV over TLS. It’s extremely important that you secure code uploads. An attacker who’s able to upload malicious code can wreak havoc on an instance. Follow these best practices.

Infocenter Retirement: On June 30, 2023, the Infocenter was retired, and documentation currently hosted on the Infocenter will be published to Salesforce Help, Commerce Cloud Developer Center, and Salesforce B2C Commerce Developer Documentation Resources. For more information, see the release note.