Salesforce Docs Portal

Get Started with Backup & Recover for Salesforce

Set up and run your first backup with minimal friction. As a first-time user, provision an Own account as the Master Admin, connect a Salesforce org, and add an initial backup service. Configure key security and user access settings so your team can operate securely.

Where possible, we changed noninclusive terms to align with our company value of Equality. We maintained certain terms to avoid any effect on customer implementations.

At a Glance

  • Goal: Run your first Salesforce backup in Own as quickly and securely as possible.
  • Required for first backup: Create your Salesforce Authenticated User, provision your Own account, configure network access only if your org requires allowlisting, add a backup service, and confirm backup status.
  • Recommended after first backup: Configure single sign-on (SSO) or MFA, apply IP restrictions, configure Bring Your Own Key (BYOK), and set up business units and users. If you use BYOK, you're required to configure it before the first production backup.

Quickstart Path

To run your first backup with minimal setup time, complete these steps in order.

  1. Create your Salesforce authenticated user
  2. Get an Own from Salesforce Platform account
  3. Configure Salesforce network access for Own
  4. Add a backup service
  5. Monitor the status of your first backup

The remaining sections cover recommended security configuration and user management. You can complete them before or after your first backup, except where noted.

For a clear first-time onboarding flow, complete the quickstart path first, confirm that your first backup starts, and then return to the optional hardening sections.

Before You Begin: Key Concepts

Before you start, it helps to understand key concepts in Backup & Recover from Salesforce.

  • Own from Salesforce Platform
  • Salesforce Authenticated User
  • Own Platform Master Admin

Own from Salesforce Platform

Backup & Recover runs on the Own from Salesforce Platform. It's a separate application with its own login, not a feature inside your Salesforce org.

You set up backup services and run backups in the Own app at https://auth.owndata.com/. You don't manage backups in Salesforce Setup.

Salesforce is the org that Own backs up. Own is the platform that performs and stores the backups.

Important
Important You access Own outside of Salesforce. Log in to the Own app at https://auth.owndata.com/ with your Own account, not your Salesforce credentials.

The Salesforce Authenticated User and the Own Platform Master Admin are two different accounts in two different systems. The Salesforce Authenticated User is in Salesforce, and the Master Admin is in Own Platform.

Salesforce Authenticated User

The Salesforce Authenticated User is the dedicated Salesforce user that Backup & Recover uses to access your Salesforce org. This user is separate from your Own platform account user.

Create a dedicated Salesforce user for this purpose to improve security and auditability. For required permissions, see Salesforce Authenticated User Requirements for Backup & Recover.

Own Platform Master Admin

The Master Admin is the user in your Own from Salesforce Platform account with the highest access privileges. The Master Admin can configure all settings, manage users, and access everything in the account.

When Own provisions the account, it assigns the person completing the setup as the Master Admin. This guide assumes that you're the Master Admin.

Important
Important An account can have only one Master Admin. Only the Master Admin can transfer the Master Admin role to another user — plan ahead so the role doesn't become inaccessible if that person leaves. For information about how to make that transfer, read Swap Master Admin Accounts. If you don't have access to the Master Admin account, contact Salesforce Support.

For more details about what the Master Admin can do, see Roles & Permissions.

Create Your Salesforce Authenticated User

Create this user before you add your first backup service.

  1. In Salesforce, create a dedicated user account and use it only for Backup & Recover authentication. See How To: Add New Users and Assign Licenses
  2. Assign the required permissions and access for Backup & Recover. For detailed permission requirements, see Salesforce Authenticated User Requirements for Backup & Recover.
  3. Save the login credentials securely so that you can use them during service authentication in Own.
Important
Important If you make changes to the Salesforce Authenticated User username, this breaks the authentication connection and requires reauthentication to restore the backup service. See Reauthenticate Salesforce Services in Backup & Recover for Salesforce.

Configure Salesforce Network Access for Own

If your Salesforce org restricts inbound traffic, enable Own's required IP addresses and URLs before adding your service. If your org doesn't restrict inbound traffic, skip this section.

  1. Review the required regional IP addresses and URLs in Own Regional Locations and IP Addresses for Allowlisting.
  2. Add the required entries to your Salesforce/network allowlists.
  3. Confirm that no firewall, proxy, or network policy blocks Own from reaching your Salesforce org.

Own Backup Service Types

There are four backup service types, each representing the type of data that's backed up.

Service Type What's Backed Up
Production Data Salesforce records, files, content documents, and Chatter posts
Production Metadata Org customizations: custom fields, custom Apex code, page layouts, reports, permission sets
Sandbox Data Salesforce records, files, content documents, and Chatter posts in sandbox environments only
Sandbox Metadata Org customizations: custom fields, custom Apex code, page layouts, reports, permission sets in sandbox environments only

These backup services run daily.

Note
Note If you have Continuous Data Protection, you can back up data for specific objects on a continuous basis. This guide doesn't cover Continuous Data Protection. For more details about the feature, see Set Up Continuous Data Protection.

Get an Own from Salesforce Platform Account

To use Backup & Recover for Salesforce, you must get an Own from Salesforce Platform account. Getting an Own from Salesforce Platform account is a two-part procedure.

First, your company representative contacts Salesforce to provision your account. They're asked to nominate the Master Admin and region.

Second, as the nominated Master Admin, you respond to the welcome email. If you haven't received the welcome email, follow the steps for Reset Passwords for an Existing User.

  1. Contact Salesforce by using the Salesforce Contact Us form. For Product Interest, select Salesforce Platform.
  2. After Own sets up your account, you receive a welcome email that prompts you to set your password. If needed, check your spam folder and add @owndata.com to your email allowlist.
  3. Use the first link in the email to set your password.
  4. If the first link expires, use the second link to request a new password link.

The first time you log in to the Own app at https://auth.owndata.com/ (not Salesforce), Own prompts you to add a backup service. Add the service, then return later to configure security and user access.

Add a Backup Service

Before you start, log out of your Salesforce org. This action makes sure that Own authenticates as your dedicated Salesforce authenticated user, rather than your current admin session.

Important
Important If you use BYOK, configure your key before you run the first backup for your production org. See Bring Your Own Key (BYOK, BYOKMS and BYOKV) for Backup & Recover.

In the Own app:

  1. Go to the Backup tab and click New Service.
  2. Select Salesforce.
  3. Select a service type.
  4. (Optional) If you use a custom domain in Salesforce, click Use Custom Domain, and enter your custom domain.
  5. Click Add Service. You're prompted to authenticate with Salesforce, authorizing Own to access your org. Use the credentials for your Salesforce authenticated user.
Note
Note After you create the service, Own starts a full backup of your org immediately. This first backup copies your entire dataset and usually takes longer than later backups. Own runs data and file backups as separate processes: the data backup typically completes first. The file backup continues until complete. Due to the large size of files, their backup continues on each consecutive day until the files backed completes. Monitor progress on the Backup Services page, and watch for the completion email. The schedule and service settings in the next section apply to subsequent backups.

Configure Own Security and Access Recommended After First Backup

Protect your Own from Salesforce Platform account by limiting access and implementing security features. These steps are optional, but recommended.

  1. Restrict access to trusted IP ranges. See Configure IP Address Restrictions.
  2. Configure identity security with Enable Single Sign-On or Set Up Multi-Factor Authentication.
  3. Secure your backup data with your own encryption keys by using Bring Your Own Key (BYOK, BYOKMS and BYOKV) for Backup & Recover.
  4. If your use case requires automation and integrations, enable API with Access Own through the Own API.

Manage Business Units and Add Users

To make sure that each user gets the right scope and role from the start, set up business units before adding users.

User Role Manage Business Unit Add Users
Master Admin Yes Yes
Admin Yes Yes
Security Admin No Yes
  1. Create or review business units in Account Settings | Business Units. See Manage Business Units.
    Note
    Note If you use System for Cross-domain Identity Management (SCIM) provisioning, the default business unit must keep the name Default Business Unit. Renaming or deleting it causes the SCIM integration to fail.
  2. Add users in Account Settings | Users and assign role and business unit. See Add Users. Review role capabilities as needed in User Roles.

When you add a new user, that user has 48 hours to verify the email address. If the user doesn't verify in time, remove the user and add them again.

Configure Backup Service Options

Your first backup has started. The next settings apply to subsequent scheduled backups. After you configure them, the next backup run applies them.

On the Backup Services page, click the backup service you created. The service's Dashboard opens.

Go to Options, then General.

  1. Change the name of your backup service.
    We suggest using a descriptive name, for example, "Production Data."
  2. Enter the time of day that you want the daily backups to start.
    For example, during off-peak hours.
    Set your time zone correctly on the Edit Profile tab.
  3. Select a day for the weekly backup.

Backup & Recover performs a full weekly backup followed by daily synthetic full backups until the next full backup day.

A synthetic full backup captures change and merges them with a previous full or synthetic full backup to create an updated complete backup. Learn more about Backup Types for Salesforce.

For details on other configuration options, see Essential Service Options in Backup & Recover for Salesforce.

Monitor the Status of Your Backup

On the Backup Services page, view the status for each service. Own backs up data and files in separate processes. This process lets data backups finish faster while file backups continue until completion. The main status on the Backup Services page shows the data backup status. When file backup completes, the page also shows a checkmark icon and "Files completed."

Click the service to see its Backup Service Dashboard. On the dashboard, view a visual representation of the number of records added, changed, or removed over time.

If a backup fails or behaves unexpectedly, identify the cause and resolve it using Backup & Recover for Salesforce Troubleshooting

Next Steps

With a backup service running, explore the tools and settings for day-to-day backup management.