> For the complete documentation index, see [llms.txt](https://docs.flosum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flosum.com/resources/architecture/flosum-cloud-apps-architecture.md). # Flosum Cloud Apps Architecture ## Overview The diagram below illustrates the architecture of Flosum Cloud Applications, which applies to both Customer-Hosted and Flosum-Hosted installations. The main distinction between the two is ownership of the Cloud VM (Cloud Virtual Machine). In a Customer-Hosted setup, the customer owns the cloud instance where DevOps, Backup & Archive, and Data Migrator are installed and manages the infrastructure. In a Flosum-Hosted setup, DevOps, Backup & Archive, and Data Migrator are installed on Flosum's AWS instance. ### System Architecture Diagram
The numbered items in the diagram above are explained in the list below. All items run as Docker images in Docker Swarm on EC2. 1. **NGINX**: Manages, routes, and optimizes web traffic. 2. **Flosum Global Settings**: Manages granular role-based access control (RBAC) user permissions, security, and Salesforce connections for the Flosum SaaS app. It also manages each tenant's S3 bucket storage. 3. **Flosum OAuth**: Manages connections to security endpoints. 4. **Flosum SaaS**: 1. **Backup & Archive**: Backs up Salesforce items (copies them) to the Flosum SaaS app, or archives them (copies them, then deletes them from Salesforce). Backups and archives can be restored to the customer's Salesforce org. Customers bring their own key to encrypt their data in transit and at rest, and the key is stored in their Salesforce org. Data is transferred over HTTPS using Salesforce and custom APIs. Amazon RDS MySQL tracks backups, archives, and restores from the customer's Salesforce org, and it records where each backed-up or archived item is stored in S3. 2. **DevOps**: Provides scalable, secure Salesforce development. Integrated compliance controls accelerate release cycles and reduce errors, so your team can focus on delivering value. 3. **Data Migrator**: Moves data between Salesforce orgs while masking sensitive information for enterprise-level security and compliance. ### Customer-Hosted Requirements The following information is designed to help you understand the requirements for hosting your own Flosum Cloud Apps instance. **Cloud Virtual Machine:** A virtual machine is required to install Flosum Cloud Apps. The virtual machine must meet the recommended system requirements to ensure optimal performance. It should support the following requirements.
System Requirements
RAM32GB
CPU4
AWS Instancer5n.xlarge or up
Operating SystemLinux Ubuntu (x64)
**Domain Registration:** A domain registration is required to host Flosum Cloud Apps. This domain must be registered before you install Flosum Cloud Apps. **SSL Certificate:** A Secure Sockets Layer (SSL) certificate is required to secure the communication between Flosum Cloud Apps and your Salesforce organization. Customers can choose between a free and a paid SSL certificate. {% hint style="info" %} Flosum Cloud Apps only supports TLS 1.2 and its later versions, not SSL. Older TLS protocols (TLS 1.0 and 1.1), algorithms, ciphers, and configurations are disabled. For more information, refer to the following example: [**Link to Salesforce TLS setup guide**](https://help.salesforce.com/s/articleView?id=sales.emailadmin_set_up_tls.htm\&type=5)**.** {% endhint %} **Identity Providers:** Configure identity providers to manage access control for Flosum Cloud Apps. Customers have the following options to choose from: * Username and password authentication * OAuth 2.0 * Single Sign-On (SSO) * **Global Settings:** Flosum uses its own User Management application, which provides controls for access to the DevOps, Backup & Archive, and Data Migrator applications. **NGINX**: NGINX serves as a proxy for requests to the Docker containers. It also enables the use of certificates to support HTTPS. **MySQL:** MySQL stores Flosum Cloud Apps configuration settings. For example, the database stores information about Salesforce org access (Access token and refresh token), datasets, backup templates, CSV file IDs for backed-up objects, and logs for backup and restore jobs. An image of a MySQL database stores application configuration settings in a Docker Compose file. The MySQL database is not used to store customer backups. **Storage**: Local storage is utilized for storing data in the database, which can be of the following types: * Storage (SSD gp2) * Storage (SSD gp3) * Storage (S3) {% hint style="info" %} You can choose either SSD or S3 as a local storage option. However, S3 applies only to AWS, not to GCP or Azure. {% endhint %} Backup & Archive offers backup compression capabilities for different types of files: * Data and text files can be compressed by up to 60%. This means their backup size can be reduced by up to 60% compared to their original size. * Binary files, on the other hand, cannot be compressed. Their compression factor is 0%. **Anonymity and VPN usage:** The Flosum Cloud Apps platform does not support anonymous data sharing or allow anonymous access to any information. However, it works seamlessly with VPNs, and there are no restrictions when using it with VPN connectivity. **Salesforce Shield**: Flosum Cloud Apps is fully compatible with Salesforce Shield. Salesforce Shield encrypts data at rest, and when using Flosum Cloud Apps, data is pulled via APIs without any conflicts. **Flosum Cloud Apps and Salesforce Licenses:** For Flosum DevOps, Salesforce Standard and Platform licenses are provisioned into the DevOps Production organization. A single Flosum Cloud Apps license key can manage multiple Salesforce organizations. Adding more organizations will increase the storage space required on the customer's side and incur an additional cost. Backup & Archive, DevOps, and Data Migrator are separate products. Each product has its own version number. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.flosum.com/resources/architecture/flosum-cloud-apps-architecture.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.