Onboard Search Index Encryption

Prepare to Use Search Index Encryption

We recommend that you take these steps before you get started.

• Read about Learn About Search Indexes, the search index encryption process, and how to set it up.
• Plan to test your encrypted search in a sandbox thoroughly before migrating your production org.

First Use of Search Index Encryption

Salesforce can create search indexes as soon as you begin using your org. When you turn on search index encryption, any plain text indexes are encrypted in place.

Most Salesforce products use traditional keyword indexing. Einstein Search enhances this experience with AI-powered personalization and natural language query processing, but it’s a keyword search. Shield Platform Encryption secures the search indexes across Salesforce's standard (non-Data 360) platforms.

Note Salesforce search index encryption isn’t the same as Data 360 search. Salesforce Data 360 uses vector search for semantic understanding and powering sophisticated AI features. Platform Encryption for Data 360 is responsible for encrypting the unique vector search indexes within Data 360 itself.

Turning off Search Index Encryption

If you decide to turn off search indexes encryption, Salesforce gradually decrypts search indexes. This process isn’t immediate, but usually completes within seven days.

Rotating Search Index Encryption Key Material

When you rotate your search index keys, Shield Platform Encryption archives your existing keys. We never destroy them. There’s no background sync for search indexes. Instead, your search indexes are gradually encrypted with the new DEK or tenant secret.