> For the complete documentation index, see [llms.txt](https://docs.flosum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flosum.com/backup-and-archive/general-information/faq-and-guidance/backup-and-archive-security-overview.md). # Backup & Archive Security Overview ## ![](https://646917531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Focom3JROuDKOidclKbQx%2Fuploads%2Fgit-blob-3f6faa4230b72167926fbc0a31dd17dc7d74581d%2FSummary2-Small-Icon.svg?alt=media) Overview Flosum Backup & Archive is designed to deliver enterprise-grade security across both Flosum-hosted and customer-hosted environments. This article provides a comprehensive overview of its security architecture, covering encryption, infrastructure setup, identity management, and secure communication practices. ### Key Security Features * **Strong Encryption:** Utilizes AES-256 and TLS 1.2+ to ensure robust data protection. * **Secure Key Management:** Encryption keys are protected by AWS KMS for enhanced security. * **Controlled Access:** Offers flexible identity provider options for tailored access control. * **Compatibility:** Integrates smoothly with Salesforce Shield and VPN solutions, ensuring comprehensive security. These features ensure that Flosum Backup & Archive provides secure and reliable backup and archiving solutions for enterprise needs. ## System Architecture The Flosum Cloud Apps architecture is explained in detail in the following article. * [Flosum Cloud Apps Architecture](/resources/architecture/flosum-cloud-apps-architecture.md) ## Encryption & Data Security ### Key Management * **Encryption Keys:** * Stored securely in the **Backup & Archive** database and protected by **AWS KMS** * Unique key per connected org * Keys are persistent across sandbox refreshes * **Key Lifecycle:** * Cannot be rotated automatically * To change a key, connect a new Salesforce org {% hint style="info" %} #### Migrating Encryption Keys for Customer-Hosted * Generate 32-byte base64 key: openssl rand -base64 32 * Add key to docker-compose: LOCAL\_ORGANIZATION\_ENCRYPTION\_KEY=\ * Upgrade the app to complete the migration {% endhint %} ### Encryption in Transit and at Rest * **Transit:** * All data is transmitted via **HTTPS (SSL/TLS)** * Bi-directional encryption between Salesforce and Backup & Archive * **At Rest:** * Data is encrypted using **AES-256** in cloud storage * Remains encrypted even when viewed/exported {% hint style="info" %} #### Decryption Process of Data for GUI Display When the user requests encrypted data from the Backup & Archive storage, the following process occurs. 1. The encryption key is retrieved from the Backup & Archive database 2. Key is cached in VM RAM 3. Encrypted file is decompressed and decrypted in-memory 4. Data is shown to the user in the GUI 5. File in storage remains encrypted {% endhint %} ### Identity & Access Management Backup & Archive supports different login methods, including multiple identity provider protocols: * **Flosum Username & Password** * **Single Sign-On (SSO)** * **OIDC** (OpenID Connect) Identity Providers * **SAML** (Security Assertion Markup Language) Identity Providers * **JIT** (Just-In-Time) Provisioning * **SCIM** (System for Cross-domain Identity Management) Support {% hint style="info" %} Flosum’s **Global Settings** app is used to securely manage access across hosted environments. For detailed information about user management, see the following article. * [Overview of Roles, Groups, and Users](/global-settings/user-management/overview-of-roles-groups-and-users.md) For information about setting up Identity Providers for SSO, see the following article. * [Overview of Identity Provider (SSO)](/global-settings/security/identity-providers-sso/overview-of-identity-provider-sso.md) {% endhint %} ### Licensing & Version Control * **Backup & Archive and Flosum DevOps are separate products** * Each has its own license and version number * **Multi-org support:** * A single license can manage multiple Salesforce orgs * Additional orgs increase required storage and may incur extra cost * **Check the current release:** * View the Release Notes section for the current version of Backup & Archive: [Backup & Archive](/release-notes/backup-and-archive/seasonal-releases.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.flosum.com/backup-and-archive/general-information/faq-and-guidance/backup-and-archive-security-overview.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.