> For the complete documentation index, see [llms.txt](https://docs.flosum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flosum.com/backup-and-archive/general-information/faq-and-guidance/faq-backup-and-archive.md).

# \[FAQ] Backup & Archive – Frequently Asked Questions

## ![](https://646917531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Focom3JROuDKOidclKbQx%2Fuploads%2Fgit-blob-3f6faa4230b72167926fbc0a31dd17dc7d74581d%2FSummary2-Small-Icon.svg?alt=media)Overview

This FAQ addresses common questions related to Flosum Backup & Archive, including its architecture across different cloud platforms, security, operational behavior, and restore functionality.

## <img src="https://646917531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Focom3JROuDKOidclKbQx%2Fuploads%2FfQykTTOGk7YPHzoHNMo5%2FInfrastructure-Icon.svg?alt=media&amp;token=dd5fc2b4-aaa6-4324-9639-ec7ee1d13f4c" alt="" data-size="original"> Architecture & Infrastructure

<details>

<summary><strong>What is the architectural setup for Flosum Backup &#x26; Archive on AWS?</strong></summary>

Flosum Backup & Archive runs on an Amazon EC2 instance and connects to Salesforce SaaS externally.

* Nginx handles proxy requests and enables SSL.
* User Pool Service manages access control.
* MySQL stores app configuration settings.
* Local storage options include:
  * SSD (gp2 or gp3)
  * S3 object storage

<figure><img src="https://646917531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Focom3JROuDKOidclKbQx%2Fuploads%2FGnj5Ebh62wPAi07FCynQ%2FFAQ-ArchitectureAWS.png?alt=media&amp;token=e126ecdc-0dbb-4813-aa44-6152790c61fd" alt=""><figcaption></figcaption></figure>

</details>

<details>

<summary><strong>What is the architectural setup for Google Cloud Platform (GCP)?</strong></summary>

Runs inside a GCP Virtual Machine and connects externally to Salesforce SaaS.

* Nginx for proxy/SSL
* Google Identity Platform for access control
* MySQL for configuration storage
* Local CSV storage on SSD

<figure><img src="https://646917531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Focom3JROuDKOidclKbQx%2Fuploads%2FsJoXIhudQzO7ZTKdp6NW%2FFlosum%20Backup%20%26%20Archive%20Architecture%20GCP.drawio.png?alt=media&amp;token=2ab3b865-25f6-4818-abf2-6fa28e9634c9" alt=""><figcaption></figcaption></figure>

</details>

<details>

<summary><strong>What is the architectural setup for Azure?</strong></summary>

Runs inside an Azure VM with Salesforce SaaS access.

* Nginx for proxy/SSL
* Azure Active Directory for access control
* MySQL for app settings
* Storage options:
  * SSD (gp2 or gp3)
  * S3-compatible storage

<figure><img src="https://646917531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Focom3JROuDKOidclKbQx%2Fuploads%2Frk1vjvIjW9nG4FqBGCa7%2FFlosum%20Backup%20%26%20Archive%20Architecture%20Azure.drawio.png?alt=media&amp;token=22f11f40-3853-4abf-9db1-3747b5a64c69" alt=""><figcaption></figcaption></figure>

</details>

<details>

<summary><strong>What is the purpose of MySQL in Backup &#x26; Archive?</strong></summary>

MySQL (running in a Docker container) stores configuration data but does **not** store customer backups.

</details>

<details>

<summary><strong>How many EC2 instances are required?</strong></summary>

Only one EC2 instance is needed for a standard self-hosted deployment.

</details>

<details>

<summary><strong>How do I patch a self-hosted Backup &#x26; Archive installation?</strong></summary>

Use the following commands to:

1. Run
2. Update
3. Verify

```docker
sudo docker pull flosum/agent-node:x.xx.x
sudo docker-compose up -d
sudo docker ps
```

</details>

## ![](https://646917531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Focom3JROuDKOidclKbQx%2Fuploads%2FsYqu8OeJgtLxFUONknLk%2FSecurity-Icon.svg?alt=media\&token=32878dbc-3902-4809-b58b-ec20fd5540f1) Security & Storage

<details>

<summary><strong>Is data encrypted before transmission to AWS?</strong></summary>

Yes, data is encrypted both in transit and at rest using the **SHA-256** algorithm.

</details>

<details>

<summary><strong>Can we choose SSD instead of S3?</strong></summary>

Yes, you can choose between SSD (gp2/gp3) or S3/S3 Glacier for your local storage needs.

</details>

<details>

<summary><strong>What is the role of the Global Settings and Local Storage?</strong></summary>

* **Global** manages Salesforce connections and controls user access with AWS Cognito (or respective identity providers).
* **Local Storage** serves as temporary data storage during processing.

</details>

<details>

<summary><strong>What are the available local storage types</strong></summary>

* SSD (gp2)
* SSD (gp3)
* S3 Glacier Instant Retrieval
* S3 Glacier Flexible Retrieval

</details>

<details>

<summary><strong>What is the purpose of Nginx?</strong></summary>

* Proxy requests to the Docker container
* Manages SSL termination and certificates
* Enables HTTPS for secure communication

</details>

## ![](https://646917531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Focom3JROuDKOidclKbQx%2Fuploads%2FO36HuytHtrB4AAaIU8AC%2FRestore-Icon.svg?alt=media\&token=8727e285-8b99-4993-8aa9-148140042c32) Backup & Restore Behavior

<details>

<summary><strong>Why do I need two backups to restore data (corruption and recovery points)?</strong></summary>

To minimize guesswork and restore only affected data. Flosum compares changes between:

* The backup **before** the data loss (Recovery Point)
* The backup **after** the incident (Known Corruption Point)

Only the **changed records** are restored, ensuring precision and speed.

</details>

<details>

<summary><strong>Can I run multiple backup or restore jobs simultaneously?</strong></summary>

No, only **one job** (backup, restore, archive, or search) can run at any given time.

</details>

<details>

<summary><strong>What happens if a scheduled backup overlaps with a running job?</strong></summary>

The overlapping backup is **skipped**. The next unscheduled slot will capture any changes missed. Composite Backups resume and capture all deltas since the last successful run.

</details>

<details>

<summary><strong>Why are History objects not restored?</strong></summary>

In Salesforce, History objects lack **insert/update** permissions. This is a Salesforce platform-level restriction, not a Flosum limitation.

</details>

<details>

<summary><strong>How do record counts work in the backup jobs?</strong></summary>

When checking a completed backup job, the app displays record counts indicating how many records are stored in the backup and how many were processed in that job.

<figure><img src="https://646917531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Focom3JROuDKOidclKbQx%2Fuploads%2FeAahNdD9A3LVLBOFlVGl%2FFAQ-BackupRecordCounts-01.png?alt=media&amp;token=885b31dd-3bdf-4a85-82b6-06eea8baf969" alt=""><figcaption></figcaption></figure>

* **Total**: Count of all records currently stored in the Backup & Archive app for a specific object (e.g., Accounts, Contacts).

<figure><img src="https://646917531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Focom3JROuDKOidclKbQx%2Fuploads%2FNAP91UV9PHXvRqHIvl5F%2FFAQ-BackupRecordCounts-02.png?alt=media&amp;token=780198df-d18b-4af8-b2b8-4a9fb065c9be" alt=""><figcaption></figcaption></figure>

* Clicking on an object row opens the **Records Table**, showing:
  * **All** = Added + Changed + Deleted
  * **Added** = New records captured in this job
  * **Changed** = Existing records that were updated
  * **Deleted** = Records removed since the last backup

**Example:**

For example, a new backup was created yesterday and captured 40 Case records from your org.  The Total would show 40 Case records. Today, you added 10 new Cases and updated 5 existing Cases.

Today's backup will show:

<table data-header-hidden><thead><tr><th width="110.3333740234375"></th><th></th></tr></thead><tbody><tr><td>Total</td><td>50 (40 original + 10 new)</td></tr><tr><td>Added</td><td>10</td></tr><tr><td>Changed</td><td>5</td></tr><tr><td>Deleted</td><td>0</td></tr><tr><td>All</td><td>15 (10 added + 5 changed)</td></tr></tbody></table>

**Summary:**

* **Total** = All records stored
* **All / Added / Changed / Deleted** = Changes in this specific backup job

</details>

<details>

<summary><strong>What do the icons and chips represent on the “Add Child Objects” screen in the Backup &#x26; Archive app?</strong></summary>

Icons and indicators on the "Add Child Objects" screen convey important relationships between parent and child objects, especially during deletions while archiving:

<img src="https://646917531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Focom3JROuDKOidclKbQx%2Fuploads%2F503SL383XJ4z3trI0XqC%2FArchiveTemplate-CascadeIcon.png?alt=media&amp;token=99df6e94-d8a7-4871-8b52-e6821036b802" alt="" data-size="line"> **Yellow Warning Triangle (Cascade Delete)**

* The child object has a dependent (cascade delete) relationship with the parent.
* These are considered **Dependent objects** in Salesforce.
* **Optional to include** in the archive.
* If excluded, child records will be deleted when the parent is archived and deleted.
* This reflects Salesforce’s native cascade behavior.

<img src="https://646917531-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Focom3JROuDKOidclKbQx%2Fuploads%2Fgit-blob-2c8b832f9b92cd020087adcd8cce9245d31e3d1d%2FArchiveTemplate-DependentIcon.png?alt=media" alt="" data-size="line"> **Red Lock Icon (Restricted Delete)**

* The child object has a **Restricted Delete relationship** with the parent object.
* These objects are **automatically included** in the archive template and **cannot be excluded.**
* In Salesforce, restricted delete relationships prevent the parent record from being deleted unless the related child records are deleted first.
* Required to archive to prevent errors.

</details>

<details>

<summary><strong>Why am I receiving an INVALID_CROSS_REFERENCE_KEY error for the RecordTypeId field on the Order object during restore?</strong></summary>

This error occurs when the RecordTypeId from the archived data no longer exists or is inaccessible in the current org.

**Root Causes:**

* The archived record has an implicitly assigned RecordTypeId that:
  * No longer exists in the current org.
  * It is not visible/accessible to the restore user (running user).
  * Was tied to a past configuration or managed package.

**Solution:**

* Exclude the RecordTypeId field during restore.
* Salesforce will auto-assign the default Record Type.
* Prevents cross-reference errors and completes the restore.

</details>

<details>

<summary><strong>Why do I get the error INVALID_OR_NULL_FOR_RESTRICTED_PICKLIST when restoring an EmailMessage record with a FromAddress?</strong></summary>

This happens when the FromAddress is not recognized or validated in your Salesforce org.

**Salesforce only allows:**

* Organization-Wide Email Addresses
* Email-to-Case routing addresses
* Email addresses of active users

If the FromAddress in your backup (e.g., <abc@abc.com>) isn’t validated, Salesforce will return:

* **INVALID\_OR\_NULL\_FOR\_RESTRICTED\_PICKLIST**
* **INVALID\_FIELD\_VALUE**

This error occurs because Salesforce is enforcing a restriction on the <mark style="color:green;">FromAddress</mark> field of the <mark style="color:green;">EmailMessage</mark> object. The error refers to <mark style="color:green;">ValidatedFromAddress</mark>, but the issue lies with the value in the <mark style="color:green;">FromAddress</mark> field, which must be validated and authorized in Salesforce.

Internally, Salesforce uses a field called <mark style="color:green;">ValidatedFromAddress</mark> to ensure that the <mark style="color:green;">FromAddress</mark> is among the list of authorized senders. To avoid this error during a restore or insert, exclude the <mark style="color:green;">ValidatedFromAddress</mark> field from your restore request for EmailMessage records.

</details>

<details>

<summary><strong>When should the “Query All Files” permission be granted to a user using the Backup &#x26; Archive app, and what happens if it is not granted?</strong></summary>

The **"Query All Files"** permission is sensitive and should be assigned only to trusted system or integration users.

**Required when:**

* Backing up or restoring files not explicitly shared with the user.

**If not granted:**

* Only shared files will be backed up.
* Some files visible via record access may be skipped.
* Restore may miss file attachments that weren’t captured.

**Impact:**

* Incomplete file backup and restore.
* Risk of data gaps in shared or collaborative environments.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.flosum.com/backup-and-archive/general-information/faq-and-guidance/faq-backup-and-archive.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.