Disclaimer: The information contained herein reflects the infrastructure and security standards in effect at the time of publication. Such standards are subject to change without prior notice in order to comply with evolving legal, regulatory, and security requirements. Accordingly, this documentation may be modified or updated at any time.
## Infrastructure ### Cloud Architecture The Forma Cloud service is delivered through a modern, resilient, and fully managed cloud infrastructure built on Amazon Web Services (AWS). The platform is deployed in AWS data centers located within the European Union (Ireland), with optional database mirroring available in Italy when required. - Our **application layer** runs on a Kubernetes-based architecture designed for high availability and elastic scalability. Workloads are distributed across multiple nodes that automatically scale up or down in response to real-time demand, ensuring consistent performance even during peak usage. All traffic is routed through AWS Global Accelerator to optimize connectivity and reduce latency for users worldwide. - The entire environment is secured within an **isolated Virtual Private Cloud (VPC)**, complemented by an AWS Web Application Firewall (WAF) that provides protection from common web threats such as SQL injection, cross-site scripting, and denial-of-service attempts. - **Load balancing** mechanisms ensure even distribution of application requests across all active nodes. Two static IPs are exposed. - Persistent data is stored in an **encrypted Aurora MySQL (RDS) cluster** in Multi-AZ configuration that provides automatic failover, multi-node read scalability. - Application files are maintained in a durable and automatically scalable **Amazon EFS shared file system**, while Redis/Valkey is used as an in-memory datastore for session management and caching. - The entire infrastructure is provisioned and managed through **Terraform**, following Infrastructure-as-Code (IaC) principles. This ensures repeatable deployments, strict version control, and a consistent configuration across environments. - **Continuous monitoring**, automated alerting, backup procedures, and business continuity measures support the reliability of the service and help maintain guaranteed availability levels. ### Physical Security The Forma Cloud Services relies on AWS who is responsible, in accordance with the AWS Shared Responsibility Model (available at https://aws.amazon.com/compliance/shared-responsibility-model), for implementing controls for the physical security of data center facilities, backup media, and other physical systems, providing comprehensive and state-of-the-art security capabilities (available at https://aws.amazon.com/compliance/data-center/controls). ## Information Protection and Security Standards ### Backup #### Infrastructure - **Hosting**: Amazon Web Services (AWS) - Region eu-west-1 (Ireland, EU) - **Database**: Amazon Aurora MySQL in Multi-AZ cluster configuration - **Backup Management**: AWS Backup (AWS managed service) #### Backup Policies - **Daily Backup** (DailyBackups) - Automatically runs at 5:00 AM UTC - Retention: 7 days (1 week) - Managed by AWS Backup plan - **Weekly Backup** (WeeklyBackups) - Automatically runs on Saturdays at 5:00 AM UTC - Retention: 4 months (120 days) - Managed by AWS Backup Long-term plan - **Monthly Backup** (MonthlyBackups) - Automatically runs on the first Saturday of the month at 5:00 AM UTC - Retention: 24 months (730 days) - Managed by AWS Backup Long-term plan - **EFS Automatic Backup** - Automatically runs daily at 5:00 AM UTC - Retention: 2 weeks (14 days) - Managed via aws/efs/automatic-backup-rule - Copy to geographically distributed vault #### Backup Status - Last 30 daily backups: all completed successfully - Active monitoring system with automatic failure notifications - 58 Aurora snapshots available for the database cluster - 180+ total recovery points available on AWS Backup (database) - 30+ recovery points available on AWS Backup (EFS file system) #### Access Control - Backup access limited via specific IAM roles - MFA required for critical operations - Service Role: AWSBackupDefaultServiceRole with minimal permissions - Full audit trail on AWS CloudTrail ### Data Storage, Localization and Segregation #### Geographic Location - Primary Location: AWS eu-west-1 (Dublin, Ireland) - All data and backups remain within the European Union (GDPR compliant) - No data transfer outside the EU #### Redundancy - Multi-AZ Architecture (3 independent Availability Zones) - Backups are automatically replicated across multiple AZs - Storage: AWS EFS and Amazon Aurora with synchronous replication #### Backup Vault - Dedicated vault with automated lifecycle management - AWS default vault for Aurora snapshots - Access controlled via IAM roles with the least privilege principle #### Data Segregation Forma Cloud implements logical tenant isolation across application, storage, and database layers. - Each customer deployment is hosted as a dedicated project within the Kubernetes cluster. - Each deployment is connected to customer-specific storage paths used to segregate application files. - Customer data is stored using separate databases, database users, and credentials for each customer project. - Application-level authorization controls and tenant-aware configuration prevent unauthorized cross-tenant access. - Administrative access to production data is restricted to authorized personnel and subject to logging and monitoring. ### Data Deletion and Disposal Customer data is deleted or rendered inaccessible through controlled procedures aligned with AWS storage lifecycle and secure deletion mechanisms. Backup data is retained according to the applicable backup retention schedule and subsequently managed according to AWS service policies. Post-contract retention and final deletion timelines are governed by the applicable contractual documentation and legal requirements. ### Data Encryption #### Encryption at Rest - Algorithm: AES-256 via AWS Key Management Service (KMS) - Encryption enabled by default on all Aurora databases - Snapshots automatically encrypted with the same key as the source database - Backup data encrypted at rest using AWS-native encryption controls #### Encryption in Transit - TLS 1.2+ for all application connections - Database connections forced over SSL/TLS - Backup transfer managed internally by AWS over an encrypted private network #### TLS Certificates Management To ensure secure communications, TLS certificates are fully provisioned, deployed, and managed through **AWS Certificate Manager (ACM)**. This integration eliminates manual handling and human error during certificate generation and renewal. * **Supported Algorithms:** ACM-managed public certificates comply with strict security requirements, supporting robust cryptographic standards including **RSA (2048-bit or higher)** and **ECDSA (P-256 or P-384)**. * **Automated Lifecycle Management:** Public certificates issued directly by ACM have a standard validity period of **198 days**. ACM monitors and automatically initiates the renewal process well before the expiration date. This automated lifecycle guarantees that the 2-year maximum lifecycle limit for asymmetric certificates is consistently met without service interruption. * **Imported Certificates:** Any third-party or custom certificates imported into ACM do not benefit from automated AWS renewal. These specific assets follow a dedicated, documented operational workflow for manual renewal and re-importation prior to their expiration. * **Symmetric Secrets and Application Credentials:** Symmetric encryption keys, application-level credentials, and environment secrets are out of scope for ACM. They are managed and documented separately under explicit access control and rotation policies. ### Monitoring & Uptime The infrastructure is equipped with the following service monitoring procedures and mechanisms: - **Server log**: All accesses and errors are logged on individual server machines (frontend and database) and the load balancer (aggregated across all machines connected to the service). - **Email pre-alerts** when peak thresholds are exceeded (CPU usage, number of DB connections). - **Uptime Robot**: Domain monitoring. If the site is unresponsive, the team is notified via email and internal communication channels (Slack). - **Automatic application error notification**: Any errors generated by application functionality on the server are notified to the support team. - **Monitoring and multi-channel alert system**: The difference between available and utilized resources (CPU and RAM) is continuously monitored. When preset thresholds are exceeded, the system triggers autoscaling and communicates the event via various channels to technical staff. - **AWS CloudWatch**: AWS-native monitoring and logging services are used for managed infrastructure components where applicable. - **Log retention**: Retention periods and storage destinations are defined according to the configuration applied to each service component and may vary depending on operational and compliance requirements. #### Uptime SLA| Metric | Value | Note |
|---|---|---|
| Granted Uptime | 99,9% | Excluding scheduled maintenance events |
| Header | Value | Purpose |
|---|---|---|
| `Strict-Transport-Security` | `max-age=31536000` | Enforces HTTPS connections for one year (HSTS) |
| `X-Content-Type-Options` | `nosniff` | Prevents MIME-type sniffing attacks |
| `Referrer-Policy` | `strict-origin-when-cross-origin` | Limits referrer information leakage |
| `Permissions-Policy` | Restrictive policy disabling geolocation, camera, microphone, payment, etc. | Reduces the browser API attack surface |
Always backup your existing DNS settings before making any changes.
### How to set a custom SUB-DOMAIN Once your main domain is configured, it will be possible to add more subdomains like client1.myacademy.com, client2.myacademy.com Since the main domain is already configured on both your DNS and our services, it will be way easier: 1. Create the subdomain on your provider control panel 2. Open a ticket writing to| Record Name | Type | Value |
| \_bbb9ea10b0856de6ba586e6207dc19a2.yourproject.forma.cloud | CNAME | \_5b1f9e0e8346d90ac6b87db19db7c2dc.xlfgrmvvlj.acm-validations.aws |
| Record Name | Tipo | Valore |
| yourdomain.com | A | 75.2.77.19 |
| yourdomain.com | A | 99.83.139.159 |
| Nome Record | Tipo | Valore |
| kkctvw3mrh2v7h3gzaoqf34t3dl4xybh.\_domainkey.yourdomain.com | CNAME | kkctvw3mrh2v7h3gzaoqf34t3dl4xybh.dkim.amazonses.com |
| j4qlk6qmjatfrrx2s2dvljosxleqs7wf.\_domainkey.yourdomain.com | CNAME | j4qlk6qmjatfrrx2s2dvljosxleqs7wf.dkim.amazonses.com |
| sabrml264bh5b4map5crcjq327z7ifgk.\_domainkey.yourdomain.com | CNAME | sabrml264bh5b4map5crcjq327z7ifgk.dkim.amazonses.com |
| \*\*Required Data\*\* | \*\*Description\*\* |
|---|---|
| **Platform Name** | Used as the project name and as part of the default domain (e.g., `https://\[platformname\].forma.cloud`). |
| **URL Alias** | The web address that will be used to access the platform (e.g., `learning.yourdomain.it`).
**Note**: During the migration process, you will need to configure DNS records in two separate phases. See the \*\*Migration Steps\*\* section below for details. |
| **Email Sender Address** | The email used for notifications, confirmations, and password resets (e.g., `info@yourdomain.it`). It must belong to the same domain as the URL alias. |
| **Superadmin Access to the Platform** | An account with superadmin rights to access your current platform. |
| **SSH/FTP Access to the Current Server** | Required to transfer files. Include: - Host/Server
- Username
- Password
- Port (22 for SSH, 21 for FTP)
SSH transfer protocol is required for safer and faster data transfer, allowing direct transfer and avoiding the risk of data loss or corruption
**Warning**: if only FTP is available, we won't be able to check and guarantee file integrity after the migration to Forma Cloud, and won't take any responsibility for possible data loss or corruption. Please ask your IT or provider for SSH access |
| **Database Access** | Host, Username, Password. Alternatively, you may send us the database file directly or provide a download link (e.g., via WeTransfer or similar services). |
**Important**: At this stage, you must only **ADD the new records** we provide. **Do NOT modify or remove any existing DNS records** — your current platform must continue to work normally while we prepare the migration.
**What you need to do:** Add all the CNAME and TXT records we send you to your domain's DNS configuration. If you're unsure how, ask your IT team or domain provider for assistance. Check our full **[DNS documentation](https://docs.forma.cloud/books/services/page/email-dns-settings)** for further details.
#### Step 2 — You put your platform in maintenance mode Once all DNS records from Step 1 have been added and propagated, set your current platform to **maintenance mode**. This ensures that no new data is generated while we transfer your content, guaranteeing an accurate and complete copy.**Plan the migration:** to reduce inconvenience for your users, we can agree on specific dates for the intervention based on the availability of our team (during standard business hours, Monday to Friday).
#### Step 3 — We transfer data and database With the platform in maintenance mode, our team will: - Perform a preliminary check of the data you provided - Transfer all files and the database from your servers to Forma Cloud - Configure your instance in Forma Cloud #### Step 4 — We upgrade and test the installation After the transfer, our team will: - Update Forma LMS to the latest available version - Run technical validation and integrity checks - Run preliminary functional tests #### Step 5 — We validate and attach SSL certificates to our infrastructure Once the installation is verified, our team will: - Validate and activate the SSL certificates for your alias domain - Configure your alias domain on our servers We will notify you once everything is ready and your instance is live on our infrastructure. #### Step 6 — You update DNS pointing records Once we give you the green light, you need to **modify your existing DNS pointing records** (typically an A record or CNAME) so that your alias domain (e.g., `learning.yourdomain.it`) points to our infrastructure instead of your old server.**Important**: Only proceed with this step after receiving explicit confirmation from our team. Changing the pointing records too early will result in downtime for your users.
**What you need to do:** **EDIT the existing A or CNAME record** for your alias domain to point to the address we provide. The certificate and SES records you added in Step 1 should remain in place. Check our full **[DNS documentation](https://docs.forma.cloud/books/services/page/email-dns-settings)** for the exact values.
Once DNS propagation is complete (usually a few minutes to a few hours), all traffic to your domain will be served by Forma Cloud. #### Step 7 — Final testing After updating the DNS, access your migrated platform and: - Verify general functionality (login, courses, tracking data) - Report any issues to our team - Apply new configurations if needed - Disable maintenance mode on the migrated platform**Important**: Leave maintenance mode **active** on your old installation. This prevents users from accidentally accessing the old server during DNS propagation.
--- ### DNS Configuration Summary Here's a quick reference of the DNS actions required during the migration:| **When** | **Action** | **Records** | **Purpose** |
|---|---|---|---|
| **Step 1** (before migration) | **ADD** new records | CNAME records for SSL certificate validation; TXT/CNAME records for SES (DKIM, SPF, domain verification) | Certificate issuance and email authentication |
| **Step 6** (after our OK) | **EDIT** existing records | A record or CNAME for the alias domain (e.g., `learning.yourdomain.it`) | Point traffic to Forma Cloud |
**Important**: We cannot maintain unrecognized plugins or platform customizations, but we will work with you to find the best possible solution to ensure continuity with your current version.
--- ### After the Migration Once the migration is complete and your platform is finally running on Forma Cloud, please keep your previous service active and maintain a backup of your files and database for at least 6 months. --- ### FAQ – Frequently Asked Questions