Data 360 Data Stores

Platform Encryption for Data 360 provides Data 360 customers with greater control and visibility over the encryption keys used to protect their sensitive, confidential, or proprietary data stored within all Data 360 data stores. When Platform Encryption for Data 360 is enabled, all Data 360 data stores are encrypted at rest. Platform Encryption for Data 360 also supports Marketing Cloud Next and Tableau Next wherever they leverage Data 360.

Required Editions

Available in both Lightning Experience and Salesforce Classic (not available in all orgs).

Available in: Enterprise, Performance, Unlimited, and Developer Editions. Requires purchasing Salesforce Shield or Shield Platform Encryption, and the External Key Management Service. Data 360 customers must also have the Platform Encryption for Consumption license.

Note As of October 14, 2025, Data Cloud has been rebranded to Data 360. During this transition, you may see references to Data Cloud in our application and documentation. While the name is new, the functionality and content remains unchanged.

You can use Customer Managed Keys (CMK), External Key Management (EKM), or Bring Your Own Key (BYOK) to provide key material for encryption. With Platform Encryption for Data 360, all Data 360 data stores are encrypted using the same data encryption key. This includes Data 360's own vector-based search indexes which are separate from Salesforce org keyword-based search indexes.

Important Because external DLOs are outside of Data 360, data in external DLOs isn't encrypted by Data 360.

See Also

• Encrypt Data 360 with Customer-Managed Root Keys