Integration style
API-led with events for state changes.
Why. Stable contracts reused by Salesforce, portals and partners.
Trade-off. More layers than a point-to-point connector. Worth it from about three systems.
CRM and business systems · Salesforce
Salesforce Sales and Service Cloud integrated with ERP through MuleSoft
API-led connectivity between Salesforce and a finance or ERP system: system APIs wrap the ERP, process APIs hold the business rules, Salesforce calls one stable contract, and events keep both sides in step.
A reference architecture from EITSAA, not a named client system. Service limits, prices and product features change, so confirm current details before you commit to a design.
- Australian Privacy Principles
- ACSC Essential Eight
- SA ISMF supplier expectations
- Australian hosting options for Salesforce and MuleSoft
Architecture
- SaaS and business systems
- Messaging, events and workflow
- Network and edge
- Security and identity
- Monitoring, audit and analytics
- Request or data flow
- Asynchronous or optional
- Boundary: region, account, network or trust zone
Request and data flow
A salesperson closes an opportunity. Salesforce calls the MuleSoft Experience API using a Named Credential with OAuth 2.0 client credentials.
The Experience API validates and shapes the payload and applies API Manager policies: client ID enforcement, rate limiting and IP allow lists.
The Process API orchestrates order-to-cash rules: credit check, product mapping, tax, idempotency and compensation on failure.
A System API wraps the ERP, hiding its protocol and data model, and reaches it over private connectivity.
State changes that are not request-response (shipped, payment received) are published as events.
Anypoint MQ buffers events with retries and a dead-letter queue.
A service agent opens a case and Salesforce asks the Process API for live order and invoice status instead of copying finance data into the CRM.
Components and why they were chosen
| Component | What it does | Why this choice |
|---|---|---|
| Salesforce Sales and Service Cloud | Accounts, pipeline, quotes, cases and entitlements. | System of engagement. Finance data is referenced, not duplicated, wherever possible. |
| Named Credentials and External Services | Declarative authenticated callouts. | Keeps secrets out of Apex and flows. |
| Platform Events and Change Data Capture | Publish record changes to subscribers. | Event-driven sync avoids polling and saves API calls. |
| MuleSoft API Manager | Policies, analytics and contract management. | One place for security and versioning. |
| Experience, Process and System APIs | API-led layers. | An ERP upgrade touches one layer, not every consumer. |
| Anypoint MQ | Managed queues with DLQs. | Decouples the speed and availability of each side. |
| Private connectivity (VPN or Direct Connect via VPC) | Reach the on-premises ERP. | ERPs are rarely safe to expose publicly. |
| Connected or External Client Apps | OAuth client registration. | Scopes and IP restrictions per integration. |
Design decisions and trade-offs
Where finance data lives
Read it live, copy only the minimum for reporting.
Why. Avoids two sources of truth.
Trade-off. CRM screens depend on ERP availability, so cache and degrade gracefully.
Authentication
OAuth client credentials with a dedicated integration user and least-privilege permission set.
Why. An auditable service identity.
Trade-off. Secret rotation and monitoring become a process.
Failure handling
Idempotent writes with business keys, DLQ and replay.
Why. Retries must not create duplicate orders.
Trade-off. Idempotency design takes upfront effort.
Well-architected pillars
Security
OAuth scopes, API policies, private network, field-level security in Salesforce and encrypted secrets.
Reliability
Queues, retries, DLQs and circuit breaking around the ERP, often the weakest link.
Performance
Cache reference data, use bulk APIs for large loads and async for anything over a few seconds.
Cost optimisation
MuleSoft vCore licensing and Salesforce API allowances. Event-driven design reduces both.
Operational excellence
API versioning policy, DLQ monitoring and sandbox-to-production promotion through CI/CD.
Sustainability
Avoid polling and duplicate data copies.
Network, identity and data
Networking
A CloudHub private space or VPC connects to the ERP network by IPsec VPN or Direct Connect. Inbound calls from Salesforce use IP allow lists, and mutual TLS where supported.
Identity and least privilege
Dedicated integration users per flow with permission sets limited to required objects and fields. Staff sign in to Salesforce by SSO from Entra ID or Okta. MuleSoft access is by role in Anypoint.
Data and encryption
Classify fields (customer, financial, personal). Use Shield Platform Encryption for sensitive fields if required. Do not replicate card or health data. Name the system of record for each entity.
Security and compliance mapping
| Control | How this design addresses it |
|---|---|
| Multi-factor authentication | Enforced for Salesforce, MuleSoft and ERP admins. Essential Eight. |
| Restrict administrative privileges | Least privilege on integration users and API policies. Essential Eight. |
| Privacy | Field-level security and retention rules support APP 11 and APP 12. |
| Logging | API analytics, Salesforce event monitoring and ERP logs give end-to-end traceability. |
Mappings show how the design supports each control. They are not certifications, and EITSAA does not claim IRAP assessment or compliance for any reference architecture.
Failure modes, targets and scaling
- Target RTOHours to redeploy the integration layer, with queued events retained
- Target RPONear zero for queued events
- Scaling and limitsBounded by Salesforce API and platform event limits and MuleSoft vCores. Check current limits for your edition.
| Failure mode | Mitigation |
|---|---|
| ERP outage | Queue writes and show a pending state. Reads fall back to cached data with a visible age. |
| Duplicate order after a timeout | Idempotency key and ERP business-key check. |
| Salesforce API limits exhausted | Events, bulk API for batches and limit monitoring. |
| Schema change in the ERP | System API contract tests in CI isolate consumers. |
Observability and runbooks
- End-to-end correlation ID from Salesforce to ERP.
- Alerts on DLQ depth, error rate per API and Salesforce limit usage.
- Business dashboard: orders submitted, synced, failed and age of the oldest pending.
Cost drivers and levers
MuleSoft vCores and licences, Salesforce edition and API allowances, ERP connector licences.
- Replace polling with events.
- Right-size vCores per application.
- Reuse System APIs across projects.
- Use batch for large loads.
Implementation and fit
Phased approach
- Agree data ownership and the order-to-cash process.
- Build the System API for one entity with contract tests.
- Add Process and Experience APIs and the Salesforce callouts.
- Add events, DLQ handling and run a failure drill.
Anti-patterns to avoid
- Apex calling the ERP directly.
- Nightly CSV both ways with no reconciliation.
- Copying all finance data into Salesforce.
- One integration user with System Administrator.
When to use it
- Several systems consuming ERP data.
- Complex order-to-cash.
- Organisations already on MuleSoft.
When not to
- A single simple sync, where a connector or lightweight iPaaS is enough.
- No one to own API governance.
More in crm and business systems
Microsoft
Dynamics 365, Power Platform and Dataverse with Entra ID
A Microsoft-centric business platform: Dynamics 365 apps on Dataverse, Power Apps and Power Automate for tailored processes, governed environments and DLP, integrated with Entra ID, Microsoft 365 and Azure.
HubSpot
HubSpot with website forms, marketing automation and data warehouse sync
A lean marketing and sales stack: consent-aware forms and tracking on the site, HubSpot as the system of engagement, and a warehouse for reporting that does not live inside the CRM.
Xero and MYOB
CRM-to-accounting integration with Xero or MYOB
Quote, invoice and payment data moving safely between a CRM and Xero or MYOB: OAuth, idempotent writes, GST-correct line items, reconciliation and clear ownership of every record.
Related insights
Discuss this architecture
Tell us your systems, constraints and timeline. We reply within one business day, and the initial conversation is free.