Introduction

SyWay adopts SAP Business Technology Platform (BTP) as the foundation to integrate, extend, and operate the programme’s SAP landscape. This document establishes a concise, region-agnostic application-architecture baseline that explains how the in-scope BTP services are organised into accounts and subaccounts, aligned to environments, and governed by platform-level guardrails for connectivity, security, operations, and lifecycle management. It is intended for Technical Architects and Operations.

Purpose

The purpose of this document is to provide a single, self-contained design baseline for SyWay’s BTP application architecture. It defines the target tenancy and placement model, high-level connectivity patterns, the operational monitoring posture, and essential platform conventions such as naming and tagging. The document sets reusable guardrails to drive consistent design and operations, while intentionally excluding product-level configuration and detailed control frameworks handled elsewhere.

Scope & Objectives

This document applies to the following BTP services: SAP Integration Suite, Forms Service by Adobe, SAP Build Work Zone, SAP Task Center, SAP Build Process Automation, SAP Build Code, SAP Business Application Studio (BAS), SAP Cloud Transport Management, ActiveControl – UI, Cloud Identity (IAS and IPS), SAP Secure Login Service for SAP GUI, Identity Access Governance (IAG), SAP Datasphere, SAP Profitability and Performance Management Cloud (PaPM Cloud), Sustainability Footprint Management (SFM), Sustainability Control Tower, Green Ledger, Asset Performance Management, Group Reporting Data Collection, Advanced Financial Closing, SAP Risk and Assurance Management, SAP Business Network Global Track & Trace (GTT) and Document Reporting Compliance (DRC). Within scope are the account/subaccount model and environment alignment, high-level connectivity and communication-security patterns, the monitoring/observability approach, and platform naming/tagging conventions required for SyWay—kept region-agnostic by design.

The objectives are to establish a consistent placement and operating baseline for the listed services, standardise platform connectivity and monitoring so delivery and run activities are predictable, and define concise guardrails that reduce ambiguity without duplicating service-specific detail. Out of scope are product-level configuration parameters, detailed identity/authorisation policy design, transport workflow specifics, business process design, and compliance framework mapping.

Key Decisions and Requirements

Application Architecture

Overview

SyWay’s SAP BTP landscape is organised into global accounts with environment-aligned subaccounts (DEV, INT, UAT, PAR, TRG, PRD), establishing clear tenancy boundaries for the in-scope services referenced in the BTP account model and enabling predictable deployment and operations without duplicating product-level detail. The design remains region-agnostic and centres on consistent placement and isolation across environments, with all services running on the SAP BTP Cloud Foundry runtime. Platform health and alerting are monitored centrally through SAP Cloud ALM, while service-specific patterns and placements are detailed in the Application Architecture Components section.

BTP Global Account & Subaccount Model

Runtime: Cloud Foundry (CF) for all subaccounts

Naming: syw-<area>-<env>-<region> (e.g., syw-itg-uat-eu20)

Environment codes: dev, int, uat, par, trg, prd

Europe — Global Account: Syensqo Main

Account ID: 59549222-81b5-4701-afde-9a23643d0b00

Regions used: EU20 (Azure Europe – Netherlands), EU10 (AWS Europe – Frankfurt)

China — Global Account: Syensqo China

Account ID: (To be provisioned )

Region used: CN20 (Azure China North 3 – Hebei)

Application Architecture Components

Application Security

Authentication

SyWay standardises Single Sign-On on SAP BTP using region-specific SAP Identity Authentication Service (IAS) tenants federated to Microsoft Entra ID. Each BTP subaccount trusts its regional IAS tenant as the default identity provider; interactive sign-in between BTP subaccounts/services and IAS uses OIDC, while federation from IAS to Entra ID uses SAML 2.0. Conditional Access in Entra (including MFA and session controls) governs user access to BTP applications. Developer tooling (e.g., BAS/Build Code/CLI) follows the same IAS ↔ Entra flow—no separate SAP ID service identities. For service-to-service calls and Destinations, SyWay adopts standards supported by each target: OAuth 2.0 (including client credentials), OAuth2 SAML Bearer Assertion, or mutual TLS; Basic authentication is permitted only where a service does not support modern methods, and such exceptions are documented. Principal propagation is used where supported by the back-end/service pair. Identity provisioning is out of scope for this section and is addressed in the programme’s Identity Provisioning artefact. Detailed administrative posture and group/role design are governed by the programme’s Security/IAM design artefacts.

Authorisation

Authorization on SAP BTP follows a group-based RBAC model: IAS groups → BTP role collections, with no direct user assignments in subaccounts. Role collections are scoped per subaccount and environment to preserve separation across DEV/INT/UAT/PAR/TRG/PRD. Access to back-end systems via Destinations requires the appropriate OAuth scopes/authorities and alignment with corresponding S/4HANA authorizations (S/4 role design is out of scope here). User access provisioning and role assignment are executed using SAP Identity Access Governance (IAG) together with SAP Identity Provisioning Service (IPS); the provisioning workflows, mappings, and controls are documented in the Identity Access Provisioning Design document. Periodic access recertification applies to BTP role collections, with cadence and evidence requirements defined in the IAM artefacts.

Communication Security

• Transport security: All endpoints expose HTTPS/TLS 1.2.

• SAP GUI/RFC: Access to SAP back-ends uses SNC via SAP Secure Login Service (SLS) to provide mutual authentication, encryption, and integrity.
• Connectivity pattern: Connectivity to RISE systems is exclusively via SAP Cloud Connector with minimal resource mappings and Location IDs per connector.
• Virtual hostnames: Destinations use non-resolvable virtual hosts; these are referenced only within BTP and not exposed publicly.
• Destination authentication: Use OAuth 2.0 variants (including client credentials) and mutual TLS only where required by the target; Basic authentication is permitted only when modern methods are not supported and must be documented at component level.
• IP allow-listing: Applied case-by-case where products support it.
• Certificates & PKI: Certificates (server, client/mTLS, SNC) are issued by the Syensqo enterprise CA, with 1-year validity and centrally managed rotation; subaccount trust stores include only required issuers.
• Regional specifics: Additional constraints for sovereign/regulated landscapes (e.g., CN) will be documented when confirmed (TBC).

Data Security

• Governance & classification: Data security follows SyWay programme standards for classification, handling, and evidence. This AAD remains region-agnostic and defers identity/authorization specifics to the respective sections.

• Regional placement & residency: Data resides in the regions reflected by the BTP Global Account & Subaccount Model. Any cross-region data movement is implemented only through approved data-movement designs; CN20 may require additional residency/egress constraints (TBC pending confirmation).

• Encryption at rest: SAP-managed BTP services use platform-managed encryption at rest by default. Where a service supports customer-managed keys (CMK), SyWay may adopt enterprise KMS-backed key control; ownership and rotation follow programme key-management standards.

• Egress control: Outbound data flows are restricted to allow-listed Destinations and explicit Cloud Connector mappings (using non-resolvable virtual hosts). No implicit or ad-hoc egress paths are permitted from BTP services.

• Scope boundaries: Authentication/Authorization mechanics (e.g., scopes, role collections, principal propagation) are defined in the Authentication and Authorization sections; backup/restore and monitoring are covered in their respective sections.

Other Controls

• Audit & evidencing: Use SAP BTP Audit Log Service (with Audit Log Viewer) to capture and review subaccount-level security and administrative events.

• Privacy operations: Apply Personal Data Manager (PDM) where applicable to execute subject-data requests and corrective actions in supported services; record actions for operational auditability.

• Operational notifications: Route critical platform/service events through the Alert Notification service for SAP BTP to email, complementing dashboards and alerts in SAP Cloud ALM.

• Configuration posture & drift: Leverage SAP Cloud ALM – Configuration & Security Analysis to capture baseline configurations for BTP services and detect/record configuration changes for review.

• Network access governance: Maintain allow-listed Destinations and Cloud Connector mappings as the approved egress paths; apply IP allow-listing on exposed endpoints case-by-case where products support it.

• Certificate lifecycle: Manage server, mTLS, and SNC certificates via the Syensqo enterprise PKI with a 1-year validity; curate subaccount trust stores to the minimum required issuers and track rotations centrally.

System Landscape

Operation Architecture

Transport Management

Please refer DD-TEC-170 Transport Management for Release 4

Application Monitoring

System Monitoring

Sizing

• Scope of sizing. In-scope SAP BTP services are SAP-managed SaaS; SyWay does not perform server or infrastructure sizing. Responsibility is limited to selecting service plans/entitlements and defining tenant counts per environment in line with the account model.

• Cloud Foundry workloads. There are no custom Cloud Foundry applications; CF org/space quotas are out of scope.
• Component-specific sizing documented in Application Architecture design.
• Integration Suite / API Management / PIR: sizing is captured in the Application Architecture design.

• Datasphere / PaPM Cloud: sizing is captured in the Application Architecture design.

• Build Process Automation (BPA): TBC for peak job concurrency and queue depth (to be baselined during UAT).

• Other services (Work Zone, Task Center, Build Code, BAS, IAS/IPS/SLS, IAG, Finance, Sustainability, GTT, DRC): no additional sizing beyond plan/entitlement and tenant count.

• Capacity adjustments. When required, capacity changes are executed via plan/entitlement adjustments with SAP; review cadence is managed operationally outside this document.

High Availability and Disaster Recovery

 All in-scope SAP BTP services are SAP-operated SaaS; platform high availability and disaster recovery are provided under SAP’s published targets. For SAP BTP, the documented disaster-recovery objectives are RPO ≤ 5 minutes and RTO ≤ 2 hours (same-metro DR), with service execution and failover managed by SAP. Where products rely on SAP HANA Cloud, database recovery specifically supports a maximum RPO of 15 minutes via continuous log backups, with overall service recovery still governed by the platform targets. SyWay’s responsibility is limited to monitoring and incident execution per runbooks; no server-level HA/DR activities are in scope for this document.

Backup/Restore

• Platform-managed: For SAP-managed BTP services, backups are handled by SAP; restore is service-specific and generally not customer-operated. Guidance is outlined in the BTP admin help (“Data Backups Managed by SAP”). 

• SAP HANA Cloud (used by services like Datasphere/PaPM): Continuous log backups enable point-in-time recovery within a configurable retention window (default 14 days; extendable up to 215 days). Restores are performed by creating a new database instance at the chosen time. 

• SAP Datasphere: Backup/restore follows the SAP HANA Cloud resiliency layer; recovery is handled by SAP for disasters within SAP’s control. 

• Audit evidence: BTP Audit Log Service stores subaccount audit data for 90 days by default; export/forward logs if longer retention is needed. 

Maintenance Plan

• Cadence. SAP operates biweekly updates (standard), immediate updates for critical fixes, and major upgrades (up to four per year).

• What’s New & release calendars. Teams subscribe to What’s New for SAP BTP and consult the Consolidated Release Schedules for SAP BTP and Intelligent Enterprise Suite: Harmonized release calendar for SAP Cloud products to track feature deliveries and maintenance windows.

• Regional communications. For China (CN20), availability and maintenance announcements are published at status.cn40.platform.sapcloud.cn (subscription supported). 

• Major upgrades. SAP provides ≥ 4 weeks’ advance notice of major upgrades; SyWay reviews impact and coordinates any required readiness actions as documented in System upgrade plan.

Exceptions

See also

Change log