How does Flosum Backup & Archive protect Salesforce data?

Flosum Backup & Archive protects Salesforce data with automated, policy-aligned backups, granular recovery, metadata coverage, encrypted storage, and long-term archiving. It helps enterprises prevent data loss, recover quickly, and maintain business continuity when records, files, metadata, or relationships are changed, corrupted, or deleted.

Does Salesforce automatically back up my data?

Salesforce provides native data protection options, but enterprise teams often need more control, automation, retention, metadata coverage, recovery precision, and compliance support than basic backup capabilities provide. Flosum gives organizations a Salesforce-aware backup and archive solution built for complex, high-risk environments.

How often should Salesforce data be backed up?

Salesforce data should be backed up based on business risk, data change frequency, compliance requirements, and recovery expectations. For many enterprises, that means scheduled, incremental, on-demand, and policy-driven backups. Flosum supports continuous protection for critical data and automated backup workflows aligned to business needs.

Can Flosum back up Salesforce metadata?

Yes. Flosum supports granular metadata backup along with Salesforce data, files, attachments, and complex object relationships. This helps teams recover not only records, but also the structure, configuration, and business logic that keep Salesforce running correctly.

How does Salesforce backup and recovery work with Flosum?

Flosum creates secure backups of Salesforce data, metadata, files, attachments, and relationships, then gives teams precise recovery options when something goes wrong. Teams can restore exactly what the business needs, from a single record to a full org, without unnecessary overrecovery or extended downtime.

Can Flosum restore deleted or corrupted Salesforce data?

Yes. Flosum helps teams identify where corruption began and restore clean data quickly. Its granular recovery capabilities allow organizations to recover specific records, fields, objects, files, metadata, or larger Salesforce environments with minimal disruption.

How long does it take to recover Salesforce data from a backup?

Recovery time depends on the scope of the restore, the amount of data, and the complexity of relationships involved. Flosum is designed for fast, targeted recovery, helping teams pinpoint the right recovery point and restore only what is needed to reduce downtime and business disruption.

What Salesforce data can Flosum protect?

Flosum can protect Salesforce records, metadata, files, attachments, object relationships, configurations, and business-critical data across Salesforce environments. This gives enterprises complete environment resilience instead of partial backup coverage.

How does Flosum archive Salesforce data?

Flosum uses policy-driven archiving and retention controls to help teams move inactive Salesforce data into secure, accessible storage. Archived data can be retrieved when needed, helping organizations reduce active storage overhead without losing visibility or control.

Can Flosum perform automatic Salesforce backups?

Yes. Flosum supports scheduled, on-demand, and incremental backups, helping teams automate Salesforce data protection and reduce the risk of manual backup gaps.

Why should enterprises back up Salesforce data?

Salesforce data loss is not just an IT problem. It can impact revenue, compliance, operations, customer trust, and business continuity. A dedicated Salesforce backup and recovery solution helps enterprises recover quickly from accidental deletion, corruption, failed integrations, user error, cyber incidents, and release issues.

Is Salesforce backup free?

Basic native or manual options may be available, but enterprise-grade Salesforce backup typically requires a dedicated solution with automated backups, metadata protection, granular restore, audit trails, compliance controls, and long-term retention. Flosum is built for organizations where data loss is not an option.

How is Flosum different from other Salesforce backup tools?

Flosum combines Salesforce-aware backup, granular restore, metadata protection, archiving, compliance controls, encrypted storage, flexible key management, and low-impact processing in one enterprise platform. It is optimized for complex orgs, high data volumes, strict compliance requirements, and predictable pricing.

Does Flosum reduce API impact during backups?

Yes. Flosum is designed for low-impact processing that minimizes API consumption and operational disruption, even in large Salesforce environments with high data volumes.

How quickly can teams get started with Flosum Backup & Archive?

Teams can get started quickly with guided workflows, unified backup, restore, and archive management, and support from Flosum experts. The platform is designed to reduce manual effort and help enterprises protect Salesforce data without adding unnecessary operational complexity.

Deployment Architectures

Run Flosum where your security
model says it should run.

Most Salesforce DevOps vendors give you one architecture and a reason to accept it. Flosum gives you three - Salesforce-native, Flosum-hosted cloud, or your own infrastructure - and tells you exactly what each one means for data flow, encryption, and responsibility. Read this page and you will know which one fits before you ever talk to sales.

At a Glance

Three architectures. One decision: who holds the keys.

The functional product is the same. What changes is where compute runs, where data rests, and who operates the infrastructure. Choose based on your data-residency, procurement, and security requirements - not on what a vendor is able to offer.

Zero external infrastructure

Salesforce Native

A managed package installed directly in your Salesforce org from the AppExchange. Metadata and data are processed inside the Salesforce trust boundary.

- No data leaves your Salesforce environment

- Inherits Salesforce's compliance framework and Shield support

- Governed by your existing Salesforce security controls

- Nothing new for your security team to host, patch, or monitor

Flosum-operated

Flosum-Hosted Cloud

Flosum Cloud Apps - DevOps, Backup & Archive, Data Migrator, Global Settings - run on Flosum-managed AWS infrastructure. Flosum operates, patches, and updates the stack.

- AES-256 at rest, TLS 1.2+ in transit

- Keys protected by AWS KMS; unique key per connected org

- SSO (SAML/OIDC), SCIM, JIT provisioning, MFA, IP allowlisting

- Optional: bring your own storage bucket (see hybrid model below)

Customer-operated

Your Cloud, Your Infrastructure

The same Cloud Apps, installed on a virtual machine you own - AWS, Azure, or GCP. Your network, your storage, your encryption keys, your controls.

- Data never transits Flosum-owned infrastructure

- You supply and manage the encryption key material

- Satisfies strict data-residency and sovereignty mandates

- You retain complete responsibility for infrastructure security

We are deliberately transparent about option 3.

Self-hosting means exactly that: you own the VM, the network perimeter, the OS patching, the storage, and the key material. Flosum ships the software and security guidance - the operational security of the infrastructure is entirely yours. If your team doesn't want that responsibility, options 1 and 2 exist for a reason.

Architecture Detail

What actually runs where

1 Salesforce Native - managed package

Trust boundary: your Salesforce org

Your Salesforce Org

Salesforce trust boundary · your existing controls apply

Flosum

managed package

Your metadata

& data

Everything executes inside your org. There is no external arrow to draw - that's the point.

Flosum's native solution is built on the Salesforce platform and distributed as a managed package. All processing - version control, merges, deployments, pipelines - executes inside your org. There is no external server, database, or data-center footprint associated with the native architecture.

Consequences worth stating plainly: your org's existing controls (profiles, permission sets, login policies, Shield Platform Encryption, event monitoring) apply to Flosum automatically. Your security review of Flosum native is largely a review of Salesforce itself, plus the package's AppExchange security review.

Data location - inside your Salesforce org, always

Infrastructure - none beyond Salesforce

Encryption - Salesforce platform encryption; Shield compatible

Identity - your Salesforce authentication and SSO

Patching - managed package upgrades, no servers

Best fit - teams standardized on the Salesforce trust boundary

2 Flosum-Hosted Cloud

Trust boundary: Flosum-managed AWS + your Salesforce org

Your Salesforce Org

your controls · Shield compatible

HTTPS · TLS 1.2+

Flosum-Managed AWS

Flosum operates, patches, monitors · audited every 6 months

Cloud Apps

DevOps · Backup & ArchiveData Migrator · Global SettingsSSO · SCIM · MFA · IP ranges

Encrypted Storage

AES-256 at restAWS KMS-protected keysunique key per org

Flosum operates the environment; your data is encrypted in transit and at rest with per-org keys.

Flosum Cloud Apps run on AWS infrastructure that Flosum owns and operates, available in private or public cloud configurations. Data moves between your Salesforce org and the Flosum environment over HTTPS with TLS 1.2 or later - legacy TLS 1.0/1.1, weak ciphers, and SSL are disabled. Backups and archives are encrypted at rest with AES-256; data remains encrypted in storage even during view and export operations (decryption happens in-memory, per request).

Key management: encryption keys are protected by AWS KMS, with a unique key per connected Salesforce org that persists across sandbox refreshes. The application's MySQL database stores configuration - connection tokens, templates, job logs - never your backup payloads. Access control runs through Flosum Global Settings: role- and group-based permissions, SAML and OIDC SSO, SCIM provisioning, JIT, MFA devices, and network-access IP ranges. Flosum's hosted services are audited by third parties every six months, and the environment is monitored with AWS-native tooling including CloudTrail.

Data location - Flosum-managed AWS

Encryption in transit - TLS 1.2+ only

Encryption at rest - AES-256, AWS KMS-protected keys

Identity - SSO (SAML/OIDC), SCIM, JIT, MFA, IP allowlists

Operations - Flosum patches, maintains, and updates

Best fit - teams that want cloud-app capability without operating it

Hybrid variant: Flosum-hosted compute, customer-owned storage

Backup & Archive supports a split model many vendors can't offer: Flosum operates the application, but backup data is written to a storage bucket you own - your AWS S3 bucket or Azure Blob container, in your account, in your region, under your IAM policies and retention rules. You get managed operations without surrendering custody of the data at rest. Configured through Global Settings.

Your Salesforce Org

source data

TLS 1.2+

Flosum-Hosted

Backup & Archive
Flosum operates the app

AES-256

Your Storage

your S3 bucket / Azure Blob
your account · your region

Hybrid model: managed application, customer-owned data at rest.

3 Customer-Hosted - your cloud and infrastructure

Trust boundary: yours, end to end

YOUR TRUST BOUNDARY - no Flosum-owned infrastructure inside

Your Salesforce Org

your controls apply

TLS 1.2+

Your Cloud VM - AWS / Azure / GCP

Flosum Cloud Apps

Docker · NGINX proxy
your domain + SSL cert

Your Storage & Keys

SSD gp2/gp3 or S3key material you generate

Identical application architecture, different owner. You provision a cloud VM - AWS, Azure, or GCP - and the Flosum Cloud Apps install onto it in Docker containers behind an NGINX proxy that you front with your own domain and SSL certificate. Storage is yours (SSD gp2/gp3, or S3 on AWS). Encryption keys are yours: you generate the 32-byte key material and inject it into the deployment configuration. Flosum never holds your data or your keys.

The trade is explicit. You gain full data sovereignty and the ability to place Flosum inside your existing network controls, monitoring, and compliance perimeter. In exchange, you retain complete responsibility for your own security: VM hardening, OS patching, network access, certificate lifecycle, storage durability, and key custody. Flosum's certifications cover Flosum's software and Flosum's hosted operations - they do not extend to infrastructure we don't operate.

Data location - your cloud account, your region

Minimum VM - 32 GB RAM, 4 vCPU (AWS r5n.xlarge or better), Ubuntu x64

Encryption keys - generated and held by you

Prerequisites - registered domain + SSL certificate, TLS 1.2+

Operations - you patch, monitor, and secure the stack

Best fit - regulated, sovereign, or air-gapped-adjacent environments

Why government and defense teams choose this model

Public-sector organizations frequently combine Salesforce Native (running in Salesforce Government Cloud, inheriting its impact-level authorizations) with Customer-Hosted Cloud Apps inside their own accredited enclave. The result: every component of the toolchain sits within an environment authorized at the DoD impact level their data requires - because the accreditation boundary is theirs, not a vendor's.

Shared Responsibility

Who is responsible for what - no ambiguity

Security questionnaires exist because vendors blur this table. Here it is unblurred.

Layer	Salesforce Native	Flosum-Hosted Cloud	Customer-Hosted
Application security (code, releases, security testing)	Flosum	Flosum	Flosum
Infrastructure & physical hosting	Salesforce	Flosum (on AWS)	Customer
OS & runtime patching	Salesforce	Flosum	Customer
Network perimeter, domain & certificates	Salesforce	Flosum	Customer
Encryption key custody	Salesforce platform / Shield	Flosum via AWS KMS	Customer
Data-at-rest storage ownership	Salesforce (your org)	Flosum - or Customer with bring-your-own bucket (B&A hybrid)	Customer
Identity & access administration	Customer (your org's IAM)	Customer (via Global Settings)	Customer
User provisioning & least-privilege configuration	Customer	Customer	Customer
Monitoring & incident response for infrastructure	Salesforce	Flosum	Customer

Flosum

Customer

Salesforce

(platform provider)

Choosing

The questions that decide it

If your requirement is...	Then start with...	Because...
No new vendor infrastructure in scope; data must stay in Salesforce	Salesforce Native	There is no external footprint to assess. Your Salesforce review covers it.
Cloud-app capability (backup, archive, data migration at scale) with a vendor-run stack	Flosum-Hosted Cloud	Flosum operates and audits the environment; you manage users and access.
Managed operations, but data at rest must stay in your account	Hybrid (B&A)	Flosum runs the application; backups land in your own S3 or Azure Blob storage.
Data sovereignty, regional residency, or DoD impact-level accreditation within your own boundary	Customer-Hosted (often with Native)	Data, keys, and the accreditation boundary never leave your control - the pattern government customers use.

Bring this page to your security team.

Then bring their hardest questions to us. Full security statements, architecture diagrams, audit reports, and pentest summaries are available in our documentation and on request.

Certifications & Compliance Technical Documentation

Architecture details reflect current published documentation at docs.flosum.com. For contractual specifics, refer to your agreement and the applicable security statement.

Run Flosum where your security
model says it should run.