Bring Your Own Key (BYOK)
When you supply your own key material, you take direct control over encryption keys in a way that helps you address compliance and regulatory requirements. You retain all the benefits built into Salesforce Shield Platform Encryption. You can upload your own customer-supplied keys for most data stores that Shield Platform Encryption supports. Depending on the feature, BYOK supports tenant secrets, data encryption keys (DEKs), and root keys.
Required Editions
| Available in both Salesforce Classic (not available in all orgs) and Lightning Experience. |
| Available in: Enterprise, Performance, and Unlimited Editions with the Salesforce Shield or Shield Platform Encryption licenses. |
| Available for free in Developer Edition. |
| User Permissions Needed | |
|---|---|
| To generate, destroy, export, import, and upload tenant secrets and customer-supplied key material: | Manage Encryption Keys |
| To edit, upload, and download HSM-protected certificates with the Shield Platform Encryption Bring Your Own Key service: | Manage Encryption Keys AND Manage Certificates AND Customize Application |
Controlling your own tenant secret, DEK, or root key entails:
- Generating a BYOK-compatible certificate for the key material type
- Using that BYOK-compatible certificate to encrypt and secure your self-generated key material. Keys must be PKCS#8 encrypted, Base64 encoded 4096 RSA key pair with appropriate headers and footers. We provide scripts to help with this step.
- Uploading your key material to Salesforce or granting the Salesforce Shield Platform Encryption key management machinery access to your key material stored outside of Salesforce
For auditing purposes, all Salesforce-generated and customer-supplied key material is visible on the Key Management page.
- Bring Your Own Key Overview
Generate and store customer-supplied key material outside of Salesforce by using your own crypto libraries, enterprise key management system, or hardware security module (HSM). You then grant the Salesforce Shield Platform Encryption access to those keys. Bring Your Own Key (BYOK) is available for most key types and data stores that Shield Platform Encryption supports. - Generate a BYOK-Compatible Certificate
To encrypt data in Salesforce with Bring Your Own Key (BYOK) key material for any feature, such as field-level encryption or Search Encryption, use Salesforce to generate a 4096-bit RSA certificate. You can generate a self-signed or certificate-authority (CA) signed certificate. Each BYOK-compatible certificate’s private key is encrypted with a derived, org-specific tenant secret key. - Generate a Certificate Fingerprint
Use this script to fetch a certificate’s fingerprint. - Wrap BYOK Key Material
Generate a random number as your BYOK key material. For FLE only, you also calculate an SHA256 hash of the secret and encrypt it with the public key from the BYOK-compatible certificate you generated. - Upload Your BYOK Key Material
After you prepare your Bring Your Own Key (BYOK) key material, upload it to Salesforce. You can upload keys for most categories of data that Shield Platform Encryption supports. Each data category uses a different type of key material: tenant secrets for deriving data encryption keys, data encryption keys (DEKs) for direct encryption, or root keys for securing other keys. You upload the key for your category of data, such as search indexes, plus a second file that secures your key material during upload. - Opt Out of Key Derivation with BYOK
For Field-Level Encryption (FLE), Files and Attachments, and Event Bus Data, you can opt out of key derivation and upload a final data encryption key (DEK). Opting out gives you even more control of the key material used to encrypt and decrypt your data. - Take Good Care of Your BYOK Keys
When you create and store your own key material outside of Salesforce, it’s important that you safeguard that key material. Make sure that you have a trustworthy place to archive your key material; never save a tenant secret or data encryption key on a hard drive without a backup. - Troubleshooting Bring Your Own Key
Read these frequently asked questions to help you troubleshoot any problems that arise with Shield Platform Encryption’s Bring Your Own Key service.
Did this article solve your issue?
Let us know so we can improve!
