search

forcedotcom / SFDX-Data-Move-Utility

SFDMU is a cutting-edge Salesforce data migration tool for seamless org population from other orgs or CSV files. It handles all CRUD operations on multiple related objects in one go.
BSD 3-Clause "New" or "Revised" License
456 stars 75 forks source link

Dear SFDMU Team We have some security related question while using the SFDMU tool #834

Closed SFDMUTOOL closed 4 months ago

SFDMUTOOL commented 4 months ago

Q1. Is it possible to have a flow diagram with all the network areas and assets/environments involved while migrating the data from Source org to Destination Org

Q2. What are the protocol used to exchange data including the encryption algorithm used in transit. While migrating the data from Source to Destination Org. Q3. Where are data stored during the end to end process. (is there any copy of data between the 2 orgs)?

Q4. Could you provide a description of the credentials management and authentication mechanism? While migrating the data from Source org to Destination Org.

Q5 . What is the licensing model for the software and all subcomponents (free/shareware libraries used)? Please provide details.

Q6. How the SFDMU Software is maintained and by whom?

Q7. While doing the migration form source org to destination org where the patches get updates?

Q8 .What are the SFDMU Software update average frequency?

hknokh commented 4 months ago

Hello, @SFDMUTOOL

Thank you for reaching out. I will do my best to assist you as quickly as possible and will keep you updated on my progress.

Cheers

hknokh2 commented 4 months ago

Hello,

Please find below the answers:

  1. I can't provide a data flow diagram, but the flow is very simple. As described on the key features page of the SFDMU Help Center, all data is processed and optionally stored ONLY ON THE USER'S COMPUTER where the SFDMU Plugin or the SFDMU GUI runs. No credentials data is stored anywhere, even on the local machine. The records are loaded from the source org into the user's computer memory, transformed in memory, and exported from memory directly to the destination org.

  2. SFDMU uses only the standard Salesforce API, called using SSL. The tool utilizes the jsforce open-source library for interaction with the Salesforce API.

  3. By default, the records are not stored anywhere, but you have data cache options in export.json. This stores unencrypted data on the user's local machine only. Some data can be exposed in the local file system when generating unencrypted _target.csv files. Typically, when migrating Files and Attachments, the binary file data is downloaded from the source org, stored on the local file system, and then uploaded to the destination org. We trust that the data buffered on the user's machine remains secure under the security mechanisms exists on the user's machine.

  4. No credential management is implemented inside the SFDMU plugin and GUI. Authentication is done by calling the Salesforce CLI command internally at runtime by the plugin's and/or GUI's code, as if you were doing that using the OS console. The access token used is what the sf org display CLI command prints to the OS console.

  5. For the licensing model, refer to the LICENSE file in the repository. For the dependent libraries, most are under MIT. You can use any free npm libraries of your choice to analyze the dependency graph, for example, depcheck.

  6. It's maintained solely by me, based on my free time. It's my contribution to the Salesforce community, and no SLA is enforced. I can stop maintaining this project and even archive it at any time.

  7. I don't understand the question.

  8. There is no specific frequency and no obligations since it's a free contribution without any responsibility.

For any other details, please examine the SFDMU Help Center and the repositories.

Helpful links:

I hope this helps!

github-actions[bot] commented 4 months ago

This case has been marked as 'to-be-closed', since it has no activity for the 3 days.
It will be automatically closed in another 3 days of inactivity.

github-actions[bot] commented 4 months ago

This case has been closed, since it has no activity for the last 6 days. Feel free to reopen it, if you need more help.