Frequently Asked Questions

Is the native Hyperforce resiliency model sufficient for me?
For the vast majority of customers, yes. Salesforce Hyperforce is engineered for stability and scalability, and features architecture that leverages the robust capabilities of Amazon Web Services (AWS) to ensure the availability and resilience of its services. Hyperforce infrastructure is deployed across multiple Availability Zones (AZs) to provide redundancy and prevent single points of failure. This design allows Hyperforce to maintain normal operations even when disruptions affect an AZ. For most customers, the inherent resiliency of Hyperforce with its 3AZ model is more than sufficient to ensure business continuity.

What is Salesforce Advanced Cross-Region Continuity?
Salesforce Advanced Cross-Region Continuity (ACRC) is a Hyperforce premium product that enables recovery from catastrophic regional disasters, such as earthquakes, climate events, or acts of war, when those events disable all availability zones (AZs) within a single Hyperforce region. Customers in highly regulated industries or in high-risk geographies might want this additional layer of protection.

How does Salesforce Advanced Cross-Region Continuity work?
Salesforce Advanced Cross-Region Continuity continuously copies your customer data from its primary region to a geographically remote and operable secondary region. The remote copy can be used to run your business from the secondary region during a disaster, and to restore data to the primary region when it recovers. Salesforce Advanced Cross-Region Continuity minimizes downtime and ensures business continuity, so you can resume business operations after an incident.

Where is Salesforce Advanced Cross-Region Continuity available?
Salesforce Advanced Cross-Region Continuity is available in the United States, India, Japan, and the EU. Salesforce is actively pursuing expansion into new regions, prioritized by customer demand.

Who needs Salesforce Advanced Cross-Region Continuity?
Customers who require safeguards against unexpected service disruptions that affect an entire geographic area can benefit from Salesforce Advanced Cross-Region Continuity. This added layer of protection, beyond standard Hyperforce capabilities, enhances overall business resilience by ensuring critical services remain available even during extended regional outages.

How is Salesforce Advanced Cross-Region Continuity different from Salesforce Backup?
Salesforce Backup protects data against everyday risks, such as accidental deletions or cyber attacks. Salesforce Advanced Cross-Region Continuity maintains full operational capabilities during severe regional disruptions. Together, they provide a comprehensive approach to data protection and business resilience.

How much does Salesforce Advanced Cross-Region Continuity cost?
For pricing information, please contact your account representative.

Is Salesforce Advanced Cross-Region Continuity only available on Hyperforce?
Yes, this service is only available on Hyperforce. Hyperforce uses a modern resiliency and availability model that deploys our software across at least three simultaneously active, independent regional locations, called availability zones (AZs). This model provides better resiliency and faster recovery than our first-party site-switching model. However, our first-party data center pairs sometimes have greater geographic separation. Salesforce Advanced Cross-Region Continuity delivers the best of both models–the high availability of Hyperforce, and the peace of mind from a geographically remote backup.

If I’m not yet on Hyperforce, can I buy Salesforce Advanced Cross-Region Continuity?
Yes, if you’re Hyperforce-eligible. Hyperforce-eligible customers who aren’t on Hyperforce are moved to Hyperforce within 90 days of purchase. Hyperforce-ineligible customers can’t buy Salesforce Advanced Cross-Region Continuity. Ask your account representative whether you’re eligible for Hyperforce.

What is a region?
A Hyperforce region is a geographic area that contains multiple independent but interrelated data centers that deliver Salesforce services. A country can contain one or several Hyperforce regions.

What is an Availability Zone (AZ)?
An availability zone (AZ) is a distinct, isolated, physical location, consisting of one or more data centers, that exists within a Hyperforce region and provides redundant and independent operations and storage. System failures in one AZ don’t affect other AZs. These systems are designed to deliver high availability and to recover from failure with minimal disruption. Hyperforce workloads and resources are distributed across at least three availability zones. The multi-AZ model provides better availability than first-party site switching.

What is RTO?
RTO stands for Recovery Time Objective. RTO goals express the maximum expected time to restore normal operations after the provider declares a disaster.

What is RPO?
RPO stands for Recovery Point Objective. RPO goals express the maximum expected amount of data loss after the provider declares a disaster.

What are the recovery time and recovery point objects (RTO/RPO) for ACRC?
The ACRC RTO/RPO targets are 12 and 4 hours. Salesforce is actively working to reduce RTO/RPO targets.

What types of scenarios could activate Salesforce Advanced Cross-Region Continuity?
Salesforce Advanced Cross-Region Continuity protects against prolonged region-wide infrastructure outages, such as those caused by natural disasters or acts of war. Examples include:

• Hurricanes
• Meteor strikes
• Nuclear attack
• Governmental coups
• Nation-state cyber terrorist attacks on critical infrastructure

Can I access my org during the disaster recovery operations?
No, your org is unavailable during a disaster recovery event.

Are my sandbox orgs protected by Salesforce Advanced Cross-Region Continuity?
Sandbox orgs aren’t covered by Salesforce Advanced Cross-Region Continuity. After the recovery event, you can trigger a new sandbox clone or refresh to create a sandbox org in the secondary region.

How does Salesforce Advanced Cross-Region Continuity impact country-level data storage commitments?
Salesforce chooses the secondary region following industry best practices for resilience, availability, and performance. Where possible, the secondary region is kept within the same country. If there’s no secondary region available in the same country, Salesforce chooses country pairings in the same geographical grouping, such as AMER, APAC or EMEA. The country pairs are selected to minimize possible regulatory or technical issues, such as Germany and France. When the primary and secondary regions are in different countries, data is stored in both countries. Before buying Salesforce Advanced Cross-Region Continuity review your data residency requirements.

What services are covered by Salesforce Advanced Cross-Region Continuity?
In general, services built on the Salesforce platform, such as the Sales and Service clouds, are covered by Salesforce Advanced Cross-Region Continuity. To ask about any specific service, contact your account team.

How should I prepare for an ACRC failover to the secondary region?
Find instructions in Prepare for an Advanced Cross-Region Continuity Failover.

What happened to the Salesforce Out of Region Disaster Recovery product?
Salesforce renamed Out of Region Disaster Recovery to Advanced Cross-Region Continuity to better express the advanced and additive nature of this product.

Technical FAQs

Does ACRC encrypt in-transit data during replication to the recovery region?
Yes. All data stores are encrypted in transit during replication.

Does ACRC use my Customer-Managed Key (CMK) for encryption?
Yes. If you’ve configured Customer Managed Keys for your org, your keys are used to encrypt your data during transit to the recovery region, and at-rest in both the primary and recovery regions.

Does ACRC support Shield Database Encryption
Yes. If you’ve purchased and enabled Salesforce Shield Database Encryption, it’s used to encrypt your org in the recovery region identically to your org in the primary region.

How does the data transit from the primary to the recovery region? Does it travel across the internet?
ACRC uses a combination of strategies depending on the data.

• S3 bucket replication moves the data entirely within Amazon’s privately owned and managed global network infrastructure.
• A secure networking service connects private networks across different regions.
• Keys are replicated through Ingress Gateway’s public endpoints through public proxy.

Data is not replicated across the open internet.

What encryption protocols and cipher suites does ACRC use for data in-transit?
ACRC uses a combination of strategies depending on the transmission type.

• S3 bucket replication: AWS automatically enforces the highest mutually supported TLS cipher suite, which is either TLS 1.2 or TLS 1.3.
• Data store replication (specific use case): Transmission is encrypted using Kerberos/SASL encryption
• Keys: The key material itself is wrapped and encrypted. The associated metadata is protected by the TLS session, which uses HTTPS and is encrypted by the TLS session key. TLS termination is also encrypted for this traffic.

How is data stored in the recovery region? Is it accessible or modifiable?
Hyperforce delivers every infrastructure instance as immutable, infrastructure-as-code, ensuring predictable state and eliminating security and configuration drift. Your org in the recovery region is identical to the org in the primary region. After a failover, accessibility is identical to the primary region.

Read more about Hyperforce Architecture.

Can Salesforce employees access the data?
The org in the recovery region is identical to the org in the primary region. All standard access rules and agreements apply.

If we stop using ACRC, what happens to our data in the recovery region?
When you discontinue ACRC, Salesforce migrates your org from the ACRC-enabled cell to a standard commercial cell. After your org is operating in the commercial cell, Salesforce deletes the primary and recovery orgs from the ACRC cells in the time frame and using protocols as set forth in the Documentation.

Will I lose access to any services after the failover?
Possibly, depending upon which SKUs you use. ACRC supports our Core data stores: Salesforce Database (SDB), Fileforce (FFX), HBase, and Search. SKUs that use other data stores aren’t supported Managed packages and 3rd-party apps are protected only if they use protected data stores. Contact your account team for a complete list of supported SKUs.