Backup & Archive Security Overview

Overview

Flosum Backup & Archive is designed to deliver enterprise-grade security across both Flosum-hosted and customer-hosted environments. This article provides a comprehensive overview of its security architecture, covering encryption, infrastructure setup, identity management, and secure communication practices.

Key Security Features

• Strong Encryption: Utilizes AES-256 and TLS 1.2+ to ensure robust data protection.
• Secure Key Management: Encryption keys are protected by AWS KMS for enhanced security.
• Controlled Access: Offers flexible identity provider options for tailored access control.
• Compatibility: Integrates smoothly with Salesforce Shield and VPN solutions, ensuring comprehensive security.

These features ensure that Flosum Backup & Archive provides secure and reliable backup and archiving solutions for enterprise needs.

System Architecture

The Flosum Cloud Apps architecture is explained in detail in the following article.

• Flosum Cloud Apps Architecture

Encryption & Data Security

Key Management

• Encryption Keys:

  • Stored securely in the Backup & Archive database and protected by AWS KMS
  • Unique key per connected org
  • Keys are persistent across sandbox refreshes
• Key Lifecycle:

  • Cannot be rotated automatically
  • To change a key, connect a new Salesforce org

Migrating Encryption Keys for Customer-Hosted

• Generate 32-byte base64 key: openssl rand -base64 32
• Add key to docker-compose: LOCAL_ORGANIZATION_ENCRYPTION_KEY=<key>
• Upgrade the app to complete the migration

Encryption in Transit and at Rest

• Transit:

  • All data is transmitted via HTTPS (SSL/TLS)
  • Bi-directional encryption between Salesforce and Backup & Archive
• At Rest:

  • Data is encrypted using AES-256 in cloud storage
  • Remains encrypted even when viewed/exported

Decryption Process of Data for GUI Display

When the user requests encrypted data from the Backup & Archive storage, the following process occurs.

1. The encryption key is retrieved from the Backup & Archive database
2. Key is cached in VM RAM
3. Encrypted file is decompressed and decrypted in-memory
4. Data is shown to the user in the GUI
5. File in storage remains encrypted

Identity & Access Management

Backup & Archive supports different login methods, including multiple identity provider protocols:

• Flosum Username & Password
• Single Sign-On (SSO)

  • OIDC (OpenID Connect) Identity Providers
  • SAML (Security Assertion Markup Language) Identity Providers
  • JIT (Just-In-Time) Provisioning
  • SCIM (System for Cross-domain Identity Management) Support

Flosum’s Global Settings app is used to securely manage access across hosted environments. For detailed information about user management, see the following article.

• Overview of Roles, Groups, and Users

For information about setting up Identity Providers for SSO, see the following article.

• Overview of Identity Provider (SSO)

Licensing & Version Control

• Backup & Archive and Flosum DevOps are separate products

  • Each has its own license and version number
• Multi-org support:

  • A single license can manage multiple Salesforce orgs
  • Additional orgs increase required storage and may incur extra cost
• Check the current release:

  • View the Release Notes section for the current version of Backup & Archive: Backup & Archive