> For the complete documentation index, see [llms.txt](https://docs.flosum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flosum.com/data-migrator/general-information/data-migrator-security-overview.md).

# Data Migrator Security Overview

## ![](https://2769999621-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FvaxzColPOlNbsq4imqpd%2Fuploads%2FcfMTqg4Brbm9baWutclZ%2FSummary2-Small-Icon.svg?alt=media\&token=d1cf162d-c02d-4184-988e-7f7350e450fc) Overview

Cloud Data Migrator is designed to deliver enterprise-grade security across both Flosum-hosted and customer-hosted environments. This article provides a comprehensive overview of its security architecture, covering encryption, infrastructure setup, identity management, and secure communication practices.

## Key Security Features

* **Strong Encryption:** Utilizes Amazon SSE-S3 with AES-256 to ensure robust data protection.
* **Secure Key Management:** Encryption keys are managed by Amazon.
* **Controlled Access:** Offers flexible identity provider options for tailored access control.

These features ensure that Cloud Data Migrator provides secure and reliable migration solutions for enterprise needs.

## System Architecture

The Flosum Cloud Apps architecture is explained in detail in the following article.

* [Flosum Cloud Apps Architecture](/resources/architecture/flosum-cloud-apps-architecture.md)

## Encryption & Data Security

### Encryption in Transit and at Rest

* **Encryption keys:**
  * Encryption keys are managed by AWS.
  * Bring Your Own Key (BYOK) is not supported for data encrypted in the Data Migrator app.
* **In transit:**
  * All data is transmitted over **HTTPS (SSL/TLS)**.
  * Migrated data is encrypted and transmitted directly between the source and target Salesforce orgs.
  * Migration results and rollback snapshots are encrypted and transmitted from the target Salesforce org to Data Migrator.
* **At rest:**
  * Data is encrypted in cloud storage using Amazon SSE-S3 with **AES-256**.
  * Data remains encrypted even when viewed or exported.

{% hint style="info" %}

#### Decryption Process of Data for GUI Display

When the user views the migration results, the following process occurs.

1. The encryption key is retrieved from Amazon.
2. Key is cached in VM RAM.
3. The encrypted file is decompressed and decrypted in memory.
4. Data is shown to the user in the GUI.
5. File in storage remains encrypted.
   {% endhint %}

### Data Residency

Data residency depends on how your Cloud Apps tenant is hosted.

* **Flosum-hosted tenants:** Your data resides in the AWS region where Flosum hosts the tenant. For example, a tenant hosted in the United States stores its data in AWS's US data center.
* **Customer-hosted tenants:** Your data resides in the AWS region you select when you deploy the Cloud Virtual Machine. Because you own and manage the cloud instance, you control where the data physically resides.

## Identity & Access Management

Data Migrator supports different login methods, including multiple identity provider protocols:

* **Flosum Username & Password**
* **Single Sign-On (SSO)**
  * **OIDC** (OpenID Connect) Identity Providers
  * **SAML** (Security Assertion Markup Language) Identity Providers
  * **JIT** (Just-In-Time) Provisioning
  * **SCIM** (System for Cross-domain Identity Management) Support

{% hint style="info" %}
Flosum’s **Global Settings** app is used to securely manage access across hosted environments. For detailed information about user management, see the following article.

* [Overview of Roles, Groups, and Users](/global-settings/user-management/overview-of-roles-groups-and-users.md)

For information about setting up Identity Providers for SSO, see the following article.

* [Overview of Identity Provider (SSO)](/global-settings/security/identity-providers-sso/overview-of-identity-provider-sso.md)
  {% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.flosum.com/data-migrator/general-information/data-migrator-security-overview.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.