Prepare for a Salesforce Advanced Cross-Region Continuity Failover

Salesforce Advanced Cross-Region Continuity (ACRC) is a premium Hyperforce offering designed for specific internal and external compliance needs. It builds on Hyperforce's inherent resilience, adding a layer of protection against extraordinary regional catastrophes.

ACRC keeps a continuously replicated copy of the Salesforce Core org data in a region that is geographically remote from the primary Hyperforce region. If a disaster occurs, this secondary region can be activated to run the business and later serve as the source for data replication back to the primary region. Some services are not yet supported by ACRC. For questions about any specific service, contact your account team.

Learn more about ACRC in Salesforce Advanced Cross-Region Continuity - General Information and FAQ.

To ensure a smooth recovery in the secondary region, customers must prepare their ACRC-enabled orgs for a possible failover, and take specific actions after failover occurs.

NOTE: This document is for informational purposes only, and is not part of any legal or otherwise binding agreement. The policies and practices described in this document are subject to change at Salesforce's sole discretion.

Prepare for an ACRC Failover

Take these steps to prepare your org for a smooth failover to the recovery region.

Allow IPs for the recovery region – If you practice IP allowlisting and constrain your allowlists to certain countries, make sure to allow the IPs in the recovery location. Salesforce recommends modern alternatives to IP allowlisting, but if you must use allowlists, Salesforce advises you to allow the complete range of Salesforce IPs. Read more in these resources:
Remove hard-coded references - Even though your instance name remains the same after the failover, hard-coded references are a common failure point when orgs move. Salesforce recommends that you replace hard-coded instance references with relative references. Read more in Updating Hard-Coded References.
Set DNS Timeout to 5 minutes - If you have custom DNS time outs, make sure that they are no more than 5 minutes. A short DNS timeout ensures that your DNS cache will refresh quickly after the failover. Read more in DNS Timeout Value.
Manage locally cached certificates: If you locally cache certificates, join the Certificate Changes group in the Trailblazer Community to get the latest certificates.
Pre-configure AWS Direct Connect (DX) for the recovery region - If you use AWS DX for direct connectivity from your corporate network to Hyperforce, complete these steps.
- Establish dual DX connections to the primary and recovery regions to ensure immediate connectivity after a failover.
- Configure DX for Edge IP Ranges: If you use Regional Edge, allow the ranges for both the primary and recovery regions. Otherwise, allow Edge IP ranges for all regions.
- Read more in Set Up AWS Direct Connect (DX) for Hyperforce

React After an ACRC Failover

Refresh integrations - If you have integration problems after the failover, refresh your integrations.
Refresh your DNS cache - If you see a “Maintenance in Progress” alert on your login page after the failover, refresh your DNS cache.
Re-enable Einstein Bots - If you have Einstein Bots enabled on your org, trigger a new org authentication to Einstein AI by disabling and re-enabling Einstein Bots under Setup.
Restart automations - Review and restart any automations that were in-progress or scheduled to occur during the failover.
Reconfigure Private Connect - If you use Salesforce Private Connect for secure outbound or inbound traffic, you must manually reestablish your connections after relocating your connected apps to the recovery region. This setup requires an additional license for the secondary region. After the org is available in the recovery region:
- Log in to your Salesforce org.
- Delete the existing connection for the primary, impacted region.
- Establish a new connection for the secondary, recovery region.

Frequently Asked Questions

How does Salesforce notify customers about an ACRC failover?

After an incident occurs, Salesforce shares relevant information on Trust.

How long is the ACRC failover downtime window?

Twelve hours.

Can I access my org during the failover?

No, your org is unavailable during the failover.

Does my instance name change after the failover?

No, your instance name in the recovery region is the same as your instance name in the primary region.

What happens to sandboxes during a failover?

ACRC doesn’t cover sandboxes. After activation in the remote location, you can create new sandboxes from the production org. New sandboxes are created in the recovery region. If sandbox creation is in-progress when the failover begins, restart the operation after the production org arrives in the recovery region.

What happens to in-process transactions during and after the failover?

In-process transactions such as inbound API requests and Web-to-Lead submissions are interrupted. Restart those operations after the org becomes available in the recovery region.

What happens to scheduled operations during and after the failover?

We recommend that you review scheduled jobs, batch processes, and automations, and restart them if necessary. Jobs that were scheduled to run during the downtime period aren’t guaranteed to resume automatically.

What happens to event logs and audit trails after a failover?

Audit trails are available on the recovery instance. Event logs that were committed to Fileforce (Salesforce's internal file storage system) before the failover are available on the recovery instance. However, these logs are committed on a nightly basis. Any logs that weren’t yet committed to Fileforce don’t exist on the recovery instance.

What happens to messaging channels after a failover?

ACRC doesn’t yet support Service Cloud Real-Time products such as Live Agent, Omni-Channel, and LiveMessage. Salesforce plans to add support for these products in the future.

If I migrate my own applications to the recovery region during a failover, what happens to my Salesforce Private Connect connections?

Private Connect connections are region-specific and don’t automatically transition to the recovery region. If you migrate your applications to the recovery region, you must manually log in to the recovery org, delete the legacy connection, and establish a new connection. To make sure you can provision the new connection immediately, Salesforce recommends acquiring an additional Private Connect license in advance. After the primary region is back online, reestablish the connections in the primary org.

Where can I get help?

Contact Customer Support by logging a support case via Salesforce Help.