Data Migrator Security Overview

Overview

Cloud Data Migrator is designed to deliver enterprise-grade security across both Flosum-hosted and customer-hosted environments. This article provides a comprehensive overview of its security architecture, covering encryption, infrastructure setup, identity management, and secure communication practices.

Key Security Features

• Strong Encryption: Utilizes Amazon SSE-S3 with AES-256 to ensure robust data protection.
• Secure Key Management: Encryption keys are managed by Amazon.
• Controlled Access: Offers flexible identity provider options for tailored access control.

These features ensure that Cloud Data Migrator provides secure and reliable migration solutions for enterprise needs.

System Architecture

The Flosum Cloud Apps architecture is explained in detail in the following article.

• Flosum Cloud Apps Architecture

Encryption & Data Security

Encryption in Transit and at Rest

• Encryption keys:

  • Encryption keys are managed by AWS.
  • Bring Your Own Key (BYOK) is not supported for data encrypted in the Data Migrator app.
• In transit:

  • All data is transmitted over HTTPS (SSL/TLS).
  • Migrated data is encrypted and transmitted directly between the source and target Salesforce orgs.
  • Migration results and rollback snapshots are encrypted and transmitted from the target Salesforce org to Data Migrator.
• At rest:

  • Data is encrypted in cloud storage using Amazon SSE-S3 with AES-256.
  • Data remains encrypted even when viewed or exported.

Decryption Process of Data for GUI Display

When the user views the migration results, the following process occurs.

1. The encryption key is retrieved from Amazon.
2. Key is cached in VM RAM.
3. The encrypted file is decompressed and decrypted in memory.
4. Data is shown to the user in the GUI.
5. File in storage remains encrypted.

Data Residency

Data residency depends on how your Cloud Apps tenant is hosted.

• Flosum-hosted tenants: Your data resides in the AWS region where Flosum hosts the tenant. For example, a tenant hosted in the United States stores its data in AWS's US data center.
• Customer-hosted tenants: Your data resides in the AWS region you select when you deploy the Cloud Virtual Machine. Because you own and manage the cloud instance, you control where the data physically resides.

Identity & Access Management

Data Migrator supports different login methods, including multiple identity provider protocols:

• Flosum Username & Password
• Single Sign-On (SSO)

  • OIDC (OpenID Connect) Identity Providers
  • SAML (Security Assertion Markup Language) Identity Providers
  • JIT (Just-In-Time) Provisioning
  • SCIM (System for Cross-domain Identity Management) Support

Flosum’s Global Settings app is used to securely manage access across hosted environments. For detailed information about user management, see the following article.

• Overview of Roles, Groups, and Users

For information about setting up Identity Providers for SSO, see the following article.

• Overview of Identity Provider (SSO)