Salesforce Docs Portal

Using Bring Your Own Storage

Bring Your Own Storage (BYOS) is ideal for customers who want to own their backup data, in line with company security regulations and AWS storage commitments.

BYOS enables customers to run backup software locally, based on their company’s on-premises policy and security regulations, AWS storage commitments, or in case the customer’s third-party vendor relationship ends. In addition, BYOS is useful for analytics purposes.

Important
Important Bring Your Own Storage (BYOS) is no longer available for purchase. The contents of this article are intended for existing customers only.

Shared Responsibility Model

You're responsible for:

  • Creating the S3 bucket according to the guidelines that we provide you in the CloudFormation file.
  • Being responsible for your bucket security.
  • Auditing your bucket logs: login, add, edit, delete.
  • Handling storage costs.
  • Making sure accessibility of storage and availability of required space.

We're responsible for:

  • Creating a Daily Backup and store it in your S3 bucket.
  • Pulling the relevant data from your S3 bucket, and storing it temporarily in o9ur EBS for processing and previewing, for up to 30 days, for Find/Compare/Restore/Export jobs.
  • Managing backup retention and auto-delete backups from your S3 bucket.
  • Providing Backup & Recover product set: Smart-Alerts, Data Privacy, and so on
  • Alerting/Notifying in these cases:
    • Your S3 bucket is inaccessible for put/get/delete.
    • Data was copied from the your S3 bucket.
    • Your S3 bucket configuration has changed.
    • Your S3 bucket content was compromised (edit/delete event by a user other than us).
Note
Note Bring Your Own Storage is only supported in AWS S3.

Right to Rectify and Right to Forget (GDPR)

When you make a GDPR request, these records are masked and not deleted. For BYOS customers, if you request records directly from your storage account these records will not be masked.

If you terminate the relationship with us, you are responsible for masking your own data.

Data Loss Prevention

The responsibility for data protection in the bucket, using BYOS, is a shared responsibility between you (the customer) and us.

To protect against accidental (or intentional) data losses, Own uses S3 object versions, which are kept for 14 days, and then deleted automatically via an S3 lifecycle policy. This ensures that the storage-tier is multi-AZ (currently either Standard or Standard_IA).

To further protect the data, we recommend that customers use AWS Service Control Policies (SCPs) to block the following actions on the AWS account level that the bucket was created in:

  • Deletion of object versions ("s3:DeleteObjectVersion")
  • Deletion of an entire bucket ("s3:DeleteBucket")

Using SCPs in AWS is the recommended approach for implementing dual-responsibility for sensitive operations.

Alerts and Notifications

As the BYOS solution uses the shared responsibility model, we can only be responsible for your backups, as long as you don’t make configuration changes or policy changes to your S3 bucket.

The BYOS identifies changes and triggers these mechanisms:

  • Bucket policy changed: If you changed the bucket’s policy or settings, a validation test will find out if you did it. The test is done automatically twice a day.
  • Bucket content compromised: If the content of your bucket (backups) was deleted or edited by any non-Own user, SQS events will identify it.

If a change in the S3 bucket is identified:

  • You’ll receive an email notification with the invalidation reason. (The email is sent to all account users).

  • An error message is displayed with the invalidation reason.

  • All daily backups for the customer stop running and manually triggered backups or jobs fail.

  • A new event is added to the account’s audit event.

+ .