What You Can Encrypt

Note This content relates to Shield Platform Encryption. Read about implementing field-level encryption using Shield Extension in Own from Salesforce.

Beyond database and field-level encryption, you can also encrypt specific types of data and specialized data stores.

• Backups made with Backup & Recover Next
• Chatter data
• CRM Analytics datasets
• Custom fields in installed managed packages that support Shield Platform Encryption
• Data 360 data stores, including its vector-based search indexes
• Event Bus data
• Files and attachments
• Fields in the Salesforce B2B Commerce managed package
• Salesforce search indexes (supports keyword searches, separate from Data 360)

Each encryption feature offers layered defense mechanisms tailored to each type of sensitive data within your Salesforce environment. Shield Platform Encryption uses different keys for each type of data and data store.

• Learn About Database Encryption
  Database Encryption is available to all Hyperforce customers with a Shield or Shield Platform Encryption license. You can encrypt most of your data without impeding filtering, sorting, or impeding the many Salesforce features that rely on sorting and filtering. Because most of your data is encrypted by default with a tenant-specific key, Database Encryption helps you meet your compliance and regulatory requirements with minimal effort.
• Learn About Encrypting Standard and Custom Fields
  With Field Level Encryption (FLE), you choose the specific fields that you want to protect with Shield Platform Encryption. You can encrypt standard and custom fields that are compatible with the Shield Platform Encryption service with key material that you control.
• Learn About Search Indexes
  Except for Data 360, Salesforce products use traditional keyword indexing and store these keywords at rest in search index files. Shield Platform Encryption Add another layer of defense for personally identifiable information (PII) or other sensitive data that users search for. Encryption keeps tokenized search indexes unreadable to unauthorized parties if the indexes are compromised.
• Learn About Encrypting Backup & Recover Next Data
  Your backups contain the same sensitive data that you encrypt in your production org. It makes sense to protect backups the same way. Shield Platform Encryption extends to Backup & Recover Next and encrypts backup data at rest with a root key that's unique to your org. As a result, your backup data meets the same compliance and regulatory requirements as your production data.
• Learn About Encrypting Data 360
  By default, Salesforce encrypts Data 360 data at rest with a Salesforce-managed data encryption key (DEK). With Shield Platform Encryption, you generate and manage a tenant-specific root key that controls your DEK. In this way, you retain control and visibility over the keys that secure your data. Shield Platform Encryption for Data 360 also supports Marketing Cloud Next and Tableau Next wherever they use Data 360.
• Learn About Encrypting Files and Attachments
  Shield Platform Encryption adds extra protection to sensitive data contained in files and attachments. As a result, documents, images, and other files uploaded to Salesforce remain encrypted. When you turn on encryption, the body of each new file or attachment is encrypted as it's uploaded to the platform.
• Learn About Encrypting Event Bus Data
  Protect event messages and Change Data Capture (CDC) events at rest with Shield Platform Encryption. The event bus stores event and CDC data in temporary files as it flows through integrations and real-time processes. Turning on Event Bus Data encryption makes sure that event bus data in these temporary storage locations is fully encrypted.
• Learn About Encrypting Chatter Data
  Shield Platform Encryption provides an additional layer of security for the collaborative discussions and information shared within Chatter. Encrypt data at rest in Chatter feed posts and comments, questions and answers, link names and URLs, poll questions and choices, and content from your custom rich publisher apps.
• Learn About Encrypting CRM Analytics Data
  CRM Analytics reports and dashboards sometimes contain confidential business insights, personally identifiable information, or other sensitive data. With Shield Platform Encryption, you can encrypt your CRM Analytics datasets at rest, maintaining compliance and enhancing your data security.