Loading
Set Up and Maintain Your Salesforce Organization
Table of Contents
Filter by (0)Add
Select Filters

          No results
          No results
          Here are some search tips

          Check the spelling of your keywords.
          Use more general search terms.
          Select fewer filters to broaden your search.

            Search all of Salesforce Help
            Search all of Salesforce Help
            Work with Salesforce Key Material

            You are here:

            1. Salesforce Help
            2. Docs
            3. Set Up and Maintain Your Salesforce Organization

            Work with Salesforce Key Material

            With Shield Platform Encryption, you can generate unique tenant secrets, root keys, and DEKs. You can also generate key material using your own external resources. In either case, you manage your own key material: you can rotate it, archive it, and designate other users to share responsibility for it.

            Required Editions

            Note
            Note This page is about Shield Platform Encryption, not Classic Encryption. What's the difference?
            Available in both Salesforce Classic (not available in all orgs) and Lightning Experience.
            Available in: Enterprise, Performance, and Unlimited Editions with the Salesforce Shield or Shield Platform Encryption licenses.
            Available for free in Developer Edition.
            User Permissions Needed
            To manage key material: Manage Encryption Keys
            Note
            Note When you generate or upload new key material for a feature, it becomes the active key for that feature. Any new data for the feature is encrypted using this key. However, existing sensitive data remains encrypted using previous keys, which are now archived. In this situation, we strongly recommend re-encrypting this data with your active key. You can synchronize your data with the active key material on the Encryption Statistics and Data Sync.
            • Rotate Your Encryption Key Material
              You control the lifecycle of your data encryption keys by controlling the lifecycle of your key material. Salesforce recommends that you regularly generate or upload new Shield Platform Encryption key material. When you rotate a tenant secret, data encryption key (DEK), or root key, you replace it with either Salesforce-generated key material or key material that you supply.
            • Back Up Your Tenant Secrets
              Your Shield Platform Encryption tenant secret is unique to your org and to the specific data to which it applies. Salesforce recommends that you export your tenant secret to ensure continued access to the related data.
            • Destroy Key Material
              Only destroy Shield Platform Encryption tenant secrets and key material in extreme cases where access to related data is no longer needed. Your key material is unique to your org and to the specific data to which it applies. Once you destroy key material, related data is not accessible unless you import previously exported key material. You can't destroy key material used by Database Encryption.
            • Require Multi-Factor Authentication for Key Management
              Multi-factor authentication (MFA) is a powerful tool for securing access to data and resources. Salesforce requires the use of MFA for all logins to your org's user interface. In addition, you can add extra security by also requiring MFA for Shield Platform Encryption key management tasks like generating, rotating, or uploading key material and certificates.

            See Also

             
            Loading
            Salesforce Help | Article