Chapter 6. Security 135
6.3  Data separation
Content Manager OnDemand allows the separation (compartmentalization) of the 
organization’s data into multiple separate partitions. Specific groups of users can access only 
the partitions that contain data that relates to their operations. The separation of data can be 
at the system level, the object server level, and the archive server level.
6.3.1  Multiple systems
The organization’s data can be spread over two or more separate systems. As illustrated in 
Figure 6-2, User Group A can access only Content Manager OnDemand server A and cannot 
access any other Content Manager OnDemand system or any other Content Manager 
OnDemand data. If necessary, you can create a super user group that can access multiple 
systems. 
System access restrictions can be implemented by one or more of the following means:
/SM590000A web server.
/SM590000Firewalls, switches, or other network devices. 
/SM590000Only the correct user group is authenticated to use the system.
Figure 6-2   Data separation at the system level
6.3.2  Multiple object servers
Data can also be separated at the object server level. In this case, the application group (AG) 
data tables that contain the indexes that point to separated data are also separated. 
Therefore, access to the AG data table is allowed only to users who need that data. As 
illustrated in Figure 6-3 on page 136, User Group A of AG Data Tables Part A is pointed to 
(allowed access to) the data on Object Server A, and User Group B of AG Data Tables Part B 
is pointed to the data on Object Server B. 
CMOD 
Serve r B
CMOD Client
Use r Group A
CMOD 
Server ATCP/IP
network
C ontai ns part “A” o f
The  o rgan ization ’s data
Con ta ins pa rt “B” of
Th e orga niza ti on’ s da ta
CMOD Client
Su per User Group
Firewall
Swit ch
…
CMOD Client
User Group B