Loading
Prepare for Email to Become the Default Login ExperienceRead More
Set Up and Maintain Your Salesforce Organization
Destroy Key Material

You are here:

  1. Salesforce Help
  2. Docs
  3. Set Up and Maintain Your Salesforce Organization

Destroy Key Material

Only destroy Shield Platform Encryption tenant secrets and key material in extreme cases where access to related data is no longer needed. Your key material is unique to your org and to the specific data to which it applies. Once you destroy key material, related data is not accessible unless you import previously exported key material. You can't destroy key material used by Database Encryption.

Required Editions

Available in both Salesforce Classic (not available in all orgs) and Lightning Experience.
Available in: Enterprise, Performance, and Unlimited Editions with the Salesforce Shield or Shield Platform Encryption licenses.
Available for free in Developer Edition.
User Permissions Needed
To generate, destroy, export, import, upload, and configure tenant secrets and customer-supplied key material: Manage Encryption Keys
Warning
Warning You are solely responsible for making sure that your data and key material are backed up and stored in a safe place. Also, due to rotation, over time you will accumulate a number of keys. You should back them up into source control, and keep an up-to-date registry of your keys outside of Salesforce. Salesforce can’t help you with deleted, destroyed, or misplaced tenant secrets and keys. Even if you destroy a key in your Salesforce org, we strongly encourage you to preserve your backup copy in source control.
Note
Note Some keys can't be destroyed. For example, you can't destroy Database Encryption keys or Search Index encryption keys in the new Search framework (available in Hyperforce only). With these keys, no Destroy option is available.
  1. From Setup, in the Quick Find box, enter Platform Encryption, and then select Key Management.
  2. In the table that lists your tenant secrets, find the row that contains the one you want to destroy. Click Destroy.
  3. A warning box appears. Type in the text as shown and select the checkbox to acknowledge that you’re destroying a tenant secret, then click Destroy.
    After you destroy the key that encrypted the content, file previews and content that was already cached in the user’s browser may still be visible in cleartext. When the user logs in again, the cached content is removed.

    If you create a sandbox org from your production org and then destroy the tenant secret in your sandbox org, the tenant secret still exists in the production org.

  4. To import your tenant secret, click Import | Choose File and select your file. Make sure you’re importing the correct version of the tenant secret.
Note
Note This page is about Shield Platform Encryption, not Classic Encryption. What's the difference?
 
Loading
Salesforce Help | Article